diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml index e96844d021..e4903b03ca 100644 --- a/.github/workflows/action.yml +++ b/.github/workflows/action.yml @@ -1,12 +1,17 @@ # https://docs.github.com/cn/actions/automating-builds-and-tests/building-and-testing-python -name: Update dailynews +name: Update dailyNews -# 国际标准时间2点（北京时间10点） on: - schedule: - - cron: '0 2 * * *' + watch: + types: [started] + # schedule: + # - cron: "5 0-10/2 * * *" workflow_dispatch: + push: + branches: [main] + paths: + - "*.py" jobs: build: @@ -17,29 +22,48 @@ jobs: uses: actions/setup-python@v3 with: python-version: '3.x' + cache: "pip" + cache-dependency-path: "**/requirements.txt" + - name: Install dependencies - run: ./install.sh + run: pip install -r requirements.txt - name: Push articles env: FEISHU_KEY: ${{ secrets.FEISHU_KEY }} WECOM_KEY: ${{ secrets.WECOM_KEY }} DINGTALK_KEY: ${{ secrets.DINGTALK_KEY }} - QQ_KEY: ${{ secrets.QQ_KEY }} TELEGRAM_KEY: ${{ secrets.TELEGRAM_KEY }} MAIL_KEY: ${{ secrets.MAIL_KEY }} MAIL_RECEIVER: ${{ secrets.MAIL_RECEIVER }} run: python3 yarb.py - - name: Commit + - name: Commit & Push run: | - git diff - git config --global user.email firmianay@gmail.com - git config --global user.name firmianay - git add archive today.md - git commit -m "每日安全资讯（`date +'%Y-%m-%d'`）" - - - name: Push changes - uses: ad-m/github-push-action@master + git status + git config --global user.name "$GITHUB_ACTOR" + git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com" + git add README.md + git add rss/rss.db3 + git commit -m "每日资讯（`date +'%Y-%m-%d'`）" + git push origin main + cp -r archive archive1 + + git fetch --all + git checkout -b archive origin/archive + cp -r -f archive1/* archive/ + git add archive + git commit -m "每日存档（`date +'%Y-%m-%d'`）" + git push origin archive + + # - name: Push changes + # uses: ad-m/github-push-action@master + # with: + # # github_token: ${{ secrets.MY_GITHUB_TOKEN }} + # branch: main + + - name: Delete Workflow Runs + uses: anaer/delete-workflow-runs@main with: - github_token: ${{ secrets.MY_GITHUB_TOKEN }} + retain_days: 3 + keep_minimum_runs: 5 diff --git a/.gitignore b/.gitignore index 60db0b2ba8..a88638c329 100644 --- a/.gitignore +++ b/.gitignore @@ -129,3 +129,5 @@ dmypy.json # Pyre type checker .pyre/ +.vscode/ +archive/ diff --git a/README.md b/README.md index 760722855e..33c2f780e7 100644 --- a/README.md +++ b/README.md @@ -1,116 +1,18 @@ -# yarb (Yet Another Rss Bot) - -一个方便获取每日安全资讯的爬虫和推送程序。支持导入 opml 文件，因此也可以订阅其他任何 RSS 源。 - -**懒人福音，每日自动更新，点击右上角 Watch 即可：[每日安全资讯](./today.md)，[历史存档](./archive)** - -- [yarb (Yet Another Rss Bot)](#yarb-yet-another-rss-bot) - - [安装](#安装) - - [运行](#运行) - - [本地搭建](#本地搭建) - - [Github Actions](#github-actions) - - [订阅源](#订阅源) - - [关注我们](#关注我们) - -## 安装 - -```sh -$ git clone https://github.com/firmianay/yarb.git -$ cd yarb && ./install.sh -``` - -## 运行 - -### 本地搭建 - -编辑配置文件 `config.json`，启用所需的订阅源和机器人（key 也可以通过环境变量传入），最好启用代理。 - -```sh -$ ./yarb.py --help -usage: yarb.py [-h] [--update] [--cron CRON] [--config CONFIG] [--test] -optional arguments: - -h, --help show this help message and exit - --update Update RSS config file - --cron CRON Execute scheduled tasks every day (eg:"11:00") - --config CONFIG Use specified config file - --test Test bot - -# 单次任务 -$ ./yarb.py - -# 每日定时任务 -$ nohup ./yarb.py --cron 11:00 > run.log 2>&1 & -``` - -### Github Actions - -利用 Github Actions 提供的服务，你只需要 fork 本项目，在 Settings 中添加 secrets，即可完成部署。 - -目前支持的推送机器人及对应的 secrets： - -- [邮件机器人](https://service.mail.qq.com/cgi-bin/help?subtype=1&&id=28&&no=1001256) - - `MAIL_KEY`（需要申请授权码，订阅较多时推荐） - - `MAIL_RECEIVER`（接收人，以“,”分隔） -- [飞书群机器人](https://open.feishu.cn/document/ukTMukTMukTM/ucTM5YjL3ETO24yNxkjN)：`FEISHU_KEY` -- [企业微信群机器人](https://developer.work.weixin.qq.com/document/path/91770)：`WECOM_KEY` -- [钉钉群机器人](https://open.dingtalk.com/document/robots/custom-robot-access)：`DINGTALK_KEY` -- [QQ群机器人](https://github.com/Mrs4s/go-cqhttp)：`QQ_KEY`（需要关闭登录设备锁） -- [Telegram机器人](https://core.telegram.org/bots/api): `TELEGRAM_KEY`（需要代理） - -## 订阅源 - -推荐订阅源： - -- [CustomRSS](rss/CustomRSS.opml) - -其他订阅源： - -- [CyberSecurityRSS](https://github.com/zer0yu/CyberSecurityRSS) -- [Chinese-Security-RSS](https://github.com/zhengjim/Chinese-Security-RSS) -- [awesome-security-feed](https://github.com/mrtouch93/awesome-security-feed) -- [SecurityRSS](https://github.com/Han0nly/SecurityRSS) -- [安全技术公众号](https://github.com/ttttmr/wechat2rss) -- [SecWiki 安全聚合](https://www.sec-wiki.com/opml/index) -- [Hacking8 安全信息流](https://i.hacking8.com/) - -非安全订阅源： - -- [中文独立博客列表](https://github.com/timqian/chinese-independent-blogs) - -添加自定义订阅有两种方法： - -1. 在 `config.json` 中添加本地或远程仓库： - -```json -{ - "rss": { - "CustomRSS": { - "enabled": true, - "filename": "CustomRSS.opml" - }, - "CyberSecurityRSS": { - "enabled": true, - "url": "https://raw.githubusercontent.com/zer0yu/CyberSecurityRSS/master/CyberSecurityRSS.opml", - "filename": "CyberSecurityRSS.opml" - }, -``` - -2. 在 `rss/CustomRSS.opml` 中添加链接： - -```opml - - -CustomRSS - - - - -``` - -## 关注我们 - -[VulnTotal安全团队](https://github.com/VulnTotal-Team)成立于2022年。致力于分享高质量原创文章和开源工具，包括Web安全、移动安全、物联网/汽车安全、代码审计、网络攻防等，欢迎[关注或加入我们](https://github.com/VulnTotal-Team/.github/blob/main/README.md)！ - -GNU General Public License v3.0 - -[![Stargazers over time](https://starchart.cc/VulnTotal-Team/yarb.svg)](https://starchart.cc/VulnTotal-Team/yarb) +# 2024-10-13 + +|来源|标题| +|---|---| +|[36氪](https://www.36kr.com/feed)|[自学2个月速成，塔罗成了年轻人的「稳赚」副业](https://36kr.com/p/2989375535917314?f=rss)| +||[继续狙击英伟达， AMD子弹已上膛丨焦点分析](https://36kr.com/p/2988990483261702?f=rss)| +||[听说了吗？他也在搞AI眼镜了丨焦点分析](https://36kr.com/p/2970563884109831?f=rss)| +|[维基萌](https://www.wikimoe.com/rss.php)|[启程去伊豆！](https://www.wikimoe.com/post/pppyrtoy)| +|[人人都是产品经理](https://www.woshipm.com/feed)|[基金转托管业务详解](https://www.woshipm.com/share/6125769.html)| +||[木途美拼深度游，再次带火中长租市场？](https://www.woshipm.com/it/6125770.html)| +|[知乎日报](https://feedx.net/rss/zhihudaily.xml)|[哈利波特的经济体系是不是很有问题？](https://daily.zhihu.com/story/9775853)| +||[中国古代以银子交易，碎银是怎么计价交易的?](https://daily.zhihu.com/story/9775858)| +||[有哪些逆天的微生物？](https://daily.zhihu.com/story/9776218)| +||[小事 · 我曾一度怀疑我之前养的那只狸花猫成精了](https://daily.zhihu.com/story/9776108)| +|[今日话题 - 雪球](https://xueqiu.com/hots/topic/rss)|[2024年是宏观的大年](http://xueqiu.com/1686401828/307802165)| +|[SegmentFault 最新的问题](https://segmentfault.com/feeds/questions)|[为何使用Discord很难用。每次打开都要更新很久，用起来也比较卡顿吃力?](https://segmentfault.com/q/1010000045375355)| +|[Space Looming](http://gtdstudy.com/index.xml)|[用 AI 辅助开发的经验二三则](https://www.gtdstudy.com/posts/learned-from-using-ai-develop-software/)| +|[极客公园](http://feeds.geekpark.net/)|[微信鸿蒙原生版首批测试名额秒空；OpenAI 推出新提示词工具；京东物流预计双十一接入淘宝](http://www.geekpark.net/news/341727)| diff --git a/README_.md b/README_.md new file mode 100644 index 0000000000..760722855e --- /dev/null +++ b/README_.md @@ -0,0 +1,116 @@ +# yarb (Yet Another Rss Bot) + +一个方便获取每日安全资讯的爬虫和推送程序。支持导入 opml 文件，因此也可以订阅其他任何 RSS 源。 + +**懒人福音，每日自动更新，点击右上角 Watch 即可：[每日安全资讯](./today.md)，[历史存档](./archive)** + +- [yarb (Yet Another Rss Bot)](#yarb-yet-another-rss-bot) + - [安装](#安装) + - [运行](#运行) + - [本地搭建](#本地搭建) + - [Github Actions](#github-actions) + - [订阅源](#订阅源) + - [关注我们](#关注我们) + +## 安装 + +```sh +$ git clone https://github.com/firmianay/yarb.git +$ cd yarb && ./install.sh +``` + +## 运行 + +### 本地搭建 + +编辑配置文件 `config.json`，启用所需的订阅源和机器人（key 也可以通过环境变量传入），最好启用代理。 + +```sh +$ ./yarb.py --help +usage: yarb.py [-h] [--update] [--cron CRON] [--config CONFIG] [--test] +optional arguments: + -h, --help show this help message and exit + --update Update RSS config file + --cron CRON Execute scheduled tasks every day (eg:"11:00") + --config CONFIG Use specified config file + --test Test bot + +# 单次任务 +$ ./yarb.py + +# 每日定时任务 +$ nohup ./yarb.py --cron 11:00 > run.log 2>&1 & +``` + +### Github Actions + +利用 Github Actions 提供的服务，你只需要 fork 本项目，在 Settings 中添加 secrets，即可完成部署。 + +目前支持的推送机器人及对应的 secrets： + +- [邮件机器人](https://service.mail.qq.com/cgi-bin/help?subtype=1&&id=28&&no=1001256) + - `MAIL_KEY`（需要申请授权码，订阅较多时推荐） + - `MAIL_RECEIVER`（接收人，以“,”分隔） +- [飞书群机器人](https://open.feishu.cn/document/ukTMukTMukTM/ucTM5YjL3ETO24yNxkjN)：`FEISHU_KEY` +- [企业微信群机器人](https://developer.work.weixin.qq.com/document/path/91770)：`WECOM_KEY` +- [钉钉群机器人](https://open.dingtalk.com/document/robots/custom-robot-access)：`DINGTALK_KEY` +- [QQ群机器人](https://github.com/Mrs4s/go-cqhttp)：`QQ_KEY`（需要关闭登录设备锁） +- [Telegram机器人](https://core.telegram.org/bots/api): `TELEGRAM_KEY`（需要代理） + +## 订阅源 + +推荐订阅源： + +- [CustomRSS](rss/CustomRSS.opml) + +其他订阅源： + +- [CyberSecurityRSS](https://github.com/zer0yu/CyberSecurityRSS) +- [Chinese-Security-RSS](https://github.com/zhengjim/Chinese-Security-RSS) +- [awesome-security-feed](https://github.com/mrtouch93/awesome-security-feed) +- [SecurityRSS](https://github.com/Han0nly/SecurityRSS) +- [安全技术公众号](https://github.com/ttttmr/wechat2rss) +- [SecWiki 安全聚合](https://www.sec-wiki.com/opml/index) +- [Hacking8 安全信息流](https://i.hacking8.com/) + +非安全订阅源： + +- [中文独立博客列表](https://github.com/timqian/chinese-independent-blogs) + +添加自定义订阅有两种方法： + +1. 在 `config.json` 中添加本地或远程仓库： + +```json +{ + "rss": { + "CustomRSS": { + "enabled": true, + "filename": "CustomRSS.opml" + }, + "CyberSecurityRSS": { + "enabled": true, + "url": "https://raw.githubusercontent.com/zer0yu/CyberSecurityRSS/master/CyberSecurityRSS.opml", + "filename": "CyberSecurityRSS.opml" + }, +``` + +2. 在 `rss/CustomRSS.opml` 中添加链接： + +```opml + + +CustomRSS + + + + +``` + +## 关注我们 + +[VulnTotal安全团队](https://github.com/VulnTotal-Team)成立于2022年。致力于分享高质量原创文章和开源工具，包括Web安全、移动安全、物联网/汽车安全、代码审计、网络攻防等，欢迎[关注或加入我们](https://github.com/VulnTotal-Team/.github/blob/main/README.md)！ + +GNU General Public License v3.0 + +[![Stargazers over time](https://starchart.cc/VulnTotal-Team/yarb.svg)](https://starchart.cc/VulnTotal-Team/yarb) diff --git a/_config.yml b/_config.yml deleted file mode 100644 index c4192631f2..0000000000 --- a/_config.yml +++ /dev/null @@ -1 +0,0 @@ -theme: jekyll-theme-cayman \ No newline at end of file diff --git a/archive/2022/2022-04-07.md b/archive/2022/2022-04-07.md deleted file mode 100644 index 0a36f1af84..0000000000 --- a/archive/2022/2022-04-07.md +++ /dev/null @@ -1,205 +0,0 @@ -# 每日安全资讯（2022-04-07） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [cmark-gfm Integer overflow](https://cxsecurity.com/issue/WLB-2022040015) - - [Bakery Shop Management System 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022040014) - - [Bakery Shop Management System 1.0 Local File Inclusion](https://cxsecurity.com/issue/WLB-2022040013) - - [SAP Information System 1.0 Shell Upload](https://cxsecurity.com/issue/WLB-2022040012) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-1253-01](https://packetstormsecurity.com/files/166605/RHSA-2022-1253-01.txt) - - [Red Hat Security Advisory 2022-1198-01](https://packetstormsecurity.com/files/166604/RHSA-2022-1198-01.txt) - - [Red Hat Security Advisory 2022-1209-01](https://packetstormsecurity.com/files/166603/RHSA-2022-1209-01.txt) - - [Red Hat Security Advisory 2022-1213-01](https://packetstormsecurity.com/files/166602/RHSA-2022-1213-01.txt) - - [Bakery Shop Management System 1.0 Local File Inclusion](https://packetstormsecurity.com/files/166601/bsms10-lfi.txt) - - [Bakery Shop Management System 1.0 SQL Injection](https://packetstormsecurity.com/files/166600/bsms10-sql.txt) - - [cmark-gfm Integer overflow](https://packetstormsecurity.com/files/166599/GS20220406161810.txt) - - [Online Sports Complex Booking System 1.0 SQL Injection](https://packetstormsecurity.com/files/166598/oscbs10id-sql.txt) - - [Red Hat Security Advisory 2022-1199-01](https://packetstormsecurity.com/files/166597/RHSA-2022-1199-01.txt) - - [SAP Information System 1.0 Shell Upload](https://packetstormsecurity.com/files/166596/sapis10-shell.txt) -- Sec-News 安全文摘 - - [Spring 远程命令执行漏洞（CVE-2022-22965）原理分析和思考](https://wiki.ioin.in/url/LX80) - - [Git honours embedded bare repos, and exploitation via core.fsmonitor in a directory's .git/config affects IDEs, shell prompts and Git pillagers](https://wiki.ioin.in/url/G7kD) - - [DeepL Api 设计中的欺骗战术](https://wiki.ioin.in/url/lEjq) - - [MacOS SUHelper Root Privilege Escalation Vulnerability A Deep Dive Into CVE-2022-22639](https://wiki.ioin.in/url/gdDp) -- 安全客-有思想的安全新媒体 - - [Ronin Network侧链被盗6.25亿美金流向分析](https://www.anquanke.com/post/id/271413) - - [java安全-02RMI](https://www.anquanke.com/post/id/271354) - - [欧盟法律草案为加密货币交易增加了安全检查](https://www.anquanke.com/post/id/271455) - - [4月6日每日安全热点 - 英特尔关闭了在俄罗斯的所有业务运营](https://www.anquanke.com/post/id/271510) -- SecWiki News - - [SecWiki News 2022-04-06 Review](http://www.sec-wiki.com/?2022-04-06) -- paper - Last paper - - [Spring 远程命令执行漏洞（CVE-2022-22965）原理分析和思考](https://paper.seebug.org/1877/) - - [Chrome Mojo 组件的沙箱逃逸漏洞分析](https://paper.seebug.org/1876/) -- 跳跳糖 - 安全与分享社区 - - [源码层面梳理Java RMI交互流程](https://tttang.com/archive/1530/) -- 安全通告 - - [华为某些产品存在认证管理不当漏洞](//www.huawei.com/cn/psirt/security-advisories/2022/huawei-sa-20220406-01-bdb62b17-cn) -- Trustwave Blog - - [Why MDR is Your Most Important Security Investment](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/why-mdr-is-your-most-important-security-investment/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [Spring远程命令执行漏洞（CVE-2022-22965）原理分析和思考](https://www.4hou.com/posts/4GM1) - - [高级持续性威胁：了解APT攻击](https://www.4hou.com/posts/13JR) - - [Microsoft Azure Automation被发现高危的账户越权访问漏洞](https://www.4hou.com/posts/WoVQ) - - [亚马逊、微软等60家高知名度公司遭受恶意软件攻击](https://www.4hou.com/posts/B9JY) - - [快速上手云原生安全平台 NeuVector](https://www.4hou.com/posts/Xp8W) -- Microsoft Security Blog - - [Forrester names Microsoft a Leader in 2022 Enterprise Detection and Response Wave™ report](https://www.microsoft.com/security/blog/2022/04/06/forrester-names-microsoft-a-leader-in-2022-enterprise-detection-and-response-wave-report/) - - [Microsoft 365 Defender demonstrates industry-leading protection in the 2022 MITRE Engenuity ATT&CK® Evaluations](https://www.microsoft.com/security/blog/2022/04/05/microsoft-365-defender-demonstrates-industry-leading-protection-in-the-2022-mitre-engenuity-attck-evaluations/) -- 安全脉搏 - - [挖洞实战之信息泄露与前端加密](https://www.secpulse.com/archives/176374.html) - - [从静到动聊杀软对抗](https://www.secpulse.com/archives/176362.html) - - [记一次曲折的CVE-2018-1270复现分析](https://www.secpulse.com/archives/176325.html) -- NVISO Labs - - [Analyzing a “multilayer” Maldoc: A Beginner’s Guide](https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/) -- 128 nops and counting - - [Binary Ninja Recipes #3](https://carstein.github.io/2022/04/06/binary-ninja-recipes3.html) -- Forcepoint - - [How Three Forcepoint Customers Use DLP for a Competitive Advantage](https://www.forcepoint.com/blog/insights/customers-use-dlp-competitive-advantage) -- Cerbero Blog - - [Certificates Support](https://blog.cerbero.io/?p=2375) -- blog.avast.com EN - - [Scam and Online Fraud Protection Features in Avast One | Avast](https://blog.avast.com/scam-and-online-fraud-protection-features-avast-one) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-04-06 - Files for an ISC diary](https://www.malware-traffic-analysis.net/2022/04/06/index.html) -- SentinelOne - - [Tech Disruptors by Bloomberg Intelligence | SentinelOne and Fragmented Endpoint Security](https://www.sentinelone.com/blog/tech-disruptors-by-bloomberg-intelligence-sentinelone-and-fragmented-endpoint-security/) -- PortSwigger Blog - - [Burp Scanner can now crawl static sites between 6x - 9x faster](https://portswigger.net/blog/burp-scanner-can-now-crawl-static-sites-between-6x-9x-faster) -- Intigriti - - [Empower your security team to build stronger defenses against cybercriminals [Interview]](https://blog.intigriti.com/2022/04/06/empower-business-build-stronger-defenses-against-cybercriminals/) - - [Bug Bytes #166 – Double-edged SSRF, ToolTime & Fun hackers stories](https://blog.intigriti.com/2022/04/06/bug-bytes-166-double-edged-ssrf-tooltime-fun-hackers-stories/) -- PortSwigger Blog - - [Burp Scanner can now crawl static sites between 6x - 9x faster](https://portswigger.net/blog/burp-scanner-can-now-crawl-static-sites-between-6x-9x-faster) -- Software Integrity Blog - - [What is the maturity level of your AppSec program?](https://www.synopsys.com/blogs/software-security/assessing-maturity-level-of-your-appsec-program/) -- 博客园 - sevck - - [MAC virtualbox Kernel driver not installed (rc=-1908) - sevck](https://www.cnblogs.com/sevck/p/16105538.html) -- Hacking Articles - - [Windows Persistence: COM Hijacking (MITRE: T1546.015)](https://www.hackingarticles.in/windows-persistence-com-hijacking-mitre-t1546-015/) -- KitPloit - PenTest & Hacking Tools - - [Hcltm - Documenting Your Threat Models With HCL](http://www.kitploit.com/2022/04/hcltm-documenting-your-threat-models.html) - - [KNX-Bus-Dump - A Tool To Listen On A KNX Bus Via TPUART And The Calimero Project Suite And To Dump The Data From The Packets Into A Wireshark-Compatible File Hex Dump](http://www.kitploit.com/2022/04/knx-bus-dump-tool-to-listen-on-knx-bus.html) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（20220328-20220403）](http://blog.nsfocus.net/weekly-20220328/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 4/6/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-4-6-2022/) -- The Daily Swig | Cybersecurity news and views - - [Authorities seize Hydra servers in bust against darknet cybercrime marketplace](https://portswigger.net/daily-swig/authorities-seize-hydra-servers-in-bust-against-darknet-cybercrime-marketplace) - - [UK retailer The Works blames store closures on POS problems following cyber-attack](https://portswigger.net/daily-swig/uk-retailer-the-works-blames-store-closures-on-pos-problems-following-cyber-attack) - - [Spring4Shell: Microsoft, CISA warn of limited, in-the-wild exploitation](https://portswigger.net/daily-swig/spring4shell-microsoft-cisa-warn-of-limited-in-the-wild-exploitation) -- FreeBuf网络安全行业门户 - - [FreeBuf 早报 | Twitter 限制俄罗斯政府账号；英特尔关闭了在俄罗斯的所有业务](https://www.freebuf.com/news/327662.html) - - [乌克兰 CERT-UA警告，俄相关Armageddon APT组织正攻击乌克兰国家机构](https://www.freebuf.com/articles/327650.html) - - [Gartner：六个步骤制定云战略](https://www.freebuf.com/articles/neopoints/327643.html) - - [德国关闭了全球最大暗网市场 Hydra](https://www.freebuf.com/news/327478.html) - - [零售商The Works在遭遇网络攻击后被迫关闭商店](https://www.freebuf.com/articles/327468.html) - - [微软在其云服务中检测到 Spring4Shell 攻击](https://www.freebuf.com/news/327462.html) -- 奇客Solidot–传递最新科技情报 - - [中国占全球半导体市场份额的 4%](https://www.solidot.org/story?sid=71172) - - [英格兰和威尔士和平离婚法生效](https://www.solidot.org/story?sid=71171) - - [欧盟法院表示电话数据不能不加区分的保留](https://www.solidot.org/story?sid=71170) - - [物种的单个基因可导致其他物种灭绝](https://www.solidot.org/story?sid=71169) - - [天文学家捕捉到一颗木星大小系外行星的诞生](https://www.solidot.org/story?sid=71168) - - [被盗的达尔文手稿归还剑桥大学图书馆](https://www.solidot.org/story?sid=71167) - - [每日 7000 步能救命](https://www.solidot.org/story?sid=71166) - - [Epic 发布虚幻引擎 5](https://www.solidot.org/story?sid=71165) - - [Twitter 限制俄罗斯政府账号](https://www.solidot.org/story?sid=71164) - - [中国亿万富豪人数减少](https://www.solidot.org/story?sid=71163) - - [德国扣押俄罗斯暗网市场 Hydra 服务器](https://www.solidot.org/story?sid=71162) - - [Elon Musk 加入 Twitter 董事会](https://www.solidot.org/story?sid=71161) -- 安全牛 - - [关注 | 一种可高度规避检测的新威胁：HEAT](https://www.aqniu.com/industry/82390.html) - - [弹性策略将是践行零信任的重要方法](https://www.aqniu.com/industry/82389.html) - - [安全牛课堂发布企业黑金卡旗舰版](https://www.aqniu.com/industry/82388.html) - - [Spring远程命令执行漏洞（CVE-2022-22965）原理分析和思考](https://www.aqniu.com/industry/82365.html) - - [从攻击视角看代码隐私安全，9款 Git秘密扫描工具盘点](https://www.aqniu.com/industry/82350.html) - - [云祺科技宣布完成数千万元A轮融资](https://www.aqniu.com/industry/82336.html) - - [中国网络安全产业创新发展联盟正式成立 助力网络安全产业高质量发展](https://www.aqniu.com/vendor/82335.html) - - [数字化时代，个人数据何处安家？](https://www.aqniu.com/vendor/82311.html) - - [周天王的愚人节-NFT精准钓鱼事件技术分析与资金流向分析](https://www.aqniu.com/industry/82310.html) -- IT Service Management News - - [Analisi dei nuovi controlli della ISO/IEC 27002](http://blog.cesaregallotti.it/2022/04/analisi-dei-nuovi-controlli-della.html) - - [Pubblicazione Enisa sugli standard di valutazione del rischio](http://blog.cesaregallotti.it/2022/04/pubblicazione-enisa-sugli-standard-di.html) - - [Guida CERT EU sulla sicurezza](http://blog.cesaregallotti.it/2022/04/guida-cert-eu-sulla-sicurezza.html) - - [PCI DSS 4.0](http://blog.cesaregallotti.it/2022/04/pci-dss-40.html) -- Fortinet Threat Research Blog - - [The Latest Remcos RAT Driven By Phishing Campaign](https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing) -- ICT Security Magazine - - [La CyberSecurity per i droni – Tipologie di attacchi](https://www.ictsecuritymagazine.com/articoli/la-cybersecurity-per-i-droni-tipologie-di-attacchi/) - - [SAST: uno strumento necessario per la strada verso il “secure by design”](https://www.ictsecuritymagazine.com/articoli/sast-uno-strumento-necessario-per-la-strada-verso-il-secure-by-design/) -- Securityinfo.it - - [WatchGuard: in crescita malware e attacchi alla rete](https://www.securityinfo.it/2022/04/06/watchguard-in-crescita-malware-e-attacchi-alla-rete/?utm_source=rss&utm_medium=rss&utm_campaign=watchguard-in-crescita-malware-e-attacchi-alla-rete) - - [Da Zyxel patch per un bug che permette di bypassare i firewall](https://www.securityinfo.it/2022/04/06/da-zyxel-patch-per-un-bug-che-permette-di-bypassare-i-firewall/?utm_source=rss&utm_medium=rss&utm_campaign=da-zyxel-patch-per-un-bug-che-permette-di-bypassare-i-firewall) - - [MailChimp violato per attaccare clienti nel settore delle criptovalute](https://www.securityinfo.it/2022/04/06/mailchimp-violato-per-attaccare-clienti-nel-settore-delle-criptovalute/?utm_source=rss&utm_medium=rss&utm_campaign=mailchimp-violato-per-attaccare-clienti-nel-settore-delle-criptovalute) -- Schneier on Security - - [Cyberweapons Arms Manufacturer FinFisher Shuts Down](https://www.schneier.com/blog/archives/2022/04/cyberweapons-arms-manufacturer-finfisher-shuts-down.html) -- Il Disinformatico - - [DragonChase 2022: slitta a “non prima del 21 aprile” la partenza della Crew-4; i poster ufficiali della missione; conferenza stampa; info sulla possibile EVA](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-slitta-non-prima-del.html) -- Data Breach - - [Block discloses data breach involving Cash App potentially impacting 8.2 million US customers](https://securityaffairs.co/wordpress/129892/data-breach/block-cash-app-data-breach.html) -- SANS Internet Storm Center, InfoCON: green - - [Windows MetaStealer Malware, (Wed, Apr 6th)](https://isc.sans.edu/diary/rss/28522) - - [ISC Stormcast For Wednesday, April 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=7952, (Wed, Apr 6th)](https://isc.sans.edu/diary/rss/28524) -- The Hacker News - - [Cyber Security WEBINAR — How to Ace Your InfoSec Board Deck](https://thehackernews.com/2021/10/cyber-security-webinar-how-to-ace-your.html) - - [Hackers Distributing Fake Shopping Apps to Steal Banking Data of Malaysian Users](https://thehackernews.com/2022/04/hackers-distributing-fake-shopping-apps.html) - - [Block Admits Data Breach Involving Cash App Data Accessed by Former Employee](https://thehackernews.com/2022/04/block-admits-data-breach-involving-cash.html) - - [U.S. Treasury Department Sanctions Russia-based Hydra Darknet Marketplace](https://thehackernews.com/2022/04/us-treasury-department-sanctions-russia.html) - - [Germany Shuts Down Russian Hydra Darknet Market; Seizes $25 Million in Bitcoin](https://thehackernews.com/2022/04/germany-shuts-down-russian-hydra.html) - - [CISA Warns of Active Exploitation of Critical Spring4Shell Vulnerability](https://thehackernews.com/2022/04/cisa-warns-of-active-exploitation-of.html) -- NVISO Labs - - [Analyzing a “multilayer” Maldoc: A Beginner’s Guide](https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/) -- Security Through Education - - [A Peek into a Professional Social Engineering Team](https://www.social-engineer.org/social-engineering/a-peek-into-a-professional-social-engineering-team/) -- TorrentFreak - - [Sky Tries to Remove ‘Pirate’ IPTV App “CucoTV” from GitHub](https://torrentfreak.com/sky-tries-to-remove-pirate-iptv-app-cucotv-from-github-220406/) - - [How LaLiga’s Anti-Piracy Tools Led To Two More Pirate IPTV Arrests](https://torrentfreak.com/how-laligas-anti-piracy-tools-led-to-two-more-pirate-iptv-arrests-220406/) -- TG Soft Software House - News - - [Phishing: i tentativi di furto credenziali e/o dati maggiormente diffusi nel mese di APRILE 2022...](http://www.tgsoft.it/italy/news_archivio.asp?id=1296) -- Krebs on Security - - [The Original APT: Advanced Persistent Teenagers](https://krebsonsecurity.com/2022/04/the-original-apt-advanced-persistent-teenagers/) -- Security Affairs - - [US dismantled the Russia-linked Cyclops Blink botnet](https://securityaffairs.co/wordpress/129911/cyber-warfare-2/us-disrupts-cyclops-blink-botnet.html) - - [Ukraine warns of attacks aimed at taking over Telegram accounts](https://securityaffairs.co/wordpress/129900/hacking/cert-ua-attacks-telegram-accounts.html) - - [Block discloses data breach involving Cash App potentially impacting 8.2 million US customers](https://securityaffairs.co/wordpress/129892/data-breach/block-cash-app-data-breach.html) - - [U.S. Treasury Department sanctions darkweb marketplace Hydra Market](https://securityaffairs.co/wordpress/129880/cyber-crime/us-treasury-sanctioned-hydra-market.html) - - [A cyber attack forced the wind turbine manufacturer Nordex Group to shut down some of IT systems](https://securityaffairs.co/wordpress/129875/security/a-cyber-attack-forced-the-wind-turbine-manufacturer-nordex-group-to-shut-down-some-of-it-systems.html) - - [Germany police shut down Hydra Market dark web marketplace](https://securityaffairs.co/wordpress/129866/cyber-crime/german-police-shut-down-hydra-market.html) -- The Register - Security - - [Hamas-linked cyber-spies 'target high-ranking Israelis'](https://go.theregister.com/feed/www.theregister.com/2022/04/06/apt-israeli-officials/) - - [Feds take down Kremlin-backed Cyclops Blink botnet](https://go.theregister.com/feed/www.theregister.com/2022/04/06/takedown_cyclops_blink/) - - [Block claims ex-employee downloaded customer data after leaving firm](https://go.theregister.com/feed/www.theregister.com/2022/04/06/ex-block-employee-takes-customer-data/) - - [UK spy agencies sharing bulk personal data with foreign allies was legal, says court](https://go.theregister.com/feed/www.theregister.com/2022/04/06/privacy_international_vs_ipt/) - - [Apple patched critical flaws in macOS Monterey but not in Big Sur nor Catalina](https://go.theregister.com/feed/www.theregister.com/2022/04/06/apple_patched_zerodays_in_macos/) -- Deeplinks - - [The Latest Threat to Independent Online Creators Is the Filter Mandate Bill](https://www.eff.org/deeplinks/2022/04/latest-threat-independent-online-creators-filter-mandate-bill) -- Threatpost - - [Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info](https://threatpost.com/attackers-whatsapp-voice-message/179244/) -- KitPloit - PenTest Tools! - - [Hcltm - Documenting Your Threat Models With HCL](http://www.kitploit.com/2022/04/hcltm-documenting-your-threat-models.html) - - [KNX-Bus-Dump - A Tool To Listen On A KNX Bus Via TPUART And The Calimero Project Suite And To Dump The Data From The Packets Into A Wireshark-Compatible File Hex Dump](http://www.kitploit.com/2022/04/knx-bus-dump-tool-to-listen-on-knx-bus.html) -- Dark Reading - - [Nearly Two-Thirds of Ransomware Victims Paid Ransoms Last Year, Finds "2022 Cyberthreat Defense Report"](https://www.darkreading.com/attacks-breaches/nearly-two-thirds-of-ransomware-victims-paid-ransoms-last-year-finds-2022-cyberthreat-defense-report-) - - [Zoom's Bug Bounty Programs Soar to $1.8M](https://www.darkreading.com/application-security/zoom-s-bug-bounty-programs-soars-to-1-8-million) - - [Nearly 40% of Macs Left Exposed to 2 Zero-Day Exploits](https://www.darkreading.com/vulnerabilities-threats/up-to-4-in-10-supported-macs-could-be-exposed-to-2-recently-patched-0-day-flaws) - - [Eliminating Passwords: One Way Forward](https://www.darkreading.com/edge-articles/dramatically-reduce-risks-by-eliminating-passwords) - - [How DevOps Automation Solves Low-Code Security Issues](https://www.darkreading.com/dr-tech/how-devops-automation-solves-low-code-security-issues) - - [FBI-Led Operation Disrupts Russian GRU Botnet](https://www.darkreading.com/vulnerabilities-threats/russian-gru-botnet-disrupted-in-fbi-led-operation) - - [Linux Systems Are Becoming Bigger Targets](https://www.darkreading.com/vulnerabilities-threats/linux-systems-are-becoming-bigger-targets) - - [Why XDR As We Know It Will Fail](https://www.darkreading.com/vulnerabilities-threats/why-xdr-as-we-know-it-will-fail) -- Trend Micro Research, News and Perspectives - - [An In-Depth Look at ICS Vulnerabilities Part 3](https://www.trendmicro.com/en_us/research/22/d/an-in-depth-look-at-ics-vulnerabilities-part-3.html) - - [Detecting Exploitation of Local Vulnerabilities Through Trend Micro Vision One™ and Cloud One™](https://www.trendmicro.com/en_us/research/22/d/detecting-exploitation-of-local-vulnerabilities-through-trend-mi.html) - - [5 Zero Trust Security Model DevOps Integrations](https://www.trendmicro.com/en_us/devops/22/d/zero-trust-security-devops-integrations.html) -- Posts By SpecterOps Team Members - Medium - - [Ghostwriter v2.3.0 & 2022 Road Map](https://posts.specterops.io/ghostwriter-v2-3-0-2022-road-map-13cb7a64ff89?source=rss----f05f8696e3cc---4) -- Instapaper: Unread - - [MAGNET Apple Warrant Return Assistant Download Our Free Tool](https://www.magnetforensics.com/blog/magnet-apple-warrant-return-assistant-download-our-free-tool/) - - [Take a Stand Against CSAM](https://www.grayshift.com/take-a-stand-against-csam/) - - [Peace through Pegasus Jordanian Human Rights Defenders and Journalists Hacked with Pegasus Spyware](https://citizenlab.ca/2022/04/peace-through-pegasus-jordanian-human-rights-defenders-and-journalists-hacked-with-pegasus-spyware/) - - [FIN7 Hackers Leveraging Password Reuse and Software Supply Chain Attacks](https://thehackernews.com/2022/04/fin7-hackers-leveraging-password-reuse.html) - - [$25 million confiscated by German authorities in takedown of Hydra dark web marketplace](https://therecord.media/25-million-confiscated-by-german-authorities-in-takedown-of-hydra-dark-web-marketplace/) - - [Reparto ransomware quando viene attaccato un ospedale](https://www.guerredirete.it/reparto-ransomware-quando-viene-attaccato-un-ospedale/) -- Dark Space Blogspot - - [La Stable USDN Di Waves Sta Perdendo Il Peg?](http://darkwhite666.blogspot.com/2022/04/la-stable-usdn-di-waves-sta-perdendo-il.html) diff --git a/archive/2022/2022-04-08.md b/archive/2022/2022-04-08.md deleted file mode 100644 index 8f0e767fe6..0000000000 --- a/archive/2022/2022-04-08.md +++ /dev/null @@ -1,236 +0,0 @@ -# 每日安全资讯（2022-04-08） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [minewebcms 1.15.2 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022040032) - - [binutils 2.37 Objdump Segmentation Fault](https://cxsecurity.com/issue/WLB-2022040031) - - [Tiny File Manager 2.4.6 Remote Code Execution (RCE)](https://cxsecurity.com/issue/WLB-2022040030) - - [qdPM 9.2 Cross Site Request Forgery](https://cxsecurity.com/issue/WLB-2022040029) - - [Small HTTP Server 3.06 Remote Buffer Overflow](https://cxsecurity.com/issue/WLB-2022040028) - - [Zenario CMS 9.0.54156 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022040027) - - [Opmon 9.11 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022040026) - - [Backdoor.Win32.Wisell / Stack Buffer Overflow (SEH)](https://cxsecurity.com/issue/WLB-2022040025) - - [Backdoor.Win32.Tiny.a / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022040024) - - [Backdoor.Win32.Easyserv.11.c / Insecure Transit](https://cxsecurity.com/issue/WLB-2022040023) - - [Backdoor.Win32.Bifrose.uw / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022040022) - - [Backdoor.Win32.Wisell / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022040021) - - [Backdoor.Win32.Ptakks.XP.a / Insecure Credential Storage](https://cxsecurity.com/issue/WLB-2022040020) - - [Backdoor.Win32.Verify.h / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022040019) - - [Backdoor.Win32.FTP.Lana.01.d / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022040018) - - [Backdoor.Win32.FTP.Lana.01.d / Port Bounce Scan](https://cxsecurity.com/issue/WLB-2022040017) - - [Backdoor.Win32.XLog.21 / Authentication Bypass Race Condition](https://cxsecurity.com/issue/WLB-2022040016) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5369-1](https://packetstormsecurity.com/files/166639/USN-5369-1.txt) - - [Red Hat Security Advisory 2022-1263-01](https://packetstormsecurity.com/files/166638/RHSA-2022-1263-01.txt) - - [Backdoor.Win32.XLog.21 Authentication Bypass / Race Condition](https://packetstormsecurity.com/files/166637/MVID-2022-0543.txt) - - [Ubuntu Security Notice USN-5368-1](https://packetstormsecurity.com/files/166636/USN-5368-1.txt) - - [Backdoor.Win32.Verify.h Remote Command Execution](https://packetstormsecurity.com/files/166635/MVID-2022-0538.txt) - - [KLiK Social Media Website 1.0 SQL Injection](https://packetstormsecurity.com/files/166634/kliksmw10-sql.txt) - - [Ubuntu Security Notice USN-5366-1](https://packetstormsecurity.com/files/166633/USN-5366-1.txt) - - [WordPress WP Downgrade Cross Site Scripting](https://packetstormsecurity.com/files/166632/wpdowngrade-xss.txt) - - [WordPress UpdraftPlus Cross Site Scripting](https://packetstormsecurity.com/files/166631/wpupdraftplus-xss.txt) - - [qdPM 9.2 Cross Site Request Forgery](https://packetstormsecurity.com/files/166630/qdpm92-xsrf.txt) - - [minewebcms 1.15.2 Cross Site Scripting](https://packetstormsecurity.com/files/166629/minewebcms1152-xss.txt) - - [WordPress Hummingbird Cross Site Scripting](https://packetstormsecurity.com/files/166628/wphummingbird-xss.txt) - - [ICEHRM 31.0.0.0S Cross Site Request Forgery](https://packetstormsecurity.com/files/166627/icehrm31000Sdel-xsrf.txt) - - [WordPress Ad Inserter Cross Site Scripting](https://packetstormsecurity.com/files/166626/wpadinserter-xss.txt) - - [WordPress Loco Translate Cross Site Scripting](https://packetstormsecurity.com/files/166625/wplocotranslate-xss.txt) - - [Backdoor.Win32.Wisell Remote Command Execution](https://packetstormsecurity.com/files/166624/MVID-2022-0536.txt) - - [Kramer VIAware Remote Code Execution](https://packetstormsecurity.com/files/166623/kramerviaware-exec.txt) - - [Small HTTP Server 3.06 Remote Buffer Overflow](https://packetstormsecurity.com/files/166622/smallhttp306-overflow.txt) - - [Backdoor.Win32.Wisell Buffer Overflow](https://packetstormsecurity.com/files/166621/MVID-2022-0541.txt) - - [Red Hat Security Advisory 2022-1254-01](https://packetstormsecurity.com/files/166620/RHSA-2022-1254-01.txt) - - [Opmon 9.11 Cross Site Scripting](https://packetstormsecurity.com/files/166619/opmon911-xss.txt) - - [binutils 2.37 Objdump Segmentation Fault](https://packetstormsecurity.com/files/166618/binutils237-crash.txt) - - [Zenario CMS 9.0.54156 Remote Code Execution](https://packetstormsecurity.com/files/166617/zenariocms9054156-exec.txt) - - [Backdoor.Win32.Xingdoor Denial Of Service](https://packetstormsecurity.com/files/166616/MVID-2022-0542.txt) - - [Backdoor.Win32.Ptakks.XP.a Insecure Credential Storage](https://packetstormsecurity.com/files/166615/MVID-2022-0537.txt) -- SecWiki News - - [SecWiki News 2022-04-07 Review](http://www.sec-wiki.com/?2022-04-07) -- Security Boulevard - - [mTLS Everywhere in Kubernetes: Not Just Entry and Exit](https://securityboulevard.com/2022/04/mtls-everywhere-in-kubernetes-not-just-entry-and-exit/) - - [Demystifying Data Mesh: Part One](https://securityboulevard.com/2022/04/demystifying-data-mesh-part-one/) - - [How to create a culture of security at your organization](https://securityboulevard.com/2022/04/how-to-create-a-culture-of-security-at-your-organization/) - - [Actions Target Russian Govt. Botnet, Hydra Dark Market](https://securityboulevard.com/2022/04/actions-target-russian-govt-botnet-hydra-dark-market/) - - [Constella Intelligence Launches Ukraine Digital Public Conversation Dashboard](https://securityboulevard.com/2022/04/constella-intelligence-launches-ukraine-digital-public-conversation-dashboard/) - - [Cloud Security Podcast by Google — Popular Episodes by Topic](https://securityboulevard.com/2022/04/cloud-security-podcast-by-google-popular-episodes-by-topic/) - - [Zero Trust Architecture for Healthcare – 7 Common Pitfalls to Avoid](https://securityboulevard.com/2022/04/zero-trust-architecture-for-healthcare-7-common-pitfalls-to-avoid/) - - [Purdue University’s CERIAS 2022 Security Seminars – Melissa Dark’s ‘Building The Next Generation Cybersecurity Workforce: Progress And Challenge’](https://securityboulevard.com/2022/04/purdue-universitys-cerias-2022-security-seminars-melissa-darks-building-the-next-generation-cybersecurity-workforce-progress-and-challenge/) - - [Fidelis Cybersecurity Endpoint Detection and Response (EDR) platform delivers 100% detection coverage across all nineteen steps during the 2022 MITRE Engenuity™ Round 4 ATT&CK® Evaluation](https://securityboulevard.com/2022/04/fidelis-cybersecurity-endpoint-detection-and-response-edr-platform-delivers-100-detection-coverage-across-all-nineteen-steps-during-the-2022-mitre-engenuity-round-4-attck-evaluat/) -- Google Online Security Blog - - [Improving software supply chain security with tamper-proof builds](http://security.googleblog.com/2022/04/improving-software-supply-chain.html) -- Tenable Blog - - [VMware Patches Multiple Vulnerabilities in Workspace ONE, Identity and Lifecycle Manager and vRealize (VMSA-2022-0011)](https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011) -- paper - Last paper - - [从 dotnet 源码看文件上传绕 waf](https://paper.seebug.org/1879/) - - [CVE-2022-22947 SpringCloud GateWay SPEL RCE Echo Response](https://paper.seebug.org/1878/) -- xorl %eax, %eax - - [Ideas for Software Supply-Chain Attacks Simulation by Red Teams](https://xorl.wordpress.com/2022/04/07/ideas-for-software-supply-chain-attacks-simulation-by-red-teams/) -- 安全脉搏 - - [攻防演练审视企业蓝队建设](https://www.secpulse.com/archives/176598.html) - - [渗透的门被封死了，还好上帝为我开了一扇窗 | 技术精选0130](https://www.secpulse.com/archives/176538.html) - - [Spring 参数绑定的分析以及甲方自查](https://www.secpulse.com/archives/176519.html) - - [拿下域控后，我还是对大佬的操作念念不忘 | 技术精选0129](https://www.secpulse.com/archives/176483.html) -- 跳跳糖 - 安全与分享社区 - - [Linux下无文件Java agent探究](https://tttang.com/archive/1525/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [两家企业因开发 QQ 自动抢红包软件被判赔偿腾讯公司 70 万元](https://www.4hou.com/posts/3VLM) - - [黑客攻破Mailchimp公司，钓取加密货币钱包](https://www.4hou.com/posts/0DGv) - - [打破安全能力协同壁垒，360核心安全大脑3.0正式发布！](https://www.4hou.com/posts/mNrO) - - [Nighthawk漏洞的检测预防](https://www.4hou.com/posts/pLly) - - [黑客利用WPS Office漏洞注入后门](https://www.4hou.com/posts/vLAX) - - [《2022年嘶吼电子季刊Q1》发布](https://www.4hou.com/posts/6KOn) -- 安全客-有思想的安全新媒体 - - [物联网终端安全入门与实践之了解物联网终端 上篇](https://www.anquanke.com/post/id/271480) - - [Cash App 向 820 万美国客户通报了数据泄露情况](https://www.anquanke.com/post/id/271523) -- blog.avast.com EN - - [IWD at Avast | Avast](https://blog.avast.com/iwd-at-avast) -- SentinelOne - - [Best-of-Breed Identity Threat Detection and Response Meets Best-of-Breed XDR](https://www.sentinelone.com/blog/best-of-breed-identity-threat-detection-and-response-meets-best-of-breed-xdr/) -- Project Zero - - [CVE-2021-30737, @xerub's 2021 iOS ASN.1 Vulnerability](https://googleprojectzero.blogspot.com/2022/04/cve-2021-30737-xerubs-2021-ios-asn1.html) -- Intigriti - - [The 3 key stages to setting up and managing a bug bounty program](https://blog.intigriti.com/2022/04/07/3-key-stages-setting-up-managing-bug-bounty-program/) -- Hacking Articles - - [A Detailed Guide on Cewl](https://www.hackingarticles.in/a-detailed-guide-on-cewl/) -- Exploit-DB.com RSS Feed - - [[local] binutils 2.37 - Objdump Segmentation Fault](https://www.exploit-db.com/exploits/50858) - - [[remote] Opmon 9.11 - Cross-site Scripting](https://www.exploit-db.com/exploits/50857) - - [[remote] Kramer VIAware - Remote Code Execution (RCE) (Root)](https://www.exploit-db.com/exploits/50856) - - [[webapps] ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion](https://www.exploit-db.com/exploits/50855) - - [[webapps] qdPM 9.2 - Cross-site Request Forgery (CSRF)](https://www.exploit-db.com/exploits/50854) - - [[webapps] minewebcms 1.15.2 - Cross-site Scripting (XSS)](https://www.exploit-db.com/exploits/50853) - - [[local] Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path](https://www.exploit-db.com/exploits/50852) - - [[webapps] KLiK Social Media Website 1.0 - 'Multiple' SQLi](https://www.exploit-db.com/exploits/50851) - - [[webapps] Zenario CMS 9.0.54156 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/50850) -- Securelist - - [A Bad Luck BlackCat](https://securelist.com/a-bad-luck-blackcat/106254/) -- The Daily Swig | Cybersecurity news and views - - [VMware patches critical flaws in Workspace ONE Access identity management software](https://portswigger.net/daily-swig/vmware-patches-critical-flaws-in-workspace-one-access-identity-management-software) - - [Wake-up call: Is the infosec skills gap causing a mental health crisis?](https://portswigger.net/daily-swig/wake-up-call-is-the-infosec-skills-gap-causing-a-mental-health-crisis) - - [Apple paid out $36,000 bug bounty for HTTP request smuggling flaws on core web apps – research](https://portswigger.net/daily-swig/apple-paid-out-36-000-bug-bounty-for-http-request-smuggling-flaws-on-core-web-apps-research) -- Hacking and security - - [7. SECURITATEA SERVICIILOR ÎN INTERNET](https://hackingandsecurity.blogspot.com/2022/04/7-securitatea-serviciilor-in-internet.html) -- Software Integrity Blog - - [What is the maturity level of your AppSec program?](https://www.synopsys.com/blogs/software-security/assessing-maturity-level-of-your-appsec-program/) -- Hackerman's Hacking Tutorials - - [Introducing Code Review Hotspots with Semgrep](https://parsiya.net/blog/2022-04-07-introducing-code-review-hotspots-with-semgrep/) -- KitPloit - PenTest & Hacking Tools - - [Octosuite - Advanced Github OSINT Framework](http://www.kitploit.com/2022/04/octosuite-advanced-github-osint.html) - - [Gitbleed_Tools - For Extracting Data From Mirrorred Git Repositories](http://www.kitploit.com/2022/04/gitbleedtools-for-extracting-data-from.html) -- 绿盟科技技术博客 - - [拨开俄乌网络战迷雾-域名证书测绘篇](http://blog.nsfocus.net/icann-ca/) -- FreeBuf网络安全行业门户 - - [FreeBuf 早报 | 谷歌下架数款收集用户数据的应用；蔚来员工被曝利用公司服务器挖矿](https://www.freebuf.com/news/327847.html) - - [Cash App数据泄露恐将影响820万美国用户](https://www.freebuf.com/news/327794.html) - - [VMware 多个产品中爆出严重漏洞](https://www.freebuf.com/news/327800.html) - - [南非和美国调查人员联手突袭BEC诈骗团伙](https://www.freebuf.com/news/327769.html) - - [值得警惕！新型恶意软件FFDroider正对 Facebook等社交帐户下手](https://www.freebuf.com/news/327763.html) -- 奇客Solidot–传递最新科技情报 - - [英国将建造 8 座新核反应堆](https://www.solidot.org/story?sid=71182) - - [IBM 大型机整合了 AI 加速器](https://www.solidot.org/story?sid=71181) - - [感染新冠和接种疫苗能提供更长时间的免疫保护](https://www.solidot.org/story?sid=71180) - - [人脑会随时间扩张和收缩](https://www.solidot.org/story?sid=71179) - - [加拿大考虑立法要求数字巨头补偿新闻媒体](https://www.solidot.org/story?sid=71178) - - [世界最古老的裤子是有 3000 年历史的工程奇迹](https://www.solidot.org/story?sid=71177) - - [斯坦福工程师发明能在夜间发电的太阳能电池](https://www.solidot.org/story?sid=71176) - - [研究人员确定密码学背后的“主问题”](https://www.solidot.org/story?sid=71175) - - [首次在人肺部深处检出微塑料](https://www.solidot.org/story?sid=71174) - - [Google 从应用商店下架数十个悄悄收集数据的应用](https://www.solidot.org/story?sid=71173) -- HAHWUL - - [Log Injection](https://www.hahwul.com/cullinan/log-injection/) -- Google Online Security Blog - - [Improving software supply chain security with tamper-proof builds](http://security.googleblog.com/2022/04/improving-software-supply-chain.html) -- 黑海洋 - WIKI - - [Macrorit Partition Expert v6.0.3](https://blog.upx8.com/2683) - - [Autodesk Revit 2023 正式版](https://blog.upx8.com/2682) -- Fortinet Threat Research Blog - - [Looking Inside Pandora’s Box](https://www.fortinet.com/blog/threat-research/looking-inside-pandoras-box) - - [Fortinet Security Researchers Discover Multiple Vulnerabilities in AutoDesk Products: DWG TrueView, Navisworks & Design Review](https://www.fortinet.com/blog/threat-research/fortinet-security-researchers-discover-multiple-vulnerabilities-in-autodesk-products-dwg-trueview-navisworks-and-design-review) -- Securityinfo.it - - [Hacker cinesi installano malware attraverso VLC Media Player](https://www.securityinfo.it/2022/04/07/hacker-cinesi-installano-malware-attraverso-vlc-media-player/?utm_source=rss&utm_medium=rss&utm_campaign=hacker-cinesi-installano-malware-attraverso-vlc-media-player) - - [Niente patch per macOS Big Sur e Catalina](https://www.securityinfo.it/2022/04/07/niente-patch-per-macos-big-sur-e-catalina/?utm_source=rss&utm_medium=rss&utm_campaign=niente-patch-per-macos-big-sur-e-catalina) -- Il Disinformatico - - [Quando l’intelligenza artificiale bara: l’aneddoto degli husky scambiati per lupi](http://attivissimo.blogspot.com/2022/04/quando-lintelligenza-artificiale-bara.html) - - [Nello spazio nessuno può sentirti urlare, ma su Marte sì](http://attivissimo.blogspot.com/2022/04/nello-spazio-nessuno-puo-sentirti.html) - - [Il servizio anti-fake news di Google: Fact Check Explorer](http://attivissimo.blogspot.com/2022/04/google-offre-un-nuovo-servizio-anti.html) -- 安全牛 - - [旧瓶装新酒！新一代IPS的发展与变革](https://www.aqniu.com/industry/82420.html) - - [云安全建设的6个建议](https://www.aqniu.com/industry/82413.html) - - [赛可达实验室发布ATT&CK®能力仿真测试系统及测评方案2.0版](https://www.aqniu.com/industry/82412.html) - - [共筑网络安全“防护网”，亚信安全与新华三达成战略合作](https://www.aqniu.com/industry/82400.html) - - [虚拟货币网络犯罪愈演愈烈，安全防护更要“多管齐下”](https://www.aqniu.com/industry/82401.html) -- Team Cymru - - [MoqHao Part 2: Continued European Expansion](https://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/) -- ProtonMail Blog - - [The new ProtonMail iOS app is here!](https://protonmail.com/blog/new-ios-app/) - - [Introducing proton.me, a new email domain for ProtonMail](https://protonmail.com/blog/protonme-domain/) -- Securelist - - [A Bad Luck BlackCat](https://securelist.com/a-bad-luck-blackcat/106254/) -- AlienVault Security Essentials Blog - - [Java Spring vulnerabilities](https://cybersecurity.att.com/blogs/labs-research/java-spring-vulnerabilities) -- Tor Project blog - - [New Release: Tor Browser 11.0.10 (Windows, macOS, Linux)](https://blog.torproject.org/new-release-tor-browser-11010/) -- SANS Internet Storm Center, InfoCON: green - - [What is BIMI and how is it supposed to help with Phishing., (Thu, Apr 7th)](https://isc.sans.edu/diary/rss/28528) - - [ISC Stormcast For Thursday, April 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=7954, (Thu, Apr 7th)](https://isc.sans.edu/diary/rss/28526) -- Schneier on Security - - [US Disrupts Russian Botnet](https://www.schneier.com/blog/archives/2022/04/us-disrupts-russian-botnet.html) -- Instapaper: Unread - - [US Disrupts Russian Cyclops Blink Botnet Before Being Used in Attacks](https://www.bleepingcomputer.com/news/security/us-disrupts-russian-cyclops-blink-botnet-before-being-used-in-attacks/) - - [Europe Is Building a Huge International Facial Recognition System](https://www.wired.com/story/europe-police-facial-recognition-prum/) - - [New Free Tool from Magnet Forensics MAGNET Apple Warrant Return Assistant](https://www.forensicfocus.com/news/new-free-tool-from-magnet-forensics-magnet-apple-warrant-return-assistant/) - - [Cyberweapons Arms Manufacturer FinFisher Shuts Down](https://www.schneier.com/blog/archives/2022/04/cyberweapons-arms-manufacturer-finfisher-shuts-down.html) -- The Hacker News - - [Hamas-linked Hackers Targeting High-Ranking Israelis Using 'Catfish' Lures](https://thehackernews.com/2022/04/hamas-linked-hackers-targeting-high.html) - - [Into the Breach: Breaking Down 3 SaaS App Cyber Attacks in 2022](https://thehackernews.com/2022/04/into-breach-breaking-down-3-saas-app.html) - - [SharkBot Banking Trojan Resurfaces On Google Play Store Hidden Behind 7 New Apps](https://thehackernews.com/2022/04/sharkbot-banking-trojan-resurfaces-on.html) - - [Researchers Uncover How Colibri Malware Stays Persistent on Hacked Systems](https://thehackernews.com/2022/04/researchers-uncover-how-colibri-malware.html) - - [FBI Shut Down Russia-linked "Cyclops Blink" Botnet That Infected Thousands of Devices](https://thehackernews.com/2022/04/fbi-shut-down-russia-linked-cyclops.html) - - [VMware Releases Critical Patches for New Vulnerabilities Affecting Multiple Products](https://thehackernews.com/2022/04/vmware-releases-critical-patches-for.html) - - [Ukraine Warns of Cyber attack Aiming to Hack Users' Telegram Messenger Accounts](https://thehackernews.com/2022/04/ukraine-warns-of-cyber-attack-aiming-to.html) -- Trend Micro Research, News and Perspectives - - [How to Optimize Your Lambda Code](https://www.trendmicro.com/en_us/devops/22/d/optimize-lambda-code.html) - - [TM Named CWS "Strong Performer" in Forrester Wave 2022](https://www.trendmicro.com/en_us/research/22/d/cloud-workload-security-cws-forrester-wave-2022.html) - - [TM Named CWS "Strong Performer" by Research Firm](https://www.trendmicro.com/en_us/research/22/d/cloud-workload-security-cws-forrester-wave-2022.html) -- TorrentFreak - - [Bungie vs Fake DMCA Notices: Google Refuses to Hand Over User Data](https://torrentfreak.com/bungie-vs-fake-dmca-notices-google-refuses-to-hand-over-user-data-220407/) - - [1337x.to is Unreachable After Domain Name Expired (Updated)](https://torrentfreak.com/1337x-to-is-unreachable-after-domain-name-expired-220407/) -- Security Affairs - - [Colibri Loader employs clever persistence mechanism](https://securityaffairs.co/wordpress/129956/cyber-crime/colibri-loader-persistent-mechanism.html) - - [CVE-2022-22292 flaw could allow hacking of Samsung Android devices](https://securityaffairs.co/wordpress/129942/hacking/cve-2022-22292-hack-samsung-android-devices.html) - - [CVE-2022-0778 OpenSSL flaw affects multiple Palo Alto devices](https://securityaffairs.co/wordpress/129935/hacking/palo-alto-networks-devices-openssl-flaws.html) - - [VMware addressed several critical vulnerabilities in multiple products](https://securityaffairs.co/wordpress/129906/security/vmware-critical-flaws-2.html) -- Deeplinks - - [The Catalog of Carceral Surveillance: Tablet Advertising That Can Also Issue Discipline](https://www.eff.org/deeplinks/2022/04/catalog-carceral-surveillance-tablet-advertising-can-also-issue-discipline) - - [Brighter Stars and Persistent Gaps Mark New Paraguay’s “Who Defends Your Data” Report](https://www.eff.org/deeplinks/2022/04/brighter-stars-and-persistent-gaps-mark-new-paraguays-who-defends-your-data-report) -- KitPloit - PenTest Tools! - - [Octosuite - Advanced Github OSINT Framework](http://www.kitploit.com/2022/04/octosuite-advanced-github-osint.html) - - [Gitbleed_Tools - For Extracting Data From Mirrorred Git Repositories](http://www.kitploit.com/2022/04/gitbleedtools-for-extracting-data-from.html) -- Troy Hunt's Blog - - [Welcoming the Serbian Government to Have I Been Pwned](https://www.troyhunt.com/welcoming-the-serbian-government-to-have-i-been-pwned/) -- Threatpost - - [SSRF Flaw in Fintech Platform Allowed for Compromise of Bank Accounts](https://threatpost.com/ssrf-flaw-fintech-bank-accounts/179247/) - - [MacOS Malware: Myth vs. Truth – Podcast](https://threatpost.com/macos-malware-myth-vs-truth-podcast/179215/) -- Krebs on Security - - [Actions Target Russian Govt. Botnet, Hydra Dark Market](https://krebsonsecurity.com/2022/04/actions-target-russian-govt-botnet-hydra-dark-market/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [PCI DSS v4.0 Resource Hub](https://www.reddit.com/r/netsecstudents/comments/tygp4o/pci_dss_v40_resource_hub/) - - [Very odd question but I’m new and need some help ( not about general hacking)](https://www.reddit.com/r/netsecstudents/comments/tyk4i4/very_odd_question_but_im_new_and_need_some_help/) - - [How to send similar payload to different http headers?](https://www.reddit.com/r/netsecstudents/comments/ty0ha1/how_to_send_similar_payload_to_different_http/) -- Dark Reading - - [Mandiant to Use CrowdStrike Technology in Its Incident Response Services](https://www.darkreading.com/attacks-breaches/mandiant-will-use-crowdstrike-technology-for-incident-response-services) - - [SeeMetrics to Help CISOs Measure Security Success](https://www.darkreading.com/dr-tech/seemetrics-to-help-cisos-measure-security-success) - - [BlackCat Purveyor Shows Ransomware Operators Have Nine Lives](https://www.darkreading.com/attacks-breaches/blackcat-purveyor-shows-ransomware-operators-have-nine-lives) - - [Ukrainian Member of Notorious FIN7 Cybercrime Group Sentenced](https://www.darkreading.com/threat-intelligence/ukrainian-member-of-notorious-fin7-cybercrime-group-sentenced) - - [Scan This: There's Danger in QR Codes](https://www.darkreading.com/omdia/scan-this-there-s-danger-in-qr-codes) - - [Top Application Security Mitigations in Q1 of 2022](https://www.darkreading.com/attacks-breaches/top-application-security-mitigations-in-q1-of-2022) - - [Nord Security Raises First Outside Capital at $1.6B Valuation](https://www.darkreading.com/remote-workforce/nord-security-raises-first-outside-capital-at-1-6b-valuation) - - [Keysight Delivers Zero Trust Test Solution](https://www.darkreading.com/cloud/keysight-delivers-zero-trust-test-solution) - - [Blumira Unveils Cloud SIEM With Integrated Detection and Response for SMBs](https://www.darkreading.com/cloud/blumira-unveils-cloud-siem-with-integrated-detection-and-response-for-smbs) - - [The Blurring Line, and Growing Risk, Between Physical and Digital Supply Chains](https://www.darkreading.com/risk/the-blurring-line-and-growing-risk-between-physical-and-digital-supply-chains) - - [BeyondTrust Announces CEO Transition](https://www.darkreading.com/endpoint/beyondtrust-announces-ceo-transition) -- Hacking and security - - [7. SECURITATEA SERVICIILOR ÎN INTERNET](https://hackingandsecurity.blogspot.com/2022/04/7-securitatea-serviciilor-in-internet.html) -- Paul's Security Weekly - - [PSW #735 - Sean Metcalf & Jay Beale](http://podcast.securityweekly.com/psw-735-sean-metcalf-jay-beale) - - [BSW #257 - Jonathan Gohstand](http://podcast.securityweekly.com/bsw-257-jonathan-gohstand) diff --git a/archive/2022/2022-04-11.md b/archive/2022/2022-04-11.md deleted file mode 100644 index ebf205e96e..0000000000 --- a/archive/2022/2022-04-11.md +++ /dev/null @@ -1,52 +0,0 @@ -# 每日安全资讯（2022-04-11） - -- Security Boulevard - - [Purdue University’s CERIAS 2022 Security Seminars – Virginia Tech’s Chen-Ching Liu’s ‘Cyber-Physical System Security Of The Power Grid’](https://securityboulevard.com/2022/04/purdue-universitys-cerias-2022-security-seminars-virginia-techs-chen-ching-lius-cyber-physical-system-security-of-the-power-grid/) - - [XKCD ‘Frankenstein Captcha’](https://securityboulevard.com/2022/04/xkcd-frankenstein-captcha/) - - [Purdue University’s CERIAS 2022 Security Seminars – Bob Gourley’s ‘The Metaverse: Infinite Attack Surface And Boundless Risk’](https://securityboulevard.com/2022/04/purdue-universitys-cerias-2022-security-seminars-bob-gourleys-the-metaverse-infinite-attack-surface-and-boundless-risk/) - - [A Lesson in (InfoSec Compliance Data) History | Blog by anecdotes](https://securityboulevard.com/2022/04/a-lesson-in-infosec-compliance-data-history-blog-by-anecdotes/) - - [Storytelling For Startups: Reach Your Prospects Heart | anecdotes](https://securityboulevard.com/2022/04/storytelling-for-startups-reach-your-prospects-heart-anecdotes/) - - [Scale Your Growth with a Comprehensive Compliance Program | anecdotes](https://securityboulevard.com/2022/04/scale-your-growth-with-a-comprehensive-compliance-program-anecdotes/) - - [How to Push a Massive Architectural Change | anecdotes](https://securityboulevard.com/2022/04/how-to-push-a-massive-architectural-change-anecdotes/) -- SecWiki News - - [SecWiki News 2022-04-10 Review](http://www.sec-wiki.com/?2022-04-10) -- MaskRay - - [Unwinding through a signal handler](https://maskray.me/blog/2022-04-10-unwinding-through-signal-handler) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [对高通Adreno GPU处理器的攻击研究](https://www.4hou.com/posts/rVwK) - - [微软：多个.NET框架版本4月底将不再支持](https://www.4hou.com/posts/7VPj) -- ふるつき - - [Plaid CTF 2022 pressure writeup](https://furutsuki.hatenablog.com/entry/2022/04/10/184118) -- KitPloit - PenTest & Hacking Tools - - [LDAP shell - AD ACL Abuse](http://www.kitploit.com/2022/04/ldap-shell-ad-acl-abuse.html) - - [Poro - Scan Publicly Accessible Assets On Your AWS Cloud Environment](http://www.kitploit.com/2022/04/poro-scan-publicly-accessible-assets-on.html) -- 博客园 - 飘渺红尘✨ - - [sql注入条件判断bypass系列 - 飘渺红尘✨](https://www.cnblogs.com/piaomiaohongchen/p/16128213.html) -- HAHWUL - - [[Cullinan #31] Add Six, Update Two 🪴](https://www.hahwul.com/2022/04/11/cullinan-31/) -- daniel.haxx.se - - [msh3 as the third h3 backend](https://daniel.haxx.se/blog/2022/04/10/msh3-as-the-third-h3-backend/) -- Il Disinformatico - - [Thunderbird fa le bizze con Gmail? Questione di cookie. E bisogna prepararsi al 30 maggio](http://attivissimo.blogspot.com/2022/04/thunderbird-fa-le-bizze-con-gmail.html) -- 黑海洋 - WIKI - - [IP Tools v8.27_Build_359解锁内购去广告版 （安卓）](https://blog.upx8.com/2688) - - [文件蜈蚣-支持迅雷、磁链、BT的全能下载工具可替代迅雷](https://blog.upx8.com/2687) -- 奇客Solidot–传递最新科技情报 - - [Google 将 AI 写作视为自动生成内容](https://www.solidot.org/story?sid=71200) - - [科学家发掘出小行星撞击地球时的恐龙化石](https://www.solidot.org/story?sid=71199) - - [鲁莽的俄罗斯士兵在污染最严重的区域挖战壕](https://www.solidot.org/story?sid=71198) -- Arturo Di Corinto - - [“Siamo sotto attacco degli hacker”. Il Mite spegne tutti i computer](https://dicorinto.it/testate/repubblica-it/siamo-sotto-attacco-degli-hacker-il-mite-spegne-tutti-i-computer/) -- KitPloit - PenTest Tools! - - [LDAP shell - AD ACL Abuse](http://www.kitploit.com/2022/04/ldap-shell-ad-acl-abuse.html) - - [Poro - Scan Publicly Accessible Assets On Your AWS Cloud Environment](http://www.kitploit.com/2022/04/poro-scan-publicly-accessible-assets-on.html) -- Security Affairs - - [Apr 03 – Apr 09 Ukraine – Russia the silent cyber conflict](https://securityaffairs.co/wordpress/130057/cyber-warfare-2/apr-03-apr-09-ukraine-russia-cyber-conflict.html) - - [NB65 group targets Russia with a modified version of Conti’s ransomware](https://securityaffairs.co/wordpress/130051/hacktivism/nb65-modified-version-conti-ransomware.html) - - [Security Affairs newsletter Round 360 by Pierluigi Paganini](https://securityaffairs.co/wordpress/130046/breaking-news/security-affairs-newsletter-round-360-by-pierluigi-paganini.html) - - [Facebook blocked Russia and Belarus threat actors’ activity against Ukraine](https://securityaffairs.co/wordpress/130037/cyber-warfare-2/facebook-block-russia-belarus-against-ukraine.html) -- TorrentFreak - - [Popular Torrent Site Lists MPA’s Content Protection Chief as Owner](https://torrentfreak.com/popular-torrent-site-lists-mpas-content-protection-chief-as-owner-220410/) -- The Hacker News - - [Chinese Hacker Groups Continue to Target Indian Power Grid Assets](https://thehackernews.com/2022/04/chinese-hacker-groups-continue-to.html) - - [Microsoft Obtains Court Order to Take Down Domains Used to Target Ukraine](https://thehackernews.com/2022/04/microsoft-obtains-court-order-to-take.html) diff --git a/archive/2022/2022-04-12.md b/archive/2022/2022-04-12.md deleted file mode 100644 index 7492965843..0000000000 --- a/archive/2022/2022-04-12.md +++ /dev/null @@ -1,232 +0,0 @@ -# 每日安全资讯（2022-04-12） - -- Sec-News 安全文摘 - - [In the land of PHP you will always be (use-after-)free](https://wiki.ioin.in/url/YDMo) - - [从零开始，分析Spring Framework RCE](https://wiki.ioin.in/url/bkdo) - - [CVE-2022-22954 VMware Workspace ONE Access SSTI漏洞](https://wiki.ioin.in/url/Eo6j) -- HackerOne Hacker Activity - - [[Python]: Add Server-side Request Forgery sinks](https://hackerone.com/reports/1538144) -- Blog & What's New | Offensive Security - - [IRQLs Close Encounters of the Rootkit Kind](https://www.offensive-security.com/offsec/irqls-close-encounters/) -- Security Boulevard - - [Accept All Cookies | Avast](https://securityboulevard.com/2022/04/accept-all-cookies-avast/) - - [Time to Lock Down Identity Management Strategies](https://securityboulevard.com/2022/04/time-to-lock-down-identity-management-strategies/) - - [Decoding Zero Trust Marketing With Appgate’s Chief Marketing Officer](https://securityboulevard.com/2022/04/decoding-zero-trust-marketing-with-appgates-chief-marketing-officer/) - - [BSides Budapest 2021: Assaf Sion’s ‘Hunting Bugs In JavaScriptCore With CodeQL’](https://securityboulevard.com/2022/04/bsides-budapest-2021-assaf-sions-hunting-bugs-in-javascriptcore-with-codeql/) - - [5 Things to Consider When Buying A Security Awareness Training Program in 2022](https://securityboulevard.com/2022/04/5-things-to-consider-when-buying-a-security-awareness-training-program-in-2022/) - - [What Is Biometric Authentication?](https://securityboulevard.com/2022/04/what-is-biometric-authentication/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 376’](https://securityboulevard.com/2022/04/robert-m-lees-jeff-haas-little-bobby-comic-week-376/) - - [Orgs Increase Focus on Automating Access Control Management](https://securityboulevard.com/2022/04/orgs-increase-focus-on-automating-access-control-management/) - - [Pandemic Two Years On: The Security Challenge of Hybrid Working](https://securityboulevard.com/2022/04/pandemic-two-years-on-the-security-challenge-of-hybrid-working/) - - [Why the Full Vulnerability Intelligence Picture Depends on Data Beyond CVE/NVD](https://securityboulevard.com/2022/04/why-the-full-vulnerability-intelligence-picture-depends-on-data-beyond-cve-nvd/) -- Microsoft Security Blog - - [Learn the latest cybersecurity techniques at the Microsoft Security Summit](https://www.microsoft.com/security/blog/2022/04/11/learn-the-latest-cybersecurity-techniques-at-the-microsoft-security-summit/) -- 跳跳糖 - 安全与分享社区 - - [从零开始，分析Spring Framework RCE](https://tttang.com/archive/1532/) -- SecWiki News - - [SecWiki News 2022-04-11 Review](http://www.sec-wiki.com/?2022-04-11) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5374-1](https://packetstormsecurity.com/files/166693/USN-5374-1.txt) - - [Red Hat Security Advisory 2022-1306-01](https://packetstormsecurity.com/files/166691/RHSA-2022-1306-01.txt) - - [Windows User Profile Service Privlege Escalation](https://packetstormsecurity.com/files/166692/cve_2022_26904_superprofile.rb.txt) - - [Ubuntu Security Notice USN-5373-2](https://packetstormsecurity.com/files/166690/USN-5373-2.txt) - - [Haveged 1.9.18](https://packetstormsecurity.com/files/166689/haveged-1.9.18.tar.gz) - - [Red Hat Security Advisory 2022-1305-01](https://packetstormsecurity.com/files/166688/RHSA-2022-1305-01.txt) - - [Ansible Quick Shot Red Teaming Cheatsheet](https://packetstormsecurity.com/files/166687/Ansible-QuickShot.pdf) - - [Ubuntu Security Notice USN-5373-1](https://packetstormsecurity.com/files/166686/USN-5373-1.txt) - - [Red Hat Security Advisory 2022-1301-01](https://packetstormsecurity.com/files/166685/RHSA-2022-1301-01.txt) - - [Razer Sila 2.0.418 Command Injection](https://packetstormsecurity.com/files/166684/razersila20418-exec.txt) - - [Razer Sila 2.0.418 Local File Inclusion](https://packetstormsecurity.com/files/166683/razersila20418-lfi.txt) - - [Red Hat Security Advisory 2022-1303-01](https://packetstormsecurity.com/files/166682/RHSA-2022-1303-01.txt) - - [Red Hat Security Advisory 2022-1302-01](https://packetstormsecurity.com/files/166681/RHSA-2022-1302-01.txt) - - [WordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting](https://packetstormsecurity.com/files/166680/wpamsbff-xss.txt) - - [WordPress LayerSlider Cross Site Scripting](https://packetstormsecurity.com/files/166679/wplayerslider-xss.txt) - - [Ubuntu Security Notice USN-5331-2](https://packetstormsecurity.com/files/166678/USN-5331-2.txt) - - [Red Hat Security Advisory 2022-1296-01](https://packetstormsecurity.com/files/166677/RHSA-2022-1296-01.txt) - - [Red Hat Security Advisory 2022-1297-01](https://packetstormsecurity.com/files/166676/RHSA-2022-1297-01.txt) - - [Telesquare TLR-2855KS6 Arbitrary File Deletion](https://packetstormsecurity.com/files/166675/telesquaretlr2855ks6-filedelete.txt) - - [Telesquare TLR-2855KS6 Arbitrary File Creation](https://packetstormsecurity.com/files/166674/telesquaretlr2855ks6-filecreate.txt) - - [Red Hat Security Advisory 2022-1299-01](https://packetstormsecurity.com/files/166673/RHSA-2022-1299-01.txt) - - [Red Hat Security Advisory 2022-1291-01](https://packetstormsecurity.com/files/166672/RHSA-2022-1291-01.txt) - - [Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 Local File Inclusion](https://packetstormsecurity.com/files/166671/ffsccm18198580-lfi.txt) - - [SAM SUNNY TRIPOWER 5.0 Insecure Direct Object Reference](https://packetstormsecurity.com/files/166670/sst50-idor.txt) - - [Red Hat Security Advisory 2022-1162-01](https://packetstormsecurity.com/files/166669/RHSA-2022-1162-01.txt) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [构建中国数字安全生态，ISC十周年系列评选征集重磅开启](https://www.4hou.com/posts/DWmn) - - [Purple Fox 通过改进其武器库又开始了新一波的攻击](https://www.4hou.com/posts/vLVm) - - [雾帜智能完成近亿元Pre-A轮融资，领跑中国SOAR安全运营](https://www.4hou.com/posts/B9kJ) - - [俄乌冲突隐形网络战场启示录 | 网络安全技术革新迫在眉睫](https://www.4hou.com/posts/rVAE) - - [安全快报 | 美国国土安全部负责人表示，海事部门缺乏网络安全](https://www.4hou.com/posts/w7GR) - - [诈骗多发！谨慎接听“00”或“+”开头的境外来电！教你防护小妙招](https://www.4hou.com/posts/vLEm) - - [远程办公场景下 企业网络安全如何保障？](https://www.4hou.com/posts/zYL8) -- Envato Tuts+ Code - Mobile Development - - [Kotlin From Scratch: Variables, Basic Types, and Arrays](https://code.tutsplus.com/tutorials/kotlin-from-scratch-variables-basic-types-arrays-type-inference-and-comments--cms-29328) -- 安全脉搏 - - [常见6种WAF绕过和防护原理](https://www.secpulse.com/archives/176763.html) - - [记一次从后门开展的应急响应溯源](https://www.secpulse.com/archives/176748.html) - - [对某站点的一次详尽渗透记录](https://www.secpulse.com/archives/176713.html) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [ICT Protege GX/WX 2.08 Stored Cross-Site Scripting (XSS)](https://cxsecurity.com/issue/WLB-2022040046) - - [WordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022040045) - - [Razer Sila 2.0.418 Command Injection](https://cxsecurity.com/issue/WLB-2022040044) - - [Razer Sila 2.0.418 Local File Inclusion](https://cxsecurity.com/issue/WLB-2022040043) - - [Telesquare TLR-2855KS6 Arbitrary File Deletion](https://cxsecurity.com/issue/WLB-2022040042) - - [Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 Local File Inclusion](https://cxsecurity.com/issue/WLB-2022040041) - - [SAM SUNNY TRIPOWER 5.0 Insecure Direct Object Reference](https://cxsecurity.com/issue/WLB-2022040040) -- XPN InfoSec Blog - - [NTLMquic](https://blog.xpnsec.com/ntlmquic/) -- XPN InfoSec Blog - - [NTLMquic](https://blog.xpnsec.com/ntlmquic/) -- blog.avast.com EN - - [Accept All Cookies | Avast](https://blog.avast.com/acceptallcookies) -- Software Integrity Blog - - [CyRC Vulnerability Advisory: Stored XSS in Directus](https://www.synopsys.com/blogs/software-security/cyrc-advisory-directus-xss/) -- 安全客-有思想的安全新媒体 - - [分析国外几款主流蜜罐产品看欺骗诱捕技术的应用脉络](https://www.anquanke.com/post/id/271553) - - [安全事件周报 (04-04 ~ 04-10)](https://www.anquanke.com/post/id/271666) - - [新发现的恶意软件 以具有加密矿工的AWS Lambda 为目标](https://www.anquanke.com/post/id/271597) - - [4月11日每日安全热点 - 黑客组织ATW称入侵奢侈品公司Dior](https://www.anquanke.com/post/id/271691) -- SentinelOne - - [Reduce Risk with Unified XDR and Cyber Asset Management](https://www.sentinelone.com/blog/reduce-risk-with-unified-xdr-and-cyber-asset-management/) -- The Daily Swig | Cybersecurity news and views - - [Access control vulnerability in Easy!Appointments platform exposed sensitive personal data](https://portswigger.net/daily-swig/access-control-vulnerability-in-easy-appointments-platform-exposed-sensitive-personal-data) - - [Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware](https://portswigger.net/daily-swig/attackers-are-abusing-spring4shell-vulnerability-to-spread-mirai-botnet-malware) - - [PacketStreamer: New tool can aid research by revealing potential hacking behaviors](https://portswigger.net/daily-swig/packetstreamer-new-tool-can-aid-research-by-revealing-potential-hacking-behaviors) -- Exploit-DB.com RSS Feed - - [[webapps] Razer Sila - Command Injection](https://www.exploit-db.com/exploits/50865) - - [[webapps] Razer Sila - Local File Inclusion (LFI)](https://www.exploit-db.com/exploits/50864) - - [[webapps] Telesquare TLR-2855KS6 - Arbitrary File Deletion](https://www.exploit-db.com/exploits/50863) - - [[webapps] Telesquare TLR-2855KS6 - Arbitrary File Creation](https://www.exploit-db.com/exploits/50862) - - [[remote] Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)](https://www.exploit-db.com/exploits/50861) - - [[webapps] SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)](https://www.exploit-db.com/exploits/50860) - - [[local] MiniTool Partition Wizard - Unquoted Service Path](https://www.exploit-db.com/exploits/50859) -- hn security - - [Semgrep ruleset for C/C++ vulnerability research](https://security.humanativaspa.it/semgrep-ruleset-for-c-c-vulnerability-research/) -- Bug Bounty in InfoSec Write-ups on Medium - - [SVG SSRFs and saga of bypasses](https://infosecwriteups.com/svg-ssrfs-and-saga-of-bypasses-777e035a17a7?source=rss----7b722bfd1b8d--bug_bounty) - - [Complete Guide To Start Bug Bounty In 2022](https://infosecwriteups.com/complete-guide-to-start-bug-bounty-in-2022-5036630e5d98?source=rss----7b722bfd1b8d--bug_bounty) -- KitPloit - PenTest & Hacking Tools - - [EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers](http://www.kitploit.com/2022/04/evilselenium-tool-that-weaponizes.html) - - [Wholeaked - A File-Sharing Tool That Allows You To Find The Responsible Person In Case Of A Leakage](http://www.kitploit.com/2022/04/wholeaked-file-sharing-tool-that-allows.html) -- Hacking Articles - - [A Detailed Guide on AMSI Bypass](https://www.hackingarticles.in/a-detailed-guide-on-amsi-bypass/) -- text/plain - - [Real-World Running](https://textslashplain.com/2022/04/11/real-world-running/) -- 绿盟科技技术博客 - - [去中心化Web，Web3流派二 ——Web3简析系列（3）](http://blog.nsfocus.net/%e5%8e%bb%e4%b8%ad%e5%bf%83%e5%8c%96web%ef%bc%8cweb3%e6%b5%81%e6%b4%be%e4%ba%8c-web3%e7%ae%80%e6%9e%90%e7%b3%bb%e5%88%97%ef%bc%883%ef%bc%89/) - - [绿盟科技威胁周报（20220404-20220410）](http://blog.nsfocus.net/weekly-20220404/) -- Data Breach - - [SuperCare Health discloses a data breach that Impacted +300K people](https://securityaffairs.co/wordpress/130089/data-breach/supercare-health-data-breach.html) -- 博客园 - 郑瀚Andrew.Hann - - [《居危思危：国家安全与乡村治理》笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16115209.html) -- 奇客Solidot–传递最新科技情报 - - [数据显示 PC 出货量同比下滑 5.1%](https://www.solidot.org/story?sid=71213) - - [《刺猬索尼克2》创造游戏改编电影的票房记录](https://www.solidot.org/story?sid=71212) - - [国家新闻出版署批准新游戏版号](https://www.solidot.org/story?sid=71211) - - [当人脸识别走进战场](https://www.solidot.org/story?sid=71210) - - [人工指尖赋予机器人近乎人类的触感](https://www.solidot.org/story?sid=71209) - - [日产与 NASA 合作在固态电池中摒弃稀有昂贵金属](https://www.solidot.org/story?sid=71208) - - [长大的地方可能会影响导航能力](https://www.solidot.org/story?sid=71207) - - [蓬勃发展的航天工业引发低轨道安全担忧](https://www.solidot.org/story?sid=71206) - - [黑客使用泄露的勒索软件攻击俄罗斯公司](https://www.solidot.org/story?sid=71205) - - [防疫措施进一步破坏全球供应链](https://www.solidot.org/story?sid=71204) - - [最大儿童色情网站如何倒下](https://www.solidot.org/story?sid=71203) - - [IMF 研究称加密货币在腐败国家更流行](https://www.solidot.org/story?sid=71202) - - [太阳黑子活动超过预期](https://www.solidot.org/story?sid=71201) -- 安全牛 - - [提升基础软件安全防护能力 UOS主动安全防护计划(UAPP)发布会即将开启](https://www.aqniu.com/activity-meeting/82465.html) - - [守住你的“钱袋子”！亚信安全信舷WAF助力金融科技(FinTech)安全能力提升](https://www.aqniu.com/industry/82462.html) - - [六方云勒索病毒解决方案重磅发布（附PDF下载）](https://www.aqniu.com/vendor/82457.html) - - [揭秘：员工行为感知就是UEBA吗](https://www.aqniu.com/industry/82443.html) - - [10款开源又好用的Linux安全工具](https://www.aqniu.com/industry/82440.html) - - [如何在勒索软件攻击爆发前发现“苗头”？](https://www.aqniu.com/industry/82436.html) - - [3项信息安全技术国家标准公开征求意见](https://www.aqniu.com/industry/82433.html) -- 黑海洋 - WIKI - - [互联网大厂的负载均衡解决方案](https://blog.upx8.com/2689) -- FreeBuf网络安全行业门户 - - [工信部等五部门印发《关于进一步加强新能源汽车企业安全体系建设的指导意见》](https://www.freebuf.com/news/328326.html) - - [黑客组织NB65用改进版的Conti勒索软件攻击俄罗斯](https://www.freebuf.com/news/328320.html) - - [匿名者伙同乌克兰 IT 军团，继续攻击俄罗斯实体](https://www.freebuf.com/news/328321.html) - - [Facebook 阻止了俄罗斯与白俄罗斯针对乌克兰的网络攻击](https://www.freebuf.com/articles/328319.html) - - [黑客利用Spring4Shell漏洞部署Mirai恶意软件](https://www.freebuf.com/news/328316.html) - - [借壳防病毒软件，SharkBot银行木马在Google Play传播](https://www.freebuf.com/news/328303.html) -- bellingcat - - [France Targeted ‘Terrorists’ with a US-Made Bomb in Mali. Witnesses Say They Hit a Wedding](https://www.bellingcat.com/news/africa/2022/04/11/france-targeted-terrorists-with-a-us-made-bomb-in-mali-witnesses-say-they-hit-a-wedding/) -- Securityinfo.it - - [GitHub può avvisare di bug supply chain nelle nuove dipendenze](https://www.securityinfo.it/2022/04/11/github-puo-avvisare-di-bug-supply-chain-nelle-nuove-dipendenze/?utm_source=rss&utm_medium=rss&utm_campaign=github-puo-avvisare-di-bug-supply-chain-nelle-nuove-dipendenze) - - [Mirai usa Spring4Shell per attacchi DDoS](https://www.securityinfo.it/2022/04/11/mirai-usa-spring4shell-per-attacchi-ddos/?utm_source=rss&utm_medium=rss&utm_campaign=mirai-usa-spring4shell-per-attacchi-ddos) -- ICT Security Magazine - - [Cyber security awareness: per 7Layers sono fondamentali consapevolezza e formazione](https://www.ictsecuritymagazine.com/notizie/cyber-security-awareness-per-7layers-sono-fondamentali-consapevolezza-e-formazione/) - - [Ransomware e finanza, i principali trend secondo l’Intelligence Finanziaria](https://www.ictsecuritymagazine.com/articoli/ransomware-e-finanza-i-principali-trend-secondo-lintelligence-finanziaria/) -- SANS Internet Storm Center, InfoCON: green - - [Spring: It isn't just about Spring4Shell. Spring Cloud Function Vulnerabilities are being probed too., (Mon, Apr 11th)](https://isc.sans.edu/diary/rss/28538) - - [ISC Stormcast For Monday, April 11th, 2022 https://isc.sans.edu/podcastdetail.html?id=7958, (Mon, Apr 11th)](https://isc.sans.edu/diary/rss/28536) -- IT Service Management News - - [Guida per le PMI per la sicurezza e la privacy](http://blog.cesaregallotti.it/2022/04/guida-per-le-pmi-per-la-sicurezza-e-la.html) -- Troy Hunt's Blog - - [Welcoming the North Macedonian Government to Have I Been Pwned](https://www.troyhunt.com/welcoming-the-north-macedonian-government-to-have-i-been-pwned/) -- The Hacker News - - [Researchers warn of FFDroider and Lightning info-stealers targeting users in the wild](https://thehackernews.com/2022/04/researchers-warn-of-ffdroider-and.html) - - [Microsoft's New Autopatch Feature to Help Businesses Keep Their Systems Up-to-Date](https://thehackernews.com/2022/04/microsofts-new-autopatch-feature-to.html) - - [Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai Botnet Malware](https://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html) -- Krebs on Security - - [Double-Your-Crypto Scams Share Crypto Scam Host](https://krebsonsecurity.com/2022/04/double-your-crypto-scams-share-crypto-scam-host/) -- TorrentFreak - - [Piracy Numbers Drop After Indonesia Blocks Over 3,500 Pirate Sites](https://torrentfreak.com/piracy-numbers-drop-after-indonesia-blocks-over-3500-pirate-sites-220411/) - - [ACE Finally Seizes Pirate Streaming Domains After Years of Legal Action](https://torrentfreak.com/ace-finally-seizes-pirate-streaming-domains-after-years-of-legal-action-220411/) -- HACKMAGEDDON - - [16-31 March 2022 Cyber Attacks Timeline](https://www.hackmageddon.com/2022/04/11/16-31-march-2022-cyber-attacks-timeline/) -- /r/netsec - Information Security News & Discussion - - [AWS RDS Vulnerability Leads to AWS Internal Service Credentials](https://www.reddit.com/r/netsec/comments/u1kgfw/aws_rds_vulnerability_leads_to_aws_internal/) - - [Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai Botnet Malware. This is far from the first time the botnet operators have quickly added newly publicized flaws to their exploit toolset. last year, multiple botnets were uncovered leveraging the Log4Shell to breach susceptible servers.](https://www.reddit.com/r/netsec/comments/u105k8/hackers_exploiting_spring4shell_vulnerability_to/) - - [CI/CD Goat - A deliberately vulnerable CI/CD environment (CTF)](https://www.reddit.com/r/netsec/comments/u16q1e/cicd_goat_a_deliberately_vulnerable_cicd/) - - [Semgrep ruleset for C/C++ vulnerability research](https://www.reddit.com/r/netsec/comments/u1362l/semgrep_ruleset_for_cc_vulnerability_research/) -- Blackhat Library: Hacking techniques and research - - [AdRotate Banner Manager Vulnerabilities - Patchstack](https://www.reddit.com/r/blackhat/comments/u1irsl/adrotate_banner_manager_vulnerabilities_patchstack/) - - [Polyglots: The Ultimate XSS Payloads](https://www.reddit.com/r/blackhat/comments/u18mhj/polyglots_the_ultimate_xss_payloads/) - - [Cross-Site Scripting (XSS) Cheat Sheet - 2022 Edition | Web Security Academy](https://www.reddit.com/r/blackhat/comments/u11bjl/crosssite_scripting_xss_cheat_sheet_2022_edition/) -- Threatpost - - [Microsoft Takes Down Domains Used in Cyberattack Against Ukraine](https://threatpost.com/microsoft-takedown-domains-ukraine/179257/) -- Dark Reading - - [Google, GitHub Collaboration Focuses on Securing Code Build Processes](https://www.darkreading.com/dr-tech/google-github-collaboration-focuses-on-securing-code-build-processes) - - [Former DHS Acting IT Chief Convicted in Software, Database Theft Scheme](https://www.darkreading.com/attacks-breaches/former-dhs-acting-it-chief-convicted-in-software-database-theft-scheme) - - [In Appreciation: Mike Murray](https://www.darkreading.com/vulnerabilities-threats/in-appreciation-mike-murray) - - [Imprivata Acquires SecureLink to Deliver a Single-Vendor Platform to Manage and Secure All Enterprise and Third-Party Digital Identities](https://www.darkreading.com/operations/imprivata-acquires-securelink-to-deliver-a-single-vendor-platform-to-manage-and-secure-all-enterprise-and-third-party-digital-identities) - - [SafeGuard Cyber Provides Security Advice for Defending Against Browser-in-the-Browser (BitB) Attacks](https://www.darkreading.com/cloud/safeguard-cyber-provides-security-advice-for-defending-against-browser-in-the-browser-bitb-attacks) - - [10 Signs of a Good Security Leader](https://www.darkreading.com/edge-articles/10-signs-of-a-good-security-leader) - - [Creating a Security Culture Where People Can Admit Mistakes](https://www.darkreading.com/remote-workforce/creating-a-security-culture-where-people-can-admit-mistakes) - - [Going Passwordless? Here Are 6 Steps to Get Started](https://www.darkreading.com/operations/going-passwordless-here-s-6-steps-to-get-started) -- Schneier on Security - - [De-anonymizing Bitcoin](https://www.schneier.com/blog/archives/2022/04/de-anonymizing-bitcoin.html) -- Computer Forensics - - [Windows Hibernation Files - A Look Back in Time](https://www.reddit.com/r/computerforensics/comments/u166zj/windows_hibernation_files_a_look_back_in_time/) - - [Does anyone here have experience with the EnCase CFSR?](https://www.reddit.com/r/computerforensics/comments/u1ajt4/does_anyone_here_have_experience_with_the_encase/) - - [Windows 7 Vulnerable for MS17-010](https://www.reddit.com/r/computerforensics/comments/u17pa6/windows_7_vulnerable_for_ms17010/) - - [AccessData FTK Imager - Memory Capture Failed - Cannot Start Driver](https://www.reddit.com/r/computerforensics/comments/u0uwc8/accessdata_ftk_imager_memory_capture_failed/) -- KitPloit - PenTest Tools! - - [EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers](http://www.kitploit.com/2022/04/evilselenium-tool-that-weaponizes.html) - - [Wholeaked - A File-Sharing Tool That Allows You To Find The Responsible Person In Case Of A Leakage](http://www.kitploit.com/2022/04/wholeaked-file-sharing-tool-that-allows.html) -- The Register - Security - - [European officials reportedly targeted by NSO spyware](https://go.theregister.com/feed/www.theregister.com/2022/04/11/nso_spyware_eu/) - - [Attackers exploit Spring4Shell flaw to let loose the Mirai botnet](https://go.theregister.com/feed/www.theregister.com/2022/04/11/spring4shell-flaw-exploited-mirai-botnet/) - - [There are few guarantees when it comes to ransomware, except that you’re a target](https://go.theregister.com/feed/www.theregister.com/2022/04/11/there_are_few_guarantees_when/) - - [Identity access management has a new price: $6.9 billion](https://go.theregister.com/feed/www.theregister.com/2022/04/11/identity_access_management/) - - [Google Play pulls sneaky data-harvesting apps with 46m+ downloads](https://go.theregister.com/feed/www.theregister.com/2022/04/11/in_brief_security/) -- Your Hacking Tutorial by Zempirians - - [Full Repo to Advance Your Hacking Skills!](https://www.reddit.com/r/HowToHack/comments/u1j37e/full_repo_to_advance_your_hacking_skills/) - - [is there any equivalent alternative to parsehub for web scraping which is not pay to use?](https://www.reddit.com/r/HowToHack/comments/u146u5/is_there_any_equivalent_alternative_to_parsehub/) - - [Struggling to learn hacking through traditional means](https://www.reddit.com/r/HowToHack/comments/u1f8aw/struggling_to_learn_hacking_through_traditional/) - - [My team created a New Search Engines based on IP, Port](https://www.reddit.com/r/HowToHack/comments/u12t4k/my_team_created_a_new_search_engines_based_on_ip/) - - [help with bWAP](https://www.reddit.com/r/HowToHack/comments/u1clmh/help_with_bwap/) - - [What are network TAPS M2M gateways and modems for and how do they work?](https://www.reddit.com/r/HowToHack/comments/u1c1jy/what_are_network_taps_m2m_gateways_and_modems_for/) - - [Phishing Email received after I lost my phone](https://www.reddit.com/r/HowToHack/comments/u1bwfj/phishing_email_received_after_i_lost_my_phone/) - - [How can you look into custom file types from a game?](https://www.reddit.com/r/HowToHack/comments/u0xtrz/how_can_you_look_into_custom_file_types_from_a/) -- Security Affairs - - [Anonymous hacked Russia’s Ministry of Culture and leaked 446 GB](https://securityaffairs.co/wordpress/130106/hacktivism/anonymous-hacked-russia-ministry-of-culture.html) - - [FFDroider, a new information-stealing malware disguised as Telegram app](https://securityaffairs.co/wordpress/130094/cyber-crime/ffdroider-info-stealer.html) - - [SuperCare Health discloses a data breach that Impacted +300K people](https://securityaffairs.co/wordpress/130089/data-breach/supercare-health-data-breach.html) - - [Microsoft’s Autopatch feature improves the patch management process](https://securityaffairs.co/wordpress/130082/security/microsoft-autopatch-feature-patch-management.html) - - [Dependency Review GitHub Action prevents adding known flaws in the code](https://securityaffairs.co/wordpress/130067/security/dependency-review-github-action.html) - - [Securing Easy Appointments and earning CVE-2022-0482](https://securityaffairs.co/wordpress/130077/security/securing-easy-appointments-cve-2022-0482.html) -- Daniel Miessler - - [News & Analysis | NO. 326](https://danielmiessler.com/podcast/news-analysis-no-326/) diff --git a/archive/2022/2022-04-13.md b/archive/2022/2022-04-13.md deleted file mode 100644 index 1875c7e06a..0000000000 --- a/archive/2022/2022-04-13.md +++ /dev/null @@ -1,226 +0,0 @@ -# 每日安全资讯（2022-04-13） - -- Sec-News 安全文摘 - - [POC for VMWARE CVE-2022-22954](https://wiki.ioin.in/url/J4B4) -- Microsoft Security Blog - - [Tarrask malware uses scheduled tasks for defense evasion](https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/) -- SecWiki News - - [SecWiki News 2022-04-12 Review](http://www.sec-wiki.com/?2022-04-12) -- Trustwave Blog - - [Enhancing Your Operational Technology Resiliency](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/enhancing-your-operational-technology-resiliency/) -- paper - Last paper - - [DeFi Hack 通关学习](https://paper.seebug.org/1880/) -- Security Boulevard - - [Beware! It’s Not the IRS Texting, Emailing, or Calling You](https://securityboulevard.com/2022/04/beware-its-not-the-irs-texting-emailing-or-calling-you/) - - [VERT Threat Alert: April 2022 Patch Tuesday Analysis](https://securityboulevard.com/2022/04/vert-threat-alert-april-2022-patch-tuesday-analysis/) - - [Using Contrast Log Enhancers to help track down vulnerable Spring4Shell applications](https://securityboulevard.com/2022/04/using-contrast-log-enhancers-to-help-track-down-vulnerable-spring4shell-applications/) - - [IronNet’s April Threat Intelligence Brief 2022](https://securityboulevard.com/2022/04/ironnets-april-threat-intelligence-brief-2022/) - - [The Ultimate Guide to Vulnerability Management of Systems and Processes](https://securityboulevard.com/2022/04/the-ultimate-guide-to-vulnerability-management-of-systems-and-processes/) - - [BSides Budapest 2021: Filipi Pires’ ‘Keep Your Code Safe During the Development Path Using Opensource Tools’](https://securityboulevard.com/2022/04/bsides-budapest-2021-filipi-pires-keep-your-code-safe-during-the-development-path-using-opensource-tools/) - - [HelpSystems Acquires Terranova Security to Aid Global Customers in Building Localized Employee Security Awareness Training](https://securityboulevard.com/2022/04/helpsystems-acquires-terranova-security-to-aid-global-customers-in-building-localized-employee-security-awareness-training/) -- Tenable Blog - - [Microsoft’s April 2022 Patch Tuesday Addresses 117 CVEs (CVE-2022-24521)](https://www.tenable.com/blog/microsofts-april-2022-patch-tuesday-addresses-117-cves-cve-2022-24521) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-1309-01](https://packetstormsecurity.com/files/166703/RHSA-2022-1309-01.txt) - - [Red Hat Security Advisory 2022-1326-01](https://packetstormsecurity.com/files/166702/RHSA-2022-1326-01.txt) - - [Easy!Appointments Information Disclosure](https://packetstormsecurity.com/files/166701/easyappointment-disclose.txt) - - [Red Hat Security Advisory 2022-1324-01](https://packetstormsecurity.com/files/166700/RHSA-2022-1324-01.txt) - - [Red Hat Security Advisory 2022-1154-01](https://packetstormsecurity.com/files/166699/RHSA-2022-1154-01.txt) - - [Red Hat Security Advisory 2022-1329-01](https://packetstormsecurity.com/files/166698/RHSA-2022-1329-01.txt) - - [Instagram API Information Disclosure](https://packetstormsecurity.com/files/166697/instagramapi-disclose.pdf) - - [Red Hat Security Advisory 2022-1292-01](https://packetstormsecurity.com/files/166696/RHSA-2022-1292-01.txt) - - [Red Hat Security Advisory 2022-1153-01](https://packetstormsecurity.com/files/166695/RHSA-2022-1153-01.txt) - - [Explore CMS 1.0 SQL Injection](https://packetstormsecurity.com/files/166694/explorecms10-sql.txt) -- Sucuri Blog - - [Sucuri WordPress Plugin += Sucuri WAF](https://blog.sucuri.net/2022/04/sucuri-wordpress-plugin-sucuri-waf.html) -- Google Online Security Blog - - [How to SLSA Part 1 - The Basics](http://security.googleblog.com/2022/04/how-to-slsa-part-1-basics.html) -- Jiajun的编程随想 - - [使用PostgreSQL做搜索引擎](https://jiajunhuang.com/articles/2022_04_12-postgresql_fulltext_search.md.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [通过查找非权限进程中的泄漏句柄来查找权限升级和UAC](https://www.4hou.com/posts/5Kp8) - - [TeaBot 木马再次出现在 Google Play 商店](https://www.4hou.com/posts/gMoG) - - [三星手机被曝严重安全漏洞](https://www.4hou.com/posts/oXwK) - - [国内首款主机防勒索系统重磅发布](https://www.4hou.com/posts/MWy3) - - [零事故的背后：一道关乎北京冬奥的网络纵深防线](https://www.4hou.com/posts/LWx4) - - [【Rootkit系列研究】Rootkit检测技术发展现状](https://www.4hou.com/posts/ZrjJ) - - [404×千里目！「目极千里 洞见安全」安全技术沙龙第五期就差你了~](https://www.4hou.com/posts/GWp0) - - [女生考研频频被他人恶意修改志愿，疑因个人信息泄漏](https://www.4hou.com/posts/JWvo) - - [黑客对 FSIN 网站进行了 DDoS 攻击](https://www.4hou.com/posts/K9wn) -- obaby@mars - - [秀人集爬虫 【22.04.12】【Windows】【Mac M1】](http://h4ck.org.cn/2022/04/%e7%a7%80%e4%ba%ba%e9%9b%86%e7%88%ac%e8%99%ab-%e3%80%9022-04-12%e3%80%91%e3%80%90windows%e3%80%91/) - - [性感美女爬虫 Windows【22.04.12】](http://h4ck.org.cn/2022/04/%e6%80%a7%e6%84%9f%e7%be%8e%e5%a5%b3%e7%88%ac%e8%99%ab-windows%e3%80%9022-04-12%e3%80%91/) -- 安全脉搏 - - [安全应急漏洞排查思路](https://www.secpulse.com/archives/176858.html) - - [​【Rootkit系列研究】Windows平台高隐匿、高持久化威胁（二）](https://www.secpulse.com/archives/176838.html) - - [密码学的安全性浅析-4](https://www.secpulse.com/archives/176808.html) -- HackerOne Hacker Activity - - [Regular Expression Denial of Service vulnerability](https://hackerone.com/reports/1538157) - - [RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installed](https://hackerone.com/reports/1401444) -- Zdziarski - - [The Unique Stupidity of American Life](https://www.zdziarski.com/blog/?p=11232) -- 安全客-有思想的安全新媒体 - - [双平台挖矿僵尸网络Sysrv-hello加持新漏洞再度来袭](https://www.anquanke.com/post/id/271672) - - [CVE-2021-22214 GITLAB SSRF 未授权漏洞](https://www.anquanke.com/post/id/271555) - - [Mirai恶意软件利用Spring4Shell感染易受攻击的Web服务器](https://www.anquanke.com/post/id/271655) -- 跳跳糖 - 安全与分享社区 - - [ByteCodeDL原理篇之手把手教你实现污点分析](https://tttang.com/archive/1541/) -- root@cyberworld:~# Noah Lab - - [CVE-2022-21907 http协议远程代码执行漏洞分析总结](http://noahblog.360.cn/cve-2022-21907-httpxie-yi-yuan-cheng-dai-ma-zhi-xing-lou-dong-fen-xi-zong-jie/) - - [CVE-2021-34535 RDP客户端漏洞分析](http://noahblog.360.cn/cve-2021-34535-rdpke-hu-duan-lou-dong-fen-xi/) - - [CVE-2021-26432 NFS ONCRPC XDR 驱动协议远程代码执行漏洞验证过程](http://noahblog.360.cn/untitled-2/) -- Securelist - - [The State of Stalkerware in 2021](https://securelist.com/the-state-of-stalkerware-in-2021/106193/) -- Reverse Engineering - - [Step-by-step creation of a Ghidra script to handle stack strings](https://www.reddit.com/r/ReverseEngineering/comments/u1xoxh/stepbystep_creation_of_a_ghidra_script_to_handle/) - - [Software Reverse Engineering: Ripping Apart Bomb Binary](https://www.reddit.com/r/ReverseEngineering/comments/u1rljs/software_reverse_engineering_ripping_apart_bomb/) -- blog.avast.com EN - - [Impact of Self-Sovereign Identity on Cybersecurity | Avast](https://blog.avast.com/impact-of-self-sovereign-identity-on-cybersecurity) -- Software Integrity Blog - - [2022 OSSRA discovers 88% of organizations still behind in keeping open source updated](https://www.synopsys.com/blogs/software-security/open-source-trends-ossra-report/) -- KitPloit - PenTest & Hacking Tools - - [Maat - Open-source Symbolic Execution Framework](http://www.kitploit.com/2022/04/maat-open-source-symbolic-execution.html) - - [NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit](http://www.kitploit.com/2022/04/nimpackt-v1-nim-based-assembly-packer.html) -- HAHWUL - - [ZAP HUNT Remix](https://www.hahwul.com/2022/04/12/zap-hunt-remix/) -- Hacking Articles - - [Defense Evasion: Process Hollowing (Mitre:T1055.012)](https://www.hackingarticles.in/defense-evasion-process-hollowing-t1055-012/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 4/12/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-4-12-2022/) -- The Daily Swig | Cybersecurity news and views - - [Internal AWS credentials swiped by researcher via SQL payload](https://portswigger.net/daily-swig/internal-aws-credentials-swiped-by-researcher-via-sql-payload) - - [OpenSSH 9.0 bakes in post-quantum cryptography to future proof against attacks](https://portswigger.net/daily-swig/openssh-9-0-bakes-in-post-quantum-cryptography-to-future-proof-against-attacks) - - [TruffleHog v3: API key leak detection tool adds support for more than 600 types](https://portswigger.net/daily-swig/trufflehog-v3-api-key-leak-detection-tool-adds-support-for-more-than-600-types) -- 风雪之隅 - - [关于PHP，关于Realsee](https://www.laruence.com/2022/04/12/6089.html) -- 黑海洋 - WIKI - - [AI图片魔法消除工具离线版 图片自动内容填充识别](https://blog.upx8.com/2694) - - [苹果旧版应用下载辅助软件](https://blog.upx8.com/2693) - - [教你如何利用影藏功能偷偷给女朋友的Iphone加上定位](https://blog.upx8.com/2692) - - [上海防疫自救互助指南](https://blog.upx8.com/2691) - - [小鲸电视TV v1.2.5绿化版](https://blog.upx8.com/2690) -- Fortinet Threat Research Blog - - [Enemybot: A Look into Keksec's Latest DDoS Botnet](https://www.fortinet.com/blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet) -- 绿盟科技技术博客 - - [面向XDR的数据质量度量方法（一）](http://blog.nsfocus.net/xdr-data-1/) -- LuxSci - - [Increasing Operational Efficiency with Email Automation](https://luxsci.com/blog/increasing-operational-efficiency-with-email-automation.html) -- ICT Security Magazine - - [Security Service Edge: quattro principi fondamentali per il tuo percorso SASE](https://www.ictsecuritymagazine.com/notizie/security-service-edge-quattro-principi-fondamentali-per-il-tuo-percorso-sase/) -- Google Online Security Blog - - [How to SLSA Part 1 - The Basics](http://security.googleblog.com/2022/04/how-to-slsa-part-1-basics.html) -- 0x00sec - The Home of the Hacker - Top topics - - [Best degree if you want a career in cybersecurity?](https://0x00sec.org/t/best-degree-if-you-want-a-career-in-cybersecurity/28995) -- Il Disinformatico - - [DragonChase 2022: Si parte! Si rinvia!](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-si-parte.html) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 开源社区提倡加强路由安全性；新加坡实施严格的网络安全许可证制度](https://www.freebuf.com/news/328454.html) - - [恶意软件Mirai正积极利用Spring4Shell漏洞](https://www.freebuf.com/news/328447.html) - - [福克斯新闻在线曝光 1300 万条敏感记录](https://www.freebuf.com/news/328421.html) - - [美国VA增加超1亿的网络安全预算，着重落地零信任](https://www.freebuf.com/news/328415.html) - - [匿名者黑客组织入侵俄罗斯文化部并泄露446GB数据](https://www.freebuf.com/news/328408.html) - - [FreeBuf早报 | 微博等多平台公告打击涉疫谣言；开源平台npm抵制俄罗斯开发者](https://www.freebuf.com/news/328396.html) -- Schneier on Security - - [John Oliver on Data Brokers](https://www.schneier.com/blog/archives/2022/04/john-oliver-on-data-brokers.html) -- Securelist - - [The State of Stalkerware in 2021](https://securelist.com/the-state-of-stalkerware-in-2021/106193/) -- Securityinfo.it - - [Singapore richiede una licenza per fare penetration test](https://www.securityinfo.it/2022/04/12/singapore-richiede-una-licenza-per-fare-penetration-test/?utm_source=rss&utm_medium=rss&utm_campaign=singapore-richiede-una-licenza-per-fare-penetration-test) - - [Hacker usano il ransomware di Conti contro la Russia](https://www.securityinfo.it/2022/04/12/hacker-usano-il-ransomware-di-conti-contro-la-russia/?utm_source=rss&utm_medium=rss&utm_campaign=hacker-usano-il-ransomware-di-conti-contro-la-russia) -- SecurityCurrent - - [CISOs Connect™’s CISOs Top 100 CISOs (C100) 2022](https://youtu.be/YHgrcFvNsGk#new_tab) -- TorrentFreak - - [ACE Targets Flixtor ‘News’ Domain With a DMCA Subpoena](https://torrentfreak.com/ace-targets-flixtor-news-domain-with-a-dmca-subpoena-220412/) - - [Omi in a Hellcat Sued Again, This Time Over Pirate IPTV Brand ‘Reloaded’](https://torrentfreak.com/omi-in-a-hellcat-sued-again-this-time-over-pirate-iptv-brand-reloaded-220412/) -- Security Affairs - - [Microsoft Partch Tuesday for April 2022 fixed 10 critical vulnerabilities](https://securityaffairs.co/wordpress/130149/breaking-news/microsoft-partch-tuesday-april-2022.html) - - [Operation TOURNIQUET: Authorities shut down dark web marketplace RaidForums](https://securityaffairs.co/wordpress/130131/deep-web/authorities-shut-down-raidforums.html) - - [Russia-linked Sandworm APT targets energy facilities in Ukraine with wipers](https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html) - - [NGINX project maintainers fix flaws in LDAP Reference Implementation](https://securityaffairs.co/wordpress/130117/hacking/nginx-ldap-reference-implementation-bug.html) - - [CISA adds WatchGuard flaw to its Known Exploited Vulnerabilities Catalog](https://securityaffairs.co/wordpress/130112/security/cisa-watchguard-flaw-known-exploited-vulnerabilities-catalog.html) -- 安全牛 - - [落地“实干派”！看深信服内部零信任改造历程](https://www.aqniu.com/vendor/82539.html) - - [大数据时代下，兼顾安全和效率是一道无解的难题吗？](https://www.aqniu.com/vendor/82538.html) - - [用DecoyMini部署业务系统蜜罐——用免费蜜罐软件快速部署业务系统蜜罐](https://www.aqniu.com/vendor/82500.html) - - [2022年攻击路径研究：94%的网络攻击仅需4步即可完成！](https://www.aqniu.com/industry/82497.html) - - [昂楷科技宣布完成新一轮战略融资](https://www.aqniu.com/industry/82487.html) - - [安全牛课堂 | 网安人必备的四大攻防资质](https://www.aqniu.com/industry/82486.html) - - [从微软、Okta和HubSpot的3起泄密事件，看SaaS平台安全防护](https://www.aqniu.com/industry/82478.html) - - [雾帜智能宣布完成近亿元Pre-A轮融资](https://www.aqniu.com/industry/82477.html) - - [安全头条 | 中央网信办牵头开展“清朗·2022年算法综合治理”专项行动；英国零售商The Works遭到网络攻击影响](https://www.aqniu.com/industry/82476.html) - - [零事故的背后：一道关乎北京冬奥的网络纵深防线](https://www.aqniu.com/industry/82469.html) -- Dark Reading - - [Microsoft Plans Windows Auto-Update Service for Enterprises](https://www.darkreading.com/dr-tech/microsoft-plans-windows-auto-update-service-for-enterprises) - - [Microsoft Patches Windows Flaw Under Attack and Reported by NSA](https://www.darkreading.com/vulnerabilities-threats/microsoft-patches-windows-flaw-under-attack-and-reported-by-nsa) - - [Russian Group Sandworm Foiled in Attempt to Disrupt Ukraine Power Grid](https://www.darkreading.com/attacks-breaches/-russian-group-sandworm-s-attempt-to-disrupt-ukraine-power-grid-foiled) - - [How Do I Conduct a Resilience Review?](https://www.darkreading.com/edge-ask-the-experts/how-do-i-conduct-a-resilience-review-) - - [80% of Software Codebases Contain at Least One Vulnerability](https://www.darkreading.com/application-security/80-of-software-codebases-contain-at-least-one-vulnerability) - - [Building a Cybersecurity Mesh Architecture in the Real World](https://www.darkreading.com/operations/building-a-cybersecurity-mesh-architecture-in-the-real-world) -- Deeplinks - - [EFF and Partners to Ninth Circuit Court of Appeals: Retaliatory Investigation of Twitter Chills First Amendment Rights](https://www.eff.org/deeplinks/2022/04/eff-and-partners-ninth-circuit-court-appeals-retaliatory-investigation-twitter) - - [Podcast Episode: Making Hope, with Adam Savage](https://www.eff.org/deeplinks/2022/04/podcast-episode-making-hope-adam-savage) -- The Hacker News - - [Critical LFI Vulnerability Reported in Hashnode Blogging Platform](https://thehackernews.com/2022/04/critical-lfi-vulnerability-reported-in.html) - - [E.U. Officials Reportedly Targeted with Israeli Pegasus Spyware](https://thehackernews.com/2022/04/eu-officials-reportedly-targeted-with.html) - - [NGINX Shares Mitigations for Zero-Day Bug Affecting LDAP Implementation](https://thehackernews.com/2022/04/nginx-shares-mitigations-for-zero-day.html) - - [Finding Attack Paths in Cloud Environments](https://thehackernews.com/2022/04/finding-attack-paths-in-cloud.html) - - [Google Sues Scammer for Running 'Puppy Fraud Scheme' Website](https://thehackernews.com/2022/04/google-sues-scammer-for-running-puppy.html) - - [Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service](https://thehackernews.com/2022/04/over-16500-sites-hacked-to-distribute.html) -- Blackhat Library: Hacking techniques and research - - [Exposing the Russian spies who attempted to hack a Kansas nuclear plant](https://www.reddit.com/r/blackhat/comments/u27po2/exposing_the_russian_spies_who_attempted_to_hack/) - - [Anonymous' Cyber Anakin hacks 5 Russian websites over Ukraine war](https://www.reddit.com/r/blackhat/comments/u284ah/anonymous_cyber_anakin_hacks_5_russian_websites/) -- The Register - Security - - [Stolen-data market RaidForums taken down in domain seizure](https://go.theregister.com/feed/www.theregister.com/2022/04/12/raidforums_market_arrest/) - - [AWS fixes local file vuln on internal credential access for Relational Database Service](https://go.theregister.com/feed/www.theregister.com/2022/04/12/aws_rds_vuln/) - - [Hardware-assisted security poised for growth, says Intel](https://go.theregister.com/feed/www.theregister.com/2022/04/12/hardware_assisted_security_poised_for_growth/) - - [Can we solve the zero-day threat once and for all? No, but here’s what we can do](https://go.theregister.com/feed/www.theregister.com/2022/04/12/can_we_solve_the_zero/) - - [Industrial cybersecurity group gathers lobbying force](https://go.theregister.com/feed/www.theregister.com/2022/04/12/industrial_cybersecurity_group_gathers_lobbying/) - - [OpenSSH takes aim at 'capture now, decrypt later' quantum attacks](https://go.theregister.com/feed/www.theregister.com/2022/04/12/openssh_9/) - - [Critical bug allows attacker to remotely control medical robot](https://go.theregister.com/feed/www.theregister.com/2022/04/12/critical_vuln_hospital_robots/) - - [Singapore to license pentesters and managed infosec operators](https://go.theregister.com/feed/www.theregister.com/2022/04/12/singapore_infosec_licensing/) - - [Defending the Endpoint with AI](https://go.theregister.com/feed/www.theregister.com/2022/04/12/darktrace_red_team_automation/) - - [HCL and HP named in unflattering audit of India’s biometric ID system](https://go.theregister.com/feed/www.theregister.com/2022/04/12/aadhaar_uadai_audit/) -- Threatpost - - [Microsoft Zero-Days, Wormable Bugs Spark Concern](https://threatpost.com/microsoft-zero-days-wormable-bugs/179273/) - - [Menswear Brand Zegna Reveals Ransomware Attack](https://threatpost.com/menswear-zegna-ransomware/179266/) -- Deep Web - - [Dread down for anyone else?](https://www.reddit.com/r/deepweb/comments/u22qle/dread_down_for_anyone_else/) -- Max Kersten - - [Binary Analysis Course: release notes 0x2A](https://maxkersten.nl/2022/04/12/binary-analysis-course-release-notes-0x2a/) -- Chaos Computer Club - last 100 events feed - - [URLs richtig verschicken (petitfoo)](https://cdn.media.ccc.de/contributors/essen/petitfoo/h264-hd/petitfoo-48-deu-URLs_richtig_verschicken_hd.mp4) -- Your Hacking Tutorial by Zempirians - - [how can i hack this key-fob, and copy it to another?](https://www.reddit.com/r/HowToHack/comments/u26i6p/how_can_i_hack_this_keyfob_and_copy_it_to_another/) - - [Help with proxychains, unknown errors. I'm stuck.](https://www.reddit.com/r/HowToHack/comments/u1zuw2/help_with_proxychains_unknown_errors_im_stuck/) - - [Is it possible to unlock a knox configure locked tablet?](https://www.reddit.com/r/HowToHack/comments/u241su/is_it_possible_to_unlock_a_knox_configure_locked/) - - [Need Help Choosing - Which Certificate Would Be Better?](https://www.reddit.com/r/HowToHack/comments/u2c1zj/need_help_choosing_which_certificate_would_be/) - - [Unlocking an old work laptop with McAfee Drive Encryption](https://www.reddit.com/r/HowToHack/comments/u1lp6p/unlocking_an_old_work_laptop_with_mcafee_drive/) - - [metasploit and exploit question on real life environment](https://www.reddit.com/r/HowToHack/comments/u28hbk/metasploit_and_exploit_question_on_real_life/) -- SANS Internet Storm Center, InfoCON: green - - [Microsoft April 2022 Patch Tuesday, (Tue, Apr 12th)](https://isc.sans.edu/diary/rss/28542) - - [ISC Stormcast For Tuesday, April 12th, 2022 https://isc.sans.edu/podcastdetail.html?id=7960, (Tue, Apr 12th)](https://isc.sans.edu/diary/rss/28540) -- KitPloit - PenTest Tools! - - [Maat - Open-source Symbolic Execution Framework](http://www.kitploit.com/2022/04/maat-open-source-symbolic-execution.html) - - [NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit](http://www.kitploit.com/2022/04/nimpackt-v1-nim-based-assembly-packer.html) -- Computer Forensics - - [A small advice for a first DFIR setup](https://www.reddit.com/r/computerforensics/comments/u1thpw/a_small_advice_for_a_first_dfir_setup/) - - [A brief look at Windows telemetry: CIT aka Customer Interaction Tracker - a source of forensic data on at least Windows version till 7](https://www.reddit.com/r/computerforensics/comments/u20q7l/a_brief_look_at_windows_telemetry_cit_aka/) - - [Cellbrite free alternatives?](https://www.reddit.com/r/computerforensics/comments/u1toco/cellbrite_free_alternatives/) -- Krebs on Security - - [RaidForums Gets Raided, Alleged Admin Arrested](https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/) -- 奇客Solidot–传递最新科技情报 - - [免疫指纹或有助于改善自身免疫性疾病的治疗](https://www.solidot.org/story?sid=71225) - - [SSLPing 服务宣布关闭](https://www.solidot.org/story?sid=71224) - - [任意一天全世界人口中有 15.8% 的人头痛](https://www.solidot.org/story?sid=71223) - - [中国公司推出两款使用 Imagination Technologies 技术的显卡](https://www.solidot.org/story?sid=71222) - - [美国陆军将造美洲最大的 3D 打印建筑](https://www.solidot.org/story?sid=71221) - - [拥有更长遗传密码的生命可能但几率小](https://www.solidot.org/story?sid=71220) - - [研究人员找到安提基特拉机械可能的“零日”](https://www.solidot.org/story?sid=71219) - - [暗物质可能是额外维的引力子](https://www.solidot.org/story?sid=71218) - - [Peter Thiel 抨击沃伦巴菲特是比特币的头号敌人](https://www.solidot.org/story?sid=71217) - - [苹果开始在印度制造 iPhone 13](https://www.solidot.org/story?sid=71216) - - [美国加强对 3D 打印武器的监管](https://www.solidot.org/story?sid=71215) - - [马斯克不会加入 Twitter 董事会](https://www.solidot.org/story?sid=71214) -- Paul's Security Weekly - - [SWN #203 - Sandworm, Protestware, FancyBear, Spring4Shell, & PacketStreamer](http://podcast.securityweekly.com/swn-203-sandworm-protestware-fancybear-spring4shell-packetstreamer) - - [ASW #192 - William Morgan](http://podcast.securityweekly.com/asw-192-william-morgan) diff --git a/archive/2022/2022-04-14.md b/archive/2022/2022-04-14.md deleted file mode 100644 index 7aed909d75..0000000000 --- a/archive/2022/2022-04-14.md +++ /dev/null @@ -1,239 +0,0 @@ -# 每日安全资讯（2022-04-14） - -- Security Boulevard - - [Patch Tuesday Advisory – April 2022](https://securityboulevard.com/2022/04/patch-tuesday-advisory-april-2022/) - - [How to Secure Data in a ‘Need-To-Share’ Business Environment](https://securityboulevard.com/2022/04/how-to-secure-data-in-a-need-to-share-business-environment/) - - [API Gateway vs WAF vs API Security Platform](https://securityboulevard.com/2022/04/api-gateway-vs-waf-vs-api-security-platform/) - - [Critical RCE Vulnerability in Elementor WordPress Plugin](https://securityboulevard.com/2022/04/critical-rce-vulnerability-in-elementor-wordpress-plugin/) - - [Who needs cyber security](https://securityboulevard.com/2022/04/who-needs-cyber-security/) - - [Should I Monitor my Endpoints with SIEM?](https://securityboulevard.com/2022/04/should-i-monitor-my-endpoints-with-siem/) - - [BSides Budapest 2021: Itzik Mantin’s & Johnathan Azaria’s ‘AI in Minefield: Learning from Poisoned Data’](https://securityboulevard.com/2022/04/bsides-budapest-2021-itzik-mantins-johnathan-azarias-ai-in-minefield-learning-from-poisoned-data/) - - [Here’s How to Stop Attackers from Exploiting Taxpayers](https://securityboulevard.com/2022/04/heres-how-to-stop-attackers-from-exploiting-taxpayers/) -- NOSEC 安全讯息平台 - 漏洞预警 - - [【安全通报】2022年4月微软漏洞补丁日修复多个高危漏洞](https://nosec.org/home/detail/4989.html) -- HackerOne Hacker Activity - - [Reflected XSS on TikTok Website](https://hackerone.com/reports/1378413) - - [CSRF protection bypass in GitHub Enterprise management console](https://hackerone.com/reports/1497169) - - [Stored XSS on the "www.intensedebate.com/extras-widgets" url at "Recent comments by" module with malicious blog url](https://hackerone.com/reports/1083734) - - [Improper Implementation of SDK Allows Universal XSS in Webview Leading to Account Takeover](https://hackerone.com/reports/1455987) - - [Ability to connect an external login service for unverified emails/accounts at accounts.shopify.com](https://hackerone.com/reports/1018489) - - [CRLF Injection - Http Response Splitting](https://hackerone.com/reports/1514359) - - [Acess control vulnerability (read/write)](https://hackerone.com/reports/1174387) - - [Access control vulnerability (read/write)](https://hackerone.com/reports/1174734) - - [Access control vulnerability (read-only)](https://hackerone.com/reports/1159367) - - [Taking position in a discontinued forex pair without executing any trades](https://hackerone.com/reports/1509211) - - [Open S3 Bucket Accessible by any User](https://hackerone.com/reports/1474017) -- Files ≈ Packet Storm - - [WordPress Elementor 3.6.2 Remote Code Execution](https://packetstormsecurity.com/files/166722/wpelementor362-exec.txt) - - [Red Hat Security Advisory 2022-1373-01](https://packetstormsecurity.com/files/166721/RHSA-2022-1373-01.txt) - - [Ubuntu Security Notice USN-5378-4](https://packetstormsecurity.com/files/166720/USN-5378-4.txt) - - [Ubuntu Security Notice USN-5378-3](https://packetstormsecurity.com/files/166719/USN-5378-3.txt) - - [Red Hat Security Advisory 2022-1361-01](https://packetstormsecurity.com/files/166718/RHSA-2022-1361-01.txt) - - [Red Hat Security Advisory 2022-1345-01](https://packetstormsecurity.com/files/166717/RHSA-2022-1345-01.txt) - - [Red Hat Security Advisory 2022-1248-01](https://packetstormsecurity.com/files/166716/RHSA-2022-1248-01.txt) - - [Red Hat Security Advisory 2022-1360-01](https://packetstormsecurity.com/files/166715/RHSA-2022-1360-01.txt) - - [Red Hat Security Advisory 2022-1354-01](https://packetstormsecurity.com/files/166714/RHSA-2022-1354-01.txt) - - [Spring4Shell Code Execution](https://packetstormsecurity.com/files/166713/CVE-2022-22965-main.zip) - - [Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm](https://packetstormsecurity.com/files/166712/ZSL-2022-5701.txt) - - [Ubuntu Security Notice USN-5378-1](https://packetstormsecurity.com/files/166711/USN-5378-1.txt) - - [Ubuntu Security Notice USN-5378-2](https://packetstormsecurity.com/files/166710/USN-5378-2.txt) - - [Ubuntu Security Notice USN-5371-1](https://packetstormsecurity.com/files/166709/USN-5371-1.txt) - - [Ubuntu Security Notice USN-5377-1](https://packetstormsecurity.com/files/166708/USN-5377-1.txt) - - [Red Hat Security Advisory 2022-1179-01](https://packetstormsecurity.com/files/166707/RHSA-2022-1179-01.txt) - - [Red Hat Security Advisory 2022-1333-01](https://packetstormsecurity.com/files/166706/RHSA-2022-1333-01.txt) - - [Ubuntu Security Notice USN-5376-1](https://packetstormsecurity.com/files/166705/USN-5376-1.txt) - - [Ubuntu Security Notice USN-5372-1](https://packetstormsecurity.com/files/166704/USN-5372-1.txt) -- 跳跳糖 - 安全与分享社区 - - [How I hacked an ESA's experimental satellite（译文）](https://tttang.com/archive/1542/) -- Microsoft Security Blog - - [Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware](https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [360数字安全入选扬州、泰州“智改数转”服务商 赋能高质量发展](https://www.4hou.com/posts/Zr26) - - [共筑网络安全“防护网”，亚信安全与新华三达成战略合作](https://www.4hou.com/posts/Yq1p) - - [人工智能还能这么干？全域敏感数据发现的秘密武器！](https://www.4hou.com/posts/O6AN) - - [【Rootkit系列研究】Windows平台高隐匿、高持久化威胁（二）](https://www.4hou.com/posts/NWzz) - - [从救火到运营——雾帜智能新品发布会](https://www.4hou.com/posts/VnL1) - - [恶意软件Mirai正积极利用Spring4Shell漏洞](https://www.4hou.com/posts/XpNm) - - [周杰伦300万元NFT被盗，数字资产NFT真的安全吗？](https://www.4hou.com/posts/WoMg) - - [原型污染漏洞的扫描及利用](https://www.4hou.com/posts/xLwP) - - [黑客使用木马化的加密货币应用传播恶意软件](https://www.4hou.com/posts/pLy2) - - [嘶吼送书活动 | 《ATT＆CK框架实践指南》](https://www.4hou.com/posts/RjER) -- FreeBuf网络安全行业门户 - - [欧盟官员或已被以色列飞马间谍软件盯上](https://www.freebuf.com/news/328758.html) - - [FreeBuf早报 | Hashnode 博客平台存在LFI漏洞；新黑客盗取价值60万美元的加密货币](https://www.freebuf.com/news/328595.html) - - [LockBit勒索软件团伙潜伏在美政府网络中数月](https://www.freebuf.com/articles/328563.html) - - [惠普 Teradici PCoIP 受漏洞影响， 波及 1500  万个端点](https://www.freebuf.com/news/328555.html) - - [Imperva最新报告，消费者对数据泄露风险日益麻木](https://www.freebuf.com/news/328540.html) - - [记一次数据包解签名实战](https://www.freebuf.com/articles/web/328534.html) - - [暗网市场 RaidForums被一锅端了](https://www.freebuf.com/news/328532.html) - - [基于机器学习的自动化网络流量分析](https://www.freebuf.com/articles/network/328526.html) -- ElcomSoft blog - - [Decrypting Password-Protected DOC and XLS Files in Minutes](https://blog.elcomsoft.com/2022/04/decrypting-password-protected-doc-and-xls-files-in-minutes/) -- 安全客-有思想的安全新媒体 - - [诈骗多发！谨慎接听“00”或“+”开头的境外来电！教你防护小妙招](https://www.anquanke.com/post/id/271605) - - [地下网络犯罪之王马克斯·维京（二）：数码耶稣的犹大 | 人物志028](https://www.anquanke.com/post/id/271859) - - [2022年3月勒索病毒态势分析](https://www.anquanke.com/post/id/271995) - - [听说安全圈也有CPU了？](https://www.anquanke.com/post/id/271689) - - [Windows 进程注入 Part 1 - 非覆写函数指针的进程注入方式](https://www.anquanke.com/post/id/271607) - - [Qbot 恶意软件，切换到新的 Windows 安装程序感染媒介](https://www.anquanke.com/post/id/271706) -- paper - Last paper - - [余弦：区块链黑暗森林自救手册](https://paper.seebug.org/1881/) -- 安全脉搏 - - [Splunk系列：Splunk搜索分析篇（四）](https://www.secpulse.com/archives/176941.html) - - [Splunk系列：Splunk字段提取篇（三）](https://www.secpulse.com/archives/176912.html) - - [Splunk系列：Splunk数据接入篇（二）](https://www.secpulse.com/archives/176894.html) - - [Splunk系列：Splunk安装部署篇（一）](https://www.secpulse.com/archives/176868.html) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Windows User Profile Service Privlege Escalation](https://cxsecurity.com/issue/WLB-2022040049) - - [Explore CMS 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022040048) - - [Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm](https://cxsecurity.com/issue/WLB-2022040047) -- Google Online Security Blog - - [How to SLSA Part 2 - The Details](http://security.googleblog.com/2022/04/how-to-slsa-part-2-details.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [500$ Bug: Sensitive Data Exposure to Broken Access Control leads, How I able to take over any…](https://infosecwriteups.com/500-bug-sensitive-data-exposure-to-broken-access-control-leads-how-i-able-to-take-over-any-33658f16e265?source=rss----7b722bfd1b8d--bug_bounty) - - [P1 Vulnerability: How I chained Logical-Error to Account-Takeover Vulnerability ‍that No-One…](https://infosecwriteups.com/p1-vulnerability-how-i-chained-logical-error-to-account-takeover-vulnerability-that-no-one-59aa88a9cae8?source=rss----7b722bfd1b8d--bug_bounty) - - [How a YouTube Video lead to pwning a web application via SQL Injection worth $4324 bounty](https://infosecwriteups.com/how-a-youtube-video-lead-to-pwning-a-web-application-via-sql-injection-worth-4324-bounty-285f0a9b9f6c?source=rss----7b722bfd1b8d--bug_bounty) - - [Android Pentesting Setup On Macbook M1](https://infosecwriteups.com/android-pentesting-setup-on-macbook-m1-d2f1f0a8db4b?source=rss----7b722bfd1b8d--bug_bounty) -- loecho@垃圾桶 - - [Behinder3-Beta11 实战下的二次开发 （3）](https://1oecho.github.io/fjA1kdB4U/) -- Securelist - - [Emotet modules and recent attacks](https://securelist.com/emotet-modules-and-recent-attacks/106290/) -- Forcepoint - - [SSE Platforms are Bringing ZTNA to the Mainstream](https://www.forcepoint.com/blog/insights/sse-platforms-making-ztna-mainstream) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Exposing Personally Identifiable Information Behind A Recently Leaked Russian High-Profile Cybercriminal Forum Community - An Analysis](http://ddanchev.blogspot.com/2022/04/exposing-personally-identifiable.html) - - [It's Full of Secrets and User-Generated Sensitive and Classified Information - An Update on Some Current Projects](http://ddanchev.blogspot.com/2022/04/its-full-of-secrets-and-user-generated.html) -- Hacking and security - - [SonicWALL Configuration Notes](https://hackingandsecurity.blogspot.com/2022/04/sonicwall-configuration-notes.html) -- Intigriti - - [Bug Bytes #167 – AWS RDS Local File Read & Are you making these learning mistakes or misusing Burp’s predefined lists?](https://blog.intigriti.com/2022/04/13/bug-bytes-167-aws-rds-local-file-read-are-you-making-these-learning-mistakes-or-misusing-burps-predefined-lists/) -- Trail of Bits Blog - - [Coordinated disclosure of vulnerabilities affecting Girault, Bulletproofs, and PlonK](https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk/) -- print("") - - [CVE-2022-22954 VMware Workspace ONE Access 复现](https://www.o2oxy.cn/4060.html) -- The Daily Swig | Cybersecurity news and views - - [Git security vulnerabilities prompt updates](https://portswigger.net/daily-swig/git-security-vulnerabilities-prompt-updates) - - [African banking sector targeted by malware-based phishing campaign](https://portswigger.net/daily-swig/african-banking-sector-targeted-by-malware-based-phishing-campaign) -- KitPloit - PenTest & Hacking Tools - - [Presshell - Quick And Dirty Wordpress Command Execution Shell](http://www.kitploit.com/2022/04/presshell-quick-and-dirty-wordpress.html) - - [Melody - A Transparent Internet Sensor Built For Threat Intelligence](http://www.kitploit.com/2022/04/melody-transparent-internet-sensor.html) -- Mozilla Hacks – the Web developer blog - - [Mozilla partners with the Center for Humane Technology](https://hacks.mozilla.org/2022/04/mozilla-partners-with-the-center-for-humane-technology/) -- 360 Netlab Blog - Network Security Research Lab at 360 - - [Fodcha, a new DDos botnet](https://blog.netlab.360.com/fodcha-a-new-ddos-botnet/) - - [新威胁：闷声发大财的Fodcha僵尸网络](https://blog.netlab.360.com/men-sheng-fa-da-cai-fodchajiang-shi-wang-luo/) -- K4YT3X - - [AI, Automation, and the Future of Humanity](https://k4yt3x.com/ai-automation-and-the-future-of-humanity/) -- Akkuman 的博客 - - [从arl中学习到的nmap配置](//hacktech.cn/2022/04/13/arl-nmap-strategy/) -- 黑海洋 - WIKI - - [易支付源码可商业运营](https://blog.upx8.com/2695) -- ProtonMail Blog - - [Introducing Proton Calendar for Android](https://protonmail.com/blog/calendar-android-app/) -- Google Online Security Blog - - [How to SLSA Part 2 - The Details](http://security.googleblog.com/2022/04/how-to-slsa-part-2-details.html) -- 安全牛 - - [一场发布，四重惊喜！三年创业，十分认真！](https://www.aqniu.com/industry/82562.html) - - [360核心安全大脑3.0正式发布，构建政企用户的“能力中枢平台”](https://www.aqniu.com/industry/82559.html) - - [数智化转型助推安全新风口 应用、云安全成投资新热点](https://www.aqniu.com/vendor/82557.html) -- Shodan Blog - - [Historical IP Information](https://blog.shodan.io/historical-ip-information/) -- 奇客Solidot–传递最新科技情报 - - [苹果上海江苏代工厂停产](https://www.solidot.org/story?sid=71238) - - [科学家揭示工作记忆的格式](https://www.solidot.org/story?sid=71237) - - [天文学家捕捉到海王星温度的惊人变化](https://www.solidot.org/story?sid=71236) - - [欧洲大力投资火车](https://www.solidot.org/story?sid=71235) - - [黑碳威胁北极](https://www.solidot.org/story?sid=71234) - - [搜狐等被 SEC 列入预摘牌名单](https://www.solidot.org/story?sid=71233) - - [维基百科社区投票禁止加密货币捐款](https://www.solidot.org/story?sid=71232) - - [库克称绕过应用商店可能会危及隐私](https://www.solidot.org/story?sid=71231) - - [记录超速的 AI 应用引发争议](https://www.solidot.org/story?sid=71230) - - [RaidForums 站长被捕](https://www.solidot.org/story?sid=71229) - - [戴尔在荷兰试验四天工作制](https://www.solidot.org/story?sid=71228) - - [TikTok 今年收入预计将超过 Twitter 和 Snap 之和](https://www.solidot.org/story?sid=71227) - - [路透中文关闭](https://www.solidot.org/story?sid=71226) -- 谢乾坤 | Kingname - - [爬虫出海Step by Step(一)](https://www.kingname.info/2022/04/13/global-crawler-1/) - - [一日一技：多个Python项目怎么调用我自己的工具函数？](https://www.kingname.info/2022/04/13/use-pth/) -- SANS Internet Storm Center, InfoCON: green - - [How is Ukrainian internet holding up during the Russian invasion?, (Wed, Apr 13th)](https://isc.sans.edu/diary/rss/28546) - - [ISC Stormcast For Wednesday, April 13th, 2022 https://isc.sans.edu/podcastdetail.html?id=7962, (Wed, Apr 13th)](https://isc.sans.edu/diary/rss/28544) -- HACKMAGEDDON - - [March 2022 Cyber Attacks Statistics](https://www.hackmageddon.com/2022/04/13/march-2022-cyber-attacks-statistics/) -- 绿盟科技技术博客 - - [Apache Struts远程代码执行漏洞S2-062（CVE-2021-31805）通告](http://blog.nsfocus.net/apache-struts-cve-2021-31805/) - - [Web3概念的演进 ——Web3简析系列（4）](http://blog.nsfocus.net/web3-4/) - - [实力验证 | 绿盟科技以综合排名第一成绩中标中国电信零信任项目](http://blog.nsfocus.net/2021-0-sdp/) -- Posts By SpecterOps Team Members - Medium - - [Coercing NTLM Authentication from SCCM](https://posts.specterops.io/coercing-ntlm-authentication-from-sccm-e6e23ea8260a?source=rss----f05f8696e3cc---4) -- Diritto dell'Informatica - - [Diritto d’autore, usare immagini e contenuti senza Copyright](https://www.dirittodellinformatica.it/diritto-autore/copyright-e-diritto-dautore-quando-e-lecito-usare-immagini.html) -- Securityinfo.it - - [Pirati russi attaccano fornitore di energia ucraino](https://www.securityinfo.it/2022/04/13/pirati-russi-attaccano-fornitore-di-energia-ucraino/?utm_source=rss&utm_medium=rss&utm_campaign=pirati-russi-attaccano-fornitore-di-energia-ucraino) - - [OpenSSH 9 pensa ai computer quantistici](https://www.securityinfo.it/2022/04/13/openssh-9-pensa-ai-computer-quantistici/?utm_source=rss&utm_medium=rss&utm_campaign=openssh-9-pensa-ai-computer-quantistici) -- Securelist - - [Emotet modules and recent attacks](https://securelist.com/emotet-modules-and-recent-attacks/106290/) -- Threatpost - - [Feds Shut Down RaidForums Hacking Marketplace](https://threatpost.com/shut-down-raidforums-hacking-marketplace/179279/) -- Security Affairs - - [CVE-2021-31805 RCE bug in Apache Struts was finally patched](https://securityaffairs.co/wordpress/130173/security/critical-apache-struts-rce-flaw.html) - - [China-linked Hafnium APT leverages Tarrask malware to gain persistence](https://securityaffairs.co/wordpress/130167/apt/tarrask-malware-persistence-technique.html) - - [JekyllBot:5 flaws allow hacking TUG autonomous mobile robots in hospitals](https://securityaffairs.co/wordpress/130157/security/jekyllbot5-flaws-tug-autonomous-mobile-robots.html) - - [EU officials were targeted with Israeli surveillance software](https://securityaffairs.co/wordpress/130139/malware/eu-officials-surveillance-software.html) -- LockBoxx - - [The Vendors and Events at Shmoocon 2022](http://lockboxx.blogspot.com/2022/04/the-vendors-and-events-at-shmoocon-2022.html) -- Hacking and security - - [SonicWALL Configuration Notes](https://hackingandsecurity.blogspot.com/2022/04/sonicwall-configuration-notes.html) -- Instapaper: Unread - - [De-anonymizing Bitcoin](https://www.schneier.com/blog/archives/2022/04/de-anonymizing-bitcoin.html) - - [Case Study Forensic Analysis of TikTok on iOS](https://dfir.pubpub.org/pub/h6vyh33u/release/1) - - [Ain’t That a Kik in the Head Kik Messenger iOS Analysis](https://dfir.pubpub.org/pub/z29xp2bu/release/1) - - [Malicious Registry Timestamp Manipulation Technique Detecting Registry Timestomping](https://www.inversecos.com/2022/04/malicious-registry-timestamp.html) - - [Attacco alla Commissione UE spyware negli iPhone](https://www.punto-informatico.it/attacco-alla-commissione-ue-spyware-negli-iphone/) - - [Chiuso RaidForums, arrestato l’amministratore](https://www.punto-informatico.it/chiuso-raidforums-arrestato-amministratore/) - - [Incoscienti e sfacciati le tecniche dei teenager che violano aziende](https://www.guerredirete.it/incoscienti-e-sfacciati-le-tecniche-dei-teenager-che-violano-aziende/) - - [Cassazione, ecco quando i tabulati sono utilizzabili nei processi](https://www.agendadigitale.eu/sicurezza/privacy/cassazione-ecco-quando-i-tabulati-sono-utilizzabili-nei-processi/) - - [Registro operatori criptovalute procedure e consigli pratici per l’iscrizione](https://www.agendadigitale.eu/cittadinanza-digitale/pagamenti-digitali/registro-operatori-criptovalute-procedure-e-consigli-pratici-per-liscrizione/) -- Schneier on Security - - [Russian Cyberattack against Ukrainian Power Grid Prevented](https://www.schneier.com/blog/archives/2022/04/russian-cyberattack-against-ukrainian-power-grid-prevented.html) -- Deeplinks - - [Civil Liberties Groups Urge Social Media Platforms to Better Protect Free Flow of Information in Crisis Zones](https://www.eff.org/press/releases/human-rights-groups-urge-social-media-platforms-better-protect-free-flow-information) -- Trend Micro Research, News and Perspectives - - [Cybersecurity Basics: Authentication and Authorization](https://www.trendmicro.com/en_us/devops/22/d/cybersecurity-basics.html) -- TorrentFreak - - [Manga Pirates Warned That Kadokawa Seeks Their Identities From YouTube](https://torrentfreak.com/manga-pirates-warned-that-kadokawa-seeks-their-identities-from-youtube-220413/) -- The Register - Security - - [Apache says Struts 2 security bug wasn't fully fixed in 2020](https://go.theregister.com/feed/www.theregister.com/2022/04/13/apache_struts_bug_new_patch/) - - [Taiwan, China square off over chip tech espionage laws](https://go.theregister.com/feed/www.theregister.com/2022/04/13/taiwan_and_china_new_chip_espionage_laws/) - - [Enemybot botnet uses Gafgyt source code with a sprinkling of Mirai](https://go.theregister.com/feed/www.theregister.com/2022/04/13/enemy-botnet-uses-gafgyt-mirai/) - - [Git for Windows issues update to fix running-someone-else’s-code vuln](https://go.theregister.com/feed/www.theregister.com/2022/04/13/git_vuln/) - - [Investment firm KKR buys Barracuda Networks](https://go.theregister.com/feed/www.theregister.com/2022/04/13/kkr_buys_barracuda/) - - [Huawei reportedly furloughs Russian staff and stops taking orders](https://go.theregister.com/feed/www.theregister.com/2022/04/13/huawei_may_quit_russia/) - - [Microsoft's huge Patch Tuesday includes fix for bug under attack](https://go.theregister.com/feed/www.theregister.com/2022/04/13/microsoft_patch_tuesday/) -- The Hacker News - - [Webinar: How The Right XDR Can Be a Game-Changer for Lean Security Teams](https://thehackernews.com/2022/04/webinar-how-right-xdr-can-be-game.html) - - [FBI, Europol Seize RaidForums Hacker Forum and Arrest Admin](https://thehackernews.com/2022/04/fbi-europol-seize-raidforums-hacker.html) - - [Microsoft Issues Patches for 2 Windows Zero-Days and 126 Other Vulnerabilities](https://thehackernews.com/2022/04/microsoft-issues-patches-for-2-windows.html) - - [Cross-Regional Disaster Recovery with Elasticsearch](https://thehackernews.com/2022/04/cross-regional-disaster-recovery-with.html) -- KitPloit - PenTest Tools! - - [Presshell - Quick And Dirty Wordpress Command Execution Shell](http://www.kitploit.com/2022/04/presshell-quick-and-dirty-wordpress.html) - - [Melody - A Transparent Internet Sensor Built For Threat Intelligence](http://www.kitploit.com/2022/04/melody-transparent-internet-sensor.html) -- Krebs on Security - - [Microsoft Patch Tuesday, April 2022 Edition](https://krebsonsecurity.com/2022/04/microsoft-patch-tuesday-april-2022-edition/) -- Dark Reading - - [Secure Systems Need Hardware-Enhanced Tools, Intel Says](https://www.darkreading.com/emerging-tech/secure-systems-need-hardware-enhanced-tools-intel-says) - - [Microsoft Leads Operation to Disrupt Zloader Botnet](https://www.darkreading.com/threat-intelligence/microsoft-leads-operation-to-disrupt-zloader-botnet-activity) - - [KKR to Acquire Barracuda Networks](https://www.darkreading.com/cloud/kkr-to-acquire-barracuda-networks) - - [More Than 60% of Organizations Suffered a Breach in the Past 12 Months](https://www.darkreading.com/attacks-breaches/more-than-60-of-organizations-suffered-a-breach-in-the-past-12-months) - - [Palo Alto Networks Extends SASE to Protect Home Networks With Okyo Garde Enterprise Edition](https://www.darkreading.com/remote-workforce/palo-alto-networks-extends-sase-to-protect-home-networks-with-okyo-garde-enterprise-edition) - - [Securing the Stopgap: Controlling Access to SaaS Applications](https://www.darkreading.com/edge-articles/securing-the-stopgap-controlling-access-to-saas-applications) - - [Supply and Demand Hits Cybersecurity: Navigating the Skills Shortage](https://www.darkreading.com/cloud/supply-and-demand-hits-cybersecurity-navigating-the-skills-shortage) - - [Identifying a Vulnerability in the SAP Software Supply Chain](https://www.darkreading.com/vulnerabilities-threats/identifying-a-vulnerability-in-the-sap-software-supply-chain) - - [Intertrust Adds Security for IoT Devices in Zero-Trust Architectures to Intertrust Platform](https://www.darkreading.com/iot/intertrust-adds-security-for-iot-devices-in-zero-trust-architectures-to-intertrust-platform) - - [Datto to be Acquired by Kaseya for $6.2 Billion](https://www.darkreading.com/cloud/datto-to-be-acquired-by-kaseya-for-6-2-billion) - - [Criminal IP Cybersecurity Search Engine Launches First Beta Test](https://www.darkreading.com/threat-intelligence/criminal-ip-cybersecurity-search-engine-launches-first-beta-test) - - [United States Leads Seizure of One of the World’s Largest Hacker Forums and Arrests Administrator](https://www.darkreading.com/attacks-breaches/united-states-leads-seizure-of-one-of-the-world-s-largest-hacker-forums-and-arrests-administrator) -- Paul's Security Weekly - - [BSW #258 - Derek Manky](http://podcast.securityweekly.com/bsw-258-derek-manky) -- Dark Space Blogspot - - [Soluzioni Privacy Per Le Cripto: Wallet, Carte Di Credito, Scambi P2P](http://darkwhite666.blogspot.com/2022/04/soluzioni-privacy-per-le-cripto-wallet.html) diff --git a/archive/2022/2022-04-15.md b/archive/2022/2022-04-15.md deleted file mode 100644 index cccfe57265..0000000000 --- a/archive/2022/2022-04-15.md +++ /dev/null @@ -1,221 +0,0 @@ -# 每日安全资讯（2022-04-15） - -- HackerOne Hacker Activity - - [Read and write beyond bounds in mod_sed](https://hackerone.com/reports/1511619) - - [[Bypass] Ability to invite a new member in sandbox Organization](https://hackerone.com/reports/1486417) -- FreeBuf网络安全行业门户 - - [因数据或隐私安全问题，这家巨头近一年已累计被罚超10亿美元](https://www.freebuf.com/news/329032.html) - - [使用Elasticsearch SIEM搭建小型组织SIEM平台](https://www.freebuf.com/sectool/327273.html) - - [FreeBuf早报 | 非洲银行成恶意软件攻击主要目标；风力涡轮机巨头Nordex遭网络攻击](https://www.freebuf.com/articles/328977.html) - - [VMware CVE-2022-22954漏洞强势来袭 请立刻打补丁！](https://www.freebuf.com/news/328873.html) - - [Elementor WordPress 插件存在漏洞，可能影响 50 万个站点](https://www.freebuf.com/news/328857.html) - - [Apache Struts中的CVE-2021-31805 RCE漏洞终于得到修复](https://www.freebuf.com/news/328850.html) - - [工信部印发《工业互联网专项工作组2022年工作计划》](https://www.freebuf.com/news/328835.html) - - [关于Spring framework RCE（CVE-2022-22965）的一些问题思考](https://www.freebuf.com/vuls/327457.html) -- Microsoft Security Blog - - [A clearer lens on Zero Trust security strategy: Part 1](https://www.microsoft.com/security/blog/2022/04/14/a-clearer-lens-on-zero-trust-security-strategy-part-1/) -- Snowming04's Blog - - [Pancake-SyrupBar 双倍 votes 漏洞](http://snowming.me/2022/04/14/pancake-syrupbar-%e5%8f%8c%e5%80%8d-votes-%e6%bc%8f%e6%b4%9e/) -- 安全客-有思想的安全新媒体 - - [渗透的门被封死了，还好上帝为我开了一扇窗](https://www.anquanke.com/post/id/271945) - - [2022-04 补丁日: 微软多个漏洞安全更新通告](https://www.anquanke.com/post/id/272013) - - [CVE-2021-31805：Apache Struts2远程代码执行漏洞通告](https://www.anquanke.com/post/id/272007) - - [一种快速的无代替模型的黑盒对抗攻击算法SurFree](https://www.anquanke.com/post/id/271671) - - [Ransom DDoS攻击在今年第一季度有所下降](https://www.anquanke.com/post/id/272014) - - [4月14日每日安全热点 - 微软破坏Zloader僵尸网络](https://www.anquanke.com/post/id/272057) -- Security Boulevard - - [SOC is Not Dead Yet It May Be Reborn As Security Operations Center of Excellence](https://securityboulevard.com/2022/04/soc-is-not-dead-yet-it-may-be-reborn-as-security-operations-center-of-excellence/) - - [Ukraine Digital Public Conversation – April 05 – 11, 2022](https://securityboulevard.com/2022/04/ukraine-digital-public-conversation-april-05-11-2022/) - - [BSides Budapest 2021: Swetha Balla’s ‘Improving Response By Being “Data Wrangling” Amateurs In AWS’](https://securityboulevard.com/2022/04/bsides-budapest-2021-swetha-ballas-improving-response-by-being-data-wrangling-amateurs-in-aws/) - - [PIPEDREAM Malware: Understanding and Mitigating the Threat](https://securityboulevard.com/2022/04/pipedream-malware-understanding-and-mitigating-the-threat/) - - [XKCD ‘Weird Unicode Math Symbols’](https://securityboulevard.com/2022/04/xkcd-weird-unicode-math-symbols/) - - [Enabling seamless digital first payments](https://securityboulevard.com/2022/04/enabling-seamless-digital-first-payments/) - - [1,701 New Vulnerabilities: Vulnerability Intelligence Infographic, March 2022: Key Trends and Analysis](https://securityboulevard.com/2022/04/1701-new-vulnerabilities-vulnerability-intelligence-infographic-march-2022-key-trends-and-analysis/) - - [API Security in a Zero Trust World](https://securityboulevard.com/2022/04/api-security-in-a-zero-trust-world/) - - [10 Ways to Implement AppSec Measures for Your Cloud Ecosystem](https://securityboulevard.com/2022/04/10-ways-to-implement-appsec-measures-for-your-cloud-ecosystem/) - - [What Is Lateral Movement?](https://securityboulevard.com/2022/04/what-is-lateral-movement/) -- Trustwave Blog - - [Trustwave Security Colony Vendor Assessment: Know Your Vulnerabilities Before Others Do](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-security-colony-vendor-assessment-know-your-vulnerabilities-before-others-do/) -- 安全脉搏 - - [【漏洞预警】Apache Struts2远程代码执行漏洞](https://www.secpulse.com/archives/177048.html) - - [SRC挖掘思路（四）](https://www.secpulse.com/archives/177027.html) - - [SRC挖掘思路（三）](https://www.secpulse.com/archives/176999.html) - - [SRC挖掘思路（二）](https://www.secpulse.com/archives/176994.html) - - [SRC挖掘思路（一）](https://www.secpulse.com/archives/176979.html) -- 跳跳糖 - 安全与分享社区 - - [mssql 提权总结](https://tttang.com/archive/1545/) -- Google Online Security Blog - - [How to SLSA Part 3 - Putting it all together](http://security.googleblog.com/2022/04/how-to-slsa-part-3-putting-it-all.html) -- Sucuri Blog - - [Critical RCE Vulnerability in Elementor WordPress Plugin](https://blog.sucuri.net/2022/04/critical-rce-vulnerability-in-elementor-wordpress-plugin.html) - - [Sucuri WordPress Plugin += Sucuri WAF](https://blog.sucuri.net/2022/04/sucuri-wordpress-plugin-sucuri-waf.html) -- Files ≈ Packet Storm - - [Delta Controls enteliTOUCH 3.40.3935 Cookie User Password Disclosure](https://packetstormsecurity.com/files/166729/ZSL-2022-5704.txt) - - [Delta Controls enteliTOUCH 3.40.3935 Cross Site Scripting](https://packetstormsecurity.com/files/166728/ZSL-2022-5703.txt) - - [Delta Controls enteliTOUCH 3.40.3935 Cross Site Request Forgery](https://packetstormsecurity.com/files/166727/ZSL-2022-5702.txt) - - [Red Hat Security Advisory 2022-1372-01](https://packetstormsecurity.com/files/166726/RHSA-2022-1372-01.txt) - - [Online Car Wash Booking System 1.0 Blind SQL Injection](https://packetstormsecurity.com/files/166725/ocwbs10b-sql.txt) - - [Online Car Wash Booking System 1.0 SQL Injection](https://packetstormsecurity.com/files/166724/ocwbs10-sql.txt) - - [REDCap Cross Site Scripting](https://packetstormsecurity.com/files/166723/redcap11-xss.txt) -- Cerbero Blog - - [Microsoft Authenticode on Linux and macOS](https://blog.cerbero.io/?p=2378) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [云甲大揭秘|容器运行时安全威胁该如何突围](https://www.4hou.com/posts/5K2R) - - [被控帮助朝鲜利用加密货币洗钱 前以太坊联合创始人被判63个月监禁](https://www.4hou.com/posts/4G16) - - [“黑客”入侵网站盗取红包链接获刑](https://www.4hou.com/posts/3VZQ) - - [专家重新考虑在俄罗斯 - 乌克兰危机中使用 IP 地址实施制裁](https://www.4hou.com/posts/0DWX) - - [​重磅 ｜ 派拉软件《构建“零信任”安全时代——数字化转型安全实践与应用》案例集正式发布](https://www.4hou.com/posts/gMw6) - - [滥用PE文件中的共享节实现代码注入](https://www.4hou.com/posts/lEq6) - - [软件安全发展态势一瞥](https://www.4hou.com/posts/O63p) - - [专家警告：汽车制造商更重视技术而非网络安全](https://www.4hou.com/posts/qLyr) - - [五部门联合发文推动车联网安全 360汽车安全卫士迈出量产第一步](https://www.4hou.com/posts/7VgA) - - [奇安信中标中国广电5G安全大单](https://www.4hou.com/posts/6K39) -- Hacking and security - - [OSCP pentesting commands - Checklist for Penetration Testing](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentesting-commands-checklist-for.html) - - [Using Amazon EC2 Instance Connect for SSH access to your EC2 Instances](https://hackingandsecurity.blogspot.com/2022/04/using-amazon-ec2-instance-connect-for.html) - - [Bash tasks](https://hackingandsecurity.blogspot.com/2022/04/bash-tasks.html) - - [OSCP pentesting - attack way - commands 7](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentesting-attack-way-commands-7.html) - - [Excellent quotes for life](https://hackingandsecurity.blogspot.com/2022/04/excellent-quotes-for-life.html) - - [More jokes...](https://hackingandsecurity.blogspot.com/2022/04/more-jokes.html) - - [How to apply for jobs...](https://hackingandsecurity.blogspot.com/2022/04/how-to-apply-for-jobs.html) - - [Netcat usage examples](https://hackingandsecurity.blogspot.com/2022/04/netcat-usage-examples.html) - - [OSCP pentesting commands - part 7](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentesting-commands-part-7.html) - - [OSCP commands part 6 - Web exploitation](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-6-web-exploitation.html) - - [The fundamentals to Windows System Security](https://hackingandsecurity.blogspot.com/2022/04/the-fundamentals-to-windows-system.html) - - [The Feynman Technique: The Best Way to Learn Anything](https://hackingandsecurity.blogspot.com/2022/04/the-feynman-technique-best-way-to-learn.html) - - [OSCP pentesting commands - shell generator part 5](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentesting-commands-shell.html) - - [OSCP commands part 5 - privilege escalation](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-5-privilege.html) - - [OSCP pentestesting commands part 4](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentestesting-commands-part-4.html) - - [OSCP commands part 3](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-3.html) - - [OSCP Commands part 2](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-2.html) - - [OSCP commands part 1](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-1.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [Bypass Rate Limit — A blank space leads to this random encounter!](https://infosecwriteups.com/bypass-rate-limit-a-blank-space-leads-to-this-random-encounter-e18e72fbf228?source=rss----7b722bfd1b8d--bug_bounty) -- blog.avast.com EN - - [Is Metaverse the New Internet? | Avast](https://blog.avast.com/is-metaverse-the-new-internet-avast) -- Marco Ramilli Web Corner - - [From a Phishing Page to a Possible Threat Actor](https://marcoramilli.com/2022/04/14/from-a-phishing-page-to-a-possible-threat-actor/) -- SentinelOne - - [Building the Revenue Organization for Hyperscale and IPO](https://www.sentinelone.com/blog/building-the-revenue-organization-for-hyperscale-and-ipo/) -- Trail of Bits Blog - - [The Frozen Heart vulnerability in Girault’s proof of knowledge](https://blog.trailofbits.com/2022/04/14/the-frozen-heart-vulnerability-in-giraults-proof-of-knowledge/) -- Microsoft Security Response Center - - [Expanding High Impact Scenario Awards for Microsoft Bug Bounty Programs](https://msrc-blog.microsoft.com/2022/04/14/expanding-high-impact-scenario-awards-for-microsoft-bug-bounty-programs/) -- The Daily Swig | Cybersecurity news and views - - [Critical infrastructure entities on red alert over ‘exceptionally rare and dangerous’ ICS malware](https://portswigger.net/daily-swig/critical-infrastructure-entities-on-red-alert-over-exceptionally-rare-and-dangerous-ics-malware) - - [Credit card industry standard revised to repel card-skimmer attacks](https://portswigger.net/daily-swig/credit-card-industry-standard-revised-to-repel-card-skimmer-attacks) -- 威尔的代码站 - - [CSharp中实现一个可继承的Singleton基类](https://blog.binklac.com/0ae505734822/) -- Sick Codes – Security Research, Hardware & Software Hacking, Consulting, Linux, IoT, Cloud, Embedded, Arch, Tweaks & Tips! - - [CVE-2022-28345 – Signal client for iOS version 5.33.2 and below are vulnerable to RTLO Injection URI Spoofing using malicious URLs such as gepj.net/selif#/moc.elpmaxe which would appear as example.com/#files/ten.jpeg](https://sick.codes/sick-2022-42/) -- KitPloit - PenTest & Hacking Tools - - [vAPI - Vulnerable Adversely Programmed Interface Which Is Self-Hostable API That Mimics OWASP API Top 10 Scenarios Through Exercises](http://www.kitploit.com/2022/04/vapi-vulnerable-adversely-programmed.html) - - [365Inspect - A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments](http://www.kitploit.com/2022/04/365inspect-powershell-script-that.html) -- Hacking Articles - - [Process Doppelganging (Mitre:T1055.013)](https://www.hackingarticles.in/process-doppelganging-mitret1055-013/) -- 绿盟科技技术博客 - - [微软4月安全更新多个产品高危漏洞通告](http://blog.nsfocus.net/microsoft-monthly-2022-4/) - - [NTFS Alternate Data Streams简介](http://blog.nsfocus.net/ntfs-alternate-data-streams/) -- Project Zero - - [CVE-2021-1782, an iOS in-the-wild vulnerability in vouchers](https://googleprojectzero.blogspot.com/2022/04/cve-2021-1782-ios-in-wild-vulnerability.html) -- Fuzzing Labs - - [Top 7 books to learn WebAssembly in 2022](https://fuzzinglabs.com/book-webassembly-wasm-security/) -- 奇客Solidot–传递最新科技情报 - - [腾讯关闭网游加速器服务](https://www.solidot.org/story?sid=71250) - - [Elon Musk 报价 410 亿美元收购 Twitter](https://www.solidot.org/story?sid=71249) - - [黑客如何利用 Windows 任务调度程序植入持久性的后门](https://www.solidot.org/story?sid=71248) - - [俄罗斯科技行业面临人才外流](https://www.solidot.org/story?sid=71247) - - [Unreal Engine 5能否实现元宇宙的潜力？](https://www.solidot.org/story?sid=71246) - - [中国计划寻找地球 2.0](https://www.solidot.org/story?sid=71245) - - [哈勃确定有史以来最大的彗核](https://www.solidot.org/story?sid=71244) - - [科学家揭示汤加火山如何引发全球海啸](https://www.solidot.org/story?sid=71243) - - [律师认为复旦调剂生的使诈行为并不违法](https://www.solidot.org/story?sid=71242) - - [Facebook 开源可扩展文本编辑器库 Lexical](https://www.solidot.org/story?sid=71241) - - [Facebook 元宇宙销售抽成接近五成](https://www.solidot.org/story?sid=71240) - - [Google 将给知名开发者和发行商展示徽章](https://www.solidot.org/story?sid=71239) -- TrustedSec - - [Persisting XSS With IFrame Traps](https://www.trustedsec.com/blog/persisting-xss-with-iframe-traps/) -- Google Online Security Blog - - [How to SLSA Part 3 - Putting it all together](http://security.googleblog.com/2022/04/how-to-slsa-part-3-putting-it-all.html) -- Securityinfo.it - - [Nuova patch di sicurezza per Struts 2](https://www.securityinfo.it/2022/04/14/nuova-patch-di-sicurezza-per-struts-2/?utm_source=rss&utm_medium=rss&utm_campaign=nuova-patch-di-sicurezza-per-struts-2) - - [Bug permette il controllo remoto di robot medici](https://www.securityinfo.it/2022/04/14/bug-permette-il-controllo-remoto-di-robot-medici/?utm_source=rss&utm_medium=rss&utm_campaign=bug-permette-il-controllo-remoto-di-robot-medici) -- ProtonMail Blog - - [Evolving privacy for the future](https://protonmail.com/blog/evolving-privacy/) -- Team Cymru - - [A New Attack Surface Management Solution to Transform the Way Organizations Manage Digital Business Risk](https://team-cymru.com/blog/2022/04/14/a-new-attack-surface-management-solution-to-transform-the-way-organizations-manage-digital-business-risk/) -- SANS Internet Storm Center, InfoCON: green - - [An Update on CVE-2022-26809 - MSRPC Vulnerabliity - PATCH NOW, (Thu, Apr 14th)](https://isc.sans.edu/diary/rss/28550) - - [ISC Stormcast For Thursday, April 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=7964, (Thu, Apr 14th)](https://isc.sans.edu/diary/rss/28548) -- bellingcat - - [Russia’s Kramatorsk ‘Facts’ Versus the Evidence](https://www.bellingcat.com/news/2022/04/14/russias-kramatorsk-facts-versus-the-evidence/) -- Schneier on Security - - [Upcoming Speaking Engagements](https://www.schneier.com/blog/archives/2022/04/upcoming-speaking-engagements-18.html) - - [Industrial Control System Malware Discovered](https://www.schneier.com/blog/archives/2022/04/industrial-control-system-malware-discovered.html) -- Hacking and security - - [OSCP pentesting commands - Checklist for Penetration Testing](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentesting-commands-checklist-for.html) - - [Using Amazon EC2 Instance Connect for SSH access to your EC2 Instances](https://hackingandsecurity.blogspot.com/2022/04/using-amazon-ec2-instance-connect-for.html) - - [Bash tasks](https://hackingandsecurity.blogspot.com/2022/04/bash-tasks.html) - - [OSCP pentesting - attack way - commands 7](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentesting-attack-way-commands-7.html) - - [Excellent quotes for life](https://hackingandsecurity.blogspot.com/2022/04/excellent-quotes-for-life.html) - - [More jokes...](https://hackingandsecurity.blogspot.com/2022/04/more-jokes.html) - - [How to apply for jobs...](https://hackingandsecurity.blogspot.com/2022/04/how-to-apply-for-jobs.html) - - [Netcat usage examples](https://hackingandsecurity.blogspot.com/2022/04/netcat-usage-examples.html) - - [OSCP pentesting commands - part 7](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentesting-commands-part-7.html) - - [OSCP commands part 6 - Web exploitation](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-6-web-exploitation.html) - - [The fundamentals to Windows System Security](https://hackingandsecurity.blogspot.com/2022/04/the-fundamentals-to-windows-system.html) - - [The Feynman Technique: The Best Way to Learn Anything](https://hackingandsecurity.blogspot.com/2022/04/the-feynman-technique-best-way-to-learn.html) - - [OSCP pentesting commands - shell generator part 5](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentesting-commands-shell.html) - - [OSCP commands part 5 - privilege escalation](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-5-privilege.html) - - [OSCP pentestesting commands part 4](https://hackingandsecurity.blogspot.com/2022/04/oscp-pentestesting-commands-part-4.html) - - [OSCP commands part 3](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-3.html) - - [OSCP Commands part 2](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-2.html) - - [OSCP commands part 1](https://hackingandsecurity.blogspot.com/2022/04/oscp-commands-part-1.html) -- Full Disclosure - - [AST-2022-003: func_odbc: Possible SQL Injection](https://seclists.org/fulldisclosure/2022/Apr/19) - - [AST-2022-002: res_stir_shaken: SSRF vulnerability with Identity header](https://seclists.org/fulldisclosure/2022/Apr/18) - - [AST-2022-001: res_stir_shaken: resource exhaustion with large files](https://seclists.org/fulldisclosure/2022/Apr/17) -- TorrentFreak - - [ACE Shuts Down Massive Pirate Site After Locating Owner in Remote Peru](https://torrentfreak.com/ace-shuts-down-massive-pirate-site-after-locating-owner-in-remote-peru-220414/) - - [Police Shut ‘Club Penguin Rewritten’, 3 Arrested For Copyright Infringement](https://torrentfreak.com/police-shut-club-penguin-rewritten-3-arrested-for-copyright-infringement-220414/) -- Security Affairs - - [US gov agencies e private firms warn nation-state actors are targeting ICS & SCADA devices](https://securityaffairs.co/wordpress/130195/apt/us-gov-warns-apt-targets-ics-scada.html) - - [CISA adds Windows CLFS Driver Privilege Escalation flaw to its Known Exploited Vulnerabilities Catalog](https://securityaffairs.co/wordpress/130191/hacking/cisa-adds-windows-clfs-driver-privilege-escalation-flaw-to-its-known-exploited-vulnerabilities-catalog.html) - - [Critical VMware Workspace ONE Access CVE-2022-22954 flaw actively exploited](https://securityaffairs.co/wordpress/130188/hacking/vmware-workspace-one-access-flaw-attacks.html) - - [Microsoft has taken legal and technical action to dismantle the Zloader botnet](https://securityaffairs.co/wordpress/130181/malware/microsoft-disrupts-zloader-malware-infrastructure.html) -- KitPloit - PenTest Tools! - - [vAPI - Vulnerable Adversely Programmed Interface Which Is Self-Hostable API That Mimics OWASP API Top 10 Scenarios Through Exercises](http://www.kitploit.com/2022/04/vapi-vulnerable-adversely-programmed.html) - - [365Inspect - A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments](http://www.kitploit.com/2022/04/365inspect-powershell-script-that.html) -- Threatpost - - [Feds: APTs Have Tools That Can Take Over Critical Infrastructure](https://threatpost.com/feds-apts-critical-infrastructure/179291/) -- The Register - Security - - [Cisco's Webex app phoned home audio telemetry even when muted](https://go.theregister.com/feed/www.theregister.com/2022/04/14/muting_ciscos_webex_app_doesnt/) - - [Microsoft-led move takes down ZLoader botnet domains](https://go.theregister.com/feed/www.theregister.com/2022/04/14/microsoftled_zloader_botnet/) - - [Threat group builds custom malware to attack industrial systems](https://go.theregister.com/feed/www.theregister.com/2022/04/14/hackers-custom-malware-ics-scada/) - - [Microsoft details how China-linked crew's malware hides scheduled Windows tasks](https://go.theregister.com/feed/www.theregister.com/2022/04/14/microsoft-tarrask-malware-in-windows/) - - [Don't let ransomware crooks spend months in your network – like this govt agency did](https://go.theregister.com/feed/www.theregister.com/2022/04/14/ransomware_gang_network/) -- DEF CON Announcements! - - [Training Coming to DEF CON 30, Call for Training is Open!](https://defcon.org/html/defcon-30/dc-30-cft.html) -- blackMORE Ops - - [Quick Snap Cheat Sheet for Ubuntu](https://www.blackmoreops.com/2022/04/15/quick-snap-cheat-sheet-for-ubuntu/) -- The Hacker News - - [Ethereum Developer Jailed 63 Months for Helping North Korea Evade Sanctions](https://thehackernews.com/2022/04/ethereum-developer-jailed-63-months-for.html) - - [New EnemyBot DDoS Botnet Borrows Exploit Code from Mirai and Gafgyt](https://thehackernews.com/2022/04/new-enemybot-ddos-botnet-borrows.html) - - [Microsoft Disrupts ZLoader Cybercrime Botnet in Global Operation](https://thehackernews.com/2022/04/microsoft-disrupts-zloader-cybercrime.html) - - [U.S. Warns of APT Hackers Targeting ICS/SCADA Systems with Specialized Malware](https://thehackernews.com/2022/04/us-warns-of-apt-hackers-targeting.html) - - [Microsoft Exposes Evasive Chinese Tarrask Malware Attacking Windows Computers](https://thehackernews.com/2022/04/microsoft-exposes-evasive-chinese.html) - - [Russian Hackers Tried Attacking Ukraine's Power Grid with Industroyer2 Malware](https://thehackernews.com/2022/04/russian-hackers-tried-attacking.html) - - [E.U. Officials Reportedly Targeted with Israeli Pegasus Spyware](https://thehackernews.com/2022/04/eu-officials-reportedly-targeted-with.html) - - [Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service](https://thehackernews.com/2022/04/over-16500-sites-hacked-to-distribute.html) - - [Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai Botnet Malware](https://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html) -- Instapaper: Unread - - [Baldoni (ACN) “Siamo al lavoro su circolare con black list fornitori cyber”](https://www.cybersecitalia.it/baldoni-acn-siamo-al-lavoro-su-circolare-con-black-list-fornitori-cyber/18214/) - - [Microsoft uses court order to disrupt ZLoader botnet](https://therecord.media/microsoft-uses-court-order-to-disrupt-zloader-botnet/) - - [[Air]Tag You're It!](https://blog.d204n6.com/2022/04/airtag-youre-it.html) -- Dark Reading - - [greymatter.io Closes $7.1 Million Series A to Meet Rising Need for Its Enterprise Microservices Platform](https://www.darkreading.com/cloud/greymatter-io-closes-7-1-million-series-a-to-meet-rising-need-for-its-enterprise-microservices-platform) - - [Kaspersky Relocates Cyberthreat-Related Data Processing for Users in Latin America and Middle East to Switzerland](https://www.darkreading.com/threat-intelligence/kaspersky-relocates-cyberthreat-related-data-processing-for-users-in-latin-america-and-middle-east-to-switzerland) - - [New Malware Tools Pose 'Clear and Present Threat' to ICS Environments](https://www.darkreading.com/threat-intelligence/new-malware-tools-a-clear-and-present-threat-to-ics-environments) - - [Data Scientists, Watch Out: Attackers Have Your Number](https://www.darkreading.com/attacks-breaches/data-scientists-watch-out-attackers-have-your-number) - - [Inside a Data Center Outage: Lessons About Resilience](https://www.darkreading.com/dr-tech/case-study-of-a-data-center-outage-building-multidimensional-resilience-in-sase-networks) - - [The Misconceptions of 2021's Black Swan Cyber Events](https://www.darkreading.com/attacks-breaches/the-misconceptions-of-2021-s-black-swan-cyber-events) diff --git a/archive/2022/2022-04-16.md b/archive/2022/2022-04-16.md deleted file mode 100644 index 3b2f54c238..0000000000 --- a/archive/2022/2022-04-16.md +++ /dev/null @@ -1,223 +0,0 @@ -# 每日安全资讯（2022-04-16） - -- Files ≈ Packet Storm - - [Asterisk Project Security Advisory - AST-2022-003](https://packetstormsecurity.com/files/166746/AST-2022-003.txt) - - [Asterisk Project Security Advisory - AST-2022-002](https://packetstormsecurity.com/files/166745/AST-2022-002.txt) - - [Asterisk Project Security Advisory - AST-2022-001](https://packetstormsecurity.com/files/166744/AST-2022-001.txt) - - [Siemens A8000 CP-8050/CP-8031 SICAM WEB Missing File Download / Missing Authentication](https://packetstormsecurity.com/files/166743/SA-20220413.txt) - - [Are You Really Muted? A Privacy Analysis Of Mute Buttons In Video Conferencing Apps](https://packetstormsecurity.com/files/166742/vca_mute.pdf) - - [Backdoor.Win32.NetSpy.10 Remote Command Execution](https://packetstormsecurity.com/files/166741/MVID-2022-0551.txt) - - [Backdoor.Win32.NetCat32.10 Remote Command Execution](https://packetstormsecurity.com/files/166740/MVID-2022-0550.txt) - - [Backdoor.Win32.NinjaSpy.c Authentication Bypass](https://packetstormsecurity.com/files/166739/MVID-2022-0552.txt) - - [Email-Worm.Win32.Pluto.b Insecure Permissions](https://packetstormsecurity.com/files/166738/MVID-2022-0547.txt) - - [Backdoor.Win32.Kilo.016 Denial Of Service](https://packetstormsecurity.com/files/166737/MVID-2022-0546.txt) - - [HackTool.Win32.IpcScan.c Buffer Overflow](https://packetstormsecurity.com/files/166736/MVID-2022-0549.txt) - - [Backdoor.Win32.Psychward.03.a Weak Hardcoded Password](https://packetstormsecurity.com/files/166735/MVID-2022-0548.txt) - - [Backdoor.Win32.Prorat.cwx Insecure Permissions](https://packetstormsecurity.com/files/166734/MVID-2022-0545.txt) - - [Backdoor.Win32.MotivFTP.12 Authentication Bypass](https://packetstormsecurity.com/files/166733/MVID-2022-0544.txt) - - [Red Hat Security Advisory 2022-1379-01](https://packetstormsecurity.com/files/166732/RHSA-2022-1379-01.txt) - - [Red Hat Security Advisory 2022-1378-01](https://packetstormsecurity.com/files/166731/RHSA-2022-1378-01.txt) - - [Microsoft HTTP Protocol Stack Denial Of Service](https://packetstormsecurity.com/files/166730/CVE-2022-21907.py.txt) -- Sec-News 安全文摘 - - [SCA的困境和出路](https://wiki.ioin.in/url/9Nnk) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Easy!Appointments Information Disclosure](https://cxsecurity.com/issue/WLB-2022040061) - - [Backdoor.Win32.NinjaSpy.c / Authentication Bypass](https://cxsecurity.com/issue/WLB-2022040060) - - [jsharp Technology - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022040059) - - [Signature Software - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022040058) - - [Miracle Hunt Services - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022040057) - - [HackTool.Win32.IpcScan.c / Local Stack Buffer Overflow](https://cxsecurity.com/issue/WLB-2022040056) - - [Email-Worm.Win32.Pluto.b / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022040055) - - [Backdoor.Win32.Prorat.cwx / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022040054) - - [Backdoor.Win32.NetSpy.10 / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022040053) - - [Backdoor.Win32.Psychward.03.a / Weak Hardcoded Password](https://cxsecurity.com/issue/WLB-2022040052) - - [Backdoor.Win32.Kilo.016 / Denial of Service (UDP Datagram)](https://cxsecurity.com/issue/WLB-2022040051) - - [Backdoor.Win32.NetCat32.10 / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022040050) -- Sploitus.com Exploits RSS Feed - - [Backdoor.Win32.Kilo.016 Denial Of Service exploit](https://sploitus.com/exploit?id=PACKETSTORM:166737&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.NetCat32.10 Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:166740&utm_source=rss&utm_medium=rss) - - [Siemens A8000 CP-8050/CP-8031 SICAM WEB Missing File Download / Missing Authentication exploit](https://sploitus.com/exploit?id=PACKETSTORM:166743&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.NetSpy.10 Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:166741&utm_source=rss&utm_medium=rss) - - [Microsoft HTTP Protocol Stack Denial Of Service exploit](https://sploitus.com/exploit?id=PACKETSTORM:166730&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.MotivFTP.12 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:166733&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Psychward.03.a Weak Hardcoded Password exploit](https://sploitus.com/exploit?id=PACKETSTORM:166735&utm_source=rss&utm_medium=rss) - - [Email-Worm.Win32.Pluto.b Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:166738&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Prorat.cwx Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:166734&utm_source=rss&utm_medium=rss) - - [HackTool.Win32.IpcScan.c Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:166736&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.NinjaSpy.c Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:166739&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2021-31805 exploit](https://sploitus.com/exploit?id=F30ACAD3-0FC4-58C8-84CF-A8FFF2BE55B4&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-22954 exploit](https://sploitus.com/exploit?id=479D22AB-BE97-51BA-82CC-F8945ED02516&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26809 exploit](https://sploitus.com/exploit?id=706A6EEB-1D07-53EB-8455-F7809863DADC&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Wps Wps Office exploit](https://sploitus.com/exploit?id=65F6FBF4-8932-5F52-8F69-DC63D6E7469B&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=7471B2E5-0795-58A2-B004-880BFD75BC0A&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Vmware Spring Cloud Gateway exploit](https://sploitus.com/exploit?id=159F2FD0-B230-5CB7-B1E6-E7A0ABD62FDE&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-29072 exploit](https://sploitus.com/exploit?id=44D0AF62-511E-5D2A-A63E-4536C317DB6C&utm_source=rss&utm_medium=rss) -- 跳跳糖 - 安全与分享社区 - - [内网渗透--NTLM中继与反射浅析](https://tttang.com/archive/1548/) -- Security Boulevard - - [PHP Web Application Security – How to protect your WordPress website](https://securityboulevard.com/2022/04/php-web-application-security-how-to-protect-your-wordpress-website/) - - [What’s the Best Movie About Hackers? (Book Review)](https://securityboulevard.com/2022/04/whats-the-best-movie-about-hackers-book-review/) - - [INCONTROLLER: Acting to Protect Customers from Unknown Threats](https://securityboulevard.com/2022/04/incontroller-acting-to-protect-customers-from-unknown-threats/) - - [BSides Budapest 2021: Vivek Malik’s & Kumar Vikramjeet’s ‘One Stop Anomaly Shop’](https://securityboulevard.com/2022/04/bsides-budapest-2021-vivek-maliks-kumar-vikramjeets-one-stop-anomaly-shop/) - - [Russia Losing War Because Unable to “Build Airplane in Flight”](https://securityboulevard.com/2022/04/russia-losing-war-because-unable-to-build-airplane-in-flight/) - - [CISO Thoughts with David Lindner – April 15](https://securityboulevard.com/2022/04/ciso-thoughts-with-david-lindner-april-15/) - - [Online Document Verification: How Does It Work?](https://securityboulevard.com/2022/04/online-document-verification-how-does-it-work/) - - [Joy Of Tech® ‘AI Mood Detector’](https://securityboulevard.com/2022/04/joy-of-tech-ai-mood-detector/) -- obaby@mars - - [Win10修改已连接网络的名称](http://h4ck.org.cn/2022/04/win10%e4%bf%ae%e6%94%b9%e5%b7%b2%e8%bf%9e%e6%8e%a5%e7%bd%91%e7%bb%9c%e7%9a%84%e5%90%8d%e7%a7%b0/) -- 安全客-有思想的安全新媒体 - - [CVE-2021-22205 GITLAB 未授权 RCE 漏洞](https://www.anquanke.com/post/id/272061) - - [专题·网安意识 | 美国网络安全意识教育举措概述](https://www.anquanke.com/post/id/272068) - - [360核心安全大脑，将17年积累的安全能力直达用户](https://www.anquanke.com/post/id/272040) - - [2022安全客优质分享计划第一期 | V8 Inline Cache源码分析](https://www.anquanke.com/post/id/272093) - - [ERC721R 风险分析](https://www.anquanke.com/post/id/272039) - - [数字安全观察-每周简报 （2022.03.26 -2022.04.08）](https://www.anquanke.com/post/id/272084) - - [数据安全事件应急及溯源分析实践案例](https://www.anquanke.com/post/id/272008) - - [新的Fodcha DDoS僵尸网络每天针对100多名受害者](https://www.anquanke.com/post/id/272059) -- FreeBuf网络安全行业门户 - - [思科修复高危身份验证绕过漏洞](https://www.freebuf.com/news/329230.html) - - [新型Enemybot DDoS僵尸网络借用Mirai和Gafgyt攻击代码](https://www.freebuf.com/news/329177.html) - - [CISA警告机构修补积极利用的Windows LPE错误](https://www.freebuf.com/articles/329172.html) - - [FreeBuf甲方群话题讨论 | 聊聊企业资产安全管理](https://www.freebuf.com/articles/neopoints/329171.html) - - [谷歌浏览器紧急更新，又修复一零日漏洞](https://www.freebuf.com/news/329068.html) - - [想不到，美国核设施太老竟成保命关键？](https://www.freebuf.com/news/329061.html) - - [2022年第一季度美国数据泄露持续上升，“未知”成最大攻击媒介](https://www.freebuf.com/news/329060.html) - - [常见框架漏洞复现—Apache Struts2](https://www.freebuf.com/vuls/325493.html) - - [Spring Cloud Gateway 远程代码执行漏洞分析（CVE-2022-22947）](https://www.freebuf.com/articles/web/328282.html) -- 绿盟科技技术博客 - - [俄乌信息技术供应链制裁中的认知“谜团”观察](http://blog.nsfocus.net/way-exp/) -- Trail of Bits Blog - - [The Frozen Heart vulnerability in Bulletproofs](https://blog.trailofbits.com/2022/04/15/the-frozen-heart-vulnerability-in-bulletproofs/) -- SpiderLabs Blog from Trustwave - - [Tough Times for Ukrainian Honeypot?](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tough-times-for-ukrainian-honeypot/) -- Hex Rays - - [Igor’s tip of the week #85: Source-level debugging](https://hex-rays.com/blog/igors-tip-of-the-week-85-source-level-debugging/) -- Reverse Engineering - - [How to Troubleshoot Arcade Boards! Reverse engineering Konami security keys and chips](https://www.reddit.com/r/ReverseEngineering/comments/u477es/how_to_troubleshoot_arcade_boards_reverse/) - - [I failed... but tomorrow is another day](https://www.reddit.com/r/ReverseEngineering/comments/u4k3u8/i_failed_but_tomorrow_is_another_day/) -- The Daily Swig | Cybersecurity news and views - - [Tearing down red flags: Women in CyberSecurity’s Lynn Dohm on tackling the high exit rate of female infosec pros](https://portswigger.net/daily-swig/tearing-down-red-flags-women-in-cybersecuritys-lynn-dohm-on-tackling-the-high-exit-rate-of-female-infosec-pros) -- Hacking Articles - - [A Detailed Guide on Medusa](https://www.hackingarticles.in/a-detailed-guide-on-medusa/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 16](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-16-3/) -- HAHWUL - - [SSE(Server Sent Event)](https://www.hahwul.com/cullinan/sse/) -- Ghostlulz Hacks - - [Cypher Injection (Neo4j) Graph Databases](http://ghostlulz.com/cypher-injection-neo4j-graph-databases/?utm_source=rss&utm_medium=rss&utm_campaign=cypher-injection-neo4j-graph-databases) -- 奇客Solidot–传递最新科技情报 - - [主要平台宣布将展示帐号 IP 属地](https://www.solidot.org/story?sid=71262) - - [Google 释出紧急更新修复正被利用的 Chrome 0day 漏洞](https://www.solidot.org/story?sid=71261) - - [密码检查算法高危漏洞允许任何人登陆思科的 Wi-Fi 管理软件](https://www.solidot.org/story?sid=71260) - - [从简单 AI 获得新理解](https://www.solidot.org/story?sid=71258) - - [儿童严重肝病病例引发国际调查](https://www.solidot.org/story?sid=71257) - - [融化的冰盖可能不会阻挡洋流](https://www.solidot.org/story?sid=71256) - - [热电池可有效将风能太阳能存储在可再生电网中](https://www.solidot.org/story?sid=71255) - - [玩家普及 Windows 11 的速度远逊于 Windows 10](https://www.solidot.org/story?sid=71254) - - [视频网站禁止直播未经批准的网游](https://www.solidot.org/story?sid=71253) - - [俄罗斯干扰乌克兰地区的 GPS 信号](https://www.solidot.org/story?sid=71252) - - [Twitter 董事会准备反击 Elon Musk 的收购提议](https://www.solidot.org/story?sid=71251) -- KitPloit - PenTest & Hacking Tools - - [Shhhloader - SysWhispers Shellcode Loader](http://www.kitploit.com/2022/04/shhhloader-syswhispers-shellcode-loader.html) - - [modifyCertTemplate - ADCS Cert Template Modification And ACL Enumeration](http://www.kitploit.com/2022/04/modifycerttemplate-adcs-cert-template.html) -- Blog – NTT Application Security - - [4 Cybersecurity Tax Tips for Last-Minute Filers](https://www.whitehatsec.com/blog/4-cybersecurity-tax-tips-for-last-minute-filers/) -- Forensic Focus - - [Magnet Forensics Previews New and Upcoming Product Updates to Magnet Digital Investigation Suite](https://www.forensicfocus.com/news/magnet-forensics-previews-new-and-upcoming-product-updates-to-magnet-digital-investigation-suite/) - - [Oxygen Forensics presents major enhancements to computer artifact support](https://www.forensicfocus.com/news/oxygen-forensics-presents-major-enhancements-to-computer-artifact-support/) -- Have I Been Pwned latest breaches - - [Avvo - 4,101,101 breached accounts](https://haveibeenpwned.com/PwnedWebsites#Avvo) -- IT Service Management News - - [Stato degli standard ISO/IEC 270xx](http://blog.cesaregallotti.it/2022/04/stato-degli-standard-isoiec-270xx.html) -- Troy Hunt's Blog - - [Breach Disclosure Blow-by-Blow: Here's Why It's so Hard](https://www.troyhunt.com/breach-disclosure-blow-by-blow-heres-why-its-so-hard/) - - [Weekly Update 291](https://www.troyhunt.com/weekly-update-291/) -- Il Disinformatico - - [Podcast RSI - Il primo video virale di Internet: Star Wars Kid](http://attivissimo.blogspot.com/2022/04/podcast-rsi-il-primo-video-virale-di.html) -- Daniel Miessler - - [A Quick Thought on Musk Buying Twitter](https://danielmiessler.com/blog/a-quick-thought-on-musk-buying-twitter/) -- 0x00sec - The Home of the Hacker - Top topics - - [Awesome malware development resources](https://0x00sec.org/t/awesome-malware-development-resources/29020) -- SANS Internet Storm Center, InfoCON: green - - [ISC Stormcast For Friday, April 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=7966, (Fri, Apr 15th)](https://isc.sans.edu/diary/rss/28552) -- Schneier on Security - - [Friday Squid Blogging: Strawberry Squid Video](https://www.schneier.com/blog/archives/2022/04/friday-squid-blogging-strawberry-squid-video.html) -- bellingcat - - [Russia’s QAnon Followers Can’t Make Up Their Minds About Ukraine](https://www.bellingcat.com/news/2022/04/15/russias-qanon-followers-cant-make-up-their-minds-about-ukraine/) -- TG Soft Software House - News - - [Auguri di Buona Pasqua dallo staff di TG Soft Cyber Security Specialist](http://www.tgsoft.it/italy/news_archivio.asp?id=1299) -- IntelTechniques Blog - - [The Privacy, Security, & OSINT Show – Episode 257](https://inteltechniques.com/blog/2022/04/15/the-privacy-security-osint-show-episode-257/) -- Security Affairs - - [Threat actors use Zimbra exploits to target organizations in Ukraine](https://securityaffairs.co/wordpress/130244/cyber-warfare-2/attacks-ukraine-govt-zimbra-exploits.html) - - [Conti Ransomware Gang claims responsibility for the Nordex hack](https://securityaffairs.co/wordpress/130238/cyber-crime/conti-ransomware-claims-nordex-attack.html) - - [ZingoStealer crimeware released for free in the cybercrime ecosystem](https://securityaffairs.co/wordpress/130229/breaking-news/zingostealer-crimeware.html) - - [Auth bypass flaw in Cisco Wireless LAN Controller Software allows device takeover](https://securityaffairs.co/wordpress/130217/security/auth-bypass-cisco-wireless-lan-controller.html) - - [Google fixed third zero-day in Chrome since the start of 2022](https://securityaffairs.co/wordpress/130213/security/google-chrome-zeroday-cve-2022-1364.html) - - [Ways to Develop a Cybersecurity Training Program for Employees](https://securityaffairs.co/wordpress/130211/security/cybersecurity-training-program.html) - - [Analysis of the SunnyDay ransomware](https://securityaffairs.co/wordpress/130204/malware/analysis-sunnyday-ransomware.html) -- The Register - Security - - [Feds offer $5m reward for info on North Korean cyber crooks](https://go.theregister.com/feed/www.theregister.com/2022/04/15/feds_north_korea_bounty/) - - [Star loses $500,000 NFT after crooks exploit Rarible market](https://go.theregister.com/feed/www.theregister.com/2022/04/15/rarible-flaw-nft/) - - [Cybercriminals do their homework for latest banking scam](https://go.theregister.com/feed/www.theregister.com/2022/04/15/the_latest_scam_pay_yourself/) - - [Google issues third emergency fix for Chrome this year](https://go.theregister.com/feed/www.theregister.com/2022/04/15/google-third-fix-chrome-vulnerability/) - - [North Korea's Lazarus cyber-gang caught 'spying' on chemical sector companies](https://go.theregister.com/feed/www.theregister.com/2022/04/15/lazarus_chemical_korea/) -- Dark Reading - - [Google Emergency Update Fixes Chrome Zero-Day](https://www.darkreading.com/attacks-breaches/google-emergency-update-fixes-chrome-zero-day) - - [Cloud Cost, Reliability Raise IT Concerns](https://www.darkreading.com/tech-trends/cloud-cost-reliability-raise-it-concerns) - - [Lazarus Targets Chemical Sector With 'Dream Jobs,' Then Trojans](https://www.darkreading.com/attacks-breaches/lazarus-targets-chemical-sector-with-dream-jobs-then-trojans) - - [CISA Alert on ICS, SCADA Devices Highlights Growing Enterprise IoT Security Risks](https://www.darkreading.com/omdia/cisa-alert-on-ics-scada-devices-highlights-growing-enterprise-iot-security-risks) - - [Cybersecurity Act of 2022: A Step in the Right Direction With a Significant Loophole](https://www.darkreading.com/vulnerabilities-threats/cybersecurity-act-of-2022-a-step-in-the-right-direction-with-a-significant-loophole) -- Securityinfo.it - - [Nuovo malware cinese per Windows](https://www.securityinfo.it/2022/04/15/nuovo-malware-cinese-per-windows/?utm_source=rss&utm_medium=rss&utm_campaign=nuovo-malware-cinese-per-windows) - - [Gli APT minacciano le infrastrutture critiche](https://www.securityinfo.it/2022/04/15/gli-apt-minacciano-le-infrastrutture-critiche/?utm_source=rss&utm_medium=rss&utm_campaign=gli-apt-minacciano-le-infrastrutture-critiche) -- TS-WAY - - [Weekly Threats N. 15 2022](https://www.ts-way.com/it/weekly-threats/2022/04/15/weekly-threats-n-15-2022/) -- KitPloit - PenTest Tools! - - [Shhhloader - SysWhispers Shellcode Loader](http://www.kitploit.com/2022/04/shhhloader-syswhispers-shellcode-loader.html) - - [modifyCertTemplate - ADCS Cert Template Modification And ACL Enumeration](http://www.kitploit.com/2022/04/modifycerttemplate-adcs-cert-template.html) -- Threatpost - - [Karakurt Ensnares Conti, Diavol Ransomware Groups in Its Web](https://threatpost.com/karakurt-conti-diavol-ransomware/179317/) -- TorrentFreak - - [DuckDuckGo Removes Pirate Sites and YouTube-DL from Its Search Results](https://torrentfreak.com/duckduckgo-removes-pirate-sites-and-youtube-dl-from-its-search-results-220415/) - - [YouTube Rejects Movie Piracy Claims and Content ID Critique](https://torrentfreak.com/youtube-rejects-movie-piracy-claims-and-content-id-critique-220415/) -- Computer Forensics - - [Autopsy web cache understanding](https://www.reddit.com/r/computerforensics/comments/u4dmfy/autopsy_web_cache_understanding/) - - [How Mobile Forensic tools work ??](https://www.reddit.com/r/computerforensics/comments/u40xnc/how_mobile_forensic_tools_work/) -- Full Disclosure - - [Adversary3 v1.0 / Malware vulnerability intel tool for third-party attackers / updated](https://seclists.org/fulldisclosure/2022/Apr/30) - - [Email-Worm.Win32.Pluto.b / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Apr/29) - - [Backdoor.Win32.Kilo.016 / Denial of Service (UDP Datagram)](https://seclists.org/fulldisclosure/2022/Apr/28) - - [Backdoor.Win32.NinjaSpy.c / Authentication Bypass](https://seclists.org/fulldisclosure/2022/Apr/27) - - [Backdoor.Win32.NetSpy.10 / Unauthenticated Remote Command Execution](https://seclists.org/fulldisclosure/2022/Apr/26) - - [Backdoor.Win32.NetCat32.10 / Unauthenticated Remote Command Execution](https://seclists.org/fulldisclosure/2022/Apr/25) - - [HackTool.Win32.IpcScan.c / Local Stack Buffer Overflow](https://seclists.org/fulldisclosure/2022/Apr/24) - - [Backdoor.Win32.Psychward.03.a / Weak Hardcoded Password](https://seclists.org/fulldisclosure/2022/Apr/23) - - [Backdoor.Win32.Prorat.cwx / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Apr/22) - - [Backdoor.Win32.MotivFTP.12 / Authentication Bypass](https://seclists.org/fulldisclosure/2022/Apr/21) - - [SEC Consult SA-20220413 :: Missing Authentication at File Download & Denial of Service in Siemens A8000 PLC](https://seclists.org/fulldisclosure/2022/Apr/20) -- Your Hacking Tutorial by Zempirians - - [How to identify zero-day phishing URL](https://www.reddit.com/r/HowToHack/comments/u47e5a/how_to_identify_zeroday_phishing_url/) - - [Windows Reverse Shell - Ethical Hacking](https://www.reddit.com/r/HowToHack/comments/u480v3/windows_reverse_shell_ethical_hacking/) - - [Evil-WinRM broken](https://www.reddit.com/r/HowToHack/comments/u432gn/evilwinrm_broken/) - - [Any RAT's working in 2022?](https://www.reddit.com/r/HowToHack/comments/u4h352/any_rats_working_in_2022/) - - [How does Nmap and Directory Traversal on a low level?](https://www.reddit.com/r/HowToHack/comments/u4f94f/how_does_nmap_and_directory_traversal_on_a_low/) - - [How to download firmware for security cameras](https://www.reddit.com/r/HowToHack/comments/u43poy/how_to_download_firmware_for_security_cameras/) -- /r/netsec - Information Security News & Discussion - - [[Techmonitor.ai] Failed cyberattack on Ukraine's electricity grid could indicate Russia's growing willingness to attack critical infrastructure](https://www.reddit.com/r/netsec/comments/u4hl7x/techmonitorai_failed_cyberattack_on_ukraines/) - - [iViewed your API keys](https://www.reddit.com/r/netsec/comments/u47hj7/iviewed_your_api_keys/) - - [New tool to exploit TURN servers - create a socks proxy into the internal network](https://www.reddit.com/r/netsec/comments/u4daum/new_tool_to_exploit_turn_servers_create_a_socks/) - - [Multiple Vulnerabilities in Cisco Expressway](https://www.reddit.com/r/netsec/comments/u4d8mr/multiple_vulnerabilities_in_cisco_expressway/) - - [Turncoat - Extract private messages from malware/phishing Telegram Bots](https://www.reddit.com/r/netsec/comments/u49kwt/turncoat_extract_private_messages_from/) - - [PYSA Ransomware Group Technical Analysis](https://www.reddit.com/r/netsec/comments/u4hrd5/pysa_ransomware_group_technical_analysis/) -- Blackhat Library: Hacking techniques and research - - [Delta Controls enteliTOUCH 3.40.3935 Cross Site Scripting ≈ Packet Storm](https://www.reddit.com/r/blackhat/comments/u40j2j/delta_controls_entelitouch_3403935_cross_site/) - - [Open source software fuzzing with AFL](https://www.reddit.com/r/blackhat/comments/u49w7u/open_source_software_fuzzing_with_afl/) -- Hakin9 – IT Security Magazine - - [365Inspect - a PowerShell script that automates the security assessment of Microsoft Office 365 environments](https://hakin9.org/365inspect-a-powershell-script-that-automates-the-security-assessment-of-microsoft-office-365-environments/) -- Deeplinks - - [Let's Encrypt Wins Levchin Prize For Work On Internet Security](https://www.eff.org/press/releases/lets-encrypt-wins-levchin-prize-work-internet-security) -- Paul's Security Weekly - - [ESW #269 - Bob Erdman & Justin Tolman](http://podcast.securityweekly.com/esw-269-bob-erdman-justin-tolman) - - [SWN #204 - Struts, Management Networks, Elon Spits in My Soup, & Zero-Days - Wrap Up](http://podcast.securityweekly.com/swn-204-struts-management-networks-elon-spits-in-my-soup-zero-days-wrap-up) - - [PSW #736 - Mike Wilkes & Amanda Berlin](http://podcast.securityweekly.com/psw-736-mike-wilkes-amanda-berlin) diff --git a/archive/2022/2022-04-17.md b/archive/2022/2022-04-17.md deleted file mode 100644 index a05b4b11ed..0000000000 --- a/archive/2022/2022-04-17.md +++ /dev/null @@ -1,77 +0,0 @@ -# 每日安全资讯（2022-04-17） - -- HackerOne Hacker Activity - - [[https://shipit-sox-staging.shopifycloud.com] Presence of multiple vulnerabilities present in Ruby On Rails](https://hackerone.com/reports/1400309) - - [Account takeover leading to PII chained with stored XSS](https://hackerone.com/reports/1483201) -- Sec-News 安全文摘 - - [Go template 遇上 yaml 反序列化 CVE-2022-21701 分析](https://wiki.ioin.in/url/k4BN) -- Security Boulevard - - [Keeping Those SSH Keys Safe](https://securityboulevard.com/2022/04/keeping-those-ssh-keys-safe/) - - [BSides Budapest 2021: Piotr Glaska’s ‘DNS in Offensive Techniques’](https://securityboulevard.com/2022/04/bsides-budapest-2021-piotr-glaskas-dns-in-offensive-techniques/) - - [XKCD ‘Geiger Counter’](https://securityboulevard.com/2022/04/xkcd-geiger-counter/) - - [BSides Budapest 2021: Daniel Nussko’s ‘Large-scale Security Analysis of IoT Firmware’](https://securityboulevard.com/2022/04/bsides-budapest-2021-daniel-nusskos-large-scale-security-analysis-of-iot-firmware/) - - [What is Image Spoofing and How to Prevent It?](https://securityboulevard.com/2022/04/what-is-image-spoofing-and-how-to-prevent-it/) - - [1964 Introduction to Distributed Communications Networks](https://securityboulevard.com/2022/04/1964-introduction-to-distributed-communications-networks/) - - [Meta Digs in Heels on Encryption](https://securityboulevard.com/2022/04/meta-digs-in-heels-on-encryption/) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-26809 exploit](https://sploitus.com/exploit?id=2A45AC5C-3583-5B97-96FD-54EDC121AE8B&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Facade Ignition exploit](https://sploitus.com/exploit?id=35896337-DA85-5D42-B9FC-4DF2E3EC881E&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=321A07F5-08A6-5CD6-8C0E-1C2F04B37061&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Exiftool Project Exiftool exploit](https://sploitus.com/exploit?id=D1EFC5A3-3F5B-5A00-9A45-80777934AC77&utm_source=rss&utm_medium=rss) -- Hexacorn - - [The Anti-VM trick that is kinda… personal](https://www.hexacorn.com/blog/2022/04/16/the-anti-vm-trick-that-is-kinda-personal/) -- Reverse Engineering - - [The Thread Context Explained (OALABS Tutorial)](https://www.reddit.com/r/ReverseEngineering/comments/u54ict/the_thread_context_explained_oalabs_tutorial/) -- Didier Stevens - - [Update: cut-bytes.py Version 0.0.14](https://blog.didierstevens.com/2022/04/16/update-cut-bytes-py-version-0-0-14/) -- SAUCERMAN - - [obection常见用法](https://saucer-man.com/information_security/911.html) -- KitPloit - PenTest & Hacking Tools - - [Kraken - A Multi-Platform Distributed Brute-Force Password Cracking System](http://www.kitploit.com/2022/04/kraken-multi-platform-distributed-brute.html) - - [EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections](http://www.kitploit.com/2022/04/edrsandblast-tool-that-weaponize.html) -- HAHWUL - - [Kiterunner](https://www.hahwul.com/cullinan/kiterunner/) -- panda | 热爱安全的理想少年 - - [从零开始，分析Spring Framework RCE](https://www.cnpanda.net/sec/1196.html) -- panda | 热爱安全的理想少年 - - [从零开始，分析Spring Framework RCE](https://blog.cnpanda.net/sec/1196.html) -- Luca Mercatanti - - [Copia forense informatica](https://luca-mercatanti.com/2022/04/16/copia-forense-informatica/?utm_source=rss&utm_medium=rss&utm_campaign=copia-forense-informatica) -- 0x00sec - The Home of the Hacker - Top topics - - [Writing a simple rootkit for linux](https://0x00sec.org/t/writing-a-simple-rootkit-for-linux/29034) - - [TCP server and TCP client in Python](https://0x00sec.org/t/tcp-server-and-tcp-client-in-python/29042) -- SANS Internet Storm Center, InfoCON: green - - [Office Protects You From Malicious ISO Files, (Sat, Apr 16th)](https://isc.sans.edu/diary/rss/28554) -- 黑海洋 - WIKI - - [最新版：Windows 11、Windows 7 精简系统](https://blog.upx8.com/2696) -- Rasta Mouse - - [Why Tool-Restricted Exams (Sometimes) Matter](https://rastamouse.me/why-tool-restricted-exams-sometimes-matter/) -- LockBoxx - - [The Newcomers of Shmoocon 2022](http://lockboxx.blogspot.com/2022/04/the-newcomers-of-shmoocon-2022.html) -- KitPloit - PenTest Tools! - - [Kraken - A Multi-Platform Distributed Brute-Force Password Cracking System](http://www.kitploit.com/2022/04/kraken-multi-platform-distributed-brute.html) - - [EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections](http://www.kitploit.com/2022/04/edrsandblast-tool-that-weaponize.html) -- /r/netsec - Information Security News & Discussion - - [Industroyer2: The Worst Sequel](https://www.reddit.com/r/netsec/comments/u4wzc3/industroyer2_the_worst_sequel/) - - [GitHub: Security alert - Attack campaign involving stolen OAuth user tokens issued to two third-party integrators (Heroku and Travis CI)](https://www.reddit.com/r/netsec/comments/u4mosv/github_security_alert_attack_campaign_involving/) -- Security Affairs - - [U.S. Gov believes North Korea-linked Lazarus APT is behind Ronin Validator cyber heist](https://securityaffairs.co/wordpress/130260/apt/lazarus-ronin-validator-cyber-heist.html) - - [The unceasing action of Anonymous against Russia](https://securityaffairs.co/wordpress/130262/hacktivism/anonymous-targets-russian-entities.html) - - [Threat actors target the Ukrainian gov with IcedID malware](https://securityaffairs.co/wordpress/130250/cyber-warfare-2/icedid-against-ukraine-gov-agencies.html) -- Dark Reading - - [Upgrades for Spring Framework Have Stalled](https://www.darkreading.com/edge-threat-monitor/upgrades-for-spring-framework-have-stalled) -- Social Engineering - - [How do you find our someone's fears without asking them directly?](https://www.reddit.com/r/SocialEngineering/comments/u4uib8/how_do_you_find_our_someones_fears_without_asking/) - - [Social engineering of the nuclear family](https://www.reddit.com/r/SocialEngineering/comments/u59ed9/social_engineering_of_the_nuclear_family/) - - [What skills does it take to be good at playing “mind games” with people?](https://www.reddit.com/r/SocialEngineering/comments/u4rr9h/what_skills_does_it_take_to_be_good_at_playing/) -- TorrentFreak - - [MPA/ACE Pounce on New Lookmovie Domain Plus Streaming & IPTV Sites](https://torrentfreak.com/mpa-ace-pounce-on-new-lookmovie-domain-plus-streaming-iptv-sites-220416/) -- Computer Forensics - - [Any ideas what college students would love to see from a guest speaker?](https://www.reddit.com/r/computerforensics/comments/u52g05/any_ideas_what_college_students_would_love_to_see/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [I want to learn hyperjacking. Can you guys provide sources to learn about the low level side of CS and hacking enough to understand hyperjacking](https://www.reddit.com/r/netsecstudents/comments/u4waoy/i_want_to_learn_hyperjacking_can_you_guys_provide/) -- Your Hacking Tutorial by Zempirians - - [RTL8812au monitor mode, poor results](https://www.reddit.com/r/HowToHack/comments/u574cc/rtl8812au_monitor_mode_poor_results/) - - [Can TryHackMe be a starting point to a legitimate career?](https://www.reddit.com/r/HowToHack/comments/u4qncl/can_tryhackme_be_a_starting_point_to_a_legitimate/) - - [Tool to search inside deleted or overwritten data](https://www.reddit.com/r/HowToHack/comments/u4v1dd/tool_to_search_inside_deleted_or_overwritten_data/) - - [Help on how to get remote access to a file on another person’s computer](https://www.reddit.com/r/HowToHack/comments/u4psoe/help_on_how_to_get_remote_access_to_a_file_on/) diff --git a/archive/2022/2022-04-18.md b/archive/2022/2022-04-18.md deleted file mode 100644 index 057112c907..0000000000 --- a/archive/2022/2022-04-18.md +++ /dev/null @@ -1,80 +0,0 @@ -# 每日安全资讯（2022-04-18） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Delta Controls enteliTOUCH 3.40.3935 Cookie User Password Disclosure](https://cxsecurity.com/issue/WLB-2022040067) - - [WordPress Elementor 3.6.2 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022040066) - - [Delta Controls enteliTOUCH 3.40.3935 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022040065) - - [Siemens A8000 CP-8050/CP-8031 SICAM WEB Missing File Download / Missing Authentication](https://cxsecurity.com/issue/WLB-2022040064) - - [Backdoor.Win32.MotivFTP.12 / Authentication Bypass](https://cxsecurity.com/issue/WLB-2022040063) - - [Telegram Android v8.4.4 - Denial of Service](https://cxsecurity.com/issue/WLB-2022040062) -- Sploitus.com Exploits RSS Feed - - [Exploit for Improper Initialization in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=C9458BBE-5F11-5BB6-BE59-8D6EC5E3D513&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-1329 exploit](https://sploitus.com/exploit?id=69B991D7-6686-5F6B-A840-CCBC07FFA5F1&utm_source=rss&utm_medium=rss) - - [Exploit for Deserialization of Untrusted Data in Apache Log4J exploit](https://sploitus.com/exploit?id=9B0163DC-EE41-5E66-9AA8-A960262A2072&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [OWASP® Global AppSec US 2021 Virtual – Jim Manico’s ‘Keynote: Request Forgery On The Web – SSRF, CSRF And Clickjacking’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-jim-manicos-keynote-request-forgery-on-the-web-ssrf-csrf-and-clickjacking/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 377’](https://securityboulevard.com/2022/04/robert-m-lees-jeff-haas-little-bobby-comic-week-377/) - - [OWASP® Global AppSec US 2021 Virtual – Adam Shostack’s ‘Keynote: 25 Years in AppSec: Looking Back, Looking Forward’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-adam-shostacks-keynote-25-years-in-appsec-looking-back-looking-forward/) -- WeiyiGeek Blog - - [自媒体文章/BiliBili/test](https://blog.weiyigeek.top/2022/4-17-index.html) -- ArthurChiao's Blog - - [Cracking Kubernetes RBAC Authorization Model](https://arthurchiao.github.io/blog/cracking-k8s-authz-rbac/) -- Didier Stevens - - [Update: 1768.py Version 0.0.13](https://blog.didierstevens.com/2022/04/17/update-1768-py-version-0-0-13/) -- Reverse Engineering - - [Reverse engineering Flutter apps](https://www.reddit.com/r/ReverseEngineering/comments/u5bi7r/reverse_engineering_flutter_apps/) - - [Spock SLAF is a Shared Library for Application Firewall "SLAF". It has the purpose to protect any service that uses the OpenSSL library. The SLAF inserts hooking to intercept all communication to detect security anomalies and block and log attacks.](https://www.reddit.com/r/ReverseEngineering/comments/u5ch5k/spock_slaf_is_a_shared_library_for_application/) -- HAHWUL - - [[Cullinan #32] Add SSE and Kiterunner!](https://www.hahwul.com/2022/04/18/cullinan-32/) -- 博客园 - 郑瀚Andrew.Hann - - [绿色有机农场商业可行性分析 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16146641.html) -- KitPloit - PenTest & Hacking Tools - - [linWinPwn - A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks](http://www.kitploit.com/2022/04/linwinpwn-bash-script-that-automates.html) - - [OWASP Coraza WAF - A Golang Modsecurity Compatible Web Application Firewall Library](http://www.kitploit.com/2022/04/owasp-coraza-waf-golang-modsecurity.html) -- 奇客Solidot–传递最新科技情报 - - [Richard Stallman 谈论自由软件运动的现状](https://www.solidot.org/story?sid=71267) - - [社交网络让我们变蠢？](https://www.solidot.org/story?sid=71266) -- 黑海洋 - WIKI - - [宝塔Linux面板 V7.5.1 免授权永久企业版脚本](https://blog.upx8.com/2701) - - [宝塔Linux工具箱BTPanel_Tools 2021.12.22](https://blog.upx8.com/2700) - - [宝塔Linux面板_v7.7.0_解锁付费插件教程分享](https://blog.upx8.com/2699) - - [全网直播视频下载器SPXZQv1.1.903.382吾爱破解专版](https://blog.upx8.com/2698) - - [万能TXT文件批量处理小工具](https://blog.upx8.com/2697) -- ImperialViolet - - [The several canons of CBOR](http://www.imperialviolet.org/2022/04/17/canonsofcbor.html) -- SANS Internet Storm Center, InfoCON: green - - [Video: Office Protects You From Malicious ISO Files, (Sun, Apr 17th)](https://isc.sans.edu/diary/rss/28556) -- KitPloit - PenTest Tools! - - [linWinPwn - A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks](http://www.kitploit.com/2022/04/linwinpwn-bash-script-that-automates.html) - - [OWASP Coraza WAF - A Golang Modsecurity Compatible Web Application Firewall Library](http://www.kitploit.com/2022/04/owasp-coraza-waf-golang-modsecurity.html) -- Security Affairs - - [Enemybot, a new DDoS botnet appears in the threat landscape](https://securityaffairs.co/wordpress/130291/cyber-crime/enemybot-botnet-ddos.html) - - [Stolen OAuth tokens used to download data from dozens of organizations, GitHub warns](https://securityaffairs.co/wordpress/130279/hacking/github-warns-stolen-oauth-tokens-access-data.html) - - [Security Affairs newsletter Round 361 by Pierluigi Paganini](https://securityaffairs.co/wordpress/130275/breaking-news/security-affairs-newsletter-round-361-by-pierluigi-paganini.html) -- Computer Forensics - - [Leveldb File Forensics](https://www.reddit.com/r/computerforensics/comments/u5pzsn/leveldb_file_forensics/) -- TorrentFreak - - [Delayed Megaupload Lawsuits Get Assigned to Ninjavideo Judge](https://torrentfreak.com/delayed-megaupload-lawsuits-get-assigned-to-ninjavideo-judge-220417/) -- 微步在线研究响应中心 - - [安全威胁情报周报（4.11~4.17）](https://mp.weixin.qq.com/s?__biz=MzA5MDc1NDc1MQ==&mid=2247492994&idx=1&sn=cb9deaf7b2209ec1d4e70a465c4d621b&chksm=90047e52a773f744046de9af9ca15438b3c7a640fdc565254f2cfe797b16a9834e1795ab8aef&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Free Network+ Training Assistance for the folks who need it](https://www.reddit.com/r/netsecstudents/comments/u5iozu/free_network_training_assistance_for_the_folks/) -- /r/netsec - Information Security News & Discussion - - [THCon CTF Writeup - SHA-1 exploitation, PHP LFI and RCE](https://www.reddit.com/r/netsec/comments/u5w81c/thcon_ctf_writeup_sha1_exploitation_php_lfi_and/) - - [Semgrep rules for smart contracts based on DeFi exploits](https://www.reddit.com/r/netsec/comments/u5u9tw/semgrep_rules_for_smart_contracts_based_on_defi/) - - [Spock SLAF is a Shared Library for Application Firewall "SLAF". It has the purpose to protect any service that uses the OpenSSL library. The SLAF inserts hooking to intercept all communication to detect security anomalies and block and log attacks.](https://www.reddit.com/r/netsec/comments/u5cdh2/spock_slaf_is_a_shared_library_for_application/) - - [Packets Remystified: Broadcast Brujería](https://www.reddit.com/r/netsec/comments/u5h3sn/packets_remystified_broadcast_brujería/) -- 情报分析师 - - [重磅图文432页|《美国武器系统手册》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497793&idx=1&sn=086e552b85bd42d82a2694f22ba28438&chksm=87164d4ab061c45ce7293b45bf1c15440b687112b30a458f12bb0e265cc75660ed0e27dc20a4&scene=58&subscene=0#rd) - - [人力情报技术：警察面谈和审讯中的暗示性](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497793&idx=2&sn=5c527ee622c54ad8b0d65e912a04cf41&chksm=87164d4ab061c45c835b90e2b0975176f541a9172ee57223014031ca001cf5fe75eeafdd1081&scene=58&subscene=0#rd) - - [20款适用于网络安全专家的免费取证调查工具](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497793&idx=3&sn=d66c776736a7100b7baddc32c5a31c1e&chksm=87164d4ab061c45cc35a47bac016c927f77cfd6b1cbbf709f6a0e3c611e742ca9640e1085c97&scene=58&subscene=0#rd) -- 云鼎实验室 - - [每周云安全资讯-2022年第16周](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494298&idx=1&sn=a2d4efb6bdef8f9753f2e7290d667f6a&chksm=fd79161cca0e9f0ad4f99c266cff85294016fb6f47af36dab2ec27efc969d6ace72ddc763779&scene=58&subscene=0#rd) -- 数世咨询 - - [数世咨询《API安全研究报告2022》正式发布 附下载](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492784&idx=1&sn=34a34070f33a990bb3e4cbbb419b522b&chksm=c144960df6331f1b105dd44b78e77dbcd20fb327be67ab44202afd68d4fb3e7c726e3ef7e289&scene=58&subscene=0#rd) - - [SentinelOne 6.17亿美元收购身份安全供应商Attivo Networks](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492784&idx=2&sn=68995d1db236460e47cacddf94d0da00&chksm=c144960df6331f1b9bbab7676d9a0bbeded64b285d5980a3456f44b924db90a5eaca0967ed18&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [Setting up remote access and a kill switch for my desktop.](https://www.reddit.com/r/HowToHack/comments/u5pkq8/setting_up_remote_access_and_a_kill_switch_for_my/) - - [Wifipumpkin3 no Internet on clients side.](https://www.reddit.com/r/HowToHack/comments/u5uadm/wifipumpkin3_no_internet_on_clients_side/) - - [Buffer Overflow with SUID help](https://www.reddit.com/r/HowToHack/comments/u5tzlt/buffer_overflow_with_suid_help/) - - [Radio frequency](https://www.reddit.com/r/HowToHack/comments/u5mfcn/radio_frequency/) diff --git a/archive/2022/2022-04-19.md b/archive/2022/2022-04-19.md deleted file mode 100644 index 0b22c5b6e8..0000000000 --- a/archive/2022/2022-04-19.md +++ /dev/null @@ -1,228 +0,0 @@ -# 每日安全资讯（2022-04-19） - -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5379-1](https://packetstormsecurity.com/files/166748/USN-5379-1.txt) - - [AIEngine 2.1.0](https://packetstormsecurity.com/files/166747/aiengine-2.1.0.tar.gz) -- Sec-News 安全文摘 - - [CVE-2022-22954 VMware Workspace ONE Access Server-side Template Injection RCE](https://wiki.ioin.in/url/nYZ2) - - [再探BeaconEye](https://wiki.ioin.in/url/MMZX) -- HackerOne Hacker Activity - - [An attacker can archive and unarchive any structured scope object on HackerOne](https://hackerone.com/reports/1501611) - - [SSRF occurrence in website preview used by LINE Official Account Manager (https://manager.line.biz)](https://hackerone.com/reports/1131608) - - [Deleting someone else's profile image with a GraphQL query in programming education service (https://entry.line.me)](https://hackerone.com/reports/952095) - - [Use of unreleased features in programming education service (https://entry.line.me)](https://hackerone.com/reports/975428) - - [SSRF restricted to HTTP/HTML on LINE Social Plugins (https://social-plugins.line.me/)](https://hackerone.com/reports/860939) -- 跳跳糖 - 安全与分享社区 - - [构建API调用框架绕过杀软hook](https://tttang.com/archive/1546/) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-26809 exploit](https://sploitus.com/exploit?id=242E006E-772E-5E86-9F48-B134D7624197&utm_source=rss&utm_medium=rss) - - [Exploit for Infinite Loop in Openssl exploit](https://sploitus.com/exploit?id=588C33E5-7CDF-5EC7-9294-74B308DC6535&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Watchguard Fireware exploit](https://sploitus.com/exploit?id=29A2C3D2-6D22-5EFF-A3D2-76EDE6BB3A5A&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-29072 exploit](https://sploitus.com/exploit?id=E25696F9-AF9E-5AB2-ACF2-289D4D02F417&utm_source=rss&utm_medium=rss) - - [Exploit for Exposure of Resource to Wrong Sphere in Vmware Spring Boot exploit](https://sploitus.com/exploit?id=4B89135F-AE08-56DB-B13E-DD5AF268E021&utm_source=rss&utm_medium=rss) -- 安全客-有思想的安全新媒体 - - [从电信网络诈骗角度剖析，诈骗资金是如何流转的？](https://www.anquanke.com/post/id/272100) - - [网空安全前沿导读 （2022年03月26日-2022年04月08日）](https://www.anquanke.com/post/id/272221) - - [安全事件周报 (04.11-04.17)](https://www.anquanke.com/post/id/272186) - - [Spring远程命令执行漏洞（CVE-2022-22965）原理分析和思考](https://www.anquanke.com/post/id/272149) - - [论坛·原创 | 元宇宙与国家数据安全：构建生态化治理体系的挑战与趋势](https://www.anquanke.com/post/id/272172) - - [CVE-2022-1364：Google Chrome V8类型混淆漏洞](https://www.anquanke.com/post/id/272127) - - [FBI：支付应用用户成为社交工程攻击的目标](https://www.anquanke.com/post/id/272103) - - [4月18日每日安全热点 - 黑客组织NB65泄漏俄罗斯实体数据](https://www.anquanke.com/post/id/272145) -- Security Boulevard - - [Explosion of Machine Identities Creating Cybersecurity ‘Debt’](https://securityboulevard.com/2022/04/explosion-of-machine-identities-creating-cybersecurity-debt/) - - [Conti’s Ransomware Toll on the Healthcare Industry](https://securityboulevard.com/2022/04/contis-ransomware-toll-on-the-healthcare-industry/) - - [OWASP® Global AppSec US 2021 Virtual – Chloé Messdaghi’s ‘Keynote: We Deserve Rights’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-chloe-messdaghis-keynote-we-deserve-rights/) - - [Rise of the “Super App”](https://securityboulevard.com/2022/04/rise-of-the-super-app/) - - [SDLC for Automotive Software Security](https://securityboulevard.com/2022/04/sdlc-for-automotive-software-security/) - - [Cybersecurity Ecosystem Mapping Updates: April 2022](https://securityboulevard.com/2022/04/cybersecurity-ecosystem-mapping-updates-april-2022/) - - [Taking Action With Flashpoint Finished Intelligence: A Cornerstone of Effective Decision-Making](https://securityboulevard.com/2022/04/taking-action-with-flashpoint-finished-intelligence-a-cornerstone-of-effective-decision-making/) - - [What is Machine Learning?](https://securityboulevard.com/2022/04/what-is-machine-learning/) - - [Industroyer2 malware targeting Ukrainian energy company](https://securityboulevard.com/2022/04/industroyer2-malware-targeting-ukrainian-energy-company/) - - [CommitStrip ‘Do You Like Containers?’](https://securityboulevard.com/2022/04/commitstrip-do-you-like-containers/) -- Envato Tuts+ Code - Mobile Development - - [10 Best Android News App Templates](https://code.tutsplus.com/articles/best-android-news-app-templates--cms-31510) -- ongoing by Tim Bray - - [4,000,000m Lessons](https://www.tbray.org/ongoing/When/202x/2022/04/18/E-Bike) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（20220411-20220417）](http://blog.nsfocus.net/weekly-20220411/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | GitHub封锁两家大型俄银行账户；金融平台漏洞或致银行信息泄露](https://www.freebuf.com/news/329415.html) - - [新型DDoS攻击泛滥: 利用中间盒的TCP反射放大攻击分析](https://www.freebuf.com/articles/network/329405.html) - - [GitHub 封禁部分俄罗斯开发者账户](https://www.freebuf.com/news/329361.html) - - [一个月疯狂窃取5.4亿美元，Lazarus Group黑客组织拿钱造导弹](https://www.freebuf.com/news/329348.html) - - [Conti勒索组织声称其对Nordex发动勒索攻击](https://www.freebuf.com/articles/329344.html) - - [GitHub：OAuth 令牌被盗，数十个组织数据被窃](https://www.freebuf.com/news/329341.html) - - [从“零”开始 重铸信任 | CIS零信任安全论坛议题征集开启](https://www.freebuf.com/news/329375.html) -- Cerbero Blog - - [Suite 5.5 and Engine 2.5 are out!](https://blog.cerbero.io/?p=2388) -- Trail of Bits Blog - - [The Frozen Heart vulnerability in PlonK](https://blog.trailofbits.com/2022/04/18/the-frozen-heart-vulnerability-in-plonk/) -- GuidePoint Security - - [PCI DSS 4.0 – Major New and Updated Requirements](https://www.guidepointsecurity.com/blog/pci-dss-4-0-major-new-and-updated-requirements/) -- Malwarebytes Labs - - [Why you shouldn’t automate your VirusTotal uploads](https://blog.malwarebytes.com/101/2022/04/why-you-shouldnt-automate-your-virustotal-uploads/) - - [A week in security (April 11 – 17)](https://blog.malwarebytes.com/a-week-in-security/2022/04/a-week-in-security-april-11-17/) -- Didier Stevens - - [New Tool: pngdump.py (Beta)](https://blog.didierstevens.com/2022/04/18/new-tool-pngdump-py-beta/) -- SentinelOne - - [From the Front Lines | Peering into A PYSA Ransomware Attack](https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/) -- Yassine Aboukir - - [Refactoring and relaunching ASNLookup.com along with a proper API](https://www.yassineaboukir.com//blog/refactoring-and-relaunching-ASNLookup.com-along-with-an-API/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/u66xsq/rreverseengineerings_weekly_questions_thread/) - - [Mobile MitM: Intercepting your Android App Traffic On the Go](https://www.reddit.com/r/ReverseEngineering/comments/u6psec/mobile_mitm_intercepting_your_android_app_traffic/) - - [Implementing Global Injection and Hooking in Windows](https://www.reddit.com/r/ReverseEngineering/comments/u67czh/implementing_global_injection_and_hooking_in/) - - [Using Z3 Theorem Solver to solve bitwise equations - SpaceHeroes CTF](https://www.reddit.com/r/ReverseEngineering/comments/u62py8/using_z3_theorem_solver_to_solve_bitwise/) -- The Daily Swig | Cybersecurity news and views - - [XSS vulnerability in open source tool PrivateBin patched](https://portswigger.net/daily-swig/xss-vulnerability-in-open-source-tool-privatebin-patched) -- Securelist - - [How to recover files encrypted by Yanlouwang](https://securelist.com/how-to-recover-files-encrypted-by-yanlouwang/106332/) -- paper - Last paper - - [CVE-2022-22954 VMware Workspace ONE Access Server-Side Template Injection RCE](https://paper.seebug.org/1884/) - - [Java 反序列化注入冰蝎内存马相关踩坑笔记](https://paper.seebug.org/1883/) - - [Go template 遇上 yaml 反序列化 CVE-2022-21701 分析](https://paper.seebug.org/1882/) -- HAHWUL - - [Prototype Pollution](https://www.hahwul.com/cullinan/prototype-pollution/) -- KitPloit - PenTest & Hacking Tools - - [KrbRelay - Framework For Kerberos Relaying](http://www.kitploit.com/2022/04/krbrelay-framework-for-kerberos-relaying.html) - - [Zircolite - A Standalone SIGMA-based Detection Tool For EVTX, Auditd And Sysmon For Linux Logs](http://www.kitploit.com/2022/04/zircolite-standalone-sigma-based.html) -- Fortinet Threat Research Blog - - [Trends in the Recent Emotet Maldoc Outbreak](https://www.fortinet.com/blog/threat-research/Trends-in-the-recent-emotet-maldoc-outbreak) -- Secureworks Blog - - [QR Codes Abused for Qshing Attacks](https://www.secureworks.com/blog/qr-codes-abused-for-qshing-attacks) -- 0x00sec - The Home of the Hacker - Top topics - - [Red Team Infrastructure](https://0x00sec.org/t/red-team-infrastructure/29056) -- Forensic Focus - - [Researcher Nina Sunde on Reducing Bias in Digital Forensic Analysis](https://www.forensicfocus.com/podcast/researcher-nina-sunde-on-reducing-bias-in-digital-forensic-analysis/) -- Securelist - - [How to recover files encrypted by Yanlouwang](https://securelist.com/how-to-recover-files-encrypted-by-yanlouwang/106332/) -- Daniel Miessler - - [News & Analysis | NO. 327](https://danielmiessler.com/podcast/news-analysis-no-327/) -- SANS Internet Storm Center, InfoCON: green - - [Sysmon's RegistryEvent (Value Set), (Mon, Apr 18th)](https://isc.sans.edu/diary/rss/28558) - - [ISC Stormcast For Monday, April 18th, 2022 https://isc.sans.edu/podcastdetail.html?id=7968, (Mon, Apr 18th)](https://isc.sans.edu/diary/rss/28560) -- Il Disinformatico - - [DragonChase 2022: Arrivo della capsula e dell’equipaggio al Kennedy Space Center; orari e link per la diretta del lancio](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-arrivo-della-capsula-e.html) -- The Register - Security - - [UK Prime Minister, Catalan groups 'targeted by NSO Pegasus spyware'](https://go.theregister.com/feed/www.theregister.com/2022/04/18/uk_catalan_spyware/) - - [Microsoft ups bug bounties 30% for cloud lines, pays more for 'scenario-based' exploits](https://go.theregister.com/feed/www.theregister.com/2022/04/18/in-brief-security/) -- Threatpost - - [Cyberattackers Put the Pedal to the Medal: Podcast](https://threatpost.com/cyberattackers-speed-fortinet-podcast/179294/) -- Krebs on Security - - [Conti’s Ransomware Toll on the Healthcare Industry](https://krebsonsecurity.com/2022/04/contis-ransomware-toll-on-the-healthcare-industry/) -- Deeplinks - - [Mobile MitM: Intercepting your Android App Traffic On the Go](https://www.eff.org/deeplinks/2022/04/mobile-mitm-intercepting-your-android-app-traffic-go) - - [California May Require Low-Cost Broadband from Subsidized Networks](https://www.eff.org/deeplinks/2022/04/california-may-require-low-cost-broadband-subsidized-networks) -- GeekPwn - - [【非常极客 在线唠“科”】中了勒索病毒要么交钱要么弃疗？](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650344186&idx=1&sn=74a74d390d8d14b547861b3fdbccd8f1&chksm=8740b13fb0373829a2c878649c180a30c7ce6cc9cc8a11fff9a26c3cc464804e2d31e731a744&scene=58&subscene=0#rd) -- Security Affairs - - [Experts spotted Industrial Spy, a new stolen data marketplace](https://securityaffairs.co/wordpress/130323/cyber-crime/industrial-spy-marketplace.html) - - [CISA adds VMware, Chrome flaws to its Known Exploited Vulnerabilities Catalog](https://securityaffairs.co/wordpress/130316/security/cisa-vmware-chrome-known-exploited-vulnerabilities-catalog.html) - - [Apr 10 – Apr 16 Ukraine – Russia the silent cyber conflict](https://securityaffairs.co/wordpress/130304/cyber-warfare-2/apr-10-apr-16-ukraine-russia-cyber-conflict.html) -- 安全牛 - - [从《SANS 2022年云安全调查报告》看云上威胁态势发展](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112405&idx=1&sn=68e19d2f7f263670f9da228ca46b5f17&chksm=bd1473068a63fa1038336ad9ac6c12d3dabfe9f8bf8aa19318a498a453f63d7a3b8e70f86b88&scene=58&subscene=0#rd) - - [安全头条 | 两部门发文 加强网络视听节目平台游戏直播管理；昂楷科技宣布完成新一轮战略融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112405&idx=2&sn=70c1ffc7e32f299e81b5d4ba5cc1d4cf&chksm=bd1473068a63fa10e9133e590e001b6bdd4f716421ad4098967b89a7499a9c486dee29ed8265&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Apr.18th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495326&idx=1&sn=3dea36ae8f7f3eece376a8f44cd73d60&chksm=ce96a3a0f9e12ab6be4fb86f8869b06eb2548723dc80ceed6321a62ecd9e4329a6b9d58eac33&scene=58&subscene=0#rd) -- 陌陌安全 - - [春日播报：探探+创新业务活动，兄弟们一波了！](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487061&idx=1&sn=f2c7990890d55d3c46533b2f79fc5c89&chksm=eadc0437ddab8d21ba8a3f84573246cc5d6457f69d450d75aa1aa366bc07cb07a0967f6f42f2&scene=58&subscene=0#rd) - - [2022Q1直播抽奖通知](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487061&idx=2&sn=def6abd47e72ac7c6de462de7200524b&chksm=eadc0437ddab8d2165c1b8907624db9e81530bf510bc4bd3e85e4c5129565cca22d374d3f431&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第15期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491539&idx=1&sn=05c9048508a769e94dcae826662ecad5&chksm=fd772f1aca00a60c5bfd35fca6134ddc7af7c85af525ef10e442847393ec0dfaf16e78c2b1aa&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220411-20220417)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491539&idx=2&sn=72b1c1dc318fa56cf706394a00b34692&chksm=fd772f1aca00a60c272a259645a67b793223989e3dfb851a7fe40540e55d3f07dc63d25990fb&scene=58&subscene=0#rd) -- Computer Forensics - - [Research sources for low level forensics?](https://www.reddit.com/r/computerforensics/comments/u6dr3z/research_sources_for_low_level_forensics/) - - [LUKS encryption](https://www.reddit.com/r/computerforensics/comments/u6mcfz/luks_encryption/) -- 美团安全应急响应中心 - - [活动 | 美团外卖业务信息泄露专场，提情报拿奖励！](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247489314&idx=1&sn=d6d437c1c6f399f402f8feead543c984&chksm=ec1bf6f1db6c7fe737a60878b16c8b7274e93778ef13d5dc0d3500377247a11cebf386cab381&scene=58&subscene=0#rd) -- 火线Zone - - [浅析不同情况下Docker的逃逸方法](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493750&idx=1&sn=f42626db726707d3c64eb4436786405b&chksm=eaa96056dddee94000a1e38c577a7cfcfcb9c8adc74454b5806717903e3c076135b31dc7fb47&scene=58&subscene=0#rd) - - [新项目丨好大夫安全测试项目上线火线啦~](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493750&idx=2&sn=8665f457fbfb85c407d59f7e5fd8de5f&chksm=eaa96056dddee9401b6935a7cc7aba24c397426bd26fef37dd3769f316f88432021831feb65e&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [密码学系列｜Chapter 1 exercises 31-40](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493099&idx=1&sn=1a106c1b4791f920473a12cd286dd750&chksm=fa523055cd25b943e9b6280823a7d7af5fd2a6a938e02e430375abc20f38340fdb1b6acb3111&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [Cyber Risk Index (2H’ 2021): An Assessment for Security Leaders](https://www.trendmicro.com/en_us/research/22/d/cyber-risk-index-2H-2021-security-assessment.html) - - [An Investigation of the BlackCat Ransomware via Trend Micro Vision One](https://www.trendmicro.com/en_us/research/22/d/an-investigation-of-the-blackcat-ransomware.html) -- KitPloit - PenTest Tools! - - [KrbRelay - Framework For Kerberos Relaying](http://www.kitploit.com/2022/04/krbrelay-framework-for-kerberos-relaying.html) - - [Zircolite - A Standalone SIGMA-based Detection Tool For EVTX, Auditd And Sysmon For Linux Logs](http://www.kitploit.com/2022/04/zircolite-standalone-sigma-based.html) -- 火绒安全实验室 - - [流氓软件传播病毒感染量数万 下载站仍是主要推广渠道](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247502462&idx=1&sn=7afaa0dc14d9b1a5003a4ee0900b941c&chksm=eb701441dc079d576570ce1168190a506d683a242048c6ff5514489539bcc3146a15e9fdf02a&scene=58&subscene=0#rd) -- Securosis Blog - - [SOC 2025: Operationalizing the SOC](http://securosis.com/blog/soc-2025-operationalizing-the-soc) -- Your Hacking Tutorial by Zempirians - - [FISH metasploit use for dir path traversal gaining access to credentials in a web config for FH. AV exploit for PE](https://www.reddit.com/r/HowToHack/comments/u63nc2/fish_metasploit_use_for_dir_path_traversal/) - - [War shipping a more in-depth explanation needed](https://www.reddit.com/r/HowToHack/comments/u6q9lz/war_shipping_a_more_indepth_explanation_needed/) - - ["Cracking" an Amazon (or generic) tablets? (I DO have password / legit units)](https://www.reddit.com/r/HowToHack/comments/u6i074/cracking_an_amazon_or_generic_tablets_i_do_have/) - - [QNX Headunit Hacking](https://www.reddit.com/r/HowToHack/comments/u6ob7b/qnx_headunit_hacking/) - - [I am curious on testing the break into my Ring camera. Has anyone been able too if they tried? I tried to Nmap and Masscan the ports but no luck the cameras are Wi-Fi operated and not hardwired which I found odd. Any options?](https://www.reddit.com/r/HowToHack/comments/u645mw/i_am_curious_on_testing_the_break_into_my_ring/) - - [Why buffer ALWAYS comes before int in stack?](https://www.reddit.com/r/HowToHack/comments/u6b1ll/why_buffer_always_comes_before_int_in_stack/) - - [WAF Bypasses collection and testing tools](https://www.reddit.com/r/HowToHack/comments/u681bs/waf_bypasses_collection_and_testing_tools/) - - [Where can I find a crypter?](https://www.reddit.com/r/HowToHack/comments/u61ica/where_can_i_find_a_crypter/) -- /r/netsec - Information Security News & Discussion - - [MITRE Engenuity ATT&CK results are out](https://www.reddit.com/r/netsec/comments/u6qf2q/mitre_engenuity_attck_results_are_out/) -- 代码卫士 - - [GitHub 突然封禁受制裁俄罗斯实体的开发人员账户](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511412&idx=1&sn=6b428b8d92a533d2fc8203f812dcf0bb&chksm=ea949c1edde3150890bde9fe031886ffcfa5007de9e2efc31dbba158dd3ebab81128609a9655&scene=58&subscene=0#rd) - - [VMware Cloud Director 严重漏洞可使整个云基础设施遭接管](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511412&idx=2&sn=a8d4aa558a717bc3227abcc1363b5e93&chksm=ea949c1edde315087a2d5ebd9235b98d5eabb6789a50df0860fd04883b4c64bacb6b33cd5daf&scene=58&subscene=0#rd) - - [GitHub：攻击者正在利用被盗 OAuth 令牌攻击数十家组织机构](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511412&idx=3&sn=e1ae2051f86fd59769f851a34b74a6d8&chksm=ea949c1edde31508e64bd8a4cfd379c97ace6c1e7b27fca2a187950cb327637742b57a7fac03&scene=58&subscene=0#rd) -- Social Engineering - - [How do you find out a strangers motivations without asking them directly?](https://www.reddit.com/r/SocialEngineering/comments/u6p0cl/how_do_you_find_out_a_strangers_motivations/) - - [How Will The Art of Argumentation Help You Achieve Your Goals?](https://www.reddit.com/r/SocialEngineering/comments/u6lt9d/how_will_the_art_of_argumentation_help_you/) -- 星阑科技 - - [【技术干货】CVE-2022-1162 gitlab 硬编码漏洞](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247492771&idx=1&sn=5bc86cbf62a83db69b1b1919ad86273b&chksm=c007493ff770c0290f199daef6b03bd09f9f85e35c5179c3ca8fe062623ecc27522b45850f0a&scene=58&subscene=0#rd) - - [转载｜数世咨询《API安全研究报告2022》正式发布 附下载](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247492771&idx=2&sn=210c51be9186cd073f39c94f1051b177&chksm=c007493ff770c02940041715d730e4da41500b8137aba56f425c9e432777a3cdebcab6d2f842&scene=58&subscene=0#rd) -- Dark Reading - - [76% of Organizations Worldwide Expect to Suffer a Cyberattack This Year](https://www.darkreading.com/attacks-breaches/76-of-organizations-worldwide-expect-to-suffer-a-cyberattack-this-year) - - [Swimlane Extends Cloud-Based Security Automation into APJ Amid Momentous Growth in Region](https://www.darkreading.com/cloud/swimlane-extends-cloud-based-security-automation-into-apj-amid-momentous-growth-in-region) - - [Absolute Software Introduces Ransomware Response Offering](https://www.darkreading.com/endpoint/absolute-software-introduces-ransomware-response-offering) - - [Security-as-Code Gains More Support, but Still Nascent](https://www.darkreading.com/cloud/security-as-code-gains-more-support-but-still-nascent) - - [Security Lessons From a Payment Fraud Attack](https://www.darkreading.com/edge-articles/security-lessons-from-a-payment-fraud-attack) - - [Why So Many Security Experts Are Concerned About Low-Code/No-Code Apps](https://www.darkreading.com/dr-tech/why-so-many-security-experts-are-concerned-about-low-code-no-code-apps) - - [Name That Toon: Helping Hands](https://www.darkreading.com/cloud/name-that-toon-helping-hands) - - [Strength in Unity: Why It's Especially Important to Strengthen Your Supply Chain Now](https://www.darkreading.com/vulnerabilities-threats/strength-in-unity-why-it-s-especially-important-to-strengthen-your-supply-chain-now) -- 360漏洞云 - - [高危 | Apache Subversion Use-After-Free漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496653&idx=1&sn=50b443edafdb6c29e08f2160caecfd85&chksm=ebe80f5fdc9f864967b1a35d0955a22f418e10c9eca53287443b5648520e39fdbe17c75df7a7&scene=58&subscene=0#rd) - - [高危 | Grafana权限提升漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496653&idx=2&sn=bad63f6fc1f466076479367534626692&chksm=ebe80f5fdc9f86491e989b6802510e95748f6caf114808114d22d47d6d5a8e4b42a9f89c9023&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [第五期「目极千里 洞见安全」线上沙龙亮点回顾！全网寻找最幸运的仔！](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650260440&idx=1&sn=08ce0ae5b11e26ac9ee9969c407b102d&chksm=f3e279acc495f0baae3c9145c8bed2ba6c5fce5766473ccef31102b0006b9fe02a65f874da78&scene=58&subscene=0#rd) -- 看雪学院 - - [Docker-remoter-api渗透](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438261&idx=1&sn=db108871abb61e4d88dc959d49da8b7d&chksm=b18ffaff86f873e9074ff93f3fe883920990a522e963ebea4d32bd0198997776fadafa6dbdc4&scene=58&subscene=0#rd) - - [GitHub封禁俄罗斯开发人员账户](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438261&idx=2&sn=0c4ae140957a9ea126ce8516fb36c1cf&chksm=b18ffaff86f873e952f9e966e9e53529540728396c3c4f5decb3416ea81b3c68ecab013acef6&scene=58&subscene=0#rd) - - [《LLVM与代码混淆技术》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438261&idx=3&sn=cbb3d4e257471333090c3933f42c989b&chksm=b18ffaff86f873e92625d6e22008776057b9ff1374cf5749f7cfc0c15584e120223d2e1258a3&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-04-18](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247489531&idx=1&sn=987b1c1ede256d8396933d04c7184a0d&chksm=c0603922f717b034f44471570909df721fffd75a92f28b3a06ffbd839dc8c48ffcf07101592d&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [从Spring RCE 0day(CVE-2022-22965)看黑产利用速度](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247486352&idx=1&sn=2e009dcc7c7de3913f7541079ebae00d&chksm=f9ee672fce99ee39f02d9456384daf94259dc4b1578dbcbcabccb39af473d1474fafe8525e4f&scene=58&subscene=0#rd) -- 互联网安全内参 - - [美国务院悬赏500万美元，征集朝鲜黑客信息](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502419&idx=1&sn=00927ab9d2e356b46210524cedd98e57&chksm=ebfa8d73dc8d0465c50f80ce03625ee0f1effbdeb83c646641fafc258bdcace3e7461061413d&scene=58&subscene=0#rd) - - [我国电信设施曾遭网络窃密，部分数据传至境外](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502419&idx=2&sn=a2277a04679eb499d011d10101084c2b&chksm=ebfa8d73dc8d046510b7fa339f64660041d985b6b0275ba3f85bb3a812058ad5f77ff5478849&scene=58&subscene=0#rd) - - [美国学者分析对俄罗斯开展网络行动的风险及选项](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502419&idx=3&sn=7adcdc68b03f4459c7f974e37e033b80&chksm=ebfa8d73dc8d04650860e57cdcbd576a92d2f9ec5daf80e58f838f5cf5371b35af11008021f3&scene=58&subscene=0#rd) - - [美国网络空间战略综述：政策文件、预算与技术研发重点](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502419&idx=4&sn=1cbcf1da44d5191ba8b0f660323c8b8b&chksm=ebfa8d73dc8d04656b0ff67c0498e08d5ba76fde46b59aea7c8a624a2f56fe538847bd5d94f8&scene=58&subscene=0#rd) -- SecIN技术平台 - - [分享图片](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247493580&idx=1&sn=102bf9fd2d98cdcdfb9501ac1b86a66e&chksm=eb84ba98dcf3338e3193443059ba070734b42520a55aa0e6ad831c0684e0a5291cfc2ac9a7aa&scene=58&subscene=0#rd) -- 安全客 - - [【安全头条】新的工业间谍被盗数据市场通过裂缝、广告软件推广](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769413&idx=1&sn=44a225400a1bd5c7b7daec5bd4064b0f&chksm=889375aabfe4fcbcb9cfb906defea0b93eed38091a8cd51d665d1802621b77b471bf482c512f&scene=58&subscene=0#rd) - - [【技术分享】Visual Studio Code本地代码执行漏洞(CVE-2019-1414)](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769413&idx=2&sn=fce295840d0736a1eee3d83f59ed6665&chksm=889375aabfe4fcbc869da1c91cd12ad53c19b08de096687dfc19904b9625ebf295f667b2ecb3&scene=58&subscene=0#rd) - - [【安全头条】FBI：支付应用用户成为社交工程攻击的目标](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769382&idx=1&sn=ecff9001a6a4e63175894a89678d56ff&chksm=889375c9bfe4fcdf4c0744c79663fdb674067152c359c96a04937fbc64e50941ac20208c9a43&scene=58&subscene=0#rd) - - [【技术分享】工控安全入门（八）—— 设备驱动与通信分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769382&idx=2&sn=9bc874c286a382abf0665f46ff257775&chksm=889375c9bfe4fcdf5eb9e6e76363334519470a037da5552d1fad51d211d7056d147cfb0649eb&scene=58&subscene=0#rd) -- TorrentFreak - - [Freelance Torrent Site Admin’s Life Still in Turmoil, 5 Years After Arrest](https://torrentfreak.com/freelance-torrent-site-admins-life-still-in-turmoil-5-years-after-arrest-220418/) -- 字节跳动技术团队 - - [极致体验，揭秘抖音背后的音视频技术](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247492679&idx=1&sn=3414ac84a70af4ce79c7af781eaf670a&chksm=e9d32fa5dea4a6b321fd55a97c6341fa82aef9543b03ecf54446d4627a2b07503ba8ab818fbb&scene=58&subscene=0#rd) -- 情报分析师 - - [国防情报局报告114页|《朝鲜军事力量》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497825&idx=1&sn=2afdebbc24d0f97e6b8370eb7a87afa2&chksm=87164d6ab061c47cba38faa8ab93c4ebef83a5e17a14639a3a76a141f8fb8b5940e3ef06d91e&scene=58&subscene=0#rd) - - [利用开源情报达成与朝鲜的潜在协议](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497825&idx=2&sn=e5bf96baa616aef675710350492bbd3f&chksm=87164d6ab061c47cb0524fd1c4f965dd4ec7950b93cfd3020ccf25636be77aaf91b429bc080a&scene=58&subscene=0#rd) - - [OSINT 工具推荐](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497825&idx=3&sn=ec8046933625b30bae01bc10a9790c14&chksm=87164d6ab061c47c41a813d1444d2e6c2ad26998a013bdeaa2294a022480908138dd5ac2a89a&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(04-18)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958358&idx=1&sn=d68b02605c2a5769a361d45bead0f025&chksm=8baeccc9bcd945df940898809ee0c411c651956b00857694e423d0afd1a8664f8bfbd30a43ed&scene=58&subscene=0#rd) -- M01NTeam - - [攻击技术研判｜发现新招！攻击者投递伪装成文件夹的恶意LNK](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247487736&idx=1&sn=674d43d8646ee291a6b56b3a8fadf3d9&chksm=c187d0e9f6f059ffc76cb3cdd279d3c2e9d77f57cbb0e27b82dfa6c1fc2949f118cdd656d54b&scene=58&subscene=0#rd) -- 安全学术圈 - - [高效、私有且健壮的联邦学习](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247487570&idx=1&sn=e2daf7e9593c96de3d76f43160cc6b74&chksm=fe2eefd9c95966cf517d2f3a4e74640f4b8ec8240475a93fcab02f66227942124e4b833b1db9&scene=58&subscene=0#rd) -- 奇安信CERT - - [【安全热点周报】第241期:微软4月补丁日发布了120个漏洞的补丁程序](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247495821&idx=1&sn=2b7f070f4e696369bb1d360fa1da05d1&chksm=fe79d415c90e5d0336b6c4b9847892371af5cf12d3a7b943c5916423bb5189577dbd2a486434&scene=58&subscene=0#rd) -- 东软网络安全 - - [《2021网信自主创新调研报告》发布仪式开幕在即！东软邀您线上参会](https://mp.weixin.qq.com/s?__biz=MjM5NTAyODkxNw==&mid=2649212261&idx=1&sn=b745cd1eb894388697b3217ad3ee0af6&chksm=beedafbf899a26a9a89333c8b5abd9bc662920873a69ff56356627264ea8e9bd955fc80d6173&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [央行数字货币CBDC：区块链技术新起点](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247491593&idx=1&sn=2940e5073dcd351c617fe15bcef096c5&chksm=e84c46d6df3bcfc09c62038a17caa61c68bcac98b554f815c132ae9344be5e0cda45bd23f510&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-04-20.md b/archive/2022/2022-04-20.md deleted file mode 100644 index a51c9b9373..0000000000 --- a/archive/2022/2022-04-20.md +++ /dev/null @@ -1,354 +0,0 @@ -# 每日安全资讯（2022-04-20） - -- HackerOne Hacker Activity - - [Invitation Email is resent as a Reminder after invalidating pending email invites](https://hackerone.com/reports/1486820) - - [xss on [developers.mtn.com]](https://hackerone.com/reports/924851) -- Security Boulevard - - [How Do SSH Certificates Reduce Management Complexity?](https://securityboulevard.com/2022/04/how-do-ssh-certificates-reduce-management-complexity/) - - [Poodle and Doodle, FUD and the Sucuri WAF](https://securityboulevard.com/2022/04/poodle-and-doodle-fud-and-the-sucuri-waf/) - - [Undetectable Backdoors in Machine-Learning Models](https://securityboulevard.com/2022/04/undetectable-backdoors-in-machine-learning-models/) - - [In New Audio Message, ISIS Spokesperson Abu Omar al-Muhajir Calls for Attacks in the West](https://securityboulevard.com/2022/04/in-new-audio-message-isis-spokesperson-abu-omar-al-muhajir-calls-for-attacks-in-the-west/) - - [CyRC Vulnerability Analysis: CVE-2022-1271 in gzip, but it’s not as bad as it sounds](https://securityboulevard.com/2022/04/cyrc-vulnerability-analysis-cve-2022-1271-in-gzip-but-its-not-as-bad-as-it-sounds/) - - [OWASP® Global AppSec US 2021 Virtual – Mohamed Alfateh’s ‘Application Threat Modeling Implementation Tips And Tricks’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-mohamed-alfatehs-application-threat-modeling-implementation-tips-and-tricks/) - - [What is Conversation Hijacking? Exploring This Emerging Form of Phishing](https://securityboulevard.com/2022/04/what-is-conversation-hijacking-exploring-this-emerging-form-of-phishing/) - - [Verica Launches Prowler Pro Services to Secure AWS Cloud](https://securityboulevard.com/2022/04/verica-launches-prowler-pro-services-to-secure-aws-cloud/) -- 跳跳糖 - 安全与分享社区 - - [bpf,ebpf一些原理以及逆向基于libbpf-bootstrap编写的bpf文件](https://tttang.com/archive/1550/) -- Microsoft Security Blog - - [The future of compliance and data governance is here: Introducing Microsoft Purview](https://www.microsoft.com/security/blog/2022/04/19/the-future-of-compliance-and-data-governance-is-here-introducing-microsoft-purview/) -- FreeBuf网络安全行业门户 - - [65.5万美元不翼而飞 黑客从iCloud备份中获取MetaMask种子](https://www.freebuf.com/news/329548.html) - - [新发现的零点击iPhone漏洞被NSO间谍软件利用](https://www.freebuf.com/articles/329547.html) - - [新的暗网市场 Industrial Spy 正在出售数据](https://www.freebuf.com/news/329494.html) - - [Beanstalk遭攻击损失1.8亿美元，攻击者将25万美元捐给乌克兰](https://www.freebuf.com/news/329480.html) - - [虚假升级网站再现！Win11已成恶意软件的“香饽饽”](https://www.freebuf.com/news/329475.html) - - [连绵不断，Anonymous组织持续对俄发动进攻](https://www.freebuf.com/news/329471.html) -- Envato Tuts+ Code - Mobile Development - - [Kotlin From Scratch: Ranges and Collections](https://code.tutsplus.com/tutorials/kotlin-from-scratch-ranges-and-collections--cms-29397) -- Files ≈ Packet Storm - - [BlueZ Key Theft / bluetoothd Double-Free](https://packetstormsecurity.com/files/166776/GS20220419151409.tgz) - - [Backdoor.Win32.GateHell.21 Authentication Bypass](https://packetstormsecurity.com/files/166774/MVID-2022-0559.txt) - - [Backdoor.Win32.Delf.zn Insecure Credential Storage](https://packetstormsecurity.com/files/166773/MVID-2022-0556.txt) - - [Linux FUSE Use-After-Free](https://packetstormsecurity.com/files/166772/GS20220419150818.tgz) - - [WordPress Motopress Hotel Booking Lite 4.2.4 SQL Injection](https://packetstormsecurity.com/files/166771/wpmotopresshbl424-sql.txt) - - [Linux watch_queue Filter Out-Of-Bounds Write](https://packetstormsecurity.com/files/166770/GS20220419150504.txt) - - [Backdoor.Win32.GateHell.21 Man-In-The-Middle](https://packetstormsecurity.com/files/166769/MVID-2022-0560.txt) - - [WordPress Popup Maker 1.16.5 Cross Site Scripting](https://packetstormsecurity.com/files/166768/wppopupmaker1165-xss.txt) - - [Responsive Online Blog 1.0 SQL Injection](https://packetstormsecurity.com/files/166767/rob10-sql.txt) - - [Backdoor.Win32.Psychward.03.a Weak Hardcoded Password](https://packetstormsecurity.com/files/166766/MVID-2022-0558.txt) - - [ManageEngine ADSelfService Plus 6.1 User Enumeration](https://packetstormsecurity.com/files/166765/meadssp61-enumerate.txt) - - [7-Zip 21.07 Code Execution / Privilege Escalation](https://packetstormsecurity.com/files/166763/7zip-escalate.txt) - - [PKP Open Journals System 3.3 Cross Site Scripting](https://packetstormsecurity.com/files/166762/pkpopenjournalsystem33-xss.txt) - - [Backdoor.Win32.Hupigon.haqj Unquoted Service Path](https://packetstormsecurity.com/files/166761/MVID-2022-0557.txt) - - [XDNR Shellcode Cryptor / Encoder](https://packetstormsecurity.com/files/166760/xdnr.c) - - [Trojan.Win32.TScash.c Insecure Permissions](https://packetstormsecurity.com/files/166759/MVID-2022-0555.txt) - - [WordPress Videos Sync PDF 1.7.4 Cross Site Scripting](https://packetstormsecurity.com/files/166758/wpvideossyncpdf174-xss.txt) - - [Backdoor.Win32.Loselove Denial Of Service](https://packetstormsecurity.com/files/166757/MVID-2022-0554.txt) - - [WordPress Elementor 3.6.2 Shell Upload](https://packetstormsecurity.com/files/166756/wpelementor36-exec.txt) - - [HackTool.Win32.Delf.vs Insecure Credential Storage](https://packetstormsecurity.com/files/166755/MVID-2022-0553.txt) - - [EaseUS Data Recovery 15.1.0.0 Unquoted Service Path](https://packetstormsecurity.com/files/166754/easeusdr-unquotedpath.txt) - - [PTPublisher 2.3.4 Unquoted Service Path](https://packetstormsecurity.com/files/166753/ptpublisher234-unquotedpath.txt) - - [Goodbye Tracking? Impact Of iOS App Tracking Transparency And Privacy Labels](https://packetstormsecurity.com/files/166749/2204.03556.pdf) -- 绿盟科技技术博客 - - [央行数字货币CBDC：区块链技术新起点](http://blog.nsfocus.net/cbdc-new/) -- Sucuri Blog - - [Poodle and Doodle, FUD and the Sucuri WAF](https://blog.sucuri.net/2022/04/poodle-and-doodle-fud-and-the-sucuri-waf.html) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Linux watch_queue Filter Out-Of-Bounds Write](https://cxsecurity.com/issue/WLB-2022040080) - - [ManageEngine ADSelfService Plus 6.1 User Enumeration](https://cxsecurity.com/issue/WLB-2022040079) - - [Zyxel NWA-1100-NH Command Injection](https://cxsecurity.com/issue/WLB-2022040078) - - [Backdoor.Win32.GateHell.21 / Authentication Bypass](https://cxsecurity.com/issue/WLB-2022040077) - - [Backdoor.Win32.Delf.zn / Insecure Credential Storage](https://cxsecurity.com/issue/WLB-2022040076) - - [Backdoor.Win32.Hupigon.haqj / Insecure Service Path](https://cxsecurity.com/issue/WLB-2022040075) - - [HackTool.Win32.Delf.vs / Insecure Credential Storage](https://cxsecurity.com/issue/WLB-2022040074) - - [Backdoor.Win32.Psychward.03.a / Weak Hardcoded Password](https://cxsecurity.com/issue/WLB-2022040073) - - [7-Zip 21.07 Code Execution / Privilege Escalation](https://cxsecurity.com/issue/WLB-2022040072) - - [PKP Open Journals System 3.3 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022040071) - - [EaseUS Data Recovery 15.1.0.0 Unquoted Service Path](https://cxsecurity.com/issue/WLB-2022040070) - - [WordPress Elementor 3.6.2 Shell Upload](https://cxsecurity.com/issue/WLB-2022040069) - - [Scriptcase 9.7 Shell Upload](https://cxsecurity.com/issue/WLB-2022040068) -- 安全客-有思想的安全新媒体 - - [美国中央情报局（CIA）“蜂巢”恶意代码攻击控制武器平台分析报告](https://www.anquanke.com/post/id/272281) - - [知识图谱可视化技术在美团的实践与探索](https://www.anquanke.com/post/id/272162) - - [为什么黑客如此“钟爱”跨链桥](https://www.anquanke.com/post/id/272183) - - [360政企安全集团获朝阳区“未来独角兽企业”授牌](https://www.anquanke.com/post/id/272191) - - [2022数字中国创新大赛车联网安全赛 best_agent 设计思路与解析](https://www.anquanke.com/post/id/272128) - - [新的工业间谍被盗数据市场通过裂缝、广告软件推广](https://www.anquanke.com/post/id/272167) - - [4月19日每日安全热点 - 针对PYSA勒索软件的深入分析](https://www.anquanke.com/post/id/272314) - - [活动｜春日播报：探探+创新业务活动，兄弟们一波了！](https://www.anquanke.com/post/id/272150) -- Sploitus.com Exploits RSS Feed - - [Responsive Online Blog 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166767&utm_source=rss&utm_medium=rss) - - [Easy Appointments 1.4.2 - Information Disclosure Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37639&utm_source=rss&utm_medium=rss) - - [WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50874&utm_source=rss&utm_medium=rss) - - [PTPublisher 2.3.4 Unquoted Service Path exploit](https://sploitus.com/exploit?id=PACKETSTORM:166753&utm_source=rss&utm_medium=rss) - - [PKP Open Journals System 3.3 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:166762&utm_source=rss&utm_medium=rss) - - [WordPress Motopress Hotel Booking Lite 4.2.4 Plugin - SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37637&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Loselove Denial Of Service exploit](https://sploitus.com/exploit?id=PACKETSTORM:166757&utm_source=rss&utm_medium=rss) - - [Fuel CMS 1.5.0 - Cross-Site Request Forgery Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37648&utm_source=rss&utm_medium=rss) - - [PTPublisher v2.3.4 - Unquoted Service Path Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37649&utm_source=rss&utm_medium=rss) - - [WordPress Popup Maker 1.16.5 Plugin - Stored Cross-Site Scripting (Authenticated) Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37643&utm_source=rss&utm_medium=rss) - - [WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:50876&utm_source=rss&utm_medium=rss) - - [REDCap 11.3.9 - Stored Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37644&utm_source=rss&utm_medium=rss) - - [ManageEngine ADSelfService Plus 6.1 - User Enumeration exploit](https://sploitus.com/exploit?id=EDB-ID:50873&utm_source=rss&utm_medium=rss) - - [7-zip - Code Execution / Local Privilege Escalation exploit](https://sploitus.com/exploit?id=EDB-ID:50883&utm_source=rss&utm_medium=rss) - - [REDCap 11.3.9 - Stored Cross Site Scripting exploit](https://sploitus.com/exploit?id=EDB-ID:50877&utm_source=rss&utm_medium=rss) - - [WordPress Elementor 3.6.2 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:166756&utm_source=rss&utm_medium=rss) - - [EaseUS Data Recovery 15.1.0.0 Unquoted Service Path exploit](https://sploitus.com/exploit?id=PACKETSTORM:166754&utm_source=rss&utm_medium=rss) - - [WordPress Popup Maker 1.16.5 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:166768&utm_source=rss&utm_medium=rss) - - [WordPress Videos Sync PDF 1.7.4 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:166758&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Delf.zn Insecure Credential Storage exploit](https://sploitus.com/exploit?id=PACKETSTORM:166773&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Hupigon.haqj Unquoted Service Path exploit](https://sploitus.com/exploit?id=PACKETSTORM:166761&utm_source=rss&utm_medium=rss) - - [PKP Open Journals System 3.3 - Cross-Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37645&utm_source=rss&utm_medium=rss) - - [7-zip - Code Execution / Local Privilege Escalation Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37647&utm_source=rss&utm_medium=rss) - - [Linux watch_queue Filter Out-Of-Bounds Write exploit](https://sploitus.com/exploit?id=PACKETSTORM:166770&utm_source=rss&utm_medium=rss) - - [Microsoft Exchange Mailbox Assistants 15.0.847.40 - Unquoted Service Path Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37635&utm_source=rss&utm_medium=rss) - - [Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF) exploit](https://sploitus.com/exploit?id=EDB-ID:50884&utm_source=rss&utm_medium=rss) - - [WordPress Motopress Hotel Booking Lite 4.2.4 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166771&utm_source=rss&utm_medium=rss) - - [Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50879&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Polkit Project Polkit exploit](https://sploitus.com/exploit?id=06C6A8A1-3957-5359-AAA6-A1171EEC7ACF&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Google Android exploit](https://sploitus.com/exploit?id=82A555B1-1D82-5D73-B7A3-B3510546CED5&utm_source=rss&utm_medium=rss) -- povcfe - - [nginx-ldap-auth之user注入漏洞](https://povcfe.github.io/posts/nginx-ldap-auth/) -- Current Posts - Red Team Journal - - [Beware the Fast-Roping Acrobats](https://www.redteamjournal.com/blog/fast-roping-acrobats) -- blog.avast.com EN - - [PCI DSS Update | Avast](https://blog.avast.com/pci-dss-update) -- Software Integrity Blog - - [CyRC Vulnerability Analysis: CVE-2022-1271 in gzip, but it’s not as bad as it sounds](https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-analysis-gzip/) -- Project Zero - - [The More You Know, The More You Know You Don’t Know](https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html) -- Reverse Engineering - - [Reverse engineering Typora Activation](https://www.reddit.com/r/ReverseEngineering/comments/u7e6d3/reverse_engineering_typora_activation/) -- Sucuri Blog - - [Poodle and Doodle, FUD and the Sucuri WAF](https://blog.sucuri.net/2022/04/poodle-and-doodle-fud-and-the-sucuri-waf.html) -- Malwarebytes Labs - - [Watch out for Ukraine donation scammers in Twitter replies](https://blog.malwarebytes.com/social-engineering/2022/04/watch-out-for-ukraine-donation-scammers-in-twitter-replies/) - - [North Korean Lazarus APT group targets blockchain tech companies](https://blog.malwarebytes.com/social-engineering/2022/04/north-korean-lazarus-apt-group-targets-blockchain-tech-companies/) -- The Daily Swig | Cybersecurity news and views - - [Pegasus mobile spyware used zero-click exploits to snoop on Catalan politicians](https://portswigger.net/daily-swig/pegasus-mobile-spyware-used-zero-click-exploits-to-snoop-on-catalan-politicians) - - [Utah Consumer Privacy Act: New legislation adds another wrinkle to the US legal landscape](https://portswigger.net/daily-swig/utah-consumer-privacy-act-new-legislation-adds-another-wrinkle-to-the-us-legal-landscape) -- Hacking Articles - - [A Detailed Guide on HTML Smuggling](https://www.hackingarticles.in/a-detailed-guide-on-html-smuggling/) -- Hacking and security - - [Programming in C - A Tutorial](https://hackingandsecurity.blogspot.com/2022/04/programming-in-c-tutorial.html) - - [Certified Ethical Hacker Q and A - part 2](https://hackingandsecurity.blogspot.com/2022/04/certified-ethical-hacker-q-and-part-2.html) -- rtl-sdr.com - - [Running GR-GSM and IMSI Catcher on a Raspberry Pi 4 with Dragon OS](https://www.rtl-sdr.com/running-gr-gsm-and-imsi-catcher-on-a-raspberry-pi-4-with-dragon-os/) - - [Lightweight Windows Software uSDR Updated to Version 1.5.0](https://www.rtl-sdr.com/lightweight-windows-software-usdr-updated-to-version-1-5-0/) - - [Skies-ADSB: A Browser Based 3D Aircraft Tracker with RTL-SDR ADS-B Receiver](https://www.rtl-sdr.com/skies-adsb-a-browser-based-3d-aircraft-tracker-with-rtl-sdr-ads-b-receiver/) -- bishopfox.com - - [Our Top 9 Favorite Fuzzers](https://bishopfox.com/blog/top-9-fuzzers) -- KitPloit - PenTest & Hacking Tools - - [Smap - A Drop-In Replacement For Nmap Powered By Shodan.Io](http://www.kitploit.com/2022/04/smap-drop-in-replacement-for-nmap.html) - - [ADReaper - A Fast Enumeration Tool For Windows Active Directory Pentesting Written In Go](http://www.kitploit.com/2022/04/adreaper-fast-enumeration-tool-for.html) -- 奇客Solidot–传递最新科技情报 - - [新数据显示 Windows 11 普及度甚至低于 XP](https://www.solidot.org/story?sid=71292) - - [佛罗里达法官推翻了旅行口罩强制令](https://www.solidot.org/story?sid=71291) - - [Google 否认对俄罗斯敏感地点卫星图片去模糊处理](https://www.solidot.org/story?sid=71290) - - [上海报告 10 例新冠死亡病例](https://www.solidot.org/story?sid=71289) - - [大学不看标准化考试成绩后申请激增](https://www.solidot.org/story?sid=71288) - - [英特尔将检测学生情绪的 AI 称为教学工具](https://www.solidot.org/story?sid=71287) - - [科学家希望为好奇的外星人广播 DNA 和地球的位置](https://www.solidot.org/story?sid=71286) - - [美国上诉法院裁决 Web 抓取是合法的](https://www.solidot.org/story?sid=71285) - - [香港研究显示奥密克戎变种流行期间未完全接种病例死亡风险与早期相当](https://www.solidot.org/story?sid=71284) - - [清华大学实现百公里量子直接通信](https://www.solidot.org/story?sid=71283) - - [英国政府官员感染间谍软件 Pegasus](https://www.solidot.org/story?sid=71282) - - [Apollo Global 考虑竞购 Twitter](https://www.solidot.org/story?sid=71281) -- Blog on Shielder - - [Printing Fake Fiscal Receipts - An Italian Job p.1](https://www.shielder.com/blog/2022/04/printing-fake-fiscal-receipts-an-italian-job-p.1/) -- 黑海洋 - WIKI - - [小码短链接](https://blog.upx8.com/2706) - - [如何用项目管理的思维找女朋友？](https://blog.upx8.com/2705) - - [Windows纯净系统镜像下载MSDN下载激活工具（HelloWindows）](https://blog.upx8.com/2704) - - [Master PDF Editor v5.8.50便携版](https://blog.upx8.com/2703) - - [M3U8视频下载器v3.0.6](https://blog.upx8.com/2702) -- Fortinet Threat Research Blog - - [Using Emulation Against Anti-Reverse Engineering Techniques](https://www.fortinet.com/blog/threat-research/Using-emulation-against-anti-reverse-engineering-techniques) -- 颖奇L'Amore - - [TextMate：轻量级代码编辑器](https://www.gem-love.com/2022/04/19/TextMate%EF%BC%9A%E8%BD%BB%E9%87%8F%E7%BA%A7%E4%BB%A3%E7%A0%81%E7%BC%96%E8%BE%91%E5%99%A8/) - - [优雅的使用vscode（插件分享）](https://www.gem-love.com/2022/04/19/vscode%E6%8F%92%E4%BB%B6%E5%88%86%E4%BA%AB/) - - [使用iTerm2+zsh替代苹果自带Terminal](https://www.gem-love.com/2022/04/19/%E4%BD%BF%E7%94%A8iTerm2-zsh%E6%9B%BF%E4%BB%A3%E8%8B%B9%E6%9E%9C%E8%87%AA%E5%B8%A6Terminal/) -- LuxSci - - [Addressing Health Equity with Digital Communications](https://luxsci.com/blog/addressing-health-equity-with-digital-communications.html) -- Forensic Focus - - [Register for Webinar: Uncovering Windows Registry Data and the Latest Mac Artifacts](https://www.forensicfocus.com/webinars/register-for-webinar-uncovering-windows-registry-data-and-the-latest-mac-artifacts/) -- Securityinfo.it - - [Hacker rubano $655.000 con seed MetaMask preso da iCloud](https://www.securityinfo.it/2022/04/19/hacker-rubano-655-000-con-seed-metamask-preso-da-icloud/?utm_source=rss&utm_medium=rss&utm_campaign=hacker-rubano-655-000-con-seed-metamask-preso-da-icloud) - - [Nuovo exploit zero-click usato per spiare gli iPhone](https://www.securityinfo.it/2022/04/19/nuovo-exploit-zero-click-usato-per-spiare-gli-iphone/?utm_source=rss&utm_medium=rss&utm_campaign=nuovo-exploit-zero-click-usato-per-spiare-gli-iphone) -- SANS Internet Storm Center, InfoCON: green - - [Resetting Linux Passwords with U-Boot Bootloaders, (Tue, Apr 19th)](https://isc.sans.edu/diary/rss/28564) - - [ISC Stormcast For Tuesday, April 19th, 2022 https://isc.sans.edu/podcastdetail.html?id=7970, (Tue, Apr 19th)](https://isc.sans.edu/diary/rss/28566) -- ICT Security Magazine - - [ICS, OT e SCADA Security: a rischio le infrastrutture critiche](https://www.ictsecuritymagazine.com/notizie/ics-ot-e-scada-security-a-rischio-le-infrastrutture-critiche/) -- Hakin9 – IT Security Magazine - - [Coraza - Golang modsecurity compatible web application firewall library](https://hakin9.org/coraza-golang-modsecurity-compatible-web-application-firewall-library/) - - [vAPI - Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises](https://hakin9.org/vapi-vulnerable-adversely-programmed-interface/) -- HACKMAGEDDON - - [Q1 2022 Cyber Attacks Statistics](https://www.hackmageddon.com/2022/04/19/q1-2022-cyber-attacks-statistics/) -- 杨龙 - - [间歇性 Error while reading line from the server.](https://www.yanglong.pro/%e9%97%b4%e6%ad%87%e6%80%a7-error-while-reading-line-from-the-server/) -- Full Disclosure - - [Backdoor.Win32.GateHell.21 / Port Bounce Scan](https://seclists.org/fulldisclosure/2022/Apr/38) - - [Backdoor.Win32.GateHell.21 / Authentication Bypass](https://seclists.org/fulldisclosure/2022/Apr/37) - - [Backdoor.Win32.Delf.zn / Insecure Credential Storage](https://seclists.org/fulldisclosure/2022/Apr/36) - - [Backdoor.Win32.Psychward.03.a / Weak Hardcoded Password](https://seclists.org/fulldisclosure/2022/Apr/35) - - [Backdoor.Win32.Hupigon.haqj / Insecure Service Path](https://seclists.org/fulldisclosure/2022/Apr/34) - - [Trojan.Win32.TScash.c / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Apr/33) - - [Backdoor.Win32.Loselove / Denial of Service](https://seclists.org/fulldisclosure/2022/Apr/32) - - [HackTool.Win32.Delf.vs / Insecure Credential Storage](https://seclists.org/fulldisclosure/2022/Apr/31) -- TorrentFreak - - [85 ‘Pirate’ IPTV Apps Reported as Illegal But Most (If Any) Carry No Content](https://torrentfreak.com/85-pirate-iptv-apps-reported-as-illegal-but-most-if-any-carry-no-content-220419/) - - [DuckDuckGo ‘Restores’ Pirate Sites and Points to Bing as Culprit](https://torrentfreak.com/duckduckgo-restores-pirate-sites-and-points-to-bing-220419/) -- Deeplinks - - [Stop Forced Arbitration in Data Privacy Legislation](https://www.eff.org/deeplinks/2022/04/stop-forced-arbitration-data-privacy-legislation) - - [Scraping Public Websites (Still) Isn’t a Crime, Court of Appeals Declares](https://www.eff.org/deeplinks/2022/04/scraping-public-websites-still-isnt-crime-court-appeals-declares) -- Computer Forensics - - [It’s not always clear which US Gov jobs are digital Forensics, so I’ve created a scraper!](https://www.reddit.com/r/computerforensics/comments/u72j58/its_not_always_clear_which_us_gov_jobs_are/) - - [Alright guys, can someone help me find this attack I'm doing??](https://www.reddit.com/r/computerforensics/comments/u7j47x/alright_guys_can_someone_help_me_find_this_attack/) - - [CHFI EXAM](https://www.reddit.com/r/computerforensics/comments/u7fm1r/chfi_exam/) - - [I’ve noticed something interesting about the UITextInputContextIdentifiers.plist file (pulled from an encrypted iOS backup) - in some cases, it identify’s a Signal contact by phone number, whereas others are only listed by a UID … anyone else aware of the following?](https://www.reddit.com/r/computerforensics/comments/u70vny/ive_noticed_something_interesting_about_the/) - - [How to convert a pcap file to an image file?](https://www.reddit.com/r/computerforensics/comments/u7ak7t/how_to_convert_a_pcap_file_to_an_image_file/) - - [What should I study for this job application?](https://www.reddit.com/r/computerforensics/comments/u74w47/what_should_i_study_for_this_job_application/) -- Blackhat Library: Hacking techniques and research - - [7Zip privilege escalation](https://www.reddit.com/r/blackhat/comments/u6uooy/7zip_privilege_escalation/) -- Il Disinformatico - - [DragonChase 2022: Lancio di satelliti di SpaceX giovedì, prova generale per vedere la partenza di @Astrosamantha](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-lancio-di-satelliti-di.html) -- 东软网络安全 - - [《2021网信自主创新调研报告》正式发布！东软荣获突出贡献单位奖](https://mp.weixin.qq.com/s?__biz=MjM5NTAyODkxNw==&mid=2649212283&idx=1&sn=59cc5f294c9adcae71601ba2107c6731&chksm=beedafa1899a26b783f2e874b849aa1eda5eea966e9bba8b9cdd65cc27bc1afb12caf625a452&scene=58&subscene=0#rd) -- Threatpost - - [Rethinking Cyber-Defense Strategies in the Public-Cloud Age](https://threatpost.com/cyber-defense-public-cloud/179342/) - - [‘CatalanGate’ Spyware Infections Tied to NSO Group](https://threatpost.com/catalangate-spyware/179336/) - - [Protect Your Executives’ Cybersecurity Amidst Global Cyberwar](https://threatpost.com/protect-executives-cybersecurity/179324/) -- Security Affairs - - [ESET warns of three flaws that affect over 100 Lenovo notebook models](https://securityaffairs.co/wordpress/130375/security/lenovo-uefi-flaws.html) - - [Kaspersky releases a free decryptor for Yanluowang ransomware](https://securityaffairs.co/wordpress/130369/malware/yanluowang-ransomware-free-decryptor.html) - - [NSO Group Pegasus spyware leverages new zero-click iPhone exploit in recent attacks](https://securityaffairs.co/wordpress/130360/malware/nso-group-pegasus-click-iphone-exploit.html) - - [New SolarMarker variant upgrades evasion abilities to avoid detection](https://securityaffairs.co/wordpress/130347/malware/solarmarker-malware-upgrades-evasion-abilities.html) - - [Crooks steal $182 million from Beanstalk DeFi platform](https://securityaffairs.co/wordpress/130334/cyber-crime/beanstalk-defi-182m-losses.html) -- Hacking and security - - [Programming in C - A Tutorial](https://hackingandsecurity.blogspot.com/2022/04/programming-in-c-tutorial.html) - - [Certified Ethical Hacker Q and A - part 2](https://hackingandsecurity.blogspot.com/2022/04/certified-ethical-hacker-q-and-part-2.html) -- 字节跳动安全中心 - - [新型DDoS攻击泛滥: 利用中间盒的TCP反射放大攻击分析](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247488507&idx=1&sn=321aa2c4813fda202b30eaafb64f8eca&chksm=fa9ee8adcde961bbadb251f1ca2ee0c548dff984a857bac31f1d5dc45349ab0c123669201f84&scene=58&subscene=0#rd) -- 锦行信息安全 - - [【漏洞预警】7-zip命令执行](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489504&idx=1&sn=fe86ccce73da17cd24ee84039aee3b28&chksm=9799ec45a0ee65530d6b7caa678c699c4a3dec3f83af411ac0aac6a9e32b4d25dbe1632b73ef&scene=58&subscene=0#rd) -- Social Engineering - - [People That Overestimate Their Own Intelligence Are Actually Easier To Fool.](https://www.reddit.com/r/SocialEngineering/comments/u77neo/people_that_overestimate_their_own_intelligence/) - - [The good and the bad way to deal with Social Anxiety](https://www.reddit.com/r/SocialEngineering/comments/u74ts9/the_good_and_the_bad_way_to_deal_with_social/) - - [Am I a psycho for wanting to read and use Robert Greene books?](https://www.reddit.com/r/SocialEngineering/comments/u6uo6w/am_i_a_psycho_for_wanting_to_read_and_use_robert/) - - [Opinion survey](https://www.reddit.com/r/SocialEngineering/comments/u6vfq6/opinion_survey/) -- Graham Cluley - - [Funky Pigeon stalls orders after hackers breach its systems](https://grahamcluley.com/funky-pigeon-stalls-orders-after-hackers-breached-its-systems/) - - [For cutting-edge web application and API protection – Trust Indusface WAAP](https://grahamcluley.com/feed-sponsor-indusface/) -- 雷神众测 - - [ATT&CK-防御绕过之进程注入攻防分析](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652496727&idx=1&sn=fafe93493a4ce6647ca3b4b490d9f620&chksm=f25840e4c52fc9f29798ec9c60660e21806ea42a514a962c3afc174920aa17b2a9c402cd44e0&scene=58&subscene=0#rd) -- 安全牛 - - [2022年威胁态势研究：还在用昨天的方法，解决明天的问题？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112432&idx=1&sn=6557470aa9f15f3168c7727dbfab17a3&chksm=bd1473238a63fa35f3cecdcc2fcc5476369307c3022314511b961f79bf6aa65eee0dbc82132d&scene=58&subscene=0#rd) - - [SD-WAN安全防护模型及能力建设挑战分析](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112432&idx=2&sn=98541eeb314ef8f28dd0e5b5862fd334&chksm=bd1473238a63fa3521d6c75abc7e51ea61aec21d5031ee10fc9a6558bc1054c5c39c6e718e57&scene=58&subscene=0#rd) - - [BCS2022全球议题征集正式开启](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112432&idx=3&sn=fc6ea68a9508a13204f741d647f03445&chksm=bd1473238a63fa350582e2f360a3709dc99c4dce3413fae7cf3fec49638eb6991d49db68e461&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [微步安全学堂 | 4.26，攻防演练专题直播·攻略篇](https://mp.weixin.qq.com/s?__biz=MzA5MDc1NDc1MQ==&mid=2247493000&idx=1&sn=00e15c01785be0d1dabf954948e8914d&chksm=90047e58a773f74e5ba040744dc1893e0848411c26999ce4534ebda37999aebb73f6af2c6fdb&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(04-19)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958362&idx=1&sn=030ff63f51ad104109dd54ff70a514e7&chksm=8baeccc5bcd945d323c9a0f705dcabe0376ac051c0ecf822b41faf490113f4456909a4203c27&scene=58&subscene=0#rd) -- Dark Reading - - [Microsoft Launches Purview Platform to Govern, Protect, and Manage Sensitive Data](https://www.darkreading.com/remote-workforce/microsoft-launches-purview-platform-to-govern-protect-and-manage-sensitive-data) - - [Millions of Lenovo Laptops Contain Firmware-Level Vulnerabilities](https://www.darkreading.com/threat-intelligence/millions-of-lenovo-laptops-contain-firmware-level-vulnerabilities) - - [More Than Half of Initial Infections in Cyberattacks Come Via Exploits, Supply Chain Compromises](https://www.darkreading.com/threat-intelligence/exploits-supply-chain-compromises-comprise-over-half-of-initial-infections-leading-to-cyberattacks) - - [RF Code Announces Sentry, a New Edge Solution for Remote Locations](https://www.darkreading.com/perimeter/rf-code-announces-sentry-a-new-edge-solution-for-remote-locations) - - [New Kiteworks Report Reveals Significant Risk Maturity Gap](https://www.darkreading.com/risk/new-kiteworks-report-reveals-significant-risk-maturity-gap) - - [How to Interpret the EU's Guidance on DNS Abuse Worldwide](https://www.darkreading.com/vulnerabilities-threats/how-to-interpret-the-eu-s-guidance-on-dns-abuse-worldwide) - - [Verica Launches Prowler Pro to Make AWS Security Simpler for Customers](https://www.darkreading.com/cloud/verica-launches-prowler-pro-to-make-aws-security-simpler-for-customers) -- 字节跳动技术团队 - - [一文读懂推荐系统中的debias](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247492717&idx=1&sn=51589532898a6c06b4384bc86774a5ea&chksm=e9d32f8fdea4a699d826d1f035f79211f376b71f9264baad9eefd974606e1d59194bdd8e942f&scene=58&subscene=0#rd) -- 看雪学院 - - [ZJCTF2021 Reverse-Triple Language](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438388&idx=1&sn=12782ff88bd2bde0f6981850b4b02a1c&chksm=b18ffa7e86f8736851bfeb653c55706f1fdb8d11b0b3569bde3b91464ca646064fbb54e13dc0&scene=58&subscene=0#rd) - - [《社交娱乐·风控课堂》4月28日云开讲！参与直播赢大奖](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438388&idx=2&sn=afd073a585540f846d249b3c05901b7e&chksm=b18ffa7e86f8736868b2f520d26eae6283b78732096a4c3377d97eccb41cf6f8f528313cd8b6&scene=58&subscene=0#rd) - - [Beanstalk DeFi平台遭攻击损失1.82亿美元](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438388&idx=3&sn=cf12f71f39cb6c809a3d93a6c0a8661d&chksm=b18ffa7e86f87368810388bd99a1fb2bf3dbbe366d8f007551e0a87f1289bac3e834dd17389c&scene=58&subscene=0#rd) - - [精品课程 | 4h入门PHP代码审计之反序列化](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438388&idx=4&sn=234560eb7d15047005f19b85d5d8373f&chksm=b18ffa7e86f87368e39b51299aab57be124cb73bc51368c6ea600185aaf464aae3bf8c80761b&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [由PolicyKit和DirtyPipe漏洞浅谈安全操作系统的意义](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525843&idx=1&sn=04cd642e1e38965470be1c70da6931a4&chksm=c1e9e982f69e60945c4712749bed3bfe994081237726b40e41460fa940b06e0f318aaba40549&scene=58&subscene=0#rd) - - [国家安全机关公布多起典型案例](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525843&idx=2&sn=bb5a328e081c2819b2e8825eb9ac7aac&chksm=c1e9e982f69e60949c82a30a9ef5012628e313b1667f3244f9f2246ba97e626776a5bcc98ac6&scene=58&subscene=0#rd) - - [谷歌再放大招？在其卫星地图上去除俄罗斯军事和战略设施目标的保密印章？](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525843&idx=3&sn=bdc0b73b7e0d92f830adcc745142a2d2&chksm=c1e9e982f69e6094bf4dd4563b9a6ee7c068abd5939a3163a87f8940978efaf1a94a42bb93c4&scene=58&subscene=0#rd) - - [网络安全七大热点赛道](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525843&idx=4&sn=85c19c6d4f47892cdbb951c706b6acf9&chksm=c1e9e982f69e609454583142c08b03b5c4ffffcab3814fb85ed477e9adb95c78cd02e1eb16fd&scene=58&subscene=0#rd) -- 腾讯科恩实验室 - - [技术公开课｜如何应对软件供应链安全问题？谈谈SCA技术落地实践](https://mp.weixin.qq.com/s?__biz=MzU1MjgwNzc4Ng==&mid=2247503224&idx=1&sn=c6115f4bd0881ed64449a88858ca0360&chksm=fbfef17dcc89786b348dfa5a28309efff441ef0606caa98cbd7de3808d2120918930fb1a425d&scene=58&subscene=0#rd) -- 数世咨询 - - [SaaS的好处和坏处：可见性是SaaS安全的关键](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492801&idx=1&sn=aebaa50fd4aeacb1618660a7e93a6cda&chksm=c144967cf6331f6a73583add3c9074e2f2966556777c99a0b8b8cba13ed39233961bef5c5d94&scene=58&subscene=0#rd) - - [[调研]英特尔：硬件辅助安全迎来增长](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492801&idx=2&sn=4e7c2dc33f7f06865095bc202b22a659&chksm=c144967cf6331f6a29ba2ba25f34c487dd99b173a4703ff32f8daa736d4b861e6af4adaaea80&scene=58&subscene=0#rd) -- 腾讯安全威胁情报中心 - - [如何让威胁情报在重保场景中发挥最大价值？ ——马上预约，后天开讲！](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500288&idx=1&sn=74ef174e4dc17af191e8e225755106b1&chksm=ec9f1b73dbe892658e6c04f01f65ddebfdd0f70a5b296d1064ec82525f4f8297fd64b01e1d08&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [How I [almost] blew up my computer: @khr0x40sh's story of trimming LARGE password lists / txt files](https://www.reddit.com/r/netsecstudents/comments/u76c8n/how_i_almost_blew_up_my_computer_khr0x40shs_story/) - - [Currently Active Duty, looking to study Cybersecurity using benefits](https://www.reddit.com/r/netsecstudents/comments/u6vqwk/currently_active_duty_looking_to_study/) - - [what role should I apply for?](https://www.reddit.com/r/netsecstudents/comments/u77d2t/what_role_should_i_apply_for/) -- 星阑科技 - - [一周Gartner网络研讨会，了解国际最新趋势](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247492778&idx=1&sn=f1b51ad84f542dfb8c9da2cc596d55c0&chksm=c0074936f770c020ff6023d91ae2adb53b6fe9148b0a3d86398cc2e6471cdec06f8728bbeebb&scene=58&subscene=0#rd) -- Schneier on Security - - [Undetectable Backdoors in Machine-Learning Models](https://www.schneier.com/blog/archives/2022/04/undetectable-backdoors-in-machine-learning-models.html) -- 补天平台 - - [鹰图平台正式推出企业账号体系](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247493353&idx=1&sn=b5e13d3edc2ea41d7e5ca37c607493ff&chksm=eaf9aea5dd8e27b355bc3edd3127b91ff54f87e9753d03a0cc3b2dc45b76c42d68da45ed46de&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [Zip bomb](https://www.reddit.com/r/HowToHack/comments/u74jte/zip_bomb/) - - [Cloning car key fob to an RFID Tag](https://www.reddit.com/r/HowToHack/comments/u7gc5u/cloning_car_key_fob_to_an_rfid_tag/) - - [Need to unlock Motorola G6 (family member died)](https://www.reddit.com/r/HowToHack/comments/u7cqfj/need_to_unlock_motorola_g6_family_member_died/) - - [Responsible Disclosure /phpinfo.php](https://www.reddit.com/r/HowToHack/comments/u7arxi/responsible_disclosure_phpinfophp/) - - [My drunk self changed the lock pattern. Help. Please.](https://www.reddit.com/r/HowToHack/comments/u7fnhs/my_drunk_self_changed_the_lock_pattern_help_please/) - - [How are nmap arp pings implemented?](https://www.reddit.com/r/HowToHack/comments/u6tdc7/how_are_nmap_arp_pings_implemented/) - - [IP Address maping for Metasploit with Dynamic IP](https://www.reddit.com/r/HowToHack/comments/u70j9p/ip_address_maping_for_metasploit_with_dynamic_ip/) - - [Is Jackpotting ATM's still possible in 2022?](https://www.reddit.com/r/HowToHack/comments/u78csv/is_jackpotting_atms_still_possible_in_2022/) - - [Proxychains - Is it possible my ISP is blocking my Proxy attempts?](https://www.reddit.com/r/HowToHack/comments/u764j6/proxychains_is_it_possible_my_isp_is_blocking_my/) - - [Need a good service to track IP, with masked domain name as a image host](https://www.reddit.com/r/HowToHack/comments/u78hxu/need_a_good_service_to_track_ip_with_masked/) -- 三六零CERT - - [安全日报（2022.04.19）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247490891&idx=1&sn=0dd377d25cf78295c4e7efb3926607c7&chksm=fe25184ac952915cc1ee1a34579acf11c97c1f85f12be9845ff894b73537baa98dff7f3ba2c3&scene=58&subscene=0#rd) -- 情报分析师 - - [台、俄最高军事机密被谷歌地图曝光](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497913&idx=1&sn=bad245db70665284ad26e70647611e74&chksm=87164d32b061c4246025bef441f66e43d2024b5547f367ed81bd3365d54c89149a32d3a32b35&scene=58&subscene=0#rd) - - [大国重器：《俄罗斯战术核武器2022》报告](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497913&idx=2&sn=6a5456db2ffc021ea6ecc5e267d82536&chksm=87164d32b061c424a9fbc4ba1f6cbada3a800aeac91ec42f720dd1284880933a94065672bf88&scene=58&subscene=0#rd) - - [安全与冲突地图查看工具](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497913&idx=3&sn=0a1ac5d24c704617a90d8b7b3bd6be37&chksm=87164d32b061c424bb0a073d92be022de4866a18dc566d17e70081c19308ceda05f0f07cb7e6&scene=58&subscene=0#rd) -- 代码卫士 - - [NSO Group 被指利用零点击 iPhone 0day](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511433&idx=1&sn=ccfa58d4b24a80f8950bdafde68af58c&chksm=ea949ce3dde315f563191aee1b6f8c1e5a266126fe4968ef8018d1a937bc6e8a3bc500415221&scene=58&subscene=0#rd) - - [即使静音，Webex仍在监控麦克风](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511433&idx=2&sn=b222aa11317b5ed8be8ed14722e20bc5&chksm=ea949ce3dde315f55aba633171a798435d5f337c185bb8929f2898f2c899d798029256e79860&scene=58&subscene=0#rd) - - [开源工具 PrivateBin 修复XSS 漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511433&idx=3&sn=ff04084cd337034fbdf95f2eb572c65a&chksm=ea949ce3dde315f54aac997e6b2fa73ed091ef780a4381e169502f00c9227d9bc2518f543d05&scene=58&subscene=0#rd) -- The Register - Security - - [Kaspersky cracks Yanluowang ransomware, offers free decryptor](https://go.theregister.com/feed/www.theregister.com/2022/04/19/kaspersky_yanluowang_ransomware/) - - [ESET uncovers vulnerabilities in Lenovo laptops](https://go.theregister.com/feed/www.theregister.com/2022/04/19/eset_lenovo/) - - [Funky Pigeon pauses all orders after 'security incident'](https://go.theregister.com/feed/www.theregister.com/2022/04/19/funky_pigeon_security_incident/) -- SecIN技术平台 - - [分享图片](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247493584&idx=1&sn=59a5819a128bd1a2aa13c7ed167284c5&chksm=eb84ba84dcf3339277a723bf1289a1296ba76722c2db21b710cbbf4b9b1afc968322dab90a02&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [Laravel架构分析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493108&idx=1&sn=cefc07b3506dca96e19220d847334a44&chksm=fa52304acd25b95ca66693ab61769543a5a3e4c7adef83acb89da7986488c2714e6840016b8a&scene=58&subscene=0#rd) -- 青藤云安全 - - [引领创新！青藤入选“网信自主创新尖锋企业”](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650833955&idx=1&sn=77da9c197add5507414bb454bf2c5e36&chksm=80dbe786b7ac6e90d5c53c0c3fc372da405050bbf151a1a93ae6698ddbc7f4808236868daea3&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [百度安全 Teaclave TrustZone SDK 0.2.0 版本正式发布！](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537173&idx=1&sn=c64acd02f723447fbae812fa3d29162c&chksm=8bcba569bcbc2c7f3ee5875013a3caa60ad094fc2e5204bcdce75a72ae982ae4517417b5766b&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [Smap - A Drop-In Replacement For Nmap Powered By Shodan.Io](http://www.kitploit.com/2022/04/smap-drop-in-replacement-for-nmap.html) - - [ADReaper - A Fast Enumeration Tool For Windows Active Directory Pentesting Written In Go](http://www.kitploit.com/2022/04/adreaper-fast-enumeration-tool-for.html) -- 360漏洞云 - - [《2021网信自主创新调研报告》发布，360政企安全集团任漏洞管理组组长单位获权威认可](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496697&idx=1&sn=c855956c112883e2b655757b3a7c107c&chksm=ebe80f6bdc9f867d55707472f710d1d20286d12162b5690e4ebba1e9e93e8041e7e077d300af&scene=58&subscene=0#rd) - - [注意 | Zoho ManageEngine Remote Access Plus 多个安全漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496697&idx=2&sn=f2291b0d2cfa7dfb59f0baff0d2ba180&chksm=ebe80f6bdc9f867d7ce68912d0ce46ff9c000c77bc6370dae12da46b4009397853ff2702e2a8&scene=58&subscene=0#rd) -- 腾讯安全应急响应中心 - - [【即将开赛】腾讯网络安全T-Star高校挑战赛邀你冲顶！ - -4月20日（周三）上午10点，一起battle，共同守护网络安全！ - -⭕️ 参赛链接 -https://cloud.tencent.com/developer/competition/introduction/10042](https://mp.weixin.qq.com/s?__biz=MjM5NzE1NjA0MQ==&mid=2651205752&idx=1&sn=f8fdd3c83d3369784ea42e78f01e0a1d&chksm=bd2cd5de8a5b5cc8cee6d75f057735ad07b5892bfce3eb3418655cf1ddcde179d3188498c457&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [AWS's Log4Shell HotPatch Vulnerable to Container Escape and Privilige Escalation](https://www.reddit.com/r/netsec/comments/u7hsq0/awss_log4shell_hotpatch_vulnerable_to_container/) - - [US Govt Cloud Security Needs ("SCuBA"): including Technical Reference Architecture and Extensible Visibility Reference Framework (eVRF) Guidebook links](https://www.reddit.com/r/netsec/comments/u7gasp/us_govt_cloud_security_needs_scuba_including/) - - [Teaching Burp a new HTTP Transport Encoding](https://www.reddit.com/r/netsec/comments/u75pg0/teaching_burp_a_new_http_transport_encoding/) - - [Shielder - Printing Fake Fiscal Receipts - An Italian Job p.1](https://www.reddit.com/r/netsec/comments/u7b22e/shielder_printing_fake_fiscal_receipts_an_italian/) - - [Exploiting, detecting, and correcting IAM security misconfigurations](https://www.reddit.com/r/netsec/comments/u72u3s/exploiting_detecting_and_correcting_iam_security/) - - [CVE-2022-26809 : Remote Procedure Call Runtime Vulnerability](https://www.reddit.com/r/netsec/comments/u6tn98/cve202226809_remote_procedure_call_runtime/) -- 互联网安全内参 - - [全球网安行业走向黄金时代：溢价并购不断，细分龙头迎来整合潮](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502443&idx=1&sn=2d818d0879a5d667f9d94e582cb43877&chksm=ebfa8d4bdc8d045db3704063f80541d1b4611bdea6a45147e6dc80d02ae9ce4f7ef3a6d72fb5&scene=58&subscene=0#rd) - - [谷歌地图开放俄罗斯所有战略要地高像素卫星图像](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502443&idx=2&sn=b94c4618e2cd751602a84e6352207331&chksm=ebfa8d4bdc8d045d0fbca39e7391c2ea5f803171b56affb0e3d82b5ee6969d6b66f0f20550b4&scene=58&subscene=0#rd) - - [从香港个人资料跨境传输规则展望与内地的数据跨境流动合作](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502443&idx=3&sn=290bb4be636241f8d0e42815ba2c96cf&chksm=ebfa8d4bdc8d045dc22527a4d92d42cd34ea897b3b3478bb1409384f5a72b9c0c66fa1a2cc16&scene=58&subscene=0#rd) - - [中办国办印发《关于加强打击治理电信网络诈骗违法犯罪工作的意见》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502443&idx=4&sn=59bdc535d7bc74e68061b7e16700498d&chksm=ebfa8d4bdc8d045ddfd4d3848cb1965664c10ba4cc480a361997354b2a6e78fd95dec39457e8&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [预约报名｜需求之变——云化时代安全市场新洞察](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491519&idx=1&sn=c78da4643a88258a2888620734df9e13&chksm=eaaf8cf8ddd805ee2e7950d133650113d4246c59b6393ae354ea827c52a20679ae8b7b9b3c08&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [Critically Underrated: Studying the Data Distribution Service (DDS) Protocol](https://www.trendmicro.com/en_us/research/22/d/critically-underrated-studying-data-distribution-service-DDS-protocol.html) -- Paul's Security Weekly - - [SWN #205 - Win 11, iPhone Zero Clicks, LinkedIn, Scraping, Conti Lies, & Webex Mics](http://podcast.securityweekly.com/swn-205-win-11-iphone-zero-clicks-linkedin-scraping-conti-lies-webex-mics) - - [ASW #193 - AppSec (& adjacent) Metrics](http://podcast.securityweekly.com/asw-193-appsec-adjacent-metrics) diff --git a/archive/2022/2022-04-21.md b/archive/2022/2022-04-21.md deleted file mode 100644 index 6be823c6fa..0000000000 --- a/archive/2022/2022-04-21.md +++ /dev/null @@ -1,324 +0,0 @@ -# 每日安全资讯（2022-04-21） - -- Sec-News 安全文摘 - - [The More You Know, The More You Know You Don’t Know](https://wiki.ioin.in/url/1G4n) -- HackerOne Hacker Activity - - [Open Akamai ARL XSS at ████████](https://hackerone.com/reports/1317024) - - [Full account takeover in ███████ due lack of rate limiting in forgot password](https://hackerone.com/reports/1059758) - - [███ vulnerable to CVE-2022-22954](https://hackerone.com/reports/1537694) - - [CORS Misconfiguration](https://hackerone.com/reports/1530581) - - [Reflected XSS in the shared note view on https://evernote.com](https://hackerone.com/reports/1518343) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5380-1](https://packetstormsecurity.com/files/166791/USN-5380-1.txt) - - [Red Hat Security Advisory 2022-1418-01](https://packetstormsecurity.com/files/166790/RHSA-2022-1418-01.txt) - - [Red Hat Security Advisory 2022-1396-01](https://packetstormsecurity.com/files/166789/RHSA-2022-1396-01.txt) - - [Red Hat Security Advisory 2022-1410-01](https://packetstormsecurity.com/files/166788/RHSA-2022-1410-01.txt) - - [Pharmacy Management System 1.0 SQL Injection](https://packetstormsecurity.com/files/166787/pms10-sql.txt) - - [Pharmacy Management System 1.0 Shell Upload](https://packetstormsecurity.com/files/166786/pms10-shell.txt) - - [Red Hat Security Advisory 2022-1413-01](https://packetstormsecurity.com/files/166785/RHSA-2022-1413-01.txt) - - [Red Hat Security Advisory 2022-1402-01](https://packetstormsecurity.com/files/166784/RHSA-2022-1402-01.txt) - - [Red Hat Security Advisory 2022-1407-01](https://packetstormsecurity.com/files/166783/RHSA-2022-1407-01.txt) - - [Red Hat Security Advisory 2022-1394-01](https://packetstormsecurity.com/files/166782/RHSA-2022-1394-01.txt) - - [Red Hat Security Advisory 2022-1417-01](https://packetstormsecurity.com/files/166781/RHSA-2022-1417-01.txt) - - [Online Restaurant Table Reservation System 1.0 SQL Injection](https://packetstormsecurity.com/files/166780/ortrs10-sql.txt) - - [7-Zip 16 DLL Hijacking](https://packetstormsecurity.com/files/166779/7zip16-dllhijack.txt) - - [Jenkins Remote Code Execution](https://packetstormsecurity.com/files/166778/awesome-jenkins-rce-2019-master.zip) -- Security Boulevard - - [Why Striking the Balance Between Insider Risk and Privacy is More Important Than Ever](https://securityboulevard.com/2022/04/why-striking-the-balance-between-insider-risk-and-privacy-is-more-important-than-ever/) - - [Survey: Financial Services Firms Under Cybersecurity Siege](https://securityboulevard.com/2022/04/survey-financial-services-firms-under-cybersecurity-siege/) - - [C Spire Tackles Digital Divide with Industry Collaboration](https://securityboulevard.com/2022/04/c-spire-tackles-digital-divide-with-industry-collaboration/) - - [Don’t Just Ensure Cybersecurity Asset Compliance – Prove It](https://securityboulevard.com/2022/04/dont-just-ensure-cybersecurity-asset-compliance-prove-it/) - - [How Russia Is Isolating Its Own Cybercriminals](https://securityboulevard.com/2022/04/how-russia-is-isolating-its-own-cybercriminals%ef%bf%bc/) - - [Uncovering new techniques and phishing attack trends from the cloud](https://securityboulevard.com/2022/04/uncovering-new-techniques-and-phishing-attack-trends-from-the-cloud/) - - [OWASP® Global AppSec US 2021 Virtual – Joe Schottman’s ‘Harmonizing The OWASP API And Application Top 10 Lists’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-joe-schottmans-harmonizing-the-owasp-api-and-application-top-10-lists/) - - [China’s Personal Information Protection Law (PIPL) and Where it Applies](https://securityboulevard.com/2022/04/chinas-personal-information-protection-law-pipl-and-where-it-applies/) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Implications of Windows Subsystem for Linux for Adversaries & Defenders (Part 2)](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Tenable Blog - - [Oracle April 2022 Critical Patch Update Addresses 221 CVEs](https://www.tenable.com/blog/oracle-april-2022-critical-patch-update-addresses-221-cves) - - [You’ve Migrated Business-Critical Functions to the Cloud…Now What?](https://www.tenable.com/blog/youve-migrated-business-critical-functions-to-the-cloud-now-what) -- 绿盟科技技术博客 - - [Oracle全系产品2022年4月关键补丁更新通告](http://blog.nsfocus.net/oracle-202204/) - - [云原生服务风险测绘分析（一）：Docker和Kubernetes](http://blog.nsfocus.net/docker-kubernetes/) -- Sploitus.com Exploits RSS Feed - - [Multi Language-Pharmacy Management System v1.0 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37651&utm_source=rss&utm_medium=rss) - - [Pharmacy Management System 1.0 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:166786&utm_source=rss&utm_medium=rss) - - [Online Restaurant Table Reservation System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166780&utm_source=rss&utm_medium=rss) - - [Pharmacy Management System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166787&utm_source=rss&utm_medium=rss) - - [Audio Conversion Wizard V2.01 Denial of Service Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37652&utm_source=rss&utm_medium=rss) - - [7-Zip 16 DLL Hijacking exploit](https://sploitus.com/exploit?id=PACKETSTORM:166779&utm_source=rss&utm_medium=rss) - - [Fast CD Ripper V1.8rc1 Denial of Service Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37653&utm_source=rss&utm_medium=rss) - - [USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 Remote Root Backdoor exploit](https://sploitus.com/exploit?id=ZSL-2022-5705&utm_source=rss&utm_medium=rss) - - [Torrent Video Cutter V1.93 Build 114 Denial of Service Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37655&utm_source=rss&utm_medium=rss) - - [Karaoke Video Creator V2.5.6.3 Denial of Service Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37654&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-1329 exploit](https://sploitus.com/exploit?id=E6E61502-16B1-5639-8AA9-D39AAE82786D&utm_source=rss&utm_medium=rss) - - [Exploit for Use After Free in Google Android exploit](https://sploitus.com/exploit?id=DD661B2B-98BA-55FB-A7F5-85DF46E91498&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-21449 exploit](https://sploitus.com/exploit?id=4A1985F7-D340-579E-8264-6600E6D36EA6&utm_source=rss&utm_medium=rss) - - [Exploit for Deserialization of Untrusted Data in Sernet Verinice exploit](https://sploitus.com/exploit?id=4ADAA0CA-280E-5BD2-AD81-ED27AADC1F62&utm_source=rss&utm_medium=rss) - - [Exploit for Allocation of Resources Without Limits or Throttling in Helpsystems Cobalt Strike exploit](https://sploitus.com/exploit?id=E86C494D-3B8C-5EE4-A7FC-5D94C72DA7FE&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=5E3C3527-A8AB-573F-B617-ACCD672ED2FB&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-29464 exploit](https://sploitus.com/exploit?id=42F4DC94-79C9-58E1-AAAE-DC98114391B4&utm_source=rss&utm_medium=rss) -- 腾讯科恩实验室官方博客 - - [“精”准把握静态分析｜科恩二进制文件自动化静态漏洞检测工具正式开源](http://keenlab.tencent.com/2022/04/20/2022-BinAbsInspector-public-release/) -- Der Flounder - - [Building a Privileges installer package using AutoPkg](https://derflounder.wordpress.com/2022/04/20/building-a-privileges-installer-package-using-autopkg/) -- Planet Classpath - - [Tom Tromey: Faster GDB Startup](https://tromey.com/blog/?p=1084) -- 跳跳糖 - 安全与分享社区 - - [Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 2) （译文）](https://tttang.com/archive/1557/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 工信部通报37款侵害用户权益App；一种实时语音算法可阻止麦克风窃听](https://www.freebuf.com/news/330061.html) - - [警惕！加泰罗尼亚政治家活动家受间谍软件攻击](https://www.freebuf.com/articles/329814.html) - - [针对DVR设备的新BotenaGo恶意软件变种](https://www.freebuf.com/news/329769.html) - - [CISA 发出警告，攻击者正在利用 Windows 漏洞](https://www.freebuf.com/news/329766.html) - - [ESET发出警告，联想三个漏洞影响数百万台电脑](https://www.freebuf.com/news/329749.html) - - [数量猛增，LinkedIn已成为网络钓鱼者的最爱](https://www.freebuf.com/news/329742.html) - - [FreeBuf早报 | 美中情局主站网络武器“蜂巢”曝光；联想固件漏洞影响数百万电脑](https://www.freebuf.com/news/329733.html) -- Trustwave Blog - - [Why Managed Detection and Response is a Key Component to any Security Plan](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/why-managed-detection-and-response-is-a-key-component-to-any-security-plan/) -- 安全客-有思想的安全新媒体 - - [美国福克斯新闻泄露1300万条敏感数据，互联网用户可随时访问](https://www.anquanke.com/post/id/272246) - - [2022-04 补丁日: Oracle多个产品漏洞安全风险通告](https://www.anquanke.com/post/id/272343) - - [新型DDoS攻击泛滥: 利用中间盒的TCP反射放大攻击分析](https://www.anquanke.com/post/id/272193) - - [从Spring RCE 0day(CVE-2022-22965)看黑产利用速度](https://www.anquanke.com/post/id/272190) - - [黑客从iCloud备份中获取MetaMask种子后窃取了655万美元](https://www.anquanke.com/post/id/272297) - - [4月20日每日安全热点 - 福克斯广播公司遭遇数据泄露](https://www.anquanke.com/post/id/272317) -- NVISO Labs - - [Investigating an engineering workstation – Part 3](https://blog.nviso.eu/2022/04/20/investigating-an-engineering-workstation-part-3/) -- Trail of Bits Blog - - [Amarna: Static analysis for Cairo programs](https://blog.trailofbits.com/2022/04/20/amarna-static-analysis-for-cairo-programs/) -- Malwarebytes Labs - - [The fake Elon Musk Bitcoin giveaway marathon will NOT make you rich](https://blog.malwarebytes.com/scams/2022/04/the-fake-elon-musk-bitcoin-giveaway-marathon-will-not-make-you-rich/) - - [Oracle releases massive Critical Patch Update containing 520 security patches](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/04/oracle-releases-massive-critical-patch-update-containing-520-security-patches/) - - [US warns of APT groups that can “gain full system access” to some industrial control systems](https://blog.malwarebytes.com/vital-infrastructure/2022/04/us-warns-of-apt-groups-that-can-gain-full-system-access-to-industrial-control-systems/) - - [Beware tragic “my daughter died…” Facebook posts offering free PS5s](https://blog.malwarebytes.com/privacy-2/2022/04/beware-tragic-my-daughter-died-facebook-posts-offering-free-ps5s/) -- Reverse Engineering - - [Reverse-engineering the LM185 voltage reference chip and its bandgap reference](https://www.reddit.com/r/ReverseEngineering/comments/u7yixy/reverseengineering_the_lm185_voltage_reference/) - - [BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. Currently it supports binaries on x86,x64, armv7 and aarch64.](https://www.reddit.com/r/ReverseEngineering/comments/u7q6fu/binabsinspector_binary_abstract_inspector_is_a/) - - [Reverse Engineering The Houseparty Video Chat App](https://www.reddit.com/r/ReverseEngineering/comments/u7wrij/reverse_engineering_the_houseparty_video_chat_app/) - - [Unpacking an ISO File Infection](https://www.reddit.com/r/ReverseEngineering/comments/u7q70f/unpacking_an_iso_file_infection/) -- Bug Bounty in InfoSec Write-ups on Medium - - [$1000: How I could have Hack any account and become a billionaire overnightTop Crypto-Trading….](https://infosecwriteups.com/1000-how-i-could-have-hack-any-account-and-become-a-billionaire-overnight-top-crypto-trading-ff0e25b6013c?source=rss----7b722bfd1b8d--bug_bounty) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-04-19 - Infection from Brazil malspam](https://www.malware-traffic-analysis.net/2022/04/19/index2.html) - - [2022-04-19 - Files for an ISC diary (Qakbot with DarkVNC)](https://www.malware-traffic-analysis.net/2022/04/19/index.html) -- GuidePoint Security - - [PCI DSS 4.0 – Major Future-Dated Requirements](https://www.guidepointsecurity.com/blog/pci-dss-4-0-major-future-dated-requirements/) -- SentinelOne - - [Cloud Workload Protection | Your Backstop in Hardening Against Runtime Threats](https://www.sentinelone.com/blog/cloud-workload-protection-your-backstop-in-hardening-against-runtime-threats/) -- The Daily Swig | Cybersecurity news and views - - [Java encryption implementation error made it trivial to forge credentials](https://portswigger.net/daily-swig/java-encryption-implementation-error-made-it-trivial-to-forge-credentials) - - [UK government employees receive ‘billions’ of malicious emails per year – report](https://portswigger.net/daily-swig/uk-government-employees-receive-billions-of-malicious-emails-per-year-report) -- blog.avast.com EN - - [War and Cyberwar | Avast](https://blog.avast.com/war-and-cyberwar) -- daniel.haxx.se - - [curl up 2022 San Francisco](https://daniel.haxx.se/blog/2022/04/20/curl-up-2022-san-francisco/) -- SCodeScanner - - [ScodeScanner v2.1.0](https://scodescanner.info/2022/04/20/New-SCodeScanner-Release/) -- KitPloit - PenTest & Hacking Tools - - [Ma2Tl - macOS Forensic Timeline Generator Using The Analysis Result DBs Of Mac_Apt](http://www.kitploit.com/2022/04/ma2tl-macos-forensic-timeline-generator.html) - - [DumpSMBShare - A Script To Dump Files And Folders Remotely From A Windows SMB Share](http://www.kitploit.com/2022/04/dumpsmbshare-script-to-dump-files-and.html) -- Intigriti - - [Changelog #34 – Bidirectional API Integration at a Glance](https://blog.intigriti.com/2022/04/20/changelog-34-bidirectional-api-integration-at-a-glance/) - - [Bug Bytes #168 – Behind The Tool, NotGitBleed & Custom Transport Encoding in Burp](https://blog.intigriti.com/2022/04/20/bug-bytes-168-behind-the-tool-notgitbleed-custom-transport-encoding-in-burp/) -- PortSwigger Research - - [New XSS vectors](https://portswigger.net/research/new-xss-vectors) -- 奇客Solidot–传递最新科技情报 - - [Nvidia 和 AMD 显卡价格下跌](https://www.solidot.org/story?sid=71307) - - [QEMU v7.0.0 释出](https://www.solidot.org/story?sid=71306) - - [英国法庭裁决将 Julian Assange 引渡到美国](https://www.solidot.org/story?sid=71305) - - [美国人淹没在垃圾信息中](https://www.solidot.org/story?sid=71304) - - [基因外遗传帮助线虫演化](https://www.solidot.org/story?sid=71303) - - [直升机将尝试在半空捕捉火箭助推器](https://www.solidot.org/story?sid=71302) - - [NASA派全息医生前往国际空间站探望宇航员](https://www.solidot.org/story?sid=71301) - - [美国承诺结束反卫星导弹试验](https://www.solidot.org/story?sid=71300) - - [联想修复 UEFI 固件漏洞](https://www.solidot.org/story?sid=71299) - - [DuckDuckGo 否认从搜索结果剔除盗版网站域名](https://www.solidot.org/story?sid=71298) - - [长寿的秘密](https://www.solidot.org/story?sid=71297) - - [木星欧罗巴可能存在浅层液态水](https://www.solidot.org/story?sid=71296) - - [企业高管并没有遵循他们自己的重返办公室建议](https://www.solidot.org/story?sid=71295) - - [关于 Linux 服务器普通用户 host 配置](https://www.solidot.org/story?sid=71294) - - [Netflix 首次订阅用户减少股价暴跌四分之一](https://www.solidot.org/story?sid=71293) -- Cobalt Strike Research and Development - - [Cobalt Strike 4.6: The Line In The Sand](https://www.cobaltstrike.com/blog/cobalt-strike-4-6-the-line-in-the-sand/) -- Qualys Security Blog - - [Implications of Windows Subsystem for Linux for Adversaries & Defenders (Part 2)](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Data Breach - - [Anonymous hacked other Russian organizations, some of the breaches could be severe](https://securityaffairs.co/wordpress/130409/hacktivism/anonymous-hacked-other-russian-organizations.html) -- Forensic Focus - - [Featured Job: Digital Forensic Hub Manager (London, UK)](https://www.forensicfocus.com/featured-job/featured-job-digital-forensic-hub-manager-london-uk/) - - [Huawei Devices: Decryption and Extraction in Oxygen Forensic Detective](https://www.forensicfocus.com/news/huawei-devices-decryption-and-extraction-in-oxygen-forensic-detective/) -- Diritto dell'Informatica - - [Contraffazione di prodotti e concorrenza sleale, come difendersi](https://www.dirittodellinformatica.it/privacy-e-sicurezza/la-contraffazione-del-marchio-e-limitazione-dei-prodotti.html) -- Schneier on Security - - [Clever Cryptocurrency Theft](https://www.schneier.com/blog/archives/2022/04/clever-cryptocurrency-theft.html) -- ProtonMail Blog - - [Proton turns eight: A look at then vs. now](https://protonmail.com/blog/then-vs-now/) -- Graham Cluley - - [Apple iCloud account attack results in man losing $650,000 from his cryptocurrency wallet](https://www.bitdefender.com/blog/hotforsecurity/apple-icloud-account-attack-results-in-man-losing-650-000-from-his-cryptocurrency-wallet-2/) -- Trend Micro Research, News and Perspectives - - [Spring4Shell Vulnerability CVE-2022-22965 Exploited to Deploy Cryptocurrency Miners](https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html) - - [Analyzing Attempts to Exploit the Spring4Shell Vulnerability CVE-2022-22965 to Deploy Cryptocurrency Miners](https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html) -- Threatpost - - [Most Email Security Approaches Fail to Block Common Threats](https://threatpost.com/email-security-fail-block-threats/179370/) - - [Google: 2021 was a Banner Year for Exploited 0-Day Bugs](https://threatpost.com/google-2021-0-days/179355/) -- Dark Reading - - [Anti-Fraud Partnership Brings Confidential Computing to Financial Services](https://www.darkreading.com/emerging-tech/anti-fraud-partnership-brings-confidential-computing-to-financial-services) - - [LinkedIn Brand Now the Most Abused in Phishing Attempts](https://www.darkreading.com/threat-intelligence/report-linkedin-used-as-lure-in-52-of-global-phishing-attacks) - - [Okta Wraps Up Lapsus$ Investigation, Pledges More Third-Party Controls](https://www.darkreading.com/cloud/okta-wraps-up-lapsus-investigation-pledges-more-third-party-controls) - - [Denonia Malware Shows Evolving Cloud Threats](https://www.darkreading.com/omdia/denonia-malware-shows-evolving-cloud-threats) - - [CISA, Australia, Canada, New Zealand, & UK Issue Joint Advisory on Russian Cyber Threats](https://www.darkreading.com/threat-intelligence/jcdc-russian-state-sponsored-cyberattacks-on-infrastructure-are-coming) - - [6 Malware Tools Designed to Disrupt Industrial Control Systems (ICS)](https://www.darkreading.com/threat-intelligence/6-malware-tools-designed-to-disrupt-ics-environments) - - [The Modern Software Supply Chain: How It's Evolved and What to Prepare For](https://www.darkreading.com/application-security/the-modern-software-supply-chain-how-it-s-evolved-and-what-to-prepare-for) - - [Incognia Introduces New Location-Based Device Authorization Solution](https://www.darkreading.com/endpoint/incognia-introduces-new-location-based-device-authorization-solution) - - [Lightspin Secures Infrastructure as Code Files with New GitHub Integration](https://www.darkreading.com/application-security/lightspin-secures-infrastructure-as-code-files-with-new-github-integration) - - [How Russia Is Isolating Its Own Cybercriminals](https://www.darkreading.com/vulnerabilities-threats/how-russia-is-isolating-its-own-cybercriminals) - - [Backward-Compatible Post-Quantum Communications Is a Matter of National Security](https://www.darkreading.com/edge-articles/backward-compatible-post-quantum-communications-is-a-matter-of-national-security) - - [From Passive Recovery to Active Readiness](https://www.darkreading.com/threat-intelligence/from-passive-recovery-to-active-readiness) - - [Fortress Tackles Supply Chain Security, One Asset at a Time](https://www.darkreading.com/emerging-tech/fortress-tackles-supply-chain-security-one-asset-at-a-time) -- KitPloit - PenTest Tools! - - [Ma2Tl - macOS Forensic Timeline Generator Using The Analysis Result DBs Of Mac_Apt](http://www.kitploit.com/2022/04/ma2tl-macos-forensic-timeline-generator.html) - - [DumpSMBShare - A Script To Dump Files And Folders Remotely From A Windows SMB Share](http://www.kitploit.com/2022/04/dumpsmbshare-script-to-dump-files-and.html) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Career Change: Binary Exploitation or Pentesting/Red Teaming](https://www.reddit.com/r/netsecstudents/comments/u7y3sx/career_change_binary_exploitation_or/) -- Blackhat Library: Hacking techniques and research - - [I need access to my old gmail but my old phone number is connected. no recovery options work. Can I temporarily spoof my number and receive a text?](https://www.reddit.com/r/blackhat/comments/u7xfpl/i_need_access_to_my_old_gmail_but_my_old_phone/) -- CNCERT风险评估 - - [中央宣传部副部长，中央网信办主任、国家网信办主任庄荣文：顺应信息革命时代潮流 奋力推进网络强国建设](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496330&idx=1&sn=97e4afbd2968e1df800a44310404093e&chksm=973ac1e8a04d48fe16fc02a03930ca3b0ae8230910320487ea75bc79b00e79c1c0185ae97df8&scene=58&subscene=0#rd) -- 绿盟科技CERT - - [【安全更新】Oracle全系产品4月关键补丁更新通告](https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247486986&idx=1&sn=1f016188b8c52ce9fff8a40d1406e30f&chksm=c2c65901f5b1d0170214906cfb8bc828f9fc3f5871e4ce2eaa63df6c517476d59e321334c7bc&scene=58&subscene=0#rd) -- SANS Internet Storm Center, InfoCON: green - - ["aa" distribution Qakbot (Qbot) infection with DarkVNC traffic, (Wed, Apr 20th)](https://isc.sans.edu/diary/rss/28568) - - [ISC Stormcast For Wednesday, April 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=7972, (Wed, Apr 20th)](https://isc.sans.edu/diary/rss/28570) -- Instapaper: Unread - - [Preventing burnout in digital forensics](https://belkasoft.com/preventing-burnout-in-digital-forensics) - - [Pretty Maps & Plea Bargains Tips on Handling Cellular Records Analysis in Criminal Defense Cases](http://prodigital4n6.blogspot.com/2022/04/pretty-maps-plea-bargains-tips-on.html) - - [UK Government Officials Infected with Pegasus](https://citizenlab.ca/2022/04/uk-government-officials-targeted-pegasus/) - - [CatalanGate Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru](https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/) - - [Experts spotted Industrial Spy, a new stolen data marketplace](https://securityaffairs.co/wordpress/130323/cyber-crime/industrial-spy-marketplace.html) - - [NSO Group Pegasus spyware leverages new zero-click iPhone exploit in recent attacks](https://securityaffairs.co/wordpress/130360/malware/nso-group-pegasus-click-iphone-exploit.html) - - [Hacker forged Windows 11 upgrade website to trick users to download the virus](https://securityonline.info/hacker-forged-windows-11-upgrade-website-to-trick-users-to-download-the-virus/) - - [CatalanGate spionaggio con Pegasus e Candiru](https://www.punto-informatico.it/catalangate-spionaggio-pegasus-candiru/) - - [Strategia nazionale di cyber security perché la formazione deve venire prima di tutto](https://www.agendadigitale.eu/sicurezza/strategia-nazionale-di-cyber-security-perche-la-formazione-deve-venire-prima-di-tutto/) -- 字节跳动技术团队 - - [DanceNN：字节自研千亿级规模文件元数据存储系统概述](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247492732&idx=1&sn=cb9bb2d10d0fde74704c734b88924ad3&chksm=e9d32f9edea4a68861b957f931aea18e6672ead3197e53ab3ae247b35c3b8af376f05b17715f&scene=58&subscene=0#rd) - - [今日头条 App 基于火山引擎 MARS 研发流程最佳实践 | 字节技术分享汇](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247492732&idx=2&sn=c7039af6b94b8b41f10c86203d2bd83b&chksm=e9d32f9edea4a6884023c12a09a68023372a5f4f21713126da363c1a87ffc125af28b327a85b&scene=58&subscene=0#rd) -- Securityinfo.it - - [QNAP incita a disabilitare il port forwarding UPnP sui router](https://www.securityinfo.it/2022/04/20/qnap-incita-a-disabilitare-il-port-forwarding-upnp-sui-router/?utm_source=rss&utm_medium=rss&utm_campaign=qnap-incita-a-disabilitare-il-port-forwarding-upnp-sui-router) - - [Kaspersky cracca il ransomware Yanluowang](https://www.securityinfo.it/2022/04/20/kaspersky-cracca-il-ransomware-yanluowang/?utm_source=rss&utm_medium=rss&utm_campaign=kaspersky-cracca-il-ransomware-yanluowang) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于Oracle 2022年第二季度安全更新风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495333&idx=1&sn=80364d316cdcfeb715d93d8ee727d7ad&chksm=ce96a39bf9e12a8d810412dd7302011b4177538dad172b663dfddf461bd53626927b5da2a356&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Apr.20th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495333&idx=2&sn=14de9bf0f145862caaa2404bfb82c467&chksm=ce96a39bf9e12a8de2e6e9cd4db7310c51e6d3b7c2fed5c092e8fd9783e2df68c201a57d3d71&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [荣誉 | 2022年第一季度奖励重磅揭晓，当时我就羡慕了！](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247489318&idx=1&sn=7ccedb12dea7cca1bc8a5183f4cc5788&chksm=ec1bf6f5db6c7fe3a53cf94a204abe62d153808e91e39bb5f15ff93786adefbcf0b90b519376&scene=58&subscene=0#rd) -- NVISO Labs - - [Investigating an engineering workstation – Part 3](https://blog.nviso.eu/2022/04/20/investigating-an-engineering-workstation-part-3/) -- Security Through Education - - [Influence vs. Manipulation: What is the Difference](https://www.social-engineer.org/social-engineering/influence-vs-manipulation-what-is-the-difference/) -- The Register - Security - - [AWS's Log4j patches blew holes in its own security](https://go.theregister.com/feed/www.theregister.com/2022/04/20/aws_log4j_patches/) - - [Oracle already wins 'crypto bug of the year' with Java digital signature bypass](https://go.theregister.com/feed/www.theregister.com/2022/04/20/java_authentication_bug/) - - [Russian-linked Shuckworm crew ramps up Ukraine attacks](https://go.theregister.com/feed/www.theregister.com/2022/04/20/shuckworm-attack-ukraine-symantec/) - - [Criminals adopting new methods to bypass improved defenses, says Zscaler](https://go.theregister.com/feed/www.theregister.com/2022/04/20/phishing-attempts-on-rise-zscaler/) - - [US warns North Korean Lazarus gang rising against cryptocurrency outfits](https://go.theregister.com/feed/www.theregister.com/2022/04/20/lazarus-targets-digital-assets/) - - [Google tracked record 58 exploited-in-the-wild zero-day security holes in 2021](https://go.theregister.com/feed/www.theregister.com/2022/04/20/google_zero_days/) -- 腾讯玄武实验室 - - [每日安全动态推送(04-20)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958366&idx=1&sn=26499c471c2ad55b10e4ec3157f09d02&chksm=8baeccc1bcd945d7911a98971ea36a8f72c02f9c1517b64cfb513095842fc4dd233d49450870&scene=58&subscene=0#rd) -- 复旦白泽战队 - - [“疫”往无前 同心守“沪”](https://mp.weixin.qq.com/s?__biz=MzU4NzUxOTI0OQ==&mid=2247485429&idx=1&sn=aa11b037c0a6a2bd19765a8026908f34&chksm=fdeb838bca9c0a9dd5d7940c564bfc2d3448df0c68443ac491d95aceaf39324c6fbfaf8590fc&scene=58&subscene=0#rd) -- Social Engineering - - [شراء متابعين](https://www.reddit.com/r/SocialEngineering/comments/u89hnz/شراء_متابعين/) - - [WHAT DOES IT MEAN](https://www.reddit.com/r/SocialEngineering/comments/u7z3rq/what_does_it_mean/) -- 火线Zone - - [浅谈 华为云 云数据RDS攻防](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493826&idx=1&sn=0a9f0c160d730e735aedff4805a884d3&chksm=eaa960e2dddee9f4db1a2332a662d42aec58376891d96de6371f7fdb770b9e5d8d1580945340&scene=58&subscene=0#rd) - - [新项目丨Keep 安全应急响应中心入驻火线企业SRC啦~](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493826&idx=2&sn=af80d695b021520975ec26861b1c2c03&chksm=eaa960e2dddee9f482516cc90071e3e6bdd046d8eb8422db033fbd7c22ce47b052f47399c46f&scene=58&subscene=0#rd) -- 安全牛 - - [实现容器安全管理的最佳实践](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112445&idx=2&sn=c7382f65333daea99608d908e460dbb8&chksm=bd14732e8a63fa38f5955fc5391780c0482d097adc9aa6a5d3c68841cd1065a91ab174d3a69a&scene=58&subscene=0#rd) -- 腾讯科恩实验室 - - [“精”准把握静态分析｜科恩二进制文件自动化静态漏洞检测工具正式开源](https://mp.weixin.qq.com/s?__biz=MzU1MjgwNzc4Ng==&mid=2247503231&idx=1&sn=ca048f32cfba5260024b27cc3d4d479e&chksm=fbfef17acc89786c935d2ef0adce3bd44daa6a96eb8dc93665d1c2cb95307048f362cb63e1c9&scene=58&subscene=0#rd) - - [技术公开课｜如何应对软件供应链安全问题？谈谈SCA技术落地实践](https://mp.weixin.qq.com/s?__biz=MzU1MjgwNzc4Ng==&mid=2247503231&idx=2&sn=2cac7c0e89aeebf211baefd2237b5ef3&chksm=fbfef17acc89786c377b071894349dba9fccb5243f038174706d54e2c0ff501e3e8f53144229&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [今日谷雨|春渐远，夏将至](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247502487&idx=1&sn=1a1fcd03a3f2a5d8cfa0c45e860e8d58&chksm=eb7014a8dc079dbedd16f7439106e74fae4eeb77f8ba9ef0929a19799e1c6dd35b8b2033a455&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [央行数字货币CBDC：区块链技术新起点](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491533&idx=1&sn=4245e83f463851b5a33499547408403c&chksm=eaaf8c8addd8059c83b49d81b1f30e9f55981b20d5b1e6d49e97d5fafb3b83bfcfdf4838ddaf&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [从Falco看如何利用eBPF检测系统调用](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247491627&idx=1&sn=1070592c4440e8891641e14a60b8a1c1&chksm=e84c46f4df3bcfe20f31046342775243d0bce2c840c882cdb2d316b86d92d3957463ba1e9c3d&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [微步招聘第7期 | 虚位以待，职为遇见你](https://mp.weixin.qq.com/s?__biz=MzA5MDc1NDc1MQ==&mid=2247493061&idx=1&sn=2b73e83fc9f9ff1818754d7dd0a04322&chksm=90047e15a773f703999ece2b30137f1632190ae88768531512d67467da9aba949fed8d132a4b&scene=58&subscene=0#rd) - - [微步安全学堂 | 4.26，攻防演练专题直播·攻略篇](https://mp.weixin.qq.com/s?__biz=MzA5MDc1NDc1MQ==&mid=2247493061&idx=2&sn=218f4febdc4e85fb73bc9c22d9ad45cb&chksm=90047e15a773f703bfb1cca31eac1aa8cff8c385f76cca203c48598319efc80d034c10cc3a60&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [Smarty 模板注入与沙箱逃逸](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247489181&idx=1&sn=5a2a4a8d00c557165802d6b4eb5c72e0&chksm=96f409f0a18380e61c5eea43997253834f39e40420a22900a8e9b76d79a942af2da0442e233b&scene=58&subscene=0#rd) -- 安全客 - - [【安全头条】黑客从iCloud备份中获取MetaMask种子后窃取了655万美元](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769428&idx=1&sn=caf916f6fab3015c6f189703dd8dda0c&chksm=889375bbbfe4fcadefc2b881a17df202ada3e3b961f3224fab96d10273170838381ea76de49b&scene=58&subscene=0#rd) - - [【技术分享】Phar与Stream Wrapper造成PHP RCE的深入挖掘](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769428&idx=2&sn=d73dff2472aa389c279df1c88eebbae5&chksm=889375bbbfe4fcad5c8003c61cd83d13dffea1939b4a462a5ba2d071345609f7627e5cb78cad&scene=58&subscene=0#rd) -- 慢雾科技 - - [慢雾：揭露浏览器恶意书签如何盗取你的 Discord Token](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495383&idx=1&sn=3695e16c9f33aff690bb033de6f77b20&chksm=fdde9050caa919464a53d117159ff1b1ad52490b04edf372e5a9b65fde400031dad24f1348dd&scene=58&subscene=0#rd) -- M01NTeam - - [.net反序列化萌新入门--Json.Net](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247487770&idx=1&sn=e682c63db5daa7c10f4eb98c9073d119&chksm=c187d10bf6f0581d62b24b038ff694271dcb14ca2c8beb13cfac18baa9d3151b1913944c063c&scene=58&subscene=0#rd) -- 情报分析师 - - [认知战资料完全汇编！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497940&idx=1&sn=8bb1f0afad21e916f3799105ffddf7b9&chksm=87164ddfb061c4c9f72fffb1c0239a779e08733d3a408f6caf94a01a1aa3f84a02449dc19934&scene=58&subscene=0#rd) - - [五角大楼承包商如何从乌克兰危机中获利（附美国武器系统手册432页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497940&idx=2&sn=0d7aa1eee92beb1f45257ed73c5b3a93&chksm=87164ddfb061c4c9bc9fb3508519bcef9cd7612abfbcc09fb90d0120dfc4788545dff7d85383&scene=58&subscene=0#rd) -- SecIN技术平台 - - [原创 | GitHub Java CodeQL CTF](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247493607&idx=1&sn=f1ddf4110fad7d6f1485091bc2082645&chksm=eb84bab3dcf333a5d939dc9022120e74488ff933241121376fe3672329aa740b683ec48e557e&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [2022starCTF——TreasureHunter](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493141&idx=1&sn=b7d7c445f1cc6950384d5e1ff7e08e73&chksm=fa5233abcd25babd2f6fea9398eecbc634dfd34f1b44917d9749065f988c9d5f84f18e92068f&scene=58&subscene=0#rd) -- 奇安信CERT - - [【安全风险通告】Oracle多个组件漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247495839&idx=1&sn=c72294b6276e1c689e23864ed5ba58e6&chksm=fe79d407c90e5d11f136dc6f94771866a7d844f8dc21908a0064c526c48de03c7f95e0710c2d&scene=58&subscene=0#rd) -- 三六零CERT - - [2022-04 补丁日: Oracle多个产品漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247490896&idx=1&sn=214fa7addb1f41d0ba4e6e55ac6192b0&chksm=fe251851c9529147ba43c6ac1d8be787053730d77014f3a2e378547955284fe0b41db1c7c4e6&scene=58&subscene=0#rd) - - [安全日报（2022.04.20）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247490896&idx=2&sn=f96fe03be8e79430b0c908d68833d976&chksm=fe251851c952914734c69ab7cd5bd00731d3c3eab39c214eacbd3c7512d09f2f342bd38b039b&scene=58&subscene=0#rd) -- Computer Forensics - - [Best Practice Regarding iMessage Sync In UFED iOS Extraction Scenarios](https://www.reddit.com/r/computerforensics/comments/u89the/best_practice_regarding_imessage_sync_in_ufed_ios/) - - [FTK imager recover deleted files](https://www.reddit.com/r/computerforensics/comments/u82x3o/ftk_imager_recover_deleted_files/) - - [No boot after conversion of .E01](https://www.reddit.com/r/computerforensics/comments/u80g7c/no_boot_after_conversion_of_e01/) -- 深信服千里目安全实验室 - - [【安全公告】Oracle WebLogic Server 4月安全更新](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650260471&idx=1&sn=69fc56954eb63b3da9be667f79057788&chksm=f3e27983c495f095a6fa57e4f26ab043f6fd4f894bfdcdf524d871e367077269ee6b8a58665d&scene=58&subscene=0#rd) -- Posts By SpecterOps Team Members - Medium - - [Abusing Azure Container Registry Tasks](https://posts.specterops.io/abusing-azure-container-registry-tasks-1f407bfaa465?source=rss----f05f8696e3cc---4) -- Security Affairs - - [Russian Gamaredon APT continues to target Ukraine](https://securityaffairs.co/wordpress/130419/apt/gamaredon-targets-ukraine.html) - - [Anonymous hacked other Russian organizations, some of the breaches could be severe](https://securityaffairs.co/wordpress/130409/hacktivism/anonymous-hacked-other-russian-organizations.html) - - [CISA adds Windows Print Spooler to its Known Exploited Vulnerabilities Catalog](https://securityaffairs.co/wordpress/130401/hacking/win-print-spooler-known-exploited-vulnerabilities-catalog.html) - - [New BotenaGo variant specifically targets Lilin security camera DVR devices](https://securityaffairs.co/wordpress/130383/malware/botenago-botnet-targets-dvr.html) - - [QNAP users are recommended to disable UPnP port forwarding on routers](https://securityaffairs.co/wordpress/130393/security/qnap-nas-disable-upnp-port-forwarding.html) -- vivo千镜安全实验室 - - [浅谈“GDPR地域适用范围”原则及误区](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247488135&idx=1&sn=cccddead30571087caa8a7c6e8bf255d&chksm=e9b934ebdecebdfdb0f4ab299321d0eb78dfaab34b00f9a1bbe615fd75723ea2120c2940b3dd&scene=58&subscene=0#rd) -- 360漏洞云 - - [注意更新 | Oracle WebLogic Server多个组件安全漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496871&idx=1&sn=43702063c411a2ae1b2dad59f071bb8e&chksm=ebe80835dc9f81239d2532844f818977e627374a3dd8e2205b0febc15b73c423a081f37d0657&scene=58&subscene=0#rd) - - [严重 | Atlassian Bitbucket Data Center 远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496871&idx=2&sn=d8d966bf21137de84eab84cc9d87599c&chksm=ebe80835dc9f812374a72bb8c56d5a3750b918184b6423f19ea9586b72b84ea461c30f7522b5&scene=58&subscene=0#rd) -- SecPulse安全脉搏 - - [【文末福利】“工具自由”：一个职业黑客的基本修养](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044391&idx=1&sn=fb83a7ce49dfb39f614bf40d999820fc&chksm=803fa779b7482e6fefb6022a1a19c95f6886ffc883f6ea664557f095e17cf0a38485d6fe0835&scene=58&subscene=0#rd) -- 看雪学院 - - [CVE-2022-0995分析（内核越界 watch_queue_set_filter）](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438427&idx=1&sn=a265492f38362801447a5423d49a51ce&chksm=b18ffb9186f87287b1fd247325b81803b4c18429d9238be1213ff186842ddfcea51fb5be09e2&scene=58&subscene=0#rd) - - [联想UEFI漏洞影响数百万台笔记本电脑](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438427&idx=2&sn=2eb22f30d7cfaf8028cdf109d5a2f6e2&chksm=b18ffb9186f8728772dc022c69c356a46572d6307f7804b2104c7aa4756c546b82864359f7b0&scene=58&subscene=0#rd) - - [四年磨一剑，无名侠教你用Unicorn逆向闯荡江湖！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438427&idx=3&sn=40f7a91cda3ffddf13b635631dab53fe&chksm=b18ffb9186f8728766a8128a3e42b1cb5ecf228be342da8dc5b6db9c61a46bad0a00912ef39d&scene=58&subscene=0#rd) -- 数世咨询 - - [从NTA到NDR：看流量分析的演进](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492838&idx=1&sn=84bc9d76ea3c2fd838001f5902f3b41a&chksm=c144965bf6331f4d68af280866632c0a41accf1cedc77adfc6e1c5ea0f99a04fb6d9c77315ea&scene=58&subscene=0#rd) - - [Ghostwriter攻击活动中的加密通信](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492838&idx=2&sn=02a023419d9e85570d04f793fcd13f5e&chksm=c144965bf6331f4de4835be1482b9df4b67d077b71d4b82262b8bf47eb4dc8470f663f0eaa0d&scene=58&subscene=0#rd) - - [触点互动发布千万级别域名500万次查询/每秒的DNS压力测试工具](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492838&idx=3&sn=513d6eed4efba4d54a5bf99e45edae38&chksm=c144965bf6331f4d9c248b5e2ba187cd804fd4abec4e49e8718b148eab5604db587d6a18fbe1&scene=58&subscene=0#rd) -- 安全威胁情报 - - [HFish溯源版本重磅来袭，更有惊喜好礼等你拿！](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172082&idx=1&sn=5c2f3ae3407496e33548bf9debc20910&chksm=f448910ec33f18182d273e7a2fba19bbe054376f741d5e52041913f2451eeedc5e0c099ca29b&scene=58&subscene=0#rd) -- TorrentFreak - - [Piracy Poses Concern as Netflix Subscribers Drop for the First Time](https://torrentfreak.com/piracy-poses-concern-as-netflix-subscribers-drop-for-the-first-time-220420/) - - [MPA Signs New Anti-Piracy Deal Committing to “Rolling Site-Blocking Regime”](https://torrentfreak.com/mpa-signs-anti-piracy-deal-committing-to-rolling-site-blocking-regime-220420/) -- /r/netsec - Information Security News & Discussion - - [CVE-2022-21449 detector - Finds possibly vulnerable JAR/WAR files](https://www.reddit.com/r/netsec/comments/u833nk/cve202221449_detector_finds_possibly_vulnerable/) - - [A Detailed Analysis of The SunCrypt Ransomware](https://www.reddit.com/r/netsec/comments/u815ic/a_detailed_analysis_of_the_suncrypt_ransomware/) - - [CVE-2022-21449: Psychic Signatures in Java](https://www.reddit.com/r/netsec/comments/u7lg8n/cve202221449_psychic_signatures_in_java/) - - [Threat Hunting for Phishing Pages](https://www.reddit.com/r/netsec/comments/u840dl/threat_hunting_for_phishing_pages/) - - [SSRF Attack Examples and Mitigations](https://www.reddit.com/r/netsec/comments/u80a8n/ssrf_attack_examples_and_mitigations/) -- Paul's Security Weekly - - [BSW #259 - Tim Woods](http://podcast.securityweekly.com/bsw-259-tim-woods) -- 关键基础设施安全应急响应中心 - - [美国主战网络攻击武器曝光：世界重要信息基础设施已成美“情报站”](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525895&idx=1&sn=bd14824d8bf7326ba9fc8b84c9f0d8ca&chksm=c1e9ea56f69e63404f98e953d2b6998659aeae7da3a62680e11c4335e8ab219f606e06d9f0d0&scene=58&subscene=0#rd) - - [Mandiant《M-Trends 2022》年度报告：攻击者驻留时间下降但与攻击影响没有一致的相关性](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525895&idx=2&sn=99165c84d69dd60632b73c7ed4d1c645&chksm=c1e9ea56f69e6340ff6b7ee6aaf3a03445e74e3b51774a9af22269205bcadafd2810f30cf152&scene=58&subscene=0#rd) - - [黑客组织利用ProxyShell漏洞攻击医疗保健提供商](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525895&idx=3&sn=e8bfbedec74f22090bbbcc68154bd865&chksm=c1e9ea56f69e6340073094afc4f69d97c4b558f9f68bec571d75be6b4f81d59ea23e719d8c51&scene=58&subscene=0#rd) -- 威努特工控安全 - - [2021年度新锐人物：威努特董事长兼CEO龙国东](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651083659&idx=1&sn=7275303ec387665ec484c5efeec4e6c4&chksm=80e6493bb791c02d6a4a8e552324153c6a33108f9bc7f615d36211eba7f3481b8a7186b259bf&scene=58&subscene=0#rd) -- 互联网安全内参 - - [2021年零日漏洞在野利用状况：数量创纪录，传统漏洞为主](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502480&idx=1&sn=e5c7bf21f30e66209597f0db25ec465f&chksm=ebfa8db0dc8d04a6dac8d9f03f2dc712a97b4fccdcaf155080ccd7f8e7aa8a5b6a62eb97313d&scene=58&subscene=0#rd) - - [美国主战网络攻击武器曝光：世界重要信息基础设施已成美“情报站”](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502480&idx=2&sn=33983da75e88e803060d923379afc362&chksm=ebfa8db0dc8d04a61e24934f4ba532bd8b66175e65e7137a3f1eccf137f0e77b87d1d1d64c0a&scene=58&subscene=0#rd) - - [北约在俄乌战争期间举行大型网络攻防演习](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502480&idx=3&sn=3d2498a810d8f8f9efe7b1bf42a398b8&chksm=ebfa8db0dc8d04a621536b30fa0b61d1502f40bc7bfaa4863dfe7011df42264e66b7216b5887&scene=58&subscene=0#rd) - - [中央深改委审议通过《关于加强数字政府建设的指导意见》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502480&idx=4&sn=fa7033b8507188a10d5aab276ad40269&chksm=ebfa8db0dc8d04a6d5bc3786aa247b8111dce0ccae8823fc36b2eb14f2458bd66da6287deff9&scene=58&subscene=0#rd) -- Dark Space Blogspot - - [Come Funziona Stepn: Quanto Si Guadagna? (Con Codice Di Attivazione)](http://darkwhite666.blogspot.com/2022/04/come-funziona-stepn-quanto-si-guadagna.html) diff --git a/archive/2022/2022-04-22.md b/archive/2022/2022-04-22.md deleted file mode 100644 index b99f50ae61..0000000000 --- a/archive/2022/2022-04-22.md +++ /dev/null @@ -1,270 +0,0 @@ -# 每日安全资讯（2022-04-22） - -- Files ≈ Packet Storm - - [ManageEngine ADSelfService Plus Custom Script Execution](https://packetstormsecurity.com/files/166816/manageengine_adselfservice_plus_cve_2022_28810.rb.txt) - - [Watch Queue Out-Of-Bounds Write](https://packetstormsecurity.com/files/166815/cve_2022_0995_watch_queue.rb.txt) - - [Suricata IDPE 6.0.5](https://packetstormsecurity.com/files/166814/suricata-6.0.5.tar.gz) - - [USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 Remote Root Backdoor](https://packetstormsecurity.com/files/166813/ZSL-2022-5705.txt) - - [Red Hat Security Advisory 2022-1476-01](https://packetstormsecurity.com/files/166812/RHSA-2022-1476-01.txt) - - [Red Hat Security Advisory 2022-1363-01](https://packetstormsecurity.com/files/166811/RHSA-2022-1363-01.txt) - - [Ubuntu Security Notice USN-5385-1](https://packetstormsecurity.com/files/166810/USN-5385-1.txt) - - [Ubuntu Security Notice USN-5384-1](https://packetstormsecurity.com/files/166809/USN-5384-1.txt) - - [Ubuntu Security Notice USN-5383-1](https://packetstormsecurity.com/files/166808/USN-5383-1.txt) - - [Ubuntu Security Notice USN-5381-1](https://packetstormsecurity.com/files/166807/USN-5381-1.txt) - - [Ubuntu Security Notice USN-5382-1](https://packetstormsecurity.com/files/166806/USN-5382-1.txt) - - [Red Hat Security Advisory 2022-1389-01](https://packetstormsecurity.com/files/166805/RHSA-2022-1389-01.txt) - - [Red Hat Security Advisory 2022-1443-01](https://packetstormsecurity.com/files/166804/RHSA-2022-1443-01.txt) - - [Red Hat Security Advisory 2022-1390-01](https://packetstormsecurity.com/files/166803/RHSA-2022-1390-01.txt) - - [Red Hat Security Advisory 2022-1478-01](https://packetstormsecurity.com/files/166802/RHSA-2022-1478-01.txt) - - [Red Hat Security Advisory 2022-1455-01](https://packetstormsecurity.com/files/166801/RHSA-2022-1455-01.txt) - - [Red Hat Security Advisory 2022-1444-01](https://packetstormsecurity.com/files/166800/RHSA-2022-1444-01.txt) - - [Red Hat Security Advisory 2022-1441-01](https://packetstormsecurity.com/files/166799/RHSA-2022-1441-01.txt) - - [Red Hat Security Advisory 2022-1469-01](https://packetstormsecurity.com/files/166798/RHSA-2022-1469-01.txt) - - [Red Hat Security Advisory 2022-1463-01](https://packetstormsecurity.com/files/166797/RHSA-2022-1463-01.txt) - - [Red Hat Security Advisory 2022-1445-01](https://packetstormsecurity.com/files/166796/RHSA-2022-1445-01.txt) - - [Red Hat Security Advisory 2022-1336-01](https://packetstormsecurity.com/files/166795/RHSA-2022-1336-01.txt) - - [Red Hat Security Advisory 2022-1440-01](https://packetstormsecurity.com/files/166794/RHSA-2022-1440-01.txt) - - [Red Hat Security Advisory 2022-1462-01](https://packetstormsecurity.com/files/166793/RHSA-2022-1462-01.txt) - - [Red Hat Security Advisory 2022-1442-01](https://packetstormsecurity.com/files/166792/RHSA-2022-1442-01.txt) -- HackerOne Hacker Activity - - [After changing the storefront password, the preview link is still valid](https://hackerone.com/reports/1370749) - - [Open redirect by the parameter redirectUri in the URL](https://hackerone.com/reports/1250758) - - [[h1-2102] [Plus] User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management Only](https://hackerone.com/reports/1084892) - - [[h1-2102] [Plus] User with Store Management Permission can Make convertUsersFromSaml/convertUsersToSaml - that should be limited to User Management](https://hackerone.com/reports/1084904) - - [[h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only](https://hackerone.com/reports/1084939) - - [User with no Develop apps permission can Uninstall Custom App](https://hackerone.com/reports/1466855) - - [[h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserRole](https://hackerone.com/reports/1084638) - - [Same the Url](https://hackerone.com/reports/1459338) - - [curl proceeds with unsafe connections when -K file can't be read](https://hackerone.com/reports/1542881) - - [Timing difference exposes existence of accounts](https://hackerone.com/reports/1391636) -- Der Flounder - - [Apple discontinues macOS Server](https://derflounder.wordpress.com/2022/04/21/apple-discontinues-macos-server/) -- Security Boulevard - - [A10 Networks Forest – Helping Support a More Sustainable Future](https://securityboulevard.com/2022/04/a10-networks-forest-helping-support-a-more-sustainable-future/) - - [New Arkose Labs Survey Reveals the True Impact of Bot Attacks](https://securityboulevard.com/2022/04/new-arkose-labs-survey-reveals-the-true-impact-of-bot-attacks/) - - [Russia’s War in Ukraine Has Complicated the Means Through Which Cybercriminals Launder Funds. Here’s How They’re Adapting](https://securityboulevard.com/2022/04/russias-war-in-ukraine-has-complicated-the-means-through-which-cybercriminals-launder-funds-heres-how-theyre-adapting%ef%bf%bc/) - - [OWASP® Global AppSec US 2021 Virtual – Daniel Garcia’s & César Gallego’s ‘How Hackers Can Breach Your C.I / C.D Systems’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-daniel-garcias-cesar-gallegos-how-hackers-can-breach-your-c-i-c-d-systems/) - - [AoID All Other Identities](https://securityboulevard.com/2022/04/aoid-all-other-identities/) - - [Keeping Up With PHP Updates](https://securityboulevard.com/2022/04/keeping-up-with-php-updates/) - - [How to Strengthen Your Credit Union Cybersecurity Program](https://securityboulevard.com/2022/04/how-to-strengthen-your-credit-union-cybersecurity-program/) - - [XKCD ‘Entwives’](https://securityboulevard.com/2022/04/xkcd-entwives/) - - [Ukraine Digital Public Conversation – April 12 – 18, 2022](https://securityboulevard.com/2022/04/ukraine-digital-public-conversation-april-12-18-2022/) - - [Nuspire Recognized in the 2022 Gartner® Market Guide for Managed Security Services](https://securityboulevard.com/2022/04/nuspire-recognized-in-the-2022-gartner-market-guide-for-managed-security-services/) -- 安全客-有思想的安全新媒体 - - [CVE-2022-1162 gitlab 硬编码漏洞](https://www.anquanke.com/post/id/272220) - - [源海拾贝｜科恩二进制文件自动化静态漏洞检测工具正式开源](https://www.anquanke.com/post/id/272334) - - [CVE-2022-21882 Win32k内核提权漏洞深入分析](https://www.anquanke.com/post/id/272305) - - [Emotet僵尸网络切换到64位模块，增加活动](https://www.anquanke.com/post/id/272335) -- 绿盟科技技术博客 - - [Atlassian Jira 身份验证绕过漏洞 (CVE-2022-0540)通告](http://blog.nsfocus.net/atlassian-jira-cve-2022-0540/) -- Microsoft Security Blog - - [Discover the anatomy of an external cyberattack surface with new RiskIQ report](https://www.microsoft.com/security/blog/2022/04/21/discover-the-anatomy-of-an-external-cyberattack-surface-with-new-riskiq-report/) -- Tenable Blog - - [Hot Patches for Log4Shell Introduced Multiple Vulnerabilities in Amazon Web Services](https://www.tenable.com/blog/hot-patches-for-log4shell-introduced-multiple-vulnerabilities-in-amazon-web-services) -- 跳跳糖 - 安全与分享社区 - - [Postgresql 渗透总结](https://tttang.com/archive/1547/) -- FreeBuf网络安全行业门户 - - [官方发布重磅报告，全面曝光美国网络攻击武器“蜂巢”](https://www.freebuf.com/news/330228.html) - - [知识大陆招募 | 这里有未来，而你刚好在](https://www.freebuf.com/articles/323952.html) - - [FreeBuf早报 | 俄罗斯APT组织继续瞄准乌克兰；BlackCat勒索软件入侵全球60个实体](https://www.freebuf.com/news/330174.html) - - [REvil的TOR网站重新启动，一大波新型勒索软件或正在路上](https://www.freebuf.com/news/330163.html) - - [FBI警告针对美国农业部门的勒索软件攻击](https://www.freebuf.com/news/330141.html) - - [北约2022 “锁盾 ”网络演习在爱沙尼亚举行，2000名安全专家共同练兵](https://www.freebuf.com/news/330139.html) - - [《安恒网络安全3月月报》| 一份报告看全3月黑灰产、漏洞、APT、勒索、暗链等汇总信息](https://www.freebuf.com/news/330135.html) -- Sploitus.com Exploits RSS Feed - - [Linux Kernel watch_queue Out-Of-Bounds Write Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37662&utm_source=rss&utm_medium=rss) - - [Pharmacy Management System 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37658&utm_source=rss&utm_medium=rss) - - [Online Restaurant Table Reservation System 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37657&utm_source=rss&utm_medium=rss) - - [USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 Remote Root Backdoor Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37660&utm_source=rss&utm_medium=rss) - - [ManageEngine ADSelfService Plus Custom Script Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37661&utm_source=rss&utm_medium=rss) - - [USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 Remote Root Backdoor exploit](https://sploitus.com/exploit?id=PACKETSTORM:166813&utm_source=rss&utm_medium=rss) - - [ManageEngine ADSelfService Plus Custom Script Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:166816&utm_source=rss&utm_medium=rss) - - [Pharmacy Management System 1.0 Shell Upload Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37659&utm_source=rss&utm_medium=rss) - - [Watch Queue Out-Of-Bounds Write exploit](https://sploitus.com/exploit?id=PACKETSTORM:166815&utm_source=rss&utm_medium=rss) - - [Exploit for Infinite Loop in Openssl exploit](https://sploitus.com/exploit?id=0C866B2A-86E3-5C5A-AA62-622683A9A0DA&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Initialization in Google Android exploit](https://sploitus.com/exploit?id=6E6D4C4B-4912-5F69-BB8A-63233DA07F2A&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-29464 exploit](https://sploitus.com/exploit?id=D9DFB9E2-6839-5388-8C1B-4AC50F2A5660&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Read in Google Android exploit](https://sploitus.com/exploit?id=B9BD383A-80C2-501B-829A-6BED983E3BDE&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Google Android exploit](https://sploitus.com/exploit?id=5DB708BE-78F8-522A-AD6C-9A5052392E03&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Restriction of XML External Entity Reference in Hazelcast exploit](https://sploitus.com/exploit?id=58BB0395-C361-5985-BFEC-C9E154D7326C&utm_source=rss&utm_medium=rss) -- Sucuri Blog - - [Keeping Up With PHP Updates](https://blog.sucuri.net/2022/04/keeping-up-with-php-updates.html) -- Trustwave Blog - - [Trustwave and Best-of-Breed Partners Power Up Security Together](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-and-best-of-breed-partners-power-up-security-together/) -- paper - Last paper - - [解决哥斯拉内存马 pagecontext 的问题](https://paper.seebug.org/1885/) -- MWR Publications - - [Faking Another Positive COVID Test](https://labs.f-secure.com/blog/faking-another-positive-covid-test/) -- Hexacorn - - [Infosec Salaries – the myth and the reality](https://www.hexacorn.com/blog/2022/04/21/infosec-salaries-the-myth-and-the-reality/) -- Current Posts - Red Team Journal - - [Yeah, It’s Tough but We’re Tougher](https://www.redteamjournal.com/blog/red-teaming-tough-and-tougher) -- Software Integrity Blog - - [Synopsys named a Leader in the 2022 Gartner Magic Quadrant for Application Security Testing for the sixth year](https://www.synopsys.com/blogs/software-security/gartner-mq-ast/) -- Reverse Engineering - - [Pwntools for beginners - Pwn Zero To Hero](https://www.reddit.com/r/ReverseEngineering/comments/u8s7wm/pwntools_for_beginners_pwn_zero_to_hero/) - - [How to Leverage Log4j to Expose vCenter Attack Paths](https://www.reddit.com/r/ReverseEngineering/comments/u8ip2z/how_to_leverage_log4j_to_expose_vcenter_attack/) - - [DIRTY: Augmenting Decompiler Output with Learned Variable Names and Types](https://www.reddit.com/r/ReverseEngineering/comments/u8g5jr/dirty_augmenting_decompiler_output_with_learned/) -- Sucuri Blog - - [Keeping Up With PHP Updates](https://blog.sucuri.net/2022/04/keeping-up-with-php-updates.html) -- Microsoft Security Response Center - - [Congratulations and New Swag Awards for the Top MSRC 2022 Q1 Security Researchers!](https://msrc-blog.microsoft.com/2022/04/21/congratulations-and-new-swag-awards-for-the-top-msrc-2022-q1-security-researchers/) -- Mozilla Hacks – the Web developer blog - - [Adopting users’ design feedback](https://hacks.mozilla.org/2022/04/adopting-users-design-feedback/) -- blog.avast.com EN - - [USB Protection Launch | Avast](https://blog.avast.com/usb-protection-launch) -- KitPloit - PenTest & Hacking Tools - - [Jfscan - A Super Fast And Customisable Port Scanner, Based On Masscan And NMap](http://www.kitploit.com/2022/04/jfscan-super-fast-and-customisable-port.html) -- The Daily Swig | Cybersecurity news and views - - [Hack Me, I’m Famous: Bug bounty hackathon nets security researcher €10,000 overnight](https://portswigger.net/daily-swig/hack-me-im-famous-bug-bounty-hackathon-nets-security-researcher-10-000-overnight) - - [NIST revamps aging enterprise patch management guidance](https://portswigger.net/daily-swig/nist-revamps-aging-enterprise-patch-management-guidance) -- Malwarebytes Labs - - [Pegasus spyware found on UK government office phone](https://blog.malwarebytes.com/security-world/privacy-security-world/2022/04/pegasus-spyware-found-on-uk-government-office-phone/) - - [Beware of fake Twitter philanthropists offering to put $750 into your Cash App account](https://blog.malwarebytes.com/scams/2022/04/beware-of-fake-twitter-philanthropists-offering-750-for-your-cash-app-account/) - - [It’s legal to scrape public data—US appeals court](https://blog.malwarebytes.com/privacy-2/2022/04/its-legal-to-scrape-public-data-us-appeals-court/) -- 黑海洋 - WIKI - - [网站防扒JS代码技术合集](https://blog.upx8.com/2710) - - [蓝奏云一键上传v1.6 右键上传到蓝奏云工具](https://blog.upx8.com/2709) - - [CloudFlare通过SaaS免费使用CNAME接入域名解析](https://blog.upx8.com/2708) - - [Vue.js3.0核心源码解析课程](https://blog.upx8.com/2707) -- Secureworks Blog - - [Catch Malicious Threat Actors with Secureworks’ New Hands-on-Keyboard Detector](https://www.secureworks.com/blog/catch-malicious-threat-actors-with-secureworks-new-hands-on-keyboard-detector) - - [GOLD ULRICK Continues Conti Operations Despite Public Disclosures](https://www.secureworks.com/blog/gold-ulrick-continues-conti-operations-despite-public-disclosures) -- Qualys Security Blog - - [Assessing Certificate Risk with Qualys VMDR](https://blog.qualys.com/category/product-tech) -- Il Disinformatico - - [DragonChase 2022: Andiamo a vedere il lancio Starlink!](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-andiamo-vedere-il.html) - - [DragonChase 2022: Crew4 non partirà prima del 26 aprile. Non riusciremo a vedere la partenza dal vivo](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-crew4-non-partira.html) -- Luca Mercatanti - - [Come recuperare messaggi Whatsapp](https://luca-mercatanti.com/2022/04/21/come-recuperare-messaggi-whatsapp/?utm_source=rss&utm_medium=rss&utm_campaign=come-recuperare-messaggi-whatsapp) -- Securityinfo.it - - [Certificati di root delle VPN mettono a rischio la sicurezza](https://www.securityinfo.it/2022/04/21/certificati-di-root-delle-vpn-mettono-a-rischio-la-sicurezza/?utm_source=rss&utm_medium=rss&utm_campaign=certificati-di-root-delle-vpn-mettono-a-rischio-la-sicurezza) - - [Algoritmo impedisce ai microfoni di spiare](https://www.securityinfo.it/2022/04/21/un-algoritmo-per-impedire-ai-microfoni-di-spiare/?utm_source=rss&utm_medium=rss&utm_campaign=un-algoritmo-per-impedire-ai-microfoni-di-spiare) -- Hakin9 – IT Security Magazine - - [Ostorlab - a composable security scanning platform for all assets](https://hakin9.org/ostorlab-a-composable-security-scanning-platform-for-all-assets/) - - [KrbRelay - Framework for Kerberos relaying](https://hakin9.org/krbrelay-framework-for-kerberos-relaying/) -- SANS Internet Storm Center, InfoCON: green - - [Multi-Cryptocurrency Clipboard Swapper, (Thu, Apr 21st)](https://isc.sans.edu/diary/rss/28574) - - [ISC Stormcast For Thursday, April 21st, 2022 https://isc.sans.edu/podcastdetail.html?id=7974, (Thu, Apr 21st)](https://isc.sans.edu/diary/rss/28572) -- 奇客Solidot–传递最新科技情报 - - [币安给俄罗斯用户三个月时间提款](https://www.solidot.org/story?sid=71318) - - [一季度智能手机出货量将继续下滑](https://www.solidot.org/story?sid=71317) - - [毅力号在火星捕捉到日食画面](https://www.solidot.org/story?sid=71316) - - [俄罗斯计划 2030 年实现 28 纳米芯片自产](https://www.solidot.org/story?sid=71315) - - [郊区无人机送货是未来吗？](https://www.solidot.org/story?sid=71314) - - [Facebook 聚焦非洲在尼日利亚铺光纤](https://www.solidot.org/story?sid=71313) - - [科学家发明装置优化奥利奥饼干切分](https://www.solidot.org/story?sid=71312) - - [知道的越多，不知道的越多](https://www.solidot.org/story?sid=71311) - - [丘成桐全职任教清华](https://www.solidot.org/story?sid=71310) - - [东航空难初步调查报告公布](https://www.solidot.org/story?sid=71309) - - [FAA 称一 YouTube 主播故意坠毁飞机](https://www.solidot.org/story?sid=71308) -- SecurityCurrent - - [Former Federal Reserve Bank Regulator David Cass Named President of CISOs Connect, an International Cybersecurity Organization](/former-federal-reserve-bank-regulator-david-cass-named-president-of-cisos-connect-an-international-cybersecurity-organization/) -- 0xFFFF@blog:~$ - - [Protected: PHPwn3d – developing a PHP webshell, step by step.](https://blog.0xffff.info/2022/04/21/phpwn3d-developing-a-php-webshell-step-by-step/) -- Schneier on Security - - [Long Article on NSO Group](https://www.schneier.com/blog/archives/2022/04/long-article-on-nso-group.html) -- Dark Reading - - [Zero-Day Exploit Use Exploded in 2021](https://www.darkreading.com/threat-intelligence/zero-day-exploit-use-exploded-in-2021) - - [What Steps Do I Take to Shift Left in Security?](https://www.darkreading.com/edge-ask-the-experts/what-steps-do-i-take-to-shift-left-in-security) - - [Devo Acquires Threat Hunting Company Kognos](https://www.darkreading.com/analytics/devo-acquires-kognos-to-add-autonomous-threat-hunting-to-cloud-native-logging-analytics) - - [Exploring Biometrics and Trust at the Corporate Level](https://www.darkreading.com/dr-tech/exploring-biometrics-and-trust-at-the-corporate-level) - - [UntitledNew Zscaler Research Shows Over 400% Increase in Phishing Attacks With Retail and Wholesale Industries at Greatest Risk](https://www.darkreading.com/attacks-breaches/untitlednew-zscaler-research-shows-over-400-increase-in-phishing-attacks-with-retail-and-wholesale-industries-at-greatest-risk) - - [Cybereason Launches Digital Forensics Incident Response](https://www.darkreading.com/attacks-breaches/cybereason-launches-digital-forensics-incident-response) - - [Alert Logic Releases MDR Incident Response Capability for Addressing a Breach](https://www.darkreading.com/attacks-breaches/alert-logic-releases-mdr-incident-response-capability-for-addressing-a-breach) - - [3 Ways We Can Improve Cybersecurity](https://www.darkreading.com/vulnerabilities-threats/3-ways-we-can-improve-cybersecurity) -- KitPloit - PenTest Tools! - - [Jfscan - A Super Fast And Customisable Port Scanner, Based On Masscan And NMap](http://www.kitploit.com/2022/04/jfscan-super-fast-and-customisable-port.html) -- Blackhat Library: Hacking techniques and research - - [How to transfer files from a company computer without detection?](https://www.reddit.com/r/blackhat/comments/u8e67y/how_to_transfer_files_from_a_company_computer/) -- Your Hacking Tutorial by Zempirians - - [Recommended resources/paths to learn binary exploits?](https://www.reddit.com/r/HowToHack/comments/u8v7ry/recommended_resourcespaths_to_learn_binary/) - - [Best way (wordlist) to recover a WPA hash with a non-english password](https://www.reddit.com/r/HowToHack/comments/u8xfzg/best_way_wordlist_to_recover_a_wpa_hash_with_a/) - - [crack .CAP file without wordlist.](https://www.reddit.com/r/HowToHack/comments/u8ht8r/crack_cap_file_without_wordlist/) -- Graham Cluley - - [REvil reborn? Notorious gang’s dark web site redirects to new ransomware operation](https://www.tripwire.com/state-of-security/security-data-protection/revil-dark-web-site-redirects-new-ransomware-operation/) - - [Free Yanlouwang decryptor released, after flaw found in ransomware code](https://grahamcluley.com/free-yanlouwang-decryptor-released-after-flaw-found-in-ransomware-code/) - - [Smashing Security podcast #271: Crypto break-in, Google blurring, and mics not muting](https://grahamcluley.com/smashing-security-podcast-271-crypto-break-in-google-blurring-and-mics-not-muting/) -- 安全威胁情报 - - [攻防演练效果提升秘籍：妙用微步TDP，高效精准流量检测](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172108&idx=1&sn=c7ec69fe7f14ca1c040d29dedfb3fe1c&chksm=f4489170c33f1866d8119170263754dcffd74a63a4caeaceccc03a5ffe90c02124628345789d&scene=58&subscene=0#rd) -- The Register - Security - - [YouTube terminates account for Hong Kong's presumed next head of government](https://go.theregister.com/feed/www.theregister.com/2022/04/21/youtube_blocks_hong_kong_candidate/) - - [Emotet reestablishes itself at the top of the malware world](https://go.theregister.com/feed/www.theregister.com/2022/04/21/emotet-resurgence-email/) - - [Five Eyes nations fear wave of Russian attacks against critical infrastructure](https://go.theregister.com/feed/www.theregister.com/2022/04/21/five_eyes_russia/) -- 安全牛 - - [多云环境下，如何实现自动化的安全防护？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112463&idx=1&sn=4a0331202a597a424a21a34c143961ef&chksm=bd1474dc8a63fdca4a6c5e4639b5295cbb2211a3088a79b50bdc06bfb821441aa7a84a0510cb&scene=58&subscene=0#rd) - - [初探零信任建设的破局之路](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112463&idx=2&sn=bbb3c3531af012bc2024c6ccf3e5cf20&chksm=bd1474dc8a63fdcac214296e682811ca14aa9390bb53d3bd235772eac86888794de1abd73706&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [CVE-2022-21449 PoC demonstrating TLS MITM](https://www.reddit.com/r/netsec/comments/u8ihc9/cve202221449_poc_demonstrating_tls_mitm/) - - [JBoss EAP/AS <= 6.* RCE - A little bit beyond \xAC\xED](https://www.reddit.com/r/netsec/comments/u8n405/jboss_eapas_6_rce_a_little_bit_beyond_xacxed/) - - [Hello all, I have release a new version of SCodeScanner v2.1.0 where it contains advance rules and some additonal features. Features includes removing false positives, send outputfile directly to jira and Slack, more info - https://github.com/agrawalsmart7/scodescanner & https://scodescanner.info.](https://www.reddit.com/r/netsec/comments/u8l0bs/hello_all_i_have_release_a_new_version_of/) -- 默安科技 - - [默安科技荣获“网络安全国家标准20周年优秀实践案例”](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247490472&idx=1&sn=bd75a56b13c3de4788d5897b66d8aea5&chksm=e938ec8ade4f659c14059096b4c4542b74883dd05462b3af0dc278c58d35e36bca336b33a56c&scene=58&subscene=0#rd) -- 互联网安全内参 - - [国家邮政系统遭网络攻击，这个国家养老金发放部分中断](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502513&idx=1&sn=d4745e3ffa284da3147a4d4d7f80f6d0&chksm=ebfa8d91dc8d0487e300e297dfdaffd187263003e3f1e97b7afaebdcac82734e54220731073d&scene=58&subscene=0#rd) - - [谷歌2021年0day威胁形势复盘：你知道越多，你越知道你不知道](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502513&idx=2&sn=57418a913633e1a1eef0e3f3dd302a4d&chksm=ebfa8d91dc8d048773f6a303df386bb472fa3f9f126ee351b8a4c0e3bde5e040cd037c8f5f9f&scene=58&subscene=0#rd) - - [工信部通报37款存在侵害用户权益行为APP，我爱我家等在列](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502513&idx=3&sn=a942b5809a7a5d0ef4055b40ee5a67c2&chksm=ebfa8d91dc8d0487d49fa74f24f34bd71e6d0ea0b167ca89a8b27e8edfa8e8fad7bc59915d22&scene=58&subscene=0#rd) - - [警惕！失控的无人机可能成为新的网络攻击杀手](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502513&idx=4&sn=fb148a7a97e35dbd95152053c09fb567&chksm=ebfa8d91dc8d048737a75e9cf2d2fc6ab958182abb396ebdd9225d192f0f90756ece2531c70b&scene=58&subscene=0#rd) -- 代码卫士 - - [Okta 结束Lapsus$ 供应链事件调查，称将加强第三方管控](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511475&idx=1&sn=1ea2d1ecbccc18f96cf4a2042cea226d&chksm=ea949cd9dde315cf066c77d11309916d7926f24db191be889382dbb7926399c047ad7487ee78&scene=58&subscene=0#rd) - - [开源的 Snort 入侵检测系统中存在高危漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511475&idx=2&sn=7b28cadcfa45182f3c7285f34c2454c8&chksm=ea949cd9dde315cfd74febfca37472f0cf099450eb767d476baa5fc7ac53ad75dfd0d3cc2d70&scene=58&subscene=0#rd) - - [年度加密漏洞提前锁定：Java JDK 加密实现漏洞可用于伪造凭据](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511475&idx=3&sn=d944ace06613bb0fc7ab6099e251b30e&chksm=ea949cd9dde315cf4a1d48d11a8ef9a7f9d085aa16678adad9cc7ebee49b39f9415ceacb18eb&scene=58&subscene=0#rd) -- Security Affairs - - [Critical bug in decoder used by popular chipsets exposes 2/3 of Android devices to hack](https://securityaffairs.co/wordpress/130459/hacking/critical-bug-popular-chipsets-android-hack.html) - - [Cybercriminals Deliver IRS Tax Scams & Phishing Campaigns By Mimicking Government Vendors](https://securityaffairs.co/wordpress/130451/cyber-crime/cybercriminals-deliver-irs-tax-scams-phishing.html) - - [Static SSH host key in Cisco Umbrella allows stealing admin credentials](https://securityaffairs.co/wordpress/130443/hacking/cisco-umbrella-default-ssh-key.html) - - [CVE-2022-20685 flaw in the Modbus preprocessor of the Snort makes it unusable](https://securityaffairs.co/wordpress/130436/security/snort-bug-makes-it-unusable.html) - - [US, Australia, Canada, New Zealand, and the UK warn of Russia-linked threat actors’ attacks](https://securityaffairs.co/wordpress/130430/cyber-warfare-2/russia-threat-actors-cyber-attacks.html) -- TorrentFreak - - [Spanish Pirate Site Operator Gets Two-Year Prison Sentence, Mother Walks Free](https://torrentfreak.com/spanish-pirate-site-operator-gets-two-year-prison-sentence-mother-walks-free-220421/) - - [MPA Wins Piracy Battle, US Court Orders PrimeWire to Shut Down](https://torrentfreak.com/mpa-wins-piracy-battle-us-court-orders-primewire-to-shut-down-220420/) -- 腾讯玄武实验室 - - [每日安全动态推送(04-21)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958370&idx=1&sn=a9754e7e186df3c5d93153de1bbbe144&chksm=8baeccfdbcd945eb5009570afe909657f3c771de27615677c72bc207f50f1de680e64113f07a&scene=58&subscene=0#rd) -- 慢雾科技 - - [慢雾：Rikkei Finance 被黑复现分析](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495448&idx=1&sn=a9a36e0f9b8e113a7b23f37cd1e36be7&chksm=fdde919fcaa918893069fb84233a1371c2a60494882878d62a3bbe8fa73f054e1295ece1132b&scene=58&subscene=0#rd) -- Computer Forensics - - [Encase Aquistion to forensics mode](https://www.reddit.com/r/computerforensics/comments/u8y40x/encase_aquistion_to_forensics_mode/) - - [Forensic Certifications](https://www.reddit.com/r/computerforensics/comments/u8k5rd/forensic_certifications/) - - [RAM/Memory Dump of iOS devices](https://www.reddit.com/r/computerforensics/comments/u8ckq4/rammemory_dump_of_ios_devices/) -- 情报分析师 - - [信息战深度好文：从史前到乌克兰](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497992&idx=1&sn=8c96a87a2ad0dbcc54aa9b0c889f8461&chksm=87164d83b061c49526907ac82a936b9a317de1cbccb46a3b4c234aae53c00f272065f4096dc5&scene=58&subscene=0#rd) - - [专业报告：《俄罗斯信息战的探索和认知维度》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497992&idx=2&sn=c820324b1e4411c017b3ba875fc63d24&chksm=87164d83b061c49591bf10d20cd644f7d241c1f64c39a7ad8e301dd280f352bd8bb2f2c56e16&scene=58&subscene=0#rd) - - [7种优化SQL查询的工具](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650497992&idx=3&sn=9bacccb0bf4c6c69444acf326d60b286&chksm=87164d83b061c495fa3e445dc959df0c9fb0953ffc97a21f2c292605beb83e869874cfe7a1c1&scene=58&subscene=0#rd) -- Social Engineering - - [Can anyone recommend a book about societal conditioning?](https://www.reddit.com/r/SocialEngineering/comments/u8dlqm/can_anyone_recommend_a_book_about_societal/) -- 360漏洞云 - - [严重 | Apache APISIX 信息泄露漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496923&idx=1&sn=526a4343d900f91e3c8395d8d3c0e0aa&chksm=ebe80849dc9f815fffa00c7d07357035e5be69f28c79f51dd34f33e27ce221841f1fd03b91f4&scene=58&subscene=0#rd) - - [严重 | Spring Security OAuth拒绝服务漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496923&idx=2&sn=d332487bdfb4da39ae43dc8e04212aa6&chksm=ebe80849dc9f815f88ac8cf57749d8804367fac0899d191ce6cb487261a082b57450c12417df&scene=58&subscene=0#rd) - - [高危 | Jira 和 Jira Service Management身份验证绕过漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496923&idx=3&sn=c12e3255610750e1e1f1c0bb44b6abff&chksm=ebe80849dc9f815f2e63301227156b7a7fa726b17545264bb6de08cefa82e2d655b7943bc570&scene=58&subscene=0#rd) - - [注意更新 | Cisco发布安全更新，修复多个安全漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496923&idx=4&sn=65ae9cc064b7cf27f49415ed9a205f65&chksm=ebe80849dc9f815f7874a32617467d9f77ae3cfd09579b23ebedd4c852f0cce36442a7052037&scene=58&subscene=0#rd) -- 看雪学院 - - [JLink固件漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438567&idx=1&sn=a6f209fb274919dddcde9584f1e640e0&chksm=b18ffb2d86f8723b1eb6dfbb169a4c7ae4fee1dbb202b46a199da3e50201ab5ef8c1bc8a0094&scene=58&subscene=0#rd) - - [五眼联盟宣称俄罗斯政府将带来更多恶意网络活动](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438567&idx=2&sn=83d4eae52f058dbbf8d18684ba2df925&chksm=b18ffb2d86f8723b4991faea54a5ef1d2131be3aa86e1b86cb4bdce931b82f61007590d1b703&scene=58&subscene=0#rd) - - [反勒索软件开发实战篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438567&idx=3&sn=168e1f956a9b3a7e3eeac2c876018087&chksm=b18ffb2d86f8723ba829e4ad4cbb9ac3430801f5d9bf72da4eb453c2475eaae7a21896d05b66&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-04-21](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247489592&idx=1&sn=be7b4781fe67a1a65672c4ff800a7fc7&chksm=c06036e1f717bff71cf0fbbc661da4f804b56f64211290af97017071cecf8bcab382e2de9522&scene=58&subscene=0#rd) -- 安全学术圈 - - [利用神经网络挖掘共同特征发现未知的APT](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247487582&idx=1&sn=1487e5cb9acce1d8c1e8f262e299ebcc&chksm=fe2eefd5c95966c31bdab293aeead5f29676a06509f6b9e3f74b82466b30869417eb193de9e3&scene=58&subscene=0#rd) -- 三六零CERT - - [CVE-2022-0540：Jira 身份验证绕过漏洞风险通告](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247490901&idx=1&sn=0697a2bcbc10e6fd5ff13148e2038d5b&chksm=fe251854c9529142ac787655adc1aec8ce976258aca9280f83d71c0ff717eb6656dea0a7f48b&scene=58&subscene=0#rd) - - [安全日报（2022.04.21）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247490901&idx=2&sn=06d07720b7eafa62c6ab855ab478aaa4&chksm=fe251854c9529142dafbd25e1d0817c33cc786b4e2d21a6684bc234ea20045ac932f4e95b22d&scene=58&subscene=0#rd) -- 火线Zone - - [Web框架的请求上下文](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493865&idx=1&sn=4d4cdab3e060d6cd66ec6db3d7104885&chksm=eaa960c9dddee9df42bd1445ffa75ff8647f430cd724f5337a22891adbd2acd5f8ccfd50edba&scene=58&subscene=0#rd) - - [记一次反编译小程序寻找签名函数并联动bp插件自动化加签](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493865&idx=2&sn=1526478c9ad56bb0e28bdd86536121a7&chksm=eaa960c9dddee9dfbf3bc36ac18585fdebe4b45b827f3408f525a957ab8792dfdc5b8fe19a3f&scene=58&subscene=0#rd) -- 雷神众测 - - [靶场Kioptrix Level 1攻略](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652496738&idx=1&sn=319e35eb05bdc87b5ffc037dc7aae9fa&chksm=f25840d1c52fc9c7d2b3b5c62fb99d963380ef376c74f393c2dff152b2411349fd163710d4d1&scene=58&subscene=0#rd) -- 安全客 - - [【安全头条】Emotet僵尸网络切换到64位模块，发行量正在激增](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769518&idx=1&sn=ec7f2232bd169b41e3d41a522423f25a&chksm=88937641bfe4ff576f9e10b93365a606c7c165cb154d7378a6f0f6aaa7d6cd17d0a80279431a&scene=58&subscene=0#rd) - - [【技术分享】伪造面向对象编程——COOP](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769518&idx=2&sn=182354d3b66900222db9285a4e0ab7b2&chksm=88937641bfe4ff571ff451b1d9c1794b057017942e154126fc6f4aa7fe0c121b6c643269c9a4&scene=58&subscene=0#rd) -- Paul's Security Weekly - - [PSW #737 - Capt. John Alfred & Thomas Lonardo](http://podcast.securityweekly.com/psw-737-capt-john-alfred-thomas-lonardo) -- 锦行信息安全 - - [服务能力再获认可！锦行科技圆满完成2021广交会网络安全保障工作！](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489512&idx=1&sn=387d768af67dd62361de49bcce63a93f&chksm=9799ec4da0ee655b9323d469ca2002712c0e6b79e63d95d8bb9fe1073b445372dc005fe7083a&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | 新的API会危及安全性吗？](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247492797&idx=1&sn=df2a0c037053937e99419aba85295e75&chksm=c0074921f770c037d3e39b3782e77ae03cab1479a420d2272b278c4ff205d91d0b3fb3192947&scene=58&subscene=0#rd) -- SecPulse安全脉搏 - - [【漏洞预警】Asciidoctor-include-ext 命令注入漏洞](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044396&idx=1&sn=c50f71d249b87f2320faca35fdd565e6&chksm=803fa772b7482e64031830d3572f2e8f975c08c1b5bbde4895d5295889ee086984df4df6299d&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [庄荣文：顺应信息革命时代潮流 奋力推进网络强国建设](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525910&idx=1&sn=e85fc91a8ba21b38e37eade06a6743f0&chksm=c1e9ea47f69e635126911a40c14d11cbe1616211b5aeea5c24def349a0d1ab579760a2b481c4&scene=58&subscene=0#rd) - - [数量猛增，LinkedIn已成为网络钓鱼者的最爱](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525910&idx=2&sn=596943fd09fd76b61a29fbfa34a92f67&chksm=c1e9ea47f69e63517f0553c659c4faf4251eb2b6c2775ad63218693070c14f8b2b30f8138c56&scene=58&subscene=0#rd) - - [警惕！失控的无人机可能成为新的网络攻击杀手](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525910&idx=3&sn=ef5867b4ecb39d1bde1bc2f7229e8084&chksm=c1e9ea47f69e635154ff07c8ac1f1316f488080c6ed67a296e83f5e5783fb70f6ffdb42d9e70&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-04-23.md b/archive/2022/2022-04-23.md deleted file mode 100644 index 8ed40cd969..0000000000 --- a/archive/2022/2022-04-23.md +++ /dev/null @@ -1,315 +0,0 @@ -# 每日安全资讯（2022-04-23） - -- Sec-News 安全文摘 - - [《Offer一箩筐》一份高质量「简历」撰写指南，望打扰！！](https://wiki.ioin.in/url/P3Gg) -- Files ≈ Packet Storm - - [Zeek 4.2.1](https://packetstormsecurity.com/files/166819/zeek-4.2.1.tar.gz) - - [Red Hat Security Advisory 2022-1356-01](https://packetstormsecurity.com/files/166818/RHSA-2022-1356-01.txt) - - [Red Hat Security Advisory 2022-1461-01](https://packetstormsecurity.com/files/166817/RHSA-2022-1461-01.txt) -- HackerOne Hacker Activity - - [Bypass of fix #1370749](https://hackerone.com/reports/1489077) -- Security Boulevard - - [Neosec Covers Every OWASP API Top 10 Vulnerability (Blog)](https://securityboulevard.com/2022/04/neosec-covers-every-owasp-api-top-10-vulnerability-blog/) - - [Combatting a BlackCat Ransomware Active Directory Attack](https://securityboulevard.com/2022/04/combatting-a-blackcat-ransomware-active-directory-attack/) - - [OWASP® Global AppSec US 2021 Virtual – Barak Tawily’s ‘Exploiting Web Messaging Implementations’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-barak-tawilys-exploiting-web-messaging-implementations/) - - [CISO Thoughts with David Lindner – April 22](https://securityboulevard.com/2022/04/ciso-thoughts-with-david-lindner-april-22/) - - [YouTube Bans Hong Kong Election Candidate Lee Ka-chiu](https://securityboulevard.com/2022/04/youtube-bans-hong-kong-election-candidate-lee-ka-chiu/) - - [Joy Of Tech® ‘Netflix Loses It’](https://securityboulevard.com/2022/04/joy-of-tech-netflix-loses-it/) - - [Trends in Passport Personalization](https://securityboulevard.com/2022/04/trends-in-passport-personalization-2/) - - [ALPHV: Breaking Down the Complexity of the Most Sophisticated Ransomware](https://securityboulevard.com/2022/04/alphv-breaking-down-the-complexity-of-the-most-sophisticated-ransomware/) - - [How a European Electronics Retailer Ended the Bot Menace on its Portal](https://securityboulevard.com/2022/04/how-a-european-electronics-retailer-ended-the-bot-menace-on-its-portal/) -- 跳跳糖 - 安全与分享社区 - - [PE文件结构从初识到简单shellcode注入](https://tttang.com/archive/1553/) - - [The More You Know, The More You Know You Don’t Know: A Year in Review of 0-days Used In-the-Wild in 2021（译文）](https://tttang.com/archive/1568/) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-29464 exploit](https://sploitus.com/exploit?id=4622AE77-40AA-5BEA-9233-54F47C1BB5DE&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Read in Google Android exploit](https://sploitus.com/exploit?id=F21DE6F4-F131-5CDB-965C-0167DFF06BF7&utm_source=rss&utm_medium=rss) -- 安全客-有思想的安全新媒体 - - [普通人是如何不知不觉参与犯罪团伙“洗钱”的？带你了解黑钱“洗白”过程](https://www.anquanke.com/post/id/272461) - - [360安全运营服务体系全新升级，提供可扩展、可验证的安全能力](https://www.anquanke.com/post/id/272432) - - [引领自主创新，360政企安全集团获评两大领域2021网信自主创新尖峰企业](https://www.anquanke.com/post/id/272437) - - [聚焦 解读 | 中共中央办公厅、国务院办公厅印发《关于加强打击治理电信网络诈骗违法犯罪工作的意见》](https://www.anquanke.com/post/id/272442) - - [国家计算机病毒应急处理中心披露——美国中央情报局CIA“蜂巢”网络武器平台分析报告](https://www.anquanke.com/post/id/272447) - - [数字安全观察-每周简报 （20220409-20220415）](https://www.anquanke.com/post/id/272462) - - [Smarty 模板注入与沙箱逃逸](https://www.anquanke.com/post/id/272393) - - [CVE-2022-0540：Jira 身份认证绕过漏洞风险通告](https://www.anquanke.com/post/id/272401) - - [喻海松：网络犯罪形态的碎片化与刑事治理的体系化](https://www.anquanke.com/post/id/272359) - - [REvil的TOR网站活跃起来，可以重定向到新的勒索软件操作](https://www.anquanke.com/post/id/272390) -- 绿盟科技技术博客 - - [云原生服务风险测绘分析（二）： Harbor](http://blog.nsfocus.net/harbor-2/) -- Snowming04's Blog - - [功亏一篑：挖洞思路记录](http://snowming.me/2022/04/22/bug_hunter/) -- FreeBuf网络安全行业门户 - - [FBI：BlackCat 勒索软件至少入侵了全球 60 个实体](https://www.freebuf.com/news/330668.html) - - [五眼联盟发布咨询，警惕俄罗斯网络攻击](https://www.freebuf.com/news/330628.html) - - [FreeBuf甲方群话题讨论 | 聊聊企业HW行动](https://www.freebuf.com/articles/neopoints/330598.html) - - [ALAC音频格式存漏洞，全球超半数 Android 用户隐私受威胁](https://www.freebuf.com/news/330582.html) - - [Android中的严重bug可导致用户媒体文件被访问](https://www.freebuf.com/news/330575.html) - - [FreeBuf周报 | 官方曝光美国网络攻击武器“蜂巢”；联想三个漏洞影响数百万台电脑](https://www.freebuf.com/news/330559.html) - - [讲师招募中 | FreeBuf精品公开课需要发光发热的你~](https://www.freebuf.com/articles/325381.html) - - [小心，LinkedIn的求职简历被“坏蛋”盯上了](https://www.freebuf.com/news/330530.html) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [7-Zip 16 DLL Hijacking](https://cxsecurity.com/issue/WLB-2022040087) - - [USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 Remote Root Backdoor](https://cxsecurity.com/issue/WLB-2022040086) - - [Razer Sila - Command Injection (py)](https://cxsecurity.com/issue/WLB-2022040085) - - [Trojan.Win32.TScash.c / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022040084) - - [Backdoor.Win32.Loselove / Denial of Service](https://cxsecurity.com/issue/WLB-2022040083) - - [Backdoor.Win32.GateHell.21 / Port Bounce Scan](https://cxsecurity.com/issue/WLB-2022040082) - - [Torrent Video Cutter V1.93 Build 114 Denial of Service Exploit](https://cxsecurity.com/issue/WLB-2022040081) -- Hacking and security - - [Powershell script - get domain users with old passwords](https://hackingandsecurity.blogspot.com/2022/04/powershell-script-get-domain-users-with.html) - - [Powershell script - generate random password](https://hackingandsecurity.blogspot.com/2022/04/powershell-script-generate-random.html) - - [Powershell script - Windows folder permissions](https://hackingandsecurity.blogspot.com/2022/04/powershell-script-windows-folder.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [Pythonic Malware Part-2: Reversing Python Executables](https://infosecwriteups.com/pythonic-malware-part-2-reversing-python-executables-1b197bd023ca?source=rss----7b722bfd1b8d--bug_bounty) -- Hex Rays - - [Igor’s tip of the week #85: Function chunks](https://hex-rays.com/blog/igors-tip-of-the-week-85-function-chunks/) -- GuidePoint Security - - [PCI DSS 4.0 – The New ROC Template at a Glance](https://www.guidepointsecurity.com/blog/pci-dss-4-0-the-new-roc-template-at-a-glance/) -- blog.avast.com EN - - [JekyllBot:5 Threatens Hospital Robots | Avast](https://blog.avast.com/jekyllbot5-threatens-hospital-robots-avast) -- Reverse Engineering - - [How Does a Debugger Work - Debug Events Explained (OALABS Tutorial)](https://www.reddit.com/r/ReverseEngineering/comments/u9mrde/how_does_a_debugger_work_debug_events_explained/) - - [The Almighty DWARF: A Trojan Horse for Program Analysis, Verification, and Recompilation](https://www.reddit.com/r/ReverseEngineering/comments/u9n5my/the_almighty_dwarf_a_trojan_horse_for_program/) - - [Speakers Announced! Hardwear.io – Hardware Security Conference [Santa Clara, 9-10 June 2022]](https://www.reddit.com/r/ReverseEngineering/comments/u9avd4/speakers_announced_hardweario_hardware_security/) -- Hacking Articles - - [A Detailed Guide on Hydra](https://www.hackingarticles.in/a-detailed-guide-on-hydra/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 17](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-17-3/) -- KitPloit - PenTest & Hacking Tools - - [Spock SLAF - A Shared Library Application Firewall "SLAF"](http://www.kitploit.com/2022/04/spock-slaf-shared-library-application.html) - - [Sub3Suite - A Free, Open Source, Cross Platform Intelligence Gathering Tool](http://www.kitploit.com/2022/04/sub3suite-free-open-source-cross.html) - - [Ecapture - Capture SSL/TLS Text Content Without CA Cert By eBPF](http://www.kitploit.com/2022/04/ecapture-capture-ssltls-text-content.html) -- HAHWUL - - [CSS Transition 기반의 ontransitionend XSS](https://www.hahwul.com/2022/04/23/ontransitionend-xss/) - - [Metasploit 데이터를 Httpx로?](https://www.hahwul.com/2022/04/22/metasploit-netpen-httpx/) -- The Daily Swig | Cybersecurity news and views - - [Pwn2Own Miami: Hackers earn $400,000 by cracking ICS platforms](https://portswigger.net/daily-swig/pwn2own-miami-hackers-earn-400-000-by-cracking-ics-platforms) - - [Vulnerability in AWS Log4Shell hot patch allowed full host takeover](https://portswigger.net/daily-swig/vulnerability-aws-log4shell-hot-patch-allowed-full-host-takeover) -- rtl-sdr.com - - [Financial Times Story about Ukraine Radio Monitoring with WebSDRs](https://www.rtl-sdr.com/financial-times-story-about-ukraine-radio-monitoring-with-websdrs/) -- Noncombatant - - [Taxonomy Of In-The-Wild Exploitation](https://noncombatant.org/2022/04/22/itw-taxonomy) -- 谢乾坤 | Kingname - - [写在公众号粉丝2w时](https://www.kingname.info/2022/04/22/20000-fans/) - - [一日一技：优雅地加载Yaml配置文件](https://www.kingname.info/2022/04/22/hydra/) - - [一日一技：协程与多进程的完美结合](https://www.kingname.info/2022/04/22/aiomultiprocess/) -- bellingcat - - [Bellingcat is Banned in Russia. Here’s How to Beat the Block](https://www.bellingcat.com/resources/2022/04/22/how-to-beat-russias-block-on-bellingcat/) -- Securityinfo.it - - [Sicurezza a rischio in Android per vulnerabilità legata al codec ALAC](https://www.securityinfo.it/2022/04/22/sicurezza-a-rischio-in-android-per-vulnerabilita-legata-al-codec-alac/?utm_source=rss&utm_medium=rss&utm_campaign=sicurezza-a-rischio-in-android-per-vulnerabilita-legata-al-codec-alac) - - [Vulnerabilità UEFI nei laptop Lenovo](https://www.securityinfo.it/2022/04/22/vulnerabilita-uefi-nei-laptop-lenovo/?utm_source=rss&utm_medium=rss&utm_campaign=vulnerabilita-uefi-nei-laptop-lenovo) -- TS-WAY - - [Weekly Threats N. 16 2022](https://www.ts-way.com/it/weekly-threats/2022/04/22/weekly-threats-n-16-2022/) -- 奇客Solidot–传递最新科技情报 - - [高危漏洞允许攻击者控制数百万计的 Android 设备](https://www.solidot.org/story?sid=71331) - - [苹果杀死 macOS Server](https://www.solidot.org/story?sid=71330) - - [研究发现警告交通事故的公路显示屏会引发更多事故](https://www.solidot.org/story?sid=71329) - - [亚马逊欧洲分部去年销售收入 550 亿美元未缴纳任何税](https://www.solidot.org/story?sid=71328) - - [用推文实时预测粮食短缺](https://www.solidot.org/story?sid=71327) - - [为什么不回收锂电池？](https://www.solidot.org/story?sid=71326) - - [Moderna 数据表明多价 COVID 疫苗加强针是发展方向](https://www.solidot.org/story?sid=71325) - - [Amy Hennig 将再次制作星球大战游戏](https://www.solidot.org/story?sid=71324) - - [Google Play 禁止电话录音应用](https://www.solidot.org/story?sid=71323) - - [K-9 Mail 6.000 发布](https://www.solidot.org/story?sid=71322) - - [Ubuntu 22.04 LTS 释出](https://www.solidot.org/story?sid=71321) - - [Jonathan Carter 再次当选为 Debian 项目领导人](https://www.solidot.org/story?sid=71320) - - [Elon Musk 称已获得收购 Twitter 所需的融资承诺](https://www.solidot.org/story?sid=71319) -- IntelTechniques Blog - - [The Privacy, Security, & OSINT Show – Episode 258](https://inteltechniques.com/blog/2022/04/22/the-privacy-security-osint-show-episode-258/) -- 90Sec - 最新话题 - - [安卓测试之利用frida 绕过 某快餐 ssl pinning](https://forum.90sec.com/t/topic/2094) -- SANS Internet Storm Center, InfoCON: green - - [ISC Stormcast For Friday, April 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=7976, (Fri, Apr 22nd)](https://isc.sans.edu/diary/rss/28576) -- Hakin9 – IT Security Magazine - - [Windows 10 exploitation with just one image by Anastasis Vasileiadis](https://hakin9.org/windows-10-exploitation-with-just-one-image-by-anastasis-vasileiadis/) - - [Account Takeover Fraud: What You Need to Know](https://hakin9.org/account-takeover-fraud-what-you-need-to-know/) -- Troy Hunt's Blog - - [Weekly Update 292](https://www.troyhunt.com/weekly-update-292/) -- SecurityCurrent - - [CISOs Connect™ New York City 2022](/security-shark-tank-new-york-city-2022/) -- The Register - Security - - [US DOJ probes Google's $5.4b Mandiant acquisition](https://go.theregister.com/feed/www.theregister.com/2022/04/22/doj-google-mandiant/) - - [Hive ransomware affiliate zeros in on Exchange servers](https://go.theregister.com/feed/www.theregister.com/2022/04/22/hive_ransomware_microsoft_exchange/) - - [REvil resurrected? Ransomware crew appears to be back. Keyword: Appears](https://go.theregister.com/feed/www.theregister.com/2022/04/22/revil_ransomware_returns/) -- Dark Reading - - [Many Medical Device Makers Skimp on Security Practices](https://www.darkreading.com/tech-trends/many-medical-device-makers-skimp-on-security-practices) - - [Sophos Buys Alert-Monitoring Automation Vendor](https://www.darkreading.com/analytics/sophos-buys-alert-monitoring-automation-vendor) - - [Neustar Security Services’ UltraDNS Integrates Terraform for Streamlined, Automated DNS Management](https://www.darkreading.com/perimeter/neustar-security-services-ultradns-integrates-terraform-for-streamlined-automated-dns-management) - - [FBI Warns Ransomware Attacks on Agriculture Co-ops Could Upend Food Supply Chain](https://www.darkreading.com/attacks-breaches/fbi-warns-agriculture-about-ransomware-attacks-timed-to-planting-harvest-seasons) - - [Early Discovery of Pipedream Malware a Success Story for Industrial Security](https://www.darkreading.com/vulnerabilities-threats/pipedream-response-shows-best-case-for-industrial-security) - - [Bitdefender Enhances Premium VPN Service With New Privacy Protection Technologies](https://www.darkreading.com/endpoint/bitdefender-enhances-premium-vpn-service-with-new-privacy-protection-technologies) - - [Contrast Security Introduces Cloud-Native Automation](https://www.darkreading.com/cloud/contrast-security-introduces-cloud-native-automation) - - [Forescout Enhances Continuum Platform With New OT Capabilities](https://www.darkreading.com/vulnerabilities-threats/forescout-enhances-continuum-platform-with-new-ot-capabilities) - - [PerimeterX Code Defender Extends Capability To Stop Supply Chain Attacks](https://www.darkreading.com/application-security/perimeterx-code-defender-extends-capability-to-stop-supply-chain-attacks) - - [CyberUSA, and Superus Careers Launch Cyber Career Exchange Platform](https://www.darkreading.com/careers-and-people/cyberusa-and-superus-careers-launch-cyber-career-exchange-platform) - - [Fortress Information Security Receives $125M Strategic Investment from Goldman Sachs Asset Management](https://www.darkreading.com/operations/fortress-information-security-receives-125m-strategic-investment-from-goldman-sachs-asset-management) - - [Comcast Business 2021 DDoS Threat Report: DDoS Becomes a Bigger Priority as Multivector Attacks are on the Rise](https://www.darkreading.com/attacks-breaches/comcast-business-2021-ddos-threat-report-ddos-becomes-a-bigger-priority-as-multivector-attacks-are-on-the-rise) - - [Creating Cyberattack Resilience in Modern Education Environments](https://www.darkreading.com/vulnerabilities-threats/creating-cyberattack-resilience-in-modern-education-environments) -- TorrentFreak - - [Man Pleads Guilty to $23m YouTube Content ID Scam](https://torrentfreak.com/man-pleads-guilty-to-23m-youtube-content-id-scam-220423/) - - [MPA Wants Stricter Online Identity Checks to Catch Pirates](https://torrentfreak.com/mpa-wants-stricter-online-identity-checks-to-catch-pirates-220422/) - - [New Phase of ‘Operation 404’ Targets Pirate IPTV & TV Streaming Sites](https://torrentfreak.com/new-phase-of-operation-404-targets-pirate-iptv-streaming-sites-220422/) -- Computer Forensics - - [Any CREST CPIA guidance for help?](https://www.reddit.com/r/computerforensics/comments/u9l6tv/any_crest_cpia_guidance_for_help/) - - [Encase problem in question](https://www.reddit.com/r/computerforensics/comments/u92wa2/encase_problem_in_question/) -- 情报分析师 - - [智库报告|《2022公共安全趋势》及相关资料合集](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650498021&idx=1&sn=35f3a49816313e4815bb2e92495cb0b5&chksm=87164daeb061c4b8baae314e612b4d5a49f1fe685b54e92bddb8676732265bcc5ce1b253110e&scene=58&subscene=0#rd) - - [寻找隐藏监控摄像头终极指南](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650498021&idx=2&sn=c5a3a88845b358824711fb908922b00f&chksm=87164daeb061c4b820b70e6843b41229ef192741e868df5d4768ad8aeb81c8f79b299a44acf7&scene=58&subscene=0#rd) -- Social Engineering - - [Getting backstage at a concert](https://www.reddit.com/r/SocialEngineering/comments/u9foii/getting_backstage_at_a_concert/) - - [Intercourse with the Amish: How the Amish are Engineered into Society](https://www.reddit.com/r/SocialEngineering/comments/u91fhx/intercourse_with_the_amish_how_the_amish_are/) -- 安全威胁情报 - - [直播预告 | 工业互联网安全讲坛：威胁情报专题](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172118&idx=1&sn=431ca064f53adead94da8b18e6d157df&chksm=f448916ac33f187c4ff0aa4c2d6b7672d48b8cb4af437d4b30ccb6d26bc72f81a4f343662cf2&scene=58&subscene=0#rd) -- 青藤云安全 - - [青藤参与编写的《数据安全法》实施参考（第一版）发布](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650833969&idx=1&sn=f0777b1930b82498f9724a3f2f965a99&chksm=80dbe794b7ac6e82e6abc7d47f9175f4a7630d90cb2f300ebf331a7ade22a8c7d0cbbbb80e31&scene=58&subscene=0#rd) -- Yak Project - - [除了各种 DNSLog 之外还有得选吗？](https://mp.weixin.qq.com/s?__biz=MzAxOTAzOTU3Mw==&mid=2247487144&idx=1&sn=856289a0d30a3be0c24114a08539a7dc&chksm=9bcc5a92acbbd384e1e36c4fb4f97d9fee299ff8f48d4e9954f221cb56a13287c74a97aa0ea0&scene=58&subscene=0#rd) -- Paul's Security Weekly - - [ESW #270 - Dan Allen & Will Lin](http://podcast.securityweekly.com/esw-270-dan-allen-will-lin) - - [SWN #206 - Lemon Duck, Crypto Theft, Pwn2Own, Sinclair, Microsoft, & Google - Wrap Up](http://podcast.securityweekly.com/swn-206-lemon-duck-crypto-theft-pwn2own-sinclair-microsoft-google-wrap-up) -- Schneier on Security - - [Friday Squid Blogging: Squid Skin–Inspired Insulating Material](https://www.schneier.com/blog/archives/2022/04/friday-squid-blogging-squid-skin-inspired-insulating-material.html) - - [Java Cryptography Implementation Mistake Allows Digital-Signature Forgeries](https://www.schneier.com/blog/archives/2022/04/java-cryptography-implementation-mistake-allows-digital-signature-forgeries.html) -- 唯品会安全应急响应中心 - - [倒计时3天！6家SRC联合花式宠溺！抓紧冲吖~~~](https://mp.weixin.qq.com/s?__biz=MzI5ODE0ODA5MQ==&mid=2652280972&idx=1&sn=be84353bc1a873b8cb4e13562f4f6c32&chksm=f7487118c03ff80e2b89d7d34283f145302d222748213db5dc6595251741d2fa9a01a79d57cb&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [How to start pentesting Android Apps](https://www.reddit.com/r/HowToHack/comments/u9ph34/how_to_start_pentesting_android_apps/) - - [Hidden Data](https://www.reddit.com/r/HowToHack/comments/u97etm/hidden_data/) - - [Searching for volunteers for OSINT-related Ukrainian volunteer project.](https://www.reddit.com/r/HowToHack/comments/u94iqe/searching_for_volunteers_for_osintrelated/) - - [How do I use word list on Hashcat?](https://www.reddit.com/r/HowToHack/comments/u9hfv1/how_do_i_use_word_list_on_hashcat/) - - [So, I need some help. I have been trying to open a tcp listening port, but it keeps saying "Can't grab 0.0.0.0:53 with bind : Permission denied," and I don't know if there are other things than bind, so some help?](https://www.reddit.com/r/HowToHack/comments/u9gmp2/so_i_need_some_help_i_have_been_trying_to_open_a/) - - [Hacking/Modding a Minicom IV TTY/TDD device to be used for the deafblind?](https://www.reddit.com/r/HowToHack/comments/u93r2e/hackingmodding_a_minicom_iv_ttytdd_device_to_be/) - - [I have a a1474 ipad (2013) thats locked to a company email that no longer exists.](https://www.reddit.com/r/HowToHack/comments/u91xtt/i_have_a_a1474_ipad_2013_thats_locked_to_a/) -- 小米安全中心 - - [MiSRC 2022年1月荣誉榜单来啦！](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247513396&idx=1&sn=7e5a17aa20de3094ad0dcf535123676f&chksm=ea8393a1ddf41ab78e29ad17cd1da9894350cdba2eeab647ccdf91f0059995eca698961bf6ee&scene=58&subscene=0#rd) - - [MiSRC 2月荣誉榜单！](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247513396&idx=2&sn=46254153f9ddc018ced6ce4c1a43c179&chksm=ea8393a1ddf41ab707f5739b6a54948536f3a48cca92a86fb9cdc755b210b2a83790d7520015&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [漏洞马拉松·京麒站 | TSRC 3重奖励叠加，挖到就是赚到！](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727834682&idx=1&sn=8261edbbddd3e823e50cc6466f2c4354&chksm=8050a3b2b7272aa430de05df201daa829b5ef20597a7b98081af84f8136bcc7368d744448381&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [百度安全研究成果亮相 NDSS 2022](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537180&idx=1&sn=7e9fcead30f6745a12f7f3955d7eedf7&chksm=8bcba560bcbc2c763bbb957a3b11bea953bf79f8a22650c445e7aa3bb352daf2ade4ed7c7811&scene=58&subscene=0#rd) -- 锦行信息安全 - - [【漏洞预警】WSO2 API Manager安全漏洞](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489524&idx=1&sn=4d2a9c15924b23024fbdb266eb516e76&chksm=9799ec51a0ee6547bd28b8a6f7f367bb30df3172dbe322f57a88953a315c85975783cfc10a64&scene=58&subscene=0#rd) - - [【漏洞预警】Jira身份验证绕过漏洞](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489524&idx=2&sn=ab3f381c65ad078a6ed23ed15a647ec2&chksm=9799ec51a0ee654791261b6d1a91d50d580214c5f09f16a15c998f1df64c82656097f88747a8&scene=58&subscene=0#rd) -- Instapaper: Unread - - [Ma2Tl - macOS Forensic Timeline Generator Using The Analysis Result DBs Of Mac_Apt](http://www.kitploit.com/2022/04/ma2tl-macos-forensic-timeline-generator.html) - - [Long Article on NSO Group](https://www.schneier.com/blog/archives/2022/04/long-article-on-nso-group.html) - - [Been a long time coming, but now comes the second edition of the X-Ways Forensics Practitioner's Guide.](https://brettshavers.com/brett-s-blog/entry/x-ways-forensics-practitioner-s-guide-2e-xwf-2e-100-hour-book-launch) - - [Decrypting the ‘AVG’ Photo Vault](https://theincidentalchewtoy.wordpress.com/2022/02/23/decrypting-the-avg-photo-vault/) -- 雷神众测 - - [ntds.dit导出与利用总结](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652496787&idx=1&sn=07d630d15381898ffbd7db67cc471fa9&chksm=f2584020c52fc93689d6c5cd7100e81ffb60beaf05dc93b99d96067836f60f9cbf829db47d5d&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [提升行业安全水平，vivo于博鳌发布《数据保护合规趋势白皮书》](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247488154&idx=1&sn=43a924358002156a100a9c2b4e64bdcc&chksm=e9b934f6decebde02ba1001a3967dbe9f6539c9faea61593db8dbf97b51f4224aef7706c0688&scene=58&subscene=0#rd) -- 火线Zone - - [谷歌云 云数据库攻防，可造成数据库备份公开访问](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493910&idx=1&sn=b95b19863a70534d7322f5e904b24dba&chksm=eaa96136dddee8208f725ed307d4d80c5269a0908a90cc1d0cd3de51cd907f279875dd4f6ee1&scene=58&subscene=0#rd) - - [业务安全漏洞-登录认证实战总结（一）](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493910&idx=2&sn=4c56a52e2568c099253af96d1beef3c8&chksm=eaa96136dddee82096526b39e8eb718af2b44776a350187ba09e78a2c781edf30bcc369f76f1&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [死灰复燃！新型REvil勒索软件在野攻击活动分析](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247500578&idx=1&sn=e413849cf8569345a65e6fbc7fe63fa7&chksm=ea663455dd11bd437abaaeb5ec23c08ce6e2e1c4111e76deda08a49ce748a066187e0ef91a0c&scene=58&subscene=0#rd) - - [每周高级威胁情报解读(2022.04.14~04.21)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247500578&idx=2&sn=a2f09ebbe02d17191d80ba8083e73bca&chksm=ea663455dd11bd436a277cbc1e920efe3bf414936f31ed0d21d96fcd016e61a7d945dc1b807b&scene=58&subscene=0#rd) -- 360漏洞云 - - [漏洞复现|WSO2 API 远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496952&idx=1&sn=137656df8884c6bded6535b03e367bbc&chksm=ebe8086adc9f817c517d64fe3f0c3b576c9741dca146b5c076c53c5e8b8f6db052b1ba53ffb2&scene=58&subscene=0#rd) - - [高危 | JavaJDK ECDSA签名密钥缺陷](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247496952&idx=2&sn=446e803c3b21f7f2f9a10cf552d5bee1&chksm=ebe8086adc9f817cbb8831f5d9e602b2ba1a333b7bf83a31dd7e6adca1cdbe6d010dee46d196&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(04-22)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958374&idx=1&sn=f796e1aef7187674d8f8db1cfbc7963d&chksm=8baeccf9bcd945efc89a13a45a5a412de547e7d3f624b2f8045b2d88ff70a9b9858fb7be3966&scene=58&subscene=0#rd) -- Chaos Computer Club - last 100 events feed - - [10 Jahre Open Data in Österreich (glt22)](https://cdn.media.ccc.de/events/glt22/h264-hd/glt22-305-deu-10_Jahre_Open_Data_in_Oesterreich_hd.mp4) -- 默安玄甲实验室 - - [使用打印机漏洞获取Active Directory特权](https://mp.weixin.qq.com/s?__biz=MzkzNjI2MzgzOA==&mid=2247484287&idx=1&sn=927a489a3271eb3aa63a31b58f997edc&chksm=c2a02a8ef5d7a398e3c9d4b8ee37fd33c01130cb53bc135f99009b23b5f9dd387f2eecd967ba&scene=58&subscene=0#rd) -- 数世咨询 - - [混沌工程在DevSecOps中的价值](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492866&idx=1&sn=1ae7c0402ca0ef4b286c1e7991af01ac&chksm=c14497bff6331ea908b17eddfea686b0255b536e52b3f5bf2b05d790d4d95239b9c72b1604f3&scene=58&subscene=0#rd) - - [昂楷科技完成新一轮战略融资 由奇安信独家投资](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492866&idx=2&sn=18d28043f4bfb4b2272ce9cc97200b3e&chksm=c14497bff6331ea91842184f399a532370dc2556bb60ccd808af2adf0f0fde207a1b7e6b7d6d&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Apr.22th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495337&idx=1&sn=26a514fe8e563db8eae9509eb9e3591c&chksm=ce96a397f9e12a81782e58b4bd8d708d5414f79ae62d73e88bf7914e91da354772254bdf8109&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [重要通知 | 美团隐私漏洞处理标准1.0发布](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247489352&idx=1&sn=b9e728095c880831da1fca68f3c4f8bd&chksm=ec1bf69bdb6c7f8d1129ba8d7c2391e357a5adb76074a41a0477173703c3e3c5b5a0091bc926&scene=58&subscene=0#rd) -- 代码卫士 - - [Pwn2Own 2022迈阿密大赛落幕 去年春季赛冠军蝉联Master of Pwn](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511504&idx=1&sn=8b4fc83a50611faeb66599c8ede17787&chksm=ea949cbadde315ac262fa80134e5021adec56b55766b3f478081e48a1fbaa319f2d4431dcdb7&scene=58&subscene=0#rd) - - [开源组件11年未更新，严重漏洞使数百万安卓按设备易遭远程监控](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511504&idx=2&sn=04504363458ec7eae8089dbfb498d827&chksm=ea949cbadde315ac5c9bd2f40a6f192b3250198f157ae151d9aa59e0f29ce6b3f21dd2118763&scene=58&subscene=0#rd) - - [亚马逊的 Log4j 热补丁易受提权漏洞影响](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511504&idx=3&sn=db5e57652474eb1850d3b2b14ac08b7d&chksm=ea949cbadde315ac5a2e1ec42b1f22f41a109103847e4fd1d2ea90423d2291aaec360750ffa4&scene=58&subscene=0#rd) -- Threatpost - - [Zero-Trust For All: A Practical Guide](https://threatpost.com/zero-trust-guide/179377/) - - [Skeletons in the Closet: Security 101 Takes a Backseat to 0-days](https://threatpost.com/security-101-takes-a-backseat-to-0-days/179374/) -- Il Disinformatico - - [Podcast RSI - Come “hackerare” un satellite](http://attivissimo.blogspot.com/2022/04/podcast-rsi-come-hackerare-un-satellite.html) -- Security Affairs - - [Conti ransomware claims responsibility for the attack on Costa Rica](https://securityaffairs.co/wordpress/130505/cyber-crime/costa-rica-conti-ransomware.html) - - [Cyber Insurance and the Changing Global Risk Environment](https://securityaffairs.co/wordpress/130497/security/cyber-insurance-global-riskenvironment.html) - - [A stored XSS flaw in RainLoop allows stealing users’ emails](https://securityaffairs.co/wordpress/130488/hacking/unpatched-xss-rainloop.html) - - [QNAP firmware updates fix Apache HTTP vulnerabilities in its NAS](https://securityaffairs.co/wordpress/130481/hacking/qnap-nas-firmware-fix-apache-http-flaws.html) - - [Pwn2Own Miami hacking contest awarded $400,000 for 26 unique ICS exploits](https://securityaffairs.co/wordpress/130474/hacking/pwn2own-miami-2022.html) - - [Lemon_Duck cryptomining botnet targets Docker servers](https://securityaffairs.co/wordpress/130470/cyber-crime/lemon_duck-cryptomining-botnet-targets-docker.html) -- 火绒安全实验室 - - [【火绒安全周报】7-Zip被曝出现零日漏洞/黑客捐给乌克兰25万美元](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247502591&idx=1&sn=c919afebc098a9354907cb4211254d72&chksm=eb7014c0dc079dd692f3a2eb97d6f8a3815438a665040c06214d5c14a8e7bc397962ecb9240b&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【漏洞通告】Cisco Snort预处理拒绝服务漏洞 CVE-2022-20685](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650260538&idx=1&sn=b576ede084170157f5461b44ca4d8c8e&chksm=f3e27e4ec495f758dabe59bcb191727b2e208ab472a975689d7f7798c8ebbb0e12507025f29b&scene=58&subscene=0#rd) - - [【恶意文件通告】InnoStealer恶意文件分析](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650260538&idx=2&sn=989b2e507ecfd4ddcdeac07b5081a3f6&chksm=f3e27e4ec495f75887183cceb703ee78e08a0214653d5a165b1f25b76038c41d298dbc011997&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [最高检发布打击治理电信网络诈骗及关联犯罪典型案例](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525968&idx=1&sn=20bba9e34b0edc45ebc0137004aca294&chksm=c1e9ea01f69e631775abb53998f76833667bbbd29d9cd7b1dfef67a89cd87fa85e67aca6996f&scene=58&subscene=0#rd) - - [“五眼联盟”集体出动，制裁俄罗斯恶意网络活动](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525968&idx=2&sn=64a1861a163449fa99496b40a437c955&chksm=c1e9ea01f69e63176453cca370e477ee7ba1ec1ccae0689144127fde054b0f622b7ceda54574&scene=58&subscene=0#rd) - - [CISA 发出警告，攻击者正在利用Windows 漏洞](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247525968&idx=3&sn=2c381c96faee6f8aa16e51ab1ccf589f&chksm=c1e9ea01f69e6317d8388d564867644ebbd3d78ae0b1b0c4c3bf80e6a997c43074a69b047811&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [音乐研发必备：理解 MIDI 协议与标准 MIDI 文件格式](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247492778&idx=1&sn=97abaad1d4f1d16bf496e04e088a60b1&chksm=e9d32f48dea4a65e724a36c26f910fd8956f4b58cc20b084a9c3a62c0b2d0f42db64711df724&scene=58&subscene=0#rd) -- Hacking and security - - [Powershell script - get domain users with old passwords](https://hackingandsecurity.blogspot.com/2022/04/powershell-script-get-domain-users-with.html) - - [Powershell script - generate random password](https://hackingandsecurity.blogspot.com/2022/04/powershell-script-generate-random.html) - - [Powershell script - Windows folder permissions](https://hackingandsecurity.blogspot.com/2022/04/powershell-script-windows-folder.html) -- 中通安全应急响应中心 - - [【SRC联盟】倒计时3天！抓紧冲吖](https://mp.weixin.qq.com/s?__biz=MzUyMTcwNTY3Mg==&mid=2247485938&idx=1&sn=4a371c2ce7eb172b0623d6a51f3e0239&chksm=f9d64855cea1c143186a3cccdd7624d29cd22fdec9e399ea8b8572ae042d49cbe34110b2af31&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [Spock SLAF - A Shared Library Application Firewall "SLAF"](http://www.kitploit.com/2022/04/spock-slaf-shared-library-application.html) - - [Sub3Suite - A Free, Open Source, Cross Platform Intelligence Gathering Tool](http://www.kitploit.com/2022/04/sub3suite-free-open-source-cross.html) - - [Ecapture - Capture SSL/TLS Text Content Without CA Cert By eBPF](http://www.kitploit.com/2022/04/ecapture-capture-ssltls-text-content.html) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [The Illustrated QUIC Connection](https://www.reddit.com/r/netsecstudents/comments/u9fljn/the_illustrated_quic_connection/) - - [network traffic features extraction](https://www.reddit.com/r/netsecstudents/comments/u9i3as/network_traffic_features_extraction/) - - [Looking for email security demo ideas](https://www.reddit.com/r/netsecstudents/comments/u9kb60/looking_for_email_security_demo_ideas/) - - [Training course suggestions](https://www.reddit.com/r/netsecstudents/comments/u9fou0/training_course_suggestions/) - - [Error running Docker image of OWASP Benchmark](https://www.reddit.com/r/netsecstudents/comments/u9gm70/error_running_docker_image_of_owasp_benchmark/) - - [Kali machine is getting locked automatically](https://www.reddit.com/r/netsecstudents/comments/u98tfn/kali_machine_is_getting_locked_automatically/) -- 看雪学院 - - [NtSockets - 直接与驱动通信实现sockets](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438774&idx=1&sn=fe308f771ff6c7c349b4a70453fed392&chksm=b18ffcfc86f875ea6bf05961855de21ed662aa476dd3a5d47581e565cfa7e7da5523a42215bb&scene=58&subscene=0#rd) - - [高通和联发科的ALAC漏洞危及大部分安卓设备](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438774&idx=3&sn=e5d94463064262334583c5caee474426&chksm=b18ffcfc86f875eafe793605f52ec72b46e35381dc2abc0a0771d7eb51ba22af8da23b5bd6ad&scene=58&subscene=0#rd) - - [看雪招聘 | 超强Offer浪潮来袭！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438774&idx=4&sn=974453f90a668faa588045a8b2016ecf&chksm=b18ffcfc86f875eaa5fcbe762fe4afe9aeacf29936f285757786e4951cdf10721bd0b6765d52&scene=58&subscene=0#rd) - - [想要无坚不摧？快来学习《Web安全编程入门》吧！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438774&idx=5&sn=7b7cdcf193b87116baab50c4ecf41196&chksm=b18ffcfc86f875ea30e44fb46cdca012ec5b56a7dd05dfc06d5ebb82369781b36d3718a02ac9&scene=58&subscene=0#rd) -- 百度安全实验室 - - [百度安全研究成果亮相 NDSS 2022](https://mp.weixin.qq.com/s?__biz=MzA3NTQ3ODI0NA==&mid=2247486619&idx=1&sn=c3519e666fa073cf25c3f1cef53f96d0&chksm=9f6ea910a8192006f8902c7af24f0a5e3d0640d47657514d2def6403335019c98ee92bc1ace6&scene=58&subscene=0#rd) -- Krebs on Security - - [Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code](https://krebsonsecurity.com/2022/04/leaked-chats-show-lapsus-stole-t-mobile-source-code/) -- 火线安全平台 - - [调研、改造、实践：洞态IAST在陌陌的应用](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247490814&idx=1&sn=edbf7f43793bee679e899ef614efd74c&chksm=fdbc3555cacbbc437a9c8111dddad4d7076c77a68e2e70584038818f6ac70db01fe56aa72879&scene=58&subscene=0#rd) - - [新项目丨Keep 安全应急响应中心入驻火线企业SRC啦~](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247490814&idx=2&sn=4915093cd101f09f18a6ddf97039f996&chksm=fdbc3555cacbbc4356d58f78aea5fd0b7ec321208047c2e571c6d4593998ac743637fdaeb62b&scene=58&subscene=0#rd) - - [新项目丨好大夫安全测试项目上线火线啦~](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247490814&idx=3&sn=3304e4a9722520d7f7a8d9997fb56e1d&chksm=fdbc3555cacbbc432748f8e572bf99ed8daee8ac1440be12bbcc6a84550cecc835a6e4cfd096&scene=58&subscene=0#rd) -- 安全客 - - [数字化靶场的未来方向](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769539&idx=1&sn=2e82d79a430650ed9b934c1b7bda42f1&chksm=8893762cbfe4ff3a9f1386dfe267e4869ea8508ff46b280f21423c02c1475539b4524642dff2&scene=58&subscene=0#rd) - - [【安全头条】REvil的TOR网站活跃起来，可以重定向到新的勒索软件操作](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769539&idx=2&sn=9ca7342f7e6427273e83132052f35b53&chksm=8893762cbfe4ff3a6e0c79c4c6c1cc5cc4e0d5457de2e8668bb8e6a342e935f52ba560be4ee5&scene=58&subscene=0#rd) - - [【技术分享】PHP7.1后webshell免杀的去路](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769539&idx=3&sn=cd55422d79b0a52287e5cf7fa6cbe035&chksm=8893762cbfe4ff3acc8359c311f6f548fb0a18c215a8a974539516eef3df519b3b66d5985430&scene=58&subscene=0#rd) -- 安全牛 - - [牛聘 | 2022年度岗位招聘第11期](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112489&idx=1&sn=ff49935dd0c4d5934a63322a91dbe132&chksm=bd1474fa8a63fdec4789054acc446f92e1840da44c0fc363ea2be61f58bd48938e6f3b77f1b7&scene=58&subscene=0#rd) - - [ESG调查：不能靠支付赎金解决勒索问题！](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112488&idx=1&sn=8484d61d3e24e6b4edb4dffd69d3909b&chksm=bd1474fb8a63fded952d2fb9c8bd7f58c57e026455fe8cad22f58a1f443eb092f2ca6d99acf9&scene=58&subscene=0#rd) - - [实现人与“人”的对抗：常用AI安全工具盘点](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112488&idx=2&sn=489e3405d7a72e64b96c0bd210c4188e&chksm=bd1474fb8a63fdedf9fb2b98419ae9c4ff3ffc15664a510d2cba1b224c6ad0c5d3403c60ccab&scene=58&subscene=0#rd) - - [2022年线上保险业务风险研究](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112488&idx=3&sn=3202e888bba2e9b1c435b0bffd7efb66&chksm=bd1474fb8a63fded70e2ed9f85b5e0a4056ccea017731c2d3fca76adb1b1590558fbe964f347&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [每周勒索威胁摘要](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247489574&idx=1&sn=19eb99f714a271dad41ac0cd2a0f4e7c&chksm=ec6a680edb1de1187bd9d89cd60f33f14c17a4a9c8faa6d4c911c0ad539b02617c64e697333c&scene=58&subscene=0#rd) -- 互联网安全内参 - - [数据交易危害国家安全！多家中介公司公开叫卖美军人员信息](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502551&idx=1&sn=10af3aa024ed3eb3fbd606b44e1127ea&chksm=ebfa8df7dc8d04e183a30ec9c5c0bbf261aeb956e163cb05ae5cf67d4437b55e0d0aa6b77f7c&scene=58&subscene=0#rd) - - [高通和联发科芯片漏洞致数百万安卓设备可被远程监控](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502551&idx=2&sn=0c04998e9088f9d84c07df4bd38abf2c&chksm=ebfa8df7dc8d04e1d983793aa0db2dfc5a4e025a85fb98a399bd6cc890d6eb88cb6821b00609&scene=58&subscene=0#rd) - - [为期半年！邮政快递领域个人信息安全治理专项行动启动](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502551&idx=3&sn=748adb5d2a09399a9d277c2611e7fcb5&chksm=ebfa8df7dc8d04e1a9f791fc13e0702645ae5a6f14737d32c87f9d815219198e3aab135d38f2&scene=58&subscene=0#rd) - - [最高检发布电信网络诈骗典型案例：公民个人信息已成为相关犯罪的“基本物料”](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502551&idx=4&sn=692bee004b6b5c0d0d7ef59336d7b8d8&chksm=ebfa8df7dc8d04e1d2b1e2bb575ef5b8f17613b0de473c25a8d0f805b754a9baf10dc3c9c70b&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [The Illustrated QUIC Connection](https://www.reddit.com/r/netsec/comments/u9fip1/the_illustrated_quic_connection/) - - [No Hardware, No Problem: Emulation and Exploitation](https://www.reddit.com/r/netsec/comments/u9kllo/no_hardware_no_problem_emulation_and_exploitation/) - - [Null ECDSA Signatures - Proof of concept for bypassing JWT signature checks using CVE-2022-21449](https://www.reddit.com/r/netsec/comments/u97dgz/null_ecdsa_signatures_proof_of_concept_for/) - - [WSO2 RCE (CVE-2022-29464) exploit and writeup](https://www.reddit.com/r/netsec/comments/u9f88r/wso2_rce_cve202229464_exploit_and_writeup/) - - [Hardware Security Talks Announced! Hardwear.io](https://www.reddit.com/r/netsec/comments/u9auxc/hardware_security_talks_announced_hardweario/) - - [Abusing Azure Container Registry Tasks from Specter-Ops](https://www.reddit.com/r/netsec/comments/u989zz/abusing_azure_container_registry_tasks_from/) -- CNCERT风险评估 - - [每周典型移动恶意APP安全监测报告--“Android勒索类病毒”篇（2022-04-11-2022-04-17）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496341&idx=1&sn=c76143a1e35dfe14da5be3f579f7a901&chksm=973ac1f7a04d48e1d778f51389e5d9f68bde3853cbf39e67366f27c9c9598c3be62cf93df850&scene=58&subscene=0#rd) -- M01NTeam - - [每周蓝军技术推送（2022.4.16-4.22）](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247487804&idx=1&sn=2e80dea43031f8d86fca2b7b88801060&chksm=c187d12df6f0583b8c86cfdaa9d8eb8485d909f8bbfc4ee057fb3a6d2b4f3b40254981235f56&scene=58&subscene=0#rd) - - [攻防有道｜获奖名单公布](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247487804&idx=2&sn=a73f1057b3e43ac8fbfbd413dbe6ae28&chksm=c187d12df6f0583b3eaa221643af4e15879b0656b6efd002d4e83bd18ba160a17694d71b7160&scene=58&subscene=0#rd) -- 威努特工控安全 - - [多个关键信息基础设施领域遭窃密，大量数据传至境外](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651083686&idx=1&sn=e953eb03cc5f06b4e6d3a8dd09061196&chksm=80e64916b791c0004a317df8e7a598e94302691bc59a057249303842c959822e76f2feb28344&scene=58&subscene=0#rd) -- 博客园 - 郑瀚Andrew.Hann - - [《娄向鹏看世界农业》笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16172621.html) -- 三六零CERT - - [安全日报（2022.04.22）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247490904&idx=1&sn=47da436c4143c4649faf0728fc70ef7e&chksm=fe251859c952914f0a6e887a9c91d93fe199fce178b72232b439e5fe7e21d608595a9da0cbc8&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-04-24.md b/archive/2022/2022-04-24.md deleted file mode 100644 index fb3622f436..0000000000 --- a/archive/2022/2022-04-24.md +++ /dev/null @@ -1,106 +0,0 @@ -# 每日安全资讯（2022-04-24） - -- HackerOne Hacker Activity - - [Renderers can obtain access to random bluetooth device without permission](https://hackerone.com/reports/1519099) - - [Attacker can bypass authentication build on ingress external auth (`nginx.ingress.kubernetes.io/auth-url`)](https://hackerone.com/reports/1357948) -- Sploitus.com Exploits RSS Feed - - [Exploit for Code Injection in Vmware Spring Framework exploit](https://sploitus.com/exploit?id=C6653FFB-B7A6-54D8-83C9-300A13AC41F4&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Privilege Management in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=A4BF4F4E-CCDE-55B8-B08B-B8F25BE163D7&utm_source=rss&utm_medium=rss) -- Sec-News 安全文摘 - - [解决哥斯拉内存马 pagecontext 的问题](https://wiki.ioin.in/url/8nMo) -- Security Boulevard - - [OWASP® Global AppSec US 2021 Virtual – Akriti Srivastava’s ‘Azure Vulnerability Testbed (AzGOAT)’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-akriti-srivastavas-azure-vulnerability-testbed-azgoat/) - - [CommitStrip ‘Trolling The AI’](https://securityboulevard.com/2022/04/commitstrip-trolling-the-ai/) - - [OWASP® Global AppSec US 2021 Virtual – Alexei Kojenov’s ‘Outside The Box: Pwning IoT Devices Through Their Applications’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-alexei-kojenovs-outside-the-box-pwning-iot-devices-through-their-applications/) - - [Zscaler ThreatLabz Discovers Multiple Product Bugs in Adobe Acrobat](https://securityboulevard.com/2022/04/zscaler-threatlabz-discovers-multiple-product-bugs-in-adobe-acrobat/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Watch Queue Out-Of-Bounds Write](https://cxsecurity.com/issue/WLB-2022040091) - - [EaseUS Data Recovery ensserver.exe Unquoted Service Path](https://cxsecurity.com/issue/WLB-2022040090) - - [Easy Appointments 1.4.2 Information Disclosure](https://cxsecurity.com/issue/WLB-2022040089) - - [ManageEngine ADSelfService Plus Custom Script Execution](https://cxsecurity.com/issue/WLB-2022040088) -- FreeBuf网络安全行业门户 - - [问题频频，盘点近期特斯拉所经历的“网安事故”](https://www.freebuf.com/news/330752.html) -- obaby@mars - - [Ida Pro 7.5 Kegen 教程](http://h4ck.org.cn/2022/04/ida-pro-7-5-kegen-%e6%95%99%e7%a8%8b/) -- Didier Stevens - - [Update: re-search.py Version 0.0.19](https://blog.didierstevens.com/2022/04/23/update-re-search-py-version-0-0-19/) -- Reverse Engineering - - [How We Fuzzed Microsoft Defender for IoT and Found Multiple Vulnerabilities](https://www.reddit.com/r/ReverseEngineering/comments/ua6pub/how_we_fuzzed_microsoft_defender_for_iot_and/) - - [The Making of “Reverse Engineering the NES”](https://www.reddit.com/r/ReverseEngineering/comments/uaawaf/the_making_of_reverse_engineering_the_nes/) - - [Reverse Engineers' Hex Editor 0.5.0](https://www.reddit.com/r/ReverseEngineering/comments/ua9m92/reverse_engineers_hex_editor_050/) -- MalwareTech - - [[Video] Exploiting Windows RPC – CVE-2022-26809 Explained | Patch Analysis](https://www.malwaretech.com/2022/04/video-exploiting-windows-rpc-cve-2022-26809-explained-patch-analysis.html) -- Data Breach - - [T-Mobile confirms Lapsus$ had access its systems](https://securityaffairs.co/wordpress/130530/data-breach/t-mobile-revealed-lapsus-access.html) -- 黑海洋 - WIKI - - [宝塔系统7.9企业版破解版](https://blog.upx8.com/2729) - - [全网最全最新Fiddler抓包实战教程](https://blog.upx8.com/2728) - - [SS一键脚本](https://blog.upx8.com/2727) - - [Choc Clash for IOS 客户端下载使用教程](https://blog.upx8.com/2726) - - [关于 Telegram(电报) 的下载使用与中文汉化](https://blog.upx8.com/2725) - - [OpenWrt 安装 iKoolProxy 滤广告插件使用教程](https://blog.upx8.com/2724) - - [OpenWrt 正确编译 SSRplus 与 Passwall 的方法](https://blog.upx8.com/2723) - - [OpenWrt 安装完整管理界面中文语言包](https://blog.upx8.com/2722) - - [OpenWrt 无法安装 block-mount 挂载点的解决办法](https://blog.upx8.com/2721) -- Arturo Di Corinto - - [Gli alleati dell’Ucraina sono a rischio cyberwar, avvertono i Five Eyes](https://dicorinto.it/testate/repubblica-it/gli-alleati-dellucraina-sono-a-rischio-cyberwar-avvertono-i-five-eyes/) -- Il Disinformatico - - [DragonChase 2022: lancio Crew-4 rinviato ancora a non prima del 27 aprile](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-lancio-crew-4-rinviato.html) -- 奇客Solidot–传递最新科技情报 - - [Ross Ulbricht 的 183M 美元罚款已经还清](https://www.solidot.org/story?sid=71334) - - [科学家重启大强子对撞机](https://www.solidot.org/story?sid=71333) - - [机智号火星直升机首飞一周年](https://www.solidot.org/story?sid=71332) -- 颖奇L'Amore - - [我的MacOS上一些好用的软件（集合）](https://www.gem-love.com/2022/04/23/%E6%88%91%E7%9A%84MacOS%E4%B8%8A%E4%B8%80%E4%BA%9B%E5%A5%BD%E7%94%A8%E7%9A%84%E8%BD%AF%E4%BB%B6/) - - [QSpace Pro: MacOS自带Finder的史诗级增强](https://www.gem-love.com/2022/04/23/QSpace-Pro-MacOS%E8%87%AA%E5%B8%A6Finder%E7%9A%84%E5%8F%B2%E8%AF%97%E7%BA%A7%E5%A2%9E%E5%BC%BA/) - - [Alfred 4: MacOS效率提升大杀器（下篇）](https://www.gem-love.com/2022/04/23/Alfred-4-MacOS%E6%95%88%E7%8E%87%E6%8F%90%E5%8D%87%E5%A4%A7%E6%9D%80%E5%99%A8-%E4%B8%8B%E7%AF%87/) - - [Alfred 4: MacOS效率提升大杀器（上篇）](https://www.gem-love.com/2022/04/23/Alfred-4-MacOS%E6%95%88%E7%8E%87%E6%8F%90%E5%8D%87%E5%A4%A7%E6%9D%80%E5%99%A8/) -- SANS Internet Storm Center, InfoCON: green - - [Are Roku Streaming Devices Safe from Exploitation?, (Sat, Apr 23rd)](https://isc.sans.edu/diary/rss/28578) -- Security Affairs - - [T-Mobile confirms Lapsus$ had access its systems](https://securityaffairs.co/wordpress/130530/data-breach/t-mobile-revealed-lapsus-access.html) - - [Are you using Java 15/16/17 or 18 in production? Patch them now!](https://securityaffairs.co/wordpress/130522/security/poc-java-vulnerability-cve-2022-21449.html) - - [Phishing attacks using the topic “Azovstal” targets entities in Ukraine](https://securityaffairs.co/wordpress/130515/cyber-warfare-2/ukraine-cert-warns-azovstal-themed-phishing.html) -- Your Hacking Tutorial by Zempirians - - [About 64,000 possible solutions on a combination lock taken down to 40 using a side channel attack. Here is how to do it.](https://www.reddit.com/r/HowToHack/comments/u9ykwv/about_64000_possible_solutions_on_a_combination/) - - [RAT Bypassing Windows defender](https://www.reddit.com/r/HowToHack/comments/ua9iyk/rat_bypassing_windows_defender/) - - [Restricted access on domain and trying to elevate rights](https://www.reddit.com/r/HowToHack/comments/ua8155/restricted_access_on_domain_and_trying_to_elevate/) - - [MITM](https://www.reddit.com/r/HowToHack/comments/ua6jje/mitm/) - - [How to get into hacking/coding](https://www.reddit.com/r/HowToHack/comments/u9vsuh/how_to_get_into_hackingcoding/) - - [What's up with https://academy.zempirians.com/?](https://www.reddit.com/r/HowToHack/comments/ua60wc/whats_up_with_httpsacademyzempirianscom/) - - [My metasploit shells hang after connecting](https://www.reddit.com/r/HowToHack/comments/ua5nha/my_metasploit_shells_hang_after_connecting/) - - [Noob: hashcat question](https://www.reddit.com/r/HowToHack/comments/u9w1he/noob_hashcat_question/) - - [Multiple rar file hash](https://www.reddit.com/r/HowToHack/comments/u9uojl/multiple_rar_file_hash/) -- MalwareTech - - [[Video] Exploiting Windows RPC – CVE-2022-26809 Explained | Patch Analysis](https://www.malwaretech.com/2022/04/video-exploiting-windows-rpc-cve-2022-26809-explained-patch-analysis.html) -- Full Disclosure - - [[AIT-SA-20220208-01] SexyPolling SQL Injection](https://seclists.org/fulldisclosure/2022/Apr/40) - - [CVE-2021-40680: Artica Proxy VMWare Appliance 4.30.000000 <=[SP273] Rev.1](https://seclists.org/fulldisclosure/2022/Apr/39) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [SANS 401 Indexing Help/Question](https://www.reddit.com/r/netsecstudents/comments/uaefed/sans_401_indexing_helpquestion/) - - [Android apk root detection in Genymotion?](https://www.reddit.com/r/netsecstudents/comments/ua4s3h/android_apk_root_detection_in_genymotion/) -- GeekPwn - - [世界读书日｜安全极客在读什么书？](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650344343&idx=1&sn=71bdfbb5582aef4ac523eb0c3987d4ba&chksm=8740b052b03739444fd51cd1446fa66148f517a40dd2b5679a714b38b013905829775be046ba&scene=58&subscene=0#rd) -- Daniel Miessler - - [Removing ^M Characters](https://danielmiessler.com/blog/removing-m-characters/) -- /r/netsec - Information Security News & Discussion - - [Writing a zero findings pentest report](https://www.reddit.com/r/netsec/comments/uaa5kn/writing_a_zero_findings_pentest_report/) - - [Are vulnerability scores misleading you? Understanding CVSS severity and using them effectively](https://www.reddit.com/r/netsec/comments/u9zjsb/are_vulnerability_scores_misleading_you/) - - [Cliam: better cloud agnostic IAM permissions enumerator. Covers AWS and GCP, but more to come!](https://www.reddit.com/r/netsec/comments/u9u94b/cliam_better_cloud_agnostic_iam_permissions/) -- The Register - Security - - [Now Mandiant says 2021 was a record year for exploited zero-day security bugs](https://go.theregister.com/feed/www.theregister.com/2022/04/23/zeroday_exploits_2021/) -- TorrentFreak - - [IPTV, Usenet and Comic Book Pirates Agree To Pay Up and Shut Down](https://torrentfreak.com/iptv-usenet-and-comic-book-pirates-agree-to-pay-up-and-shut-down-220423/) -- 情报分析师 - - [珍贵资料：《人工智能在军事上的应用》专业合集|附音频](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650498067&idx=1&sn=6daac3c4c1dca23d4679f5415050e2b1&chksm=87164a58b061c34e886c2371cc1af60922356cb54cf09b6bf1b2b704c215ab57689a67f0585a&scene=58&subscene=0#rd) - - [AI 在开源情报（OSINT）中的作用](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650498067&idx=2&sn=4833f4eefcfce762463a6e617b08be59&chksm=87164a58b061c34e78726718b5adc7f67066ba140e96e000130856f059291701abbffeb7cd5b&scene=58&subscene=0#rd) -- Social Engineering - - [how do you get someone to tell you about their favorite memories?](https://www.reddit.com/r/SocialEngineering/comments/uafg3b/how_do_you_get_someone_to_tell_you_about_their/) -- 0xFFFF@blog:~$ - - [Technique of the week: Log Forgery](https://blog.0xffff.info/2022/04/23/technique-of-the-week-log-forgery/) -- Blackhat Library: Hacking techniques and research - - [Magic-trace – High-resolution traces of what a process is doing](https://www.reddit.com/r/blackhat/comments/u9x9i3/magictrace_highresolution_traces_of_what_a/) -- 看雪学院 - - [分析一个安卓简单CrackMe](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438809&idx=1&sn=4fd83190abdbe0286b0912dc3380c348&chksm=b18ffc1386f87505c0a2600f6afddf6d3db2945bc07391e05aa5660cfa0ca9b379f4be21e367&scene=58&subscene=0#rd) - - [2022 KCTF春季赛防守方征题中！5月10日开赛～](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438809&idx=2&sn=00ec849746a7a53d46bfeb3d3f8c0c85&chksm=b18ffc1386f87505f5bc7edba0a8859aaf7866a249cc3f5f694e79bf5f62f462c270ed0cffc3&scene=58&subscene=0#rd) - - [Intel CPU漏洞研究，为你深入详解三个史诗级的芯片漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458438809&idx=3&sn=22897f7a006bea015f9615c487f59204&chksm=b18ffc1386f8750558ca8484f7436d52d56390a5317b419b63a1199fe1ea19d5b858f3c29ff0&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-04-26.md b/archive/2022/2022-04-26.md deleted file mode 100644 index 3bad976615..0000000000 --- a/archive/2022/2022-04-26.md +++ /dev/null @@ -1,295 +0,0 @@ -# 每日安全资讯（2022-04-26） - -- HackerOne Hacker Activity - - [Local file disclosure through SSRF at next.nutanix.com](https://hackerone.com/reports/471520) - - [Force User to Accept Attacker's invite [ Restrict user to create account]](https://hackerone.com/reports/1420070) - - [Visibility Robots.txt file](https://hackerone.com/reports/1450014) - - [Xss triggered in Your-store.myshopify.com/myshopify.com/admin/apps/shopify-email/editor/****](https://hackerone.com/reports/1472471) - - [CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 comparison disaster](https://hackerone.com/reports/1549435) - - [CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 bypass if string not 32 chars](https://hackerone.com/reports/1549461) -- Tenable Blog - - [Test Your Hacking Skills: Join Tenable’s Annual CTF Competition!](https://www.tenable.com/blog/test-your-hacking-skills-join-tenables-annual-ctf-competition) -- Microsoft Security Blog - - [Microsoft best practices for managing IoT security concerns](https://www.microsoft.com/security/blog/2022/04/25/microsoft-best-practices-for-managing-iot-security-concerns/) -- Trustwave Blog - - [Trustwave Recognized in Gartner’s 2022 Market Guide for Managed Security Services](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-recognized-in-gartners-2022-market-guide-for-managed-security-services/) -- Files ≈ Packet Storm - - [Joomla Sexy Polling 2.1.7 SQL Injection](https://packetstormsecurity.com/files/166821/AIT-SA-20220208-01.txt) - - [WordPress ScrollReveal.js Effects 1.1.1 Cross Site Scripting](https://packetstormsecurity.com/files/166820/wpsrjs111-xss.txt) -- Security Boulevard - - [Register for the Bankrupting Fraud Virtual Panel Series 2022 to Collaborate Fearlessly and Eliminate Fraud](https://securityboulevard.com/2022/04/register-for-the-bankrupting-fraud-virtual-panel-series-2022-to-collaborate-fearlessly-and-eliminate-fraud/) - - [Application Programming Interfaces (APIs): The Soft Underbelly of Zero Trust](https://securityboulevard.com/2022/04/application-programming-interfaces-apis-the-soft-underbelly-of-zero-trust/) - - [OWASP® Global AppSec US 2021 Virtual – Pedro Fortuna’s & Jasvir Nagra’s ‘Bots Have Gone Phishing, But All They Get Is The Boot’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-pedro-fortunas-jasvir-nagras-bots-have-gone-phishing-but-all-they-get-is-the-boot/) - - [6 Steps in 60 Days to FAIR Quantitative Risk Management](https://securityboulevard.com/2022/04/6-steps-in-60-days-to-fair-quantitative-risk-management/) - - [Get Deep Detection and Risk Insights with Arkose Detect](https://securityboulevard.com/2022/04/get-deep-detection-and-risk-insights-with-arkose-detect/) - - [Bravo, Thoma Bravo](https://securityboulevard.com/2022/04/bravo-thoma-bravo/) - - [New Chinese Poems Naturally Express Frustration and Dissent](https://securityboulevard.com/2022/04/new-chinese-poems-naturally-express-frustration-and-dissent/) -- Sploitus.com Exploits RSS Feed - - [Joomla Sexy Polling 2.1.7 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37664&utm_source=rss&utm_medium=rss) - - [WordPress ScrollReveal.js Effects 1.1.1 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37663&utm_source=rss&utm_medium=rss) - - [Joomla Sexy Polling 2.1.7 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166821&utm_source=rss&utm_medium=rss) - - [WordPress ScrollReveal.js Effects 1.1.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:166820&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Gerapy exploit](https://sploitus.com/exploit?id=AACF9C93-6E7C-50C6-B3B0-AB270B95B710&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Djangoproject Django exploit](https://sploitus.com/exploit?id=9F50AAE5-3EA3-5804-A040-09FE1281C2FB&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-2333 exploit](https://sploitus.com/exploit?id=2200D285-98A8-564F-944C-F7EC639E6FDD&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=63FE351E-F353-5ECF-A2FF-E425A0A9E6AB&utm_source=rss&utm_medium=rss) - - [Exploit for Incorrect Authorization in Microsoft exploit](https://sploitus.com/exploit?id=516883FF-25B0-5E12-9FA2-038E48B62C0E&utm_source=rss&utm_medium=rss) -- The DFIR Report - - [Quantum Ransomware](https://thedfirreport.com/2022/04/25/quantum-ransomware/) -- 跳跳糖 - 安全与分享社区 - - [CodeQL能找到log4shell(CVE-2021-44228)漏洞吗？](https://tttang.com/archive/1570/) -- ArthurChiao's Blog - - [[译] BPF ring buffer：使用场景、核心设计及程序示例（2020）](https://arthurchiao.github.io/blog/bpf-ringbuf-zh/) -- Exodus Intelligence - - [Exodus Wants to help CISA Shields Up](https://blog.exodusintel.com/2022/04/25/exodus-wants-to-help-cisa-shields-up/?utm_source=rss&utm_medium=rss&utm_campaign=exodus-wants-to-help-cisa-shields-up) -- FreeBuf网络安全行业门户 - - [中央网信办等三部门印发《深入推进IPv6规模部署和应用2022年工作安排》](https://www.freebuf.com/news/331180.html) - - [谷歌Project Zero报告披露2021年0-day漏洞利用全球趋势](https://www.freebuf.com/vuls/331078.html) - - [借由Hack DHS计划，美国国土安全部系统发现了122个安全漏洞](https://www.freebuf.com/news/331076.html) - - [2021年网络与数据安全法规、政策、国标、报告大合集](https://www.freebuf.com/articles/paper/331045.html) - - [FreeBuf早报 | 匿名者累计泄露俄罗斯5.8TB数据；安全漏洞创纪录增长](https://www.freebuf.com/articles/330800.html) - - [从欧洲“超算”被黑事件，重新审视和思考威胁情报的价值](https://www.freebuf.com/articles/network/241227.html) - - [Atlassian解决了一个关键的Jira身份验证绕过漏洞](https://www.freebuf.com/news/330970.html) - - [Java加密漏洞PoC代码公开，受影响的版本需尽快升级](https://www.freebuf.com/news/330953.html) - - [对俄罗斯宣战以来，匿名者累计泄露5.8TB数据](https://www.freebuf.com/news/330955.html) - - [哥斯达黎加国家财政系统遭勒索攻击：税务海关停摆](https://www.freebuf.com/news/330941.html) - - [OSSIM平台网络日志关联分析实战](https://www.freebuf.com/articles/network/329752.html) -- Envato Tuts+ Code - Mobile Development - - [Mobile Development Languages](https://code.tutsplus.com/articles/mobile-development-languages--cms-29138) -- 绿盟科技技术博客 - - [工业“军刀”出鞘 警惕“软战争”外挂](http://blog.nsfocus.net/incon-code/) -- Forcepoint - - [SWG: The Third Key Component of an SSE Platform](https://www.forcepoint.com/blog/insights/swg-key-component-sse-platform) -- bunnie's blog - - [Name that Ware, April 2022](https://www.bunniestudios.com/blog/?p=6367) - - [Winner, Name that Ware March 2022](https://www.bunniestudios.com/blog/?p=6365) -- blog.avast.com EN - - [Newest State Data Privacy Legislation | Avast](https://blog.avast.com/newest-data-privacy-legislation) - - [Journey Into The Metaverse | Avast](https://blog.avast.com/journey-into-the-metaverse) -- SentinelOne - - [Defending the Enterprise Against Digital Supply Chain Risk in 2022](https://www.sentinelone.com/blog/defending-the-enterprise-against-digital-supply-chain-risk-in-2022/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-04-25 - Emotet epoch4 activity (LNK files)](https://www.malware-traffic-analysis.net/2022/04/25/index.html) -- Securelist - - [DDoS attacks in Q1 2022](https://securelist.com/ddos-attacks-in-q1-2022/106358/) -- The Daily Swig | Cybersecurity news and views - - [IBM database updates address critical vulnerabilities in third-party XML parser](https://portswigger.net/daily-swig/ibm-database-updates-address-critical-vulnerabilities-in-third-party-xml-parser) - - [OT security coalition aims to bolster industrial cybersecurity](https://portswigger.net/daily-swig/ot-security-coalition-aims-to-bolster-industrial-cybersecurity) -- KitPloit - PenTest & Hacking Tools - - [Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer](http://www.kitploit.com/2022/04/wpgarlic-proof-of-concept-wordpress.html) - - [DDexec - A Technique To Run Binaries Filelessly And Stealthily On Linux Using Dd To Replace The Shell With Another Process](http://www.kitploit.com/2022/04/ddexec-technique-to-run-binaries.html) -- Malwarebytes Labs - - [Watch out for this SMS phish promising a tax refund](https://blog.malwarebytes.com/scams/2022/04/steer-clear-of-this-sms-tax-refund-phish/) - - [Why software has so many vulnerabilities, with Tanya Janca: Lock and Code S03E09](https://blog.malwarebytes.com/podcast/2022/04/why-our-software-has-so-many-vulnerabilities-with-tanya-janca-lock-and-code-s03e09/) - - [Apple’s child safety features are coming to a Messages app near you](https://blog.malwarebytes.com/cybercrime/privacy/2022/04/apples-child-safety-features-are-coming-to-a-messages-app-near-you/) - - [Why MITRE matters to SMBs](https://blog.malwarebytes.com/business-2/2022/04/why-mitre-matters-to-smbs/) - - [A week in security (April 18 – 24)](https://blog.malwarebytes.com/a-week-in-security/2022/04/a-week-in-security-april-18-24/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 4/25/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-4-25-2022/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/ubf0r3/rreverseengineerings_weekly_questions_thread/) - - [Reverse Engineering Dust: Game Locations and Map Layout](https://www.reddit.com/r/ReverseEngineering/comments/ubp6rr/reverse_engineering_dust_game_locations_and_map/) -- Secureworks Blog - - [Why the Buzz on XDR Solutions?](https://www.secureworks.com/blog/why-the-buzz-on-xdr-solutions) -- 博客园 - 郑瀚Andrew.Hann - - [《品牌革命: 从田间到餐桌的食品品牌革命》笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16181404.html) -- NETRESEC Network Security Blog - - [Industroyer2 IEC-104 Analysis](https://www.netresec.com/?page=Blog&month=2022-04&post=Industroyer2-IEC-104-Analysis) -- Forensic Focus - - [DFRWS-EU 2022: The Future of Digital Forensics Is Now](https://www.forensicfocus.com/articles/dfrws-eu-2022-the-future-of-digital-forensics-is-now/) - - [How Atola TaskForce’s New Logical Imaging Module Speeds Up Your Investigation](https://www.forensicfocus.com/news/how-atola-taskforces-new-logical-imaging-module-speeds-up-your-investigation/) -- JUMPSEC - - [FUTURE PROOF YOUR CYBER DEFENCES TO DRIVE INCREMENTAL IMPROVEMENT](https://www.jumpsec.com/2022/04/25/future-proof-your-cyber-defences/) -- Securityinfo.it - - [Lo scraping dei dati pubblici resta legale](https://www.securityinfo.it/2022/04/25/lo-scraping-dei-dati-pubblici-resta-legale-negli-usa/?utm_source=rss&utm_medium=rss&utm_campaign=lo-scraping-dei-dati-pubblici-resta-legale-negli-usa) - - [Credenziali a rischio con la chiave SSH predefinita di Cisco Umbrella](https://www.securityinfo.it/2022/04/25/credenziali-a-rischio-con-la-chiave-ssh-predefinita-di-cisco-umbrella/?utm_source=rss&utm_medium=rss&utm_campaign=credenziali-a-rischio-con-la-chiave-ssh-predefinita-di-cisco-umbrella) -- 奇客Solidot–传递最新科技情报 - - [Overgrowth 开源](https://www.solidot.org/story?sid=71356) - - [无人机更快的为卢旺达运送血液](https://www.solidot.org/story?sid=71355) - - [体育成为中小学主科](https://www.solidot.org/story?sid=71354) - - [Google Pixel Watch 原型遗落在餐馆内](https://www.solidot.org/story?sid=71353) - - [研究发现超级细菌艰难梭菌可在猪和人之间传播](https://www.solidot.org/story?sid=71352) - - [AI 如何加剧巴西的种族主义](https://www.solidot.org/story?sid=71351) - - [预测他人在公路上的行为](https://www.solidot.org/story?sid=71350) - - [机器学习模型可植入无法检测到的后门](https://www.solidot.org/story?sid=71349) - - [苹果通知开发者将下架长期不更新的应用](https://www.solidot.org/story?sid=71348) - - [台积电计划 2025 年量产 2nm 制程芯片](https://www.solidot.org/story?sid=71347) - - [Twitter 与 Elon Musk 洽谈出售](https://www.solidot.org/story?sid=71346) -- Daniel Miessler - - [News & Analysis: NO. 328](https://danielmiessler.com/podcast/news-analysis-no-328/) - - [Disappointed in Scott Galloway](https://danielmiessler.com/blog/disappointment-in-scott-galloway/) -- Hakin9 – IT Security Magazine - - [Lnkbomb - Malicious shortcut generator for collecting NTLM hashes from insecure file shares](https://hakin9.org/lnkbomb-malicious-shortcut-generator-for-collecting-ntlm-hashes/) -- 黑海洋 - WIKI - - [免费搭建博客或网盘，注册送20美金可用一年](https://blog.upx8.com/2733) -- Luca Mercatanti - - [Convertire una copia forense in macchina virtuale](https://luca-mercatanti.com/2022/04/25/convertire-una-copia-forense-in-macchina-virtuale/?utm_source=rss&utm_medium=rss&utm_campaign=convertire-una-copia-forense-in-macchina-virtuale) -- Deeplinks - - [Plaintiffs Press Appeals Court to Rule That FOSTA Violates the First Amendment](https://www.eff.org/deeplinks/2022/04/plaintiffs-press-appeals-court-rule-fosta-violates-first-amendment) - - [Twitter Has a New Owner. Here’s What He Should Do.](https://www.eff.org/deeplinks/2022/04/twitter-has-new-owner-heres-what-he-should-do) - - [Our Fight To Prevent Patent Suits From Being Shrouded in Secrecy](https://www.eff.org/deeplinks/2022/04/our-fight-prevent-patent-suits-being-shrouded-secrecy) -- Graham Cluley - - [Ukraine’s postal service prints stamp mocking sunken Russian ship, and gets hit by DDoS attack](https://grahamcluley.com/ukraines-postal-service-prints-stamp-mocking-sunken-russian-ship-and-gets-hit-by-ddos-attack/) -- /dev/random - - [[SANS ISC] Simple PDF Linking to Malicious Content](https://blog.rootshell.be/2022/04/25/sans-isc-simple-pdf-linking-to-malicious-content/) -- Schneier on Security - - [SMS Phishing Attacks are on the Rise](https://www.schneier.com/blog/archives/2022/04/sms-phishing-attacks-are-on-the-rise.html) -- Computer Forensics - - [Trying to carve Office documents but they always open corrupted, Help pls](https://www.reddit.com/r/computerforensics/comments/uby67l/trying_to_carve_office_documents_but_they_always/) - - [Extract Bitlocker Clear Key?](https://www.reddit.com/r/computerforensics/comments/ubjkvv/extract_bitlocker_clear_key/) -- 情报分析师 - - [《生物战简史：从史前到乌克兰》（附音频及近期生物战资料下载）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650498131&idx=1&sn=709c437e9a58cea77ccbfc9fd55f1fdd&chksm=87164a18b061c30e77d11123a8202f3e3a49073dd026ef38fc6c83735657b376cd714eecc42c&scene=58&subscene=0#rd) - - [【人物库】情报人员应知道马克龙的十件事](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650498131&idx=2&sn=b1d30828ce95773375bd6f60d41c63d9&chksm=87164a18b061c30ead71ba7e7b6a8dcf240cf58ddd38890bfbd468bcaa439a67e2927e2217d3&scene=58&subscene=0#rd) - - [开源情报工具——ICEYE](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650498131&idx=3&sn=3a5bfcaf7f9cd665a628b09cd695a270&chksm=87164a18b061c30e5bc8911bfbdf0ec8b72e1d38a5dd40ce18fd871c19323ad005084f42065c&scene=58&subscene=0#rd) -- 默安科技 - - [6岁这天，数一数默安那些666的瞬间](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247490597&idx=1&sn=ab1f248a7636e6690f8c1f10de7c3e13&chksm=e938eb07de4f62119545b34e283f9491ff098c16a854d56ed0c476f616c732c82a1e2d36eb2e&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [I’m mid level in my career path in IT but feel like a complete noob when it comes to security , should I wait to go somewhere like defcon?](https://www.reddit.com/r/HowToHack/comments/ubwurf/im_mid_level_in_my_career_path_in_it_but_feel/) - - [How hackers check if their malware will get detected or not?](https://www.reddit.com/r/HowToHack/comments/ub9ka3/how_hackers_check_if_their_malware_will_get/) - - [Advice regarding Hackthebox Academy.](https://www.reddit.com/r/HowToHack/comments/ubq8v3/advice_regarding_hackthebox_academy/) - - [How to make custom pages for Zphisher?](https://www.reddit.com/r/HowToHack/comments/ub9fyi/how_to_make_custom_pages_for_zphisher/) - - [portswigger academy navigation](https://www.reddit.com/r/HowToHack/comments/ube2dm/portswigger_academy_navigation/) -- Tor Project blog - - [Malicious relays and the health of the Tor network](https://blog.torproject.org/malicious-relays-health-tor-network/) -- KitPloit - PenTest Tools! - - [Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer](http://www.kitploit.com/2022/04/wpgarlic-proof-of-concept-wordpress.html) - - [DDexec - A Technique To Run Binaries Filelessly And Stealthily On Linux Using Dd To Replace The Shell With Another Process](http://www.kitploit.com/2022/04/ddexec-technique-to-run-binaries.html) -- SANS Internet Storm Center, InfoCON: green - - [Simple PDF Linking to Malicious Content, (Mon, Apr 25th)](https://isc.sans.edu/diary/rss/28582) - - [ISC Stormcast For Monday, April 25th, 2022 https://isc.sans.edu/podcastdetail.html?id=7978, (Mon, Apr 25th)](https://isc.sans.edu/diary/rss/28580) -- LockBoxx - - [An Interview with a Founder at Shmoocon 2022 (Heidi Potter)](http://lockboxx.blogspot.com/2022/04/an-interview-with-founder-at-shmoocon.html) -- 锦行信息安全 - - [【漏洞预警】Java数字签名伪造漏洞](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489536&idx=1&sn=640891e328f90da1e1aab139344cfdda&chksm=9799e3a5a0ee6ab3186fe418fc33199f877ac4df5f0f3f07afcf13a01af63e4293a452c0b2e9&scene=58&subscene=0#rd) - - [【漏洞预警】Apache Log4j SQL注入漏洞](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489536&idx=2&sn=0477b0c8ee438132fec22917e44c044d&chksm=9799e3a5a0ee6ab3ce16b13d47958c6cb4fc4af5fff356f8f4653b87975a19dbab575159830f&scene=58&subscene=0#rd) -- 颖奇L'Amore - - [我的MacOS上一些好用的软件-第二篇](https://www.gem-love.com/2022/04/25/%E6%88%91%E7%9A%84MacOS%E4%B8%8A%E4%B8%80%E4%BA%9B%E5%A5%BD%E7%94%A8%E7%9A%84%E8%BD%AF%E4%BB%B6-2/) -- The Register - Security - - [Intuit sued over alleged cryptocurrency thefts via Mailchimp intrusion](https://go.theregister.com/feed/www.theregister.com/2022/04/25/intuit-mailchimp-cryptocurrency/) - - [Homeland Security bug bounty program uncovers 122 holes in its systems](https://go.theregister.com/feed/www.theregister.com/2022/04/25/dhs_bug_bounty/) - - [Flaw could have granted criminals control over Ever Surf crypto wallets](https://go.theregister.com/feed/www.theregister.com/2022/04/25/ever-surf-wallet-vulnerability/) - - [FBI: BlackCat ransomware scratched 60-plus orgs](https://go.theregister.com/feed/www.theregister.com/2022/04/25/in_brief_security/) -- Threatpost - - [Lapsus$ Hackers Target T-Mobile](https://threatpost.com/lapsus-hackers-target-t-mobile/179384/) -- TorrentFreak - - [RIAA & Homeland Security’s IPR Center Team Up to Fight Online Piracy](https://torrentfreak.com/riaa-homeland-securitys-ipr-center-team-up-to-fight-online-piracy-220425/) - - [EU Reaches Agreement on Digital Services Act, Including New Takedown Rules](https://torrentfreak.com/eu-reaches-agreement-on-digital-services-act-including-new-takedown-rules-220425/) -- 星阑科技 - - [文末福利抽奖，五一前最后一波Gartner网络研讨会！](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247492852&idx=1&sn=e5a1e110d1362cf77bf9cbea46114be0&chksm=c0074968f770c07e48c811d094de9bf9fbfc7d85e8f3d1b51cb1297d61d6bbe9cbd8df095759&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [【英雄帖】2022年度网络安全威胁情报生态联盟广募盟友](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247500584&idx=1&sn=c740ef3c25d893c4f2088e2e24e2a694&chksm=ea66345fdd11bd4970c07e9c195b255d1702864310d1457493f15c2c9fadeaeea2d99293dc5c&scene=58&subscene=0#rd) -- 火线Zone - - [AWS Key泄露利用工具--awskeytools](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493934&idx=1&sn=5e70e4cb54fbd2e81c10e23e0a9fc889&chksm=eaa9610edddee818ebcf9b6efd2d31de302c3e4139507e147a4b0ce5bda4775dcda195716abc&scene=58&subscene=0#rd) - - [缓冲区溢出使用说明书](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247493934&idx=2&sn=3ba0605a1023119c212b752ffb4e115e&chksm=eaa9610edddee8184a2b09df61b70b8f00c404ea3f477965b360ccbb46647b831fc0a74e3721&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(04-25)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958378&idx=1&sn=a57324ebd060935ee8f8944bca6db0ee&chksm=8baeccf5bcd945e3229eb7690662f4b3d6597716024d147dfa267d84fc1855005571ea485ba3&scene=58&subscene=0#rd) -- 看雪学院 - - [首个体系课重磅上线！《CTF训练营-Web篇》文末有抽奖哦～](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458439286&idx=1&sn=01c1ccae004b3846db12031e0ab9b8c8&chksm=b18ffefc86f877eaf0aa84905adc66c89428bdf84e0dfac7bd8f4ed0e319431a3835471e1538&scene=58&subscene=0#rd) - - [为IDA架设私人lumen服务器](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458439286&idx=2&sn=9b8d1438f351984df87c5a2c1e3c55ed&chksm=b18ffefc86f877ea6f92b505da7bc1200211776ea8ca02ff1d40cb7e6ef6c09b859254c1590a&scene=58&subscene=0#rd) - - [Conti网络攻击使哥斯达黎加网络瘫痪](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458439286&idx=3&sn=f5c133fc60bd721f5cb3d2d6ce8b41bd&chksm=b18ffefc86f877ea53426f2f3fc02f0763f9c77aceef78645dad1b8c98e804551b231e3a9150&scene=58&subscene=0#rd) - - [零基础入门PWN——带你轻松玩转CTF，逐一击破难题！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458439286&idx=4&sn=a0b2f961ae4c77d3e1ab26e4420a4259&chksm=b18ffefc86f877ead46b47d4459968d72b00a48083bdc2ad147b679c30d3d6ef8a44189cfc07&scene=58&subscene=0#rd) -- Il Disinformatico - - [DragonChase 2022: Samantha Cristoforetti su TikTok spiega come si passano questi giorni pre-lancio; l’equipaggio ride e scherza su YouTube](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-samantha-cristoforetti.html) - - [DragonChase 2022: gli orari aggiornati degli eventi intorno al lancio di Crew-4](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-gli-orari-aggiornati.html) - - [A Radio3 Scienza ho parlato di Forever Young, l’autobiografia dell’astronauta John Young](http://attivissimo.blogspot.com/2022/04/a-radio3-scienza-ho-parlato-di-forever.html) -- 绿盟科技CERT - - [热烈庆祝绿盟科技成立22周年~](https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247486996&idx=1&sn=e7db10f3d3228b8706561bb58161c120&chksm=c2c6591ff5b1d009b81b4bbdf339c64873a685c3488caa8d0d89d929b5e9b9666273ec33af13&scene=58&subscene=0#rd) -- 百度安全实验室 - - [建造更安全的SGX区块链共识机制 Proof-of-Elapsed-Time，百度安全论文入选安全顶会NDSS](https://mp.weixin.qq.com/s?__biz=MzA3NTQ3ODI0NA==&mid=2247486640&idx=1&sn=13cbe2dd4f27cf607675fad748e674b2&chksm=9f6ea93ba819202d65ec883a874de96c0257f593f2391b2cdc39da852aef9751d8b8b9be55c7&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [大流量活动下钱包提现方案的设计与实现](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247492807&idx=1&sn=534582db4d9910b3caa5a46cd907ca82&chksm=e9d32f25dea4a6334da14f46cc147cef03ca5e160921e5951e63007153493f0f9e9a856d5738&scene=58&subscene=0#rd) -- Dark Reading - - [What the ECDSA Flaw in Java Means for Enterprises](https://www.darkreading.com/dr-tech/what-the-ecdsa-flaw-in-java-means-for-enterprises) - - [Iranian Hacking Group Among Those Exploiting Recently Disclosed VMWare RCE Flaw](https://www.darkreading.com/attacks-breaches/-iranian-group-among-those-exploiting-recently-disclosed-rce-flaw-in-vmware) - - [North Korean State Actors Deploying Novel Malware to Spy on Journalists](https://www.darkreading.com/attacks-breaches/dprk-state-actors-deploying-novel-malware-to-spy-on-journalists) - - [When Security Meets Development: The DevSecOps Conundrum](https://www.darkreading.com/edge-articles/when-security-meets-development-the-devsecops-conundrum) - - [Mastercard Launches Next-Generation Identity Technology with Microsoft](https://www.darkreading.com/endpoint/mastercard-launches-next-generation-identity-technology-with-microsoft) - - [Ukraine Invasion Driving DDoS Attacks to All-Time Highs](https://www.darkreading.com/attacks-breaches/ukraine-invasion-driving-ddos-attacks-to-all-time-highs) - - [Trend Micro Launches New Security Platform](https://www.darkreading.com/operations/trend-micro-launches-new-security-platform) - - [Overlapping ICS/OT Mandates Distract From Threat Detection and Response](https://www.darkreading.com/attacks-breaches/overlapping-ics-ot-mandates-distract-from-threat-detection-and-response) -- Blackhat Library: Hacking techniques and research - - [Writing a Linux Kernel Remote in 2022](https://www.reddit.com/r/blackhat/comments/uba5dl/writing_a_linux_kernel_remote_in_2022/) -- 永安在线情报平台 - - [永安在线API安全研究报告（2022年Q1）](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493232&idx=1&sn=39af1d16b52da562aab73fe5d576467c&chksm=eb12c04bdc65495d87b1b40d0b836967ee36673019874e92236034b89be3a84f1d260f6c09e7&scene=58&subscene=0#rd) -- 数世咨询 - - [数世咨询：蜜罐诱捕市场指南2022](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492926&idx=1&sn=44039bc8df6faae3065ca8c25d9af143&chksm=c1449783f6331e956eaf6629e8c5d0887009ffa2a84fed3584c100e26de1e7fbcba59ef5aeb8&scene=58&subscene=0#rd) - - [[调研]80%的软件代码库含有至少一个漏洞](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247492926&idx=2&sn=8753e83a55476cdac042aba6e84bd7f4&chksm=c1449783f6331e95be73d42cea78d793e4518f0a6cada2aef1e003039686b05bbb1c71436d73&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (04.18-04.24)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247490911&idx=1&sn=9efeb601fb3790e69d24050fe258ecf8&chksm=fe25185ec952914864d18741a31dedea2c3c6e56fd5041846d8cd153c37867c51259c13d20b0&scene=58&subscene=0#rd) - - [安全日报（2022.04.25）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247490911&idx=2&sn=5f0011e076e882f66f2bfecd73c1bea0&chksm=fe25185ec95291485b450855823d21e3edc45477a2d0fea5c2e09ed972d872b7535543122c78&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [软件成分安全分析（SCA）能力的建设与演进](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247489380&idx=1&sn=73299d1d66d740dda7a812145fecfab2&chksm=ec1bf6b7db6c7fa10172d645c667669aa57ff22346b90c3b5538b60465d86558a0ef5c074321&scene=58&subscene=0#rd) -- Security Affairs - - [Iran announced to have foiled massive cyberattacks on public services](https://securityaffairs.co/wordpress/130592/hacking/iran-foiled-cyberattacks-public-services.html) - - [BlackCat Ransomware gang breached over 60 orgs worldwide](https://securityaffairs.co/wordpress/130582/reports/fbi-blackcat-ransomware.html) - - [Experts warn of a surge in zero-day flaws observed and exploited in 2021](https://securityaffairs.co/wordpress/130569/apt/zero-day-discovered-exploited-2021.html) -- 雷神众测 - - [雷神众测漏洞周报2022.04.18-2022.04.24-4](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652496833&idx=1&sn=0c9e7462798d247483c04d12e8a9d469&chksm=f2584072c52fc964f09b89dec09bcfe3e8afce57c9124168e52a84fe8b6c1511b99f7813a9fd&scene=58&subscene=0#rd) -- 安全牛 - - [告别孤立的安全告警！立刻升级SIEM的五大理由](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112554&idx=1&sn=7b2d431fce73f929f523241bbdf0edf4&chksm=bd1474b98a63fdaf3e7fccb1afa154e85fcdb245668ae130c6da155b1457fa9d836ed226eb52&scene=58&subscene=0#rd) - - [安全头条 | 10项网络安全国家标准获批发布；2022年北京地区App综合治理专项行动开启](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112554&idx=2&sn=554bd4809f2ff4926c29202ebc8585c5&chksm=bd1474b98a63fdaf5af3c5520d17cd7d7cf8b1f962f2fee9bc8177ced654b128d43f3cc7df64&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（19期）：数据分类分级实践](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651112554&idx=3&sn=26f9fdda634d86be91da189e50ba75e8&chksm=bd1474b98a63fdafd08f5b0b2aa88291bd8a5eb28df786be2110a0fba23fd4f4c3ca48200111&scene=58&subscene=0#rd) -- M01NTeam - - [攻击技术研判｜具备“自组织”能力的跨平台恶意程序](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247487830&idx=1&sn=7fb1b00bbe24c9e491d925df0210794f&chksm=c187d147f6f058518d3f697d3fa57df72895e7feafbbedabfa29c3ca77b8c14d97821629eb5b&scene=58&subscene=0#rd) - - [热烈庆祝绿盟科技成立22周年](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247487830&idx=2&sn=6d76508847fa1959ce439b7467c138ac&chksm=c187d147f6f058516f767f8423a5eb578a3af8f0a7e33895239f3588d231574e62a2affb991b&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [安恒猎影实验室发现疑似蔓灵花APT组织伪装多国身份攻击孟加拉国](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247486598&idx=1&sn=dc2da9c61b3fc05b78cf98abd8b7db52&chksm=f9ee6039ce99e92fb49ccd43e2d83a0a19ee16a929e46d138b3d84d829a246d1e846e8a9a7eb&scene=58&subscene=0#rd) -- 腾讯安全威胁情报中心 - - [腾讯云百万容器镜像安全治理运营实践](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500290&idx=1&sn=e9f64f4a53cc0ccc2ed2e0928e658258&chksm=ec9f1b71dbe8926785182143c4f0ed7dcd0d74002205bd473a7d0cd6e64523a18a42b1645964&scene=58&subscene=0#rd) -- 互联网安全内参 - - [南美洲金融中心里约财政系统遭勒索攻击，420GB数据被盗](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502586&idx=1&sn=f63f49ab6fec1305678d1f80094386b4&chksm=ebfa8ddadc8d04ccbb7cb2e7665ea4e9dd272b9460647946fb61fecba36916cacefa4fc98e6d&scene=58&subscene=0#rd) - - [五眼联盟网络安全当局针对俄罗斯发布联合网络安全警告](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502586&idx=2&sn=e1a850948046c684e2508a1a2c32d874&chksm=ebfa8ddadc8d04cc443693f8bfdc610afec95abc16e1326747cbd25f15cc9847c150402eed11&scene=58&subscene=0#rd) - - [美国众议员提出《能源网络安全大学领导力计划法案》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502586&idx=3&sn=33479684377e54a651f60c9ebc7d99f4&chksm=ebfa8ddadc8d04cc13e2d65d69d18ff33fa35fcc308a07d4425162bf8a9d4cf68ac248c025d3&scene=58&subscene=0#rd) - - [计划比技术重要：NIST发布新版企业补丁管理指南](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247502586&idx=4&sn=10949031963ff73c7f4780f010552b2b&chksm=ebfa8ddadc8d04cc9780c4b42cb7a2c5514ca3c35870e6d26c643a79dc75f81dc0f3273bd0bc&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [端到端加密(E2EE)及其内容审核技术](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493211&idx=1&sn=7d4f88c22caa945950ae03c0b5abfc94&chksm=fa5233e5cd25baf3d6b4201195704256ba718daabbaeb4100c9e176b2bd18c2dcd2924121842&scene=58&subscene=0#rd) -- 白帽100安全攻防实验室 - - [MRCTF 2022 By W&M](https://mp.weixin.qq.com/s?__biz=MzIxMDYyNTk3Nw==&mid=2247489763&idx=1&sn=2a470aae95cdcf992f7cdfbdb0fdbefd&chksm=9760ec35a0176523ae9faa8105f15117c0a5ef2d787bc1b6c82ffb4f4b0f0bcc83f2eadeade9&scene=58&subscene=0#rd) -- GeekPwn - - [GeekPwn 助力首届腾讯数字安全创新大赛｜三十强名单出炉，导师领衔备战十强争霸赛](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650344352&idx=1&sn=65e9bca385607dbcaa4966d5ba95346e&chksm=8740b065b0373973be58825b95018753b845489aa0082be34ecade9492f3b1ffd07c2dc7949f&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Apr.25th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495341&idx=1&sn=06f51656374a84d1785ffbd2359a1aa9&chksm=ce96a393f9e12a85a9b0fe9270ab61a80f84bb9a8f4da49d73b7589c9e73ec0d904dd88ddcfd&scene=58&subscene=0#rd) -- 奇安信CERT - - [【安全热点周报】第242期:Oracle官方发布了2022年4月的关键安全补丁集合更新](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247495845&idx=1&sn=7b01b334527ae2752e1c1d318e7c1da1&chksm=fe79d43dc90e5d2b553254c1bece738c8d7a0c7261ff10ce55e26a0dba22b33ecdda7c43dada&scene=58&subscene=0#rd) -- 安全学术圈 - - [针对移动支付的道德反欺诈系统](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247487595&idx=1&sn=f023c4d1a046e62439be618f7fdc4787&chksm=fe2eefe0c95966f601ac841b3492f57f6445d365c91c7af703c25266edc52b71421549e24bf6&scene=58&subscene=0#rd) -- 安全客 - - [【安全头条】T-Mobile证实Lapsus$黑客入侵内部系统](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769803&idx=1&sn=5442665acf3c7632bad1791cdbc43a7f&chksm=88937724bfe4fe32c460fc393db72f02da1a70766a7df9987723d9cc725f443e66e599a8d0b1&scene=58&subscene=0#rd) - - [【技术分享】针对KingSqlZ组织一次攻击的分析报告](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769803&idx=2&sn=20be4ffc0fd31525f11cf100935ed2c4&chksm=88937724bfe4fe3213c5f4e02ad4b1128f39141aeb1c8daa56b20a8e2e949e2769a0b302c2ee&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Is there a tool to help you identify the likely APT based on inputted mitre codes?](https://www.reddit.com/r/netsecstudents/comments/ubnxmq/is_there_a_tool_to_help_you_identify_the_likely/) - - [Network penetration testing and red teaming path](https://www.reddit.com/r/netsecstudents/comments/ub8b5x/network_penetration_testing_and_red_teaming_path/) - - [Telegram group members adder](https://www.reddit.com/r/netsecstudents/comments/ubdoj2/telegram_group_members_adder/) -- Securelist - - [DDoS attacks in Q1 2022](https://securelist.com/ddos-attacks-in-q1-2022/106358/) -- 云鼎实验室 - - [腾讯云百万容器镜像安全治理运营实践](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494321&idx=1&sn=6247f829188e8c7f7e68558a3e5be555&chksm=fd791637ca0e9f2193a6a341971804376dc691d0f5f08c18e62925724604023aab65f0d91e29&scene=58&subscene=0#rd) - - [您有一份安全知识大礼包待查收~](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494321&idx=2&sn=da1115e03bf74c6e5d2733a7b5674e1e&chksm=fd791637ca0e9f21c55429a99ff8d78eab7ead5a9682f3c1048bb358f5abb8fbb651809e78a5&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [Static unpacker and decoder for Hello Kitty Packer](https://www.reddit.com/r/netsec/comments/ubr63l/static_unpacker_and_decoder_for_hello_kitty_packer/) -- 代码卫士 - - [SmartPTT、SmartICS 工业产品存在多个严重漏洞，影响全球90国](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511538&idx=1&sn=6f91f6176cac01585dd7b8fa5c1c7f18&chksm=ea949c98dde3158e379cbf7052ded0011c00528a6104cbb0043cbd738d11575dad2c31167efd&scene=58&subscene=0#rd) - - [美国政府为六个大学团队拨款1200万美元开发网络防御工具](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511538&idx=2&sn=5985c3d9c6c846a3ad2dc1af32ad7635&chksm=ea949c98dde3158ef942d9eedd37a4a6ea9508730e6e3a02a40d066e493d68d73cf61c451d68&scene=58&subscene=0#rd) - - [哥斯达黎加共和国政府系统遭勒索攻击，引发混乱](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247511538&idx=3&sn=e38a09a3504b14a14b0944d3bec83681&chksm=ea949c98dde3158e326df796956f7d053c210565dd5574b65633bbec09b8683180a5c05dff41&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220425期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247526053&idx=1&sn=4ebe4fd25ff24b8cb0b633a41670c6cd&chksm=c1e9eaf4f69e63e232cd49495f429acf1fc2f01ab041bfcb1daef52f8278bb6651d4a6759b31&scene=58&subscene=0#rd) - - [再奏强音！第五届中国数据安全治理高峰论坛全维度升级](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247526053&idx=2&sn=8d872fc620dffe4086ae4d6d840c6623&chksm=c1e9eaf4f69e63e26f4f90fce6eadb20524865cf98cf6f59bd0ed232e0027b193e88e8924139&scene=58&subscene=0#rd) - - [美国政府向六所大学拨款1200万美元，研发网络攻...](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247526053&idx=3&sn=f138f55ded38baaac468836019da2d31&chksm=c1e9eaf4f69e63e2e22ebfca6c59698d67ba7bba7a8b8e6ba8bc89ac3829cc573a0109f42eb3&scene=58&subscene=0#rd) - - [十年三倍！安全漏洞创纪录增长](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247526053&idx=4&sn=80bda77efd350d13a5b9959964e03a16&chksm=c1e9eaf4f69e63e229bbf5e0f611d9fa769decec6e589e5a2c7a80ab4e03e95eb9945f2cf20d&scene=58&subscene=0#rd) - - [对“黑天鹅”网络事件的常见误解](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247526053&idx=5&sn=11a4a0faf31460fd592d1521aaf1162a&chksm=c1e9eaf4f69e63e2dba151268a304af700cea82d506428dc3dfc2dadb5cdaa08b3cb12cfd92f&scene=58&subscene=0#rd) - - [从顶级黑客大赛看工控系统的不堪一击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247526053&idx=6&sn=32a6da9eedf5ffb0fdeaddddfe56b204&chksm=c1e9eaf4f69e63e207354ad2a7658ff8accc188d90b90f3ede5674acc1df41d37499f73e0972&scene=58&subscene=0#rd) -- ChaMd5安全团队 - - [2022网刃杯-WriteUp](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247504976&idx=1&sn=ec2d88fc8f903f14a51ec5feffae5ac4&chksm=e89dfc88dfea759ecc03d15d3adb3a97149464659aff32004319871f4b3fb269c51a8f4ece1c&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-04-25](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247489619&idx=1&sn=1af06bed2090efb9efeffb116787f50a&chksm=c060368af717bf9c54ba5d359e9018594bbc22505a76dcffb69ba8df043f71447b02a799325c&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第16期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491577&idx=1&sn=29b4c59fd4ca8ebf49070b17188b9a98&chksm=fd772f30ca00a6268f5ad08faa531c80390c159549d4540e90386ccd8b356ece701d70d47489&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220418-20220424)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491577&idx=2&sn=84594d370130956460057cb4b985cfcc&chksm=fd772f30ca00a62607414a8b3873aacb90939ea4e06c24061b7496aec00e481cba597a56a9b2&scene=58&subscene=0#rd) -- Social Engineering - - [Pretty sure everyone has seen this now. Attacker attempts to send a password reset text to the victim and asks for a screenshot. But this dummy clicked a link a sent him!](https://www.reddit.com/r/SocialEngineering/comments/ubsrjm/pretty_sure_everyone_has_seen_this_now_attacker/) - - [There are many ways in which others deceive us. Lying, for example, is relatively rare, difficult to do, and often penalized. Bullshit, in contrast, is much more common, effortless, and often goes unpunished. Read more about the science here:](https://www.reddit.com/r/SocialEngineering/comments/ubp8fv/there_are_many_ways_in_which_others_deceive_us/) - - [any books out there that explain how to Read a 'flow of information'? and/or wield it?](https://www.reddit.com/r/SocialEngineering/comments/ubqe47/any_books_out_there_that_explain_how_to_read_a/) - - [Any ideas on how to get access to an expensive paid course for discounted / free?](https://www.reddit.com/r/SocialEngineering/comments/ubyc9j/any_ideas_on_how_to_get_access_to_an_expensive/) - - [Where should I begin?](https://www.reddit.com/r/SocialEngineering/comments/ubit2g/where_should_i_begin/) -- Dark Space Blogspot - - [Tutti I Derivati Di Luna: bLuna, LunaX, stLuna, nLuna, pLuna, yLuna e cLuna](http://darkwhite666.blogspot.com/2022/04/tutti-i-derivati-di-luna-bluna-lunax.html) diff --git a/archive/2022/2022-04-27.md b/archive/2022/2022-04-27.md deleted file mode 100644 index 9ee55d05fc..0000000000 --- a/archive/2022/2022-04-27.md +++ /dev/null @@ -1,237 +0,0 @@ -# 每日安全资讯（2022-04-27） - -- Files ≈ Packet Storm - - [GNU Privacy Guard 2.2.35](https://packetstormsecurity.com/files/166838/gnupg-2.2.35.tar.bz2) - - [Mandos Encrypted File System Unattended Reboot Utility 1.8.15](https://packetstormsecurity.com/files/166836/mandos_1.8.15.orig.tar.gz) - - [Ubuntu Security Notice USN-5388-2](https://packetstormsecurity.com/files/166835/USN-5388-2.txt) - - [Ubuntu Security Notice USN-5388-1](https://packetstormsecurity.com/files/166834/USN-5388-1.txt) - - [Ubuntu Security Notice USN-5387-1](https://packetstormsecurity.com/files/166833/USN-5387-1.txt) - - [Red Hat Security Advisory 2022-1490-01](https://packetstormsecurity.com/files/166832/RHSA-2022-1490-01.txt) - - [WordPress Coru LFMember 1.0.2 Cross Site Scripting](https://packetstormsecurity.com/files/166831/wpcorulfmember102-xss.txt) - - [Red Hat Security Advisory 2022-1491-01](https://packetstormsecurity.com/files/166830/RHSA-2022-1491-01.txt) - - [Gitlab 14.9 Cross Site Scripting](https://packetstormsecurity.com/files/166829/gitlab149-xss.txt) - - [Gitlab 14.9 Authentication Bypass](https://packetstormsecurity.com/files/166828/gitlab149-bypass.txt) - - [Ubuntu Security Notice USN-5376-2](https://packetstormsecurity.com/files/166827/USN-5376-2.txt) - - [Spamhaus Botnet Threat Update Q1 2022](https://packetstormsecurity.com/files/166826/Botnet-Report-Q1-2022.pdf) - - [Red Hat Security Advisory 2022-1487-01](https://packetstormsecurity.com/files/166825/RHSA-2022-1487-01.txt) - - [WordPress WP-Invoice 4.3.1 Cross Site Scripting](https://packetstormsecurity.com/files/166824/wpinvoice431-xss.txt) - - [Red Hat Security Advisory 2022-1488-01](https://packetstormsecurity.com/files/166823/RHSA-2022-1488-01.txt) - - [GNU Privacy Guard 2.3.6](https://packetstormsecurity.com/files/166837/gnupg-2.3.6.tar.bz2) - - [Red Hat Security Advisory 2022-1489-01](https://packetstormsecurity.com/files/166822/RHSA-2022-1489-01.txt) -- HackerOne Hacker Activity - - [SQL Injection on https://soa-accp.glbx.tva.gov/ via "/api/" path - VI-21-015](https://hackerone.com/reports/1125752) - - [Stored XSS in "product type" field executed via product filters](https://hackerone.com/reports/1404770) - - [RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.com](https://hackerone.com/reports/1456063) -- FreeBuf网络安全行业门户 - - [Java代码审计一危险函数分析与利用（二）](https://www.freebuf.com/articles/web/330798.html) - - [专访F5陈亮：数字化浪潮下的应用与安全](https://www.freebuf.com/articles/people/331347.html) - - [FreeBuf早报 | 伊朗黑客利用RCE漏洞部署后门；BotenaGo变种针对Lilin摄像头](https://www.freebuf.com/news/331327.html) - - [斗象攻防演练宝典系列之神剑出鞘](https://www.freebuf.com/articles/network/331283.html) - - [记一次数据包解签名实战](https://www.freebuf.com/articles/web/328534.html) - - [伊朗宣布挫败针对公共服务的大规模网络攻击](https://www.freebuf.com/articles/331258.html) - - [CISA在漏洞利用列表中增加了7个新漏洞](https://www.freebuf.com/news/331257.html) - - [病毒利用驱动人生升级通道及高危漏洞传播 12月14日半天感染数万台电脑](https://www.freebuf.com/vuls/192014.html) - - [谷歌修复了VirusTotal平台的高危RCE漏洞](https://www.freebuf.com/news/331255.html) - - [美指控朝鲜APT利用新型恶意软件攻击记者](https://www.freebuf.com/news/331237.html) - - [俄乌争端致使 DDoS 攻击达到历史最高水平](https://www.freebuf.com/news/331233.html) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Joomla Sexy Polling 2.1.7 SQL Injection](https://cxsecurity.com/issue/WLB-2022040102) - - [Gitlab 14.9 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022040101) - - [Gitlab 14.9 Authentication Bypass](https://cxsecurity.com/issue/WLB-2022040100) - - [WordPress Coru LFMember 1.0.2 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022040099) - - [WordPress WP-Invoice 4.3.1 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022040098) -- 绿盟科技技术博客 - - [基于中间盒的TCP反射放大攻击研究与实战分析](http://blog.nsfocus.net/tcp-use/) - - [绿盟科技威胁周报（20220418-20220424）](http://blog.nsfocus.net/weekly-20220418/) -- ElcomSoft blog - - [iOS Low-Level Acquisition: How to Sideload the Extraction Agent](https://blog.elcomsoft.com/2022/04/ios-low-level-acquisition-how-to-sideload-the-extraction-agent/) -- Microsoft Security Blog - - [Microsoft finds new elevation of privilege Linux vulnerability, Nimbuspwn](https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/) -- Sploitus.com Exploits RSS Feed - - [GitLab 14.9 - Stored Cross-Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37667&utm_source=rss&utm_medium=rss) - - [Gitlab 14.9 - Authentication Bypass Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37666&utm_source=rss&utm_medium=rss) - - [Gitlab 14.9 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:166828&utm_source=rss&utm_medium=rss) - - [Gitlab 14.9 - Authentication Bypass exploit](https://sploitus.com/exploit?id=EDB-ID:50888&utm_source=rss&utm_medium=rss) - - [WordPress Coru LFMember 1.0.2 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:166831&utm_source=rss&utm_medium=rss) - - [Gitlab 14.9 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:166829&utm_source=rss&utm_medium=rss) - - [WordPress WP-Invoice 4.3.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:166824&utm_source=rss&utm_medium=rss) - - [GitLab 14.9 - Stored Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50889&utm_source=rss&utm_medium=rss) - - [WordPress WP-Invoice 4.3.1 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37669&utm_source=rss&utm_medium=rss) - - [WordPress Coru LFMember 1.0.2 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37668&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Gerapy exploit](https://sploitus.com/exploit?id=668D480E-7AB9-565C-AB21-4B6C41241F57&utm_source=rss&utm_medium=rss) - - [Exploit for Cross-site Scripting in Webmin exploit](https://sploitus.com/exploit?id=3D11411C-1164-5E8F-9365-50ADEA0BFBA7&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Sonicwall Sma 200 Firmware exploit](https://sploitus.com/exploit?id=08357A6D-CD7A-52F0-9697-45B80724C49D&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Wso2 Api Manager exploit](https://sploitus.com/exploit?id=EF4758A5-6970-501E-8926-AEFB5A2C6DA7&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Vmware Spring Cloud Gateway exploit](https://sploitus.com/exploit?id=5311844C-6D6C-5939-8B20-911F0C6E1486&utm_source=rss&utm_medium=rss) - - [Exploit for Use After Free in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=0AADD19A-EDB0-57B1-90A5-96CF733B31D8&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Google Android exploit](https://sploitus.com/exploit?id=533B274A-A0D8-5DAF-A5F0-FB370010A53B&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Djangoproject Django exploit](https://sploitus.com/exploit?id=1EF4C8A5-CBE0-550F-A94D-2EA044EEFD2C&utm_source=rss&utm_medium=rss) -- 跳跳糖 - 安全与分享社区 - - [滥用具备RWX-S权限且有签名的dll进行无感知的shellcode注入](https://tttang.com/archive/1565/) -- Flexera Blog - Feed - - [Overwhelmed by vulnerabilities? Here’s the best way to prioritize them.](https://www.flexera.com/blog/vulnerability-management/software-vulnerability-prioritization/) -- Sucuri Blog - - [Vulnerability Roundup – April 2022](https://blog.sucuri.net/2022/04/vulnerability-roundup-april-2022.html) -- GuidePoint Security - - [HIPAA Breach Notification Simplified](https://www.guidepointsecurity.com/blog/hipaa-breach-notification/) -- Real-time communications security on Communication Breakdown - Real-Time Communications Security - - [We're hiring, new SIPVicious PRO tools, advisories and blog post galore](https://www.rtcsec.com/newsletter/2022-04-rtcsec-news/) -- Trail of Bits Blog - - [Improving the state of go-fuzz](https://blog.trailofbits.com/2022/04/26/improving-the-state-of-go-fuzz/) -- Blog & What's New | Offensive Security - - [Clarifying Hacking with XSS](https://www.offensive-security.com/offsec/clarifying-hacking-with-xss/) -- blog.avast.com EN - - [Obama speaks at Stanford University on strengthening our democracy and reforming social media](https://blog.avast.com/obama-stanford-keynote-address) -- Malwarebytes Labs - - [Hospitals taken offline after cyberattack](https://blog.malwarebytes.com/reports/2022/04/hospitals-taken-offline-after-cyberattack/) - - [Rogue ads phishing for cryptocurrency: Are you secure?](https://blog.malwarebytes.com/scams/2022/04/rogue-ads-phishing-for-cryptocurrency-are-you-secure/) -- Reverse Engineering - - [Exploring Widevine for Fun and Profit](https://www.reddit.com/r/ReverseEngineering/comments/uckibc/exploring_widevine_for_fun_and_profit/) - - [A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection](https://www.reddit.com/r/ReverseEngineering/comments/uc9pwq/a_comparison_of_static_dynamic_and_hybrid/) - - [Relock 3.0: Relocation-based obfuscation revisited in Windows 11 on Arm](https://www.reddit.com/r/ReverseEngineering/comments/uc1gll/relock_30_relocationbased_obfuscation_revisited/) -- cdxy's home - - [解决复杂问题的一般性方法](https://www.cdxy.me/?p=853) -- Whwlsfb's Tech Blog - - [CVE-2022-22947 注入哥斯拉内存马](https://blog.wanghw.cn/tech-share/cve-2022-22947-inject-godzilla-memshell.html) -- The Daily Swig | Cybersecurity news and views - - [Disavowed: Chrome plans to deprecate ‘document.domain’ lays the groundwork for shift in browser security](https://portswigger.net/daily-swig/disavowed-chrome-plans-to-deprecate-document-domain-lays-the-groundwork-for-shift-in-browser-security) - - [Bug bounty platform Intigriti offers new hourly payment option for vulnerability researchers](https://portswigger.net/daily-swig/bug-bounty-platform-intigriti-offers-new-hourly-payment-option-for-vulnerability-researchers) -- Intigriti - - [Intigriti secures more than €21M in Series B funding](https://blog.intigriti.com/2022/04/26/intigriti-secures-more-than-21-million-series-b-funding/) -- Sucuri Blog - - [Vulnerability Roundup – April 2022](https://blog.sucuri.net/2022/04/vulnerability-roundup-april-2022.html) -- Forcepoint - - [Forcepoint Brings Personalized Automation at Scale to DLP](https://www.forcepoint.com/blog/insights/forcepoint-dlp-personalized-automation-at-scale) -- Exploit-DB.com RSS Feed - - [[webapps] GitLab 14.9 - Stored Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/50889) - - [[webapps] Gitlab 14.9 - Authentication Bypass](https://www.exploit-db.com/exploits/50888) -- HAHWUL - - [Go에서 Stdin에 대한 테스트 코드 작성하기](https://www.hahwul.com/2022/04/26/write-testcode-for-stdin-in-go/) -- KitPloit - PenTest & Hacking Tools - - [VulFi - Plugin To IDA Pro Which Can Be Used To Assist During Bug Hunting In Binaries](http://www.kitploit.com/2022/04/vulfi-plugin-to-ida-pro-which-can-be.html) - - [Bore - Simple CLI Tool For Making Tunnels To Localhost](http://www.kitploit.com/2022/04/bore-simple-cli-tool-for-making-tunnels.html) -- 博客园 - 郑瀚Andrew.Hann - - [《如何成为优秀的大脑饲养员：让我们精力更足、记性更好、情绪更佳的健脑饮食全书》笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16190533.html) -- 博客园 - nice_0e3 - - [Java安全之S2-001漏洞分析 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16197395.html) -- 黑海洋 - WIKI - - [俄罗斯无版权全免费游戏库：byrut](https://blog.upx8.com/2736) - - [引爆门店成交必杀技视频课程](https://blog.upx8.com/2735) - - [PC图片自动拼接工具v1.22](https://blog.upx8.com/2734) -- 颖奇L'Amore - - [从MySQL注入到XPath注入](https://www.gem-love.com/2022/04/26/%E4%BB%8EMySQL%E7%9B%B2%E6%B3%A8%E5%88%B0XPath%E7%9B%B2%E6%B3%A8/) -- ProtonMail Blog - - [There’s no Proton without the Proton community](https://protonmail.com/blog/proton-community/) -- TrustedSec - - [Defending the Gates of Microsoft Azure With MFA](https://www.trustedsec.com/blog/defending-the-gates-of-microsoft-azure-with-mfa/) -- IT Service Management News - - [CNIL dichiara illegali i Google Analytics](http://blog.cesaregallotti.it/2022/04/cnil-dichiara-illegali-i-google.html) -- Yoroi Warning Archive Feed - - [Warning: Cisco Umbrella VA - Static SSH host key](https://us9.campaign-archive.com/?u=00093dab1cf5ca5a1d3d08535&id=e03cd4f515) -- Chaos Computer Club - last 100 events feed - - [Jerrycan (petitfoo)](https://cdn.media.ccc.de/contributors/essen/petitfoo/h264-hd/petitfoo-50-deu-Jerrycan_hd.mp4) -- Securityinfo.it - - [Record di exploit di bug zero-day](https://www.securityinfo.it/2022/04/26/record-di-exploit-di-bug-zero-day/?utm_source=rss&utm_medium=rss&utm_campaign=record-di-exploit-di-bug-zero-day) - - [Prynt Stealer, il nuovo potente malware per rubare informazioni](https://www.securityinfo.it/2022/04/26/prynt-stealer-il-nuovo-potente-malware-per-rubare-informazioni/?utm_source=rss&utm_medium=rss&utm_campaign=prynt-stealer-il-nuovo-potente-malware-per-rubare-informazioni) -- Il Disinformatico - - [DragonChase 2022: Le dirette per seguire il lancio di Crew-4 e le repliche per rivederlo](http://attivissimo.blogspot.com/2022/04/dragonchase-2022-le-dirette-per-seguire.html) -- Hakin9 – IT Security Magazine - - [Spring4Shell-scan - a fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities](https://hakin9.org/spring4shell-scan-a-fully-automated-scanner-for-spring4shell-and-spring-cloud-rce-vulnerabilities/) - - [List of Free Python Resources [Updated April 2022]](https://hakin9.org/list-of-free-python-resources/) -- Pentestmag - - [Open Authorisation Exploitation](https://pentestmag.com/open-authorisation-exploitation/?utm_source=rss&utm_medium=rss&utm_campaign=open-authorisation-exploitation) -- SANS Internet Storm Center, InfoCON: green - - [WSO2 RCE exploited in the wild, (Tue, Apr 26th)](https://isc.sans.edu/diary/rss/28586) - - [ISC Stormcast For Tuesday, April 26th, 2022 https://isc.sans.edu/podcastdetail.html?id=7980, (Tue, Apr 26th)](https://isc.sans.edu/diary/rss/28584) -- 奇客Solidot–传递最新科技情报 - - [老年人的疫苗加强针接种放缓](https://www.solidot.org/story?sid=71370) - - [网信办等要求年底所有新路由器默认启用 IPv6](https://www.solidot.org/story?sid=71369) - - [3800 年前的智利大地震引发社会混乱](https://www.solidot.org/story?sid=71368) - - [LineageOS 19 释出](https://www.solidot.org/story?sid=71367) - - [MIT 新计算机视觉算法以像素为单位识别图像](https://www.solidot.org/story?sid=71366) - - [经济不平等和公民的幸福感](https://www.solidot.org/story?sid=71365) - - [锰可能是真正大众电动车的秘诀](https://www.solidot.org/story?sid=71364) - - [六页优雅的论文证明随机结构的出现](https://www.solidot.org/story?sid=71363) - - [世界最长寿者去世](https://www.solidot.org/story?sid=71362) -- NetSPI - - [Getting Started as a Pentester: Cybersecurity Career Q&A](https://www.netspi.com/blog/executive/penetration-testing/cybersecurity-career-getting-started-as-a-pentester/) -- LuxSci - - [Using Technology to Address Clinician Burnout](https://luxsci.com/blog/using-technology-to-address-clinician-burnout.html) -- Graham Cluley - - [Ransomware attack attempted to destabilise Costa Rica, says outgoing president](https://www.bitdefender.com/blog/hotforsecurity/ransomware-attack-attempted-to-destabilise-our-country-says-outgoing-costa-rican-president/) -- Posts By SpecterOps Team Members - Medium - - [Learning Machine Learning Part 2: Attacking White Box Models](https://posts.specterops.io/learning-machine-learning-part-2-attacking-white-box-models-1a10bbb4a2ae?source=rss----f05f8696e3cc---4) -- ICT Security Magazine - - [Meta realizza l’Adversarial Threat Report contro la disinformazione](https://www.ictsecuritymagazine.com/notizie/meta-realizza-ladversarial-threat-report-contro-la-disinformazione/) -- Blackhat Library: Hacking techniques and research - - [Question about bruteforcing](https://www.reddit.com/r/blackhat/comments/ucpfuo/question_about_bruteforcing/) -- Computer Forensics - - [Windows Indexing Locations](https://www.reddit.com/r/computerforensics/comments/uckk1x/windows_indexing_locations/) -- Threatpost - - [Firms Push for CVE-Like Cloud Bug System](https://threatpost.com/cve-cloud-bug-system/179394/) - - [Nation-state Hackers Target Journalists with Goldbackdoor Malware](https://threatpost.com/hackers-target-journalists-goldbackdoor/179389/) -- Dark Reading - - [Log4j Attack Surface Remains Massive](https://www.darkreading.com/threat-intelligence/l0g4j-attack-surface-remains-huge) - - [How Do I Report My Security Program's ROI?](https://www.darkreading.com/edge-ask-the-experts/how-do-i-report-my-security-program-s-roi) - - [Tenable Acquires External Attack Surface Management Vendor for $44.5M](https://www.darkreading.com/analytics/tenable-adds-attack-surface-mapping-know-how-with-latest-acquisition) - - [The Ins and Outs of Secure Infrastructure as Code](https://www.darkreading.com/dr-tech/the-ins-and-outs-of-secure-infrastructure-as-code) - - [CISA Taps Veteran CISO Bob Lord for Technical Adviser Role](https://www.darkreading.com/operations/cisa-taps-seasoned-ciso-bob-lord-for-technical-adviser-role) - - [API Attacks Soar Amid the Growing Application Surface Area](https://www.darkreading.com/application-security/api-attacks-soar-amid-the-growing-application-surface-area) - - [Cyber Conflict Overshadowed a Major Government Ransomware Alert](https://www.darkreading.com/attacks-breaches/cyber-conflict-overshadowed-a-major-government-ransomware-alert-here-s-the-attention-it-deserves) - - [Introducing Apostro: A Risk Management Platform for Web3 Security](https://www.darkreading.com/risk/introducing-apostro-a-risk-management-platform-for-web3-security) - - [SecurityScorecard Launches Cyber Risk Quantification Portfolio](https://www.darkreading.com/risk/securityscorecard-launches-cyber-risk-quantification-portfolio) -- Instapaper: Unread - - [How a new generation of IoT botnets is amplifying DDoS attacks](https://www.csoonline.com/article/3657738/how-a-new-generation-of-iot-botnets-is-amplifying-ddos-attacks.html) - - [Velociraptor Version 0.6.4 Dead Disk Forensics and Better Path Handling Let You Dig Deeper](https://www.rapid7.com/blog/post/2022/04/25/velociraptor-version-0-6-4-dead-disk-forensics-and-better-path-handling-let-you-dig-deeper-2/) - - [DFRWS-EU 2022 The Future of Digital Forensics Is Now](https://www.forensicfocus.com/articles/dfrws-eu-2022-the-future-of-digital-forensics-is-now/) - - [File Formats](http://windowsir.blogspot.com/2022/04/file-formats.html) - - [Convertire una copia forense in macchina virtuale](https://luca-mercatanti.com/2022/04/25/convertire-una-copia-forense-in-macchina-virtuale/) - - [Anomaly Six può sorvegliare miliardi di persone](https://www.punto-informatico.it/anomaly-six-puo-sorvegliare-miliardi-persone/) -- /r/netsec - Information Security News & Discussion - - [KrbRelayUp - local privilege escalation in Windows domain environments where LDAP signing is not enforced](https://www.reddit.com/r/netsec/comments/uclvtc/krbrelayup_local_privilege_escalation_in_windows/) - - [Introduction to VirtualBox security research and fuzzing](https://www.reddit.com/r/netsec/comments/ucltsz/introduction_to_virtualbox_security_research_and/) - - [New CloudGoat scenario: Vulnerable-by-Design Lambda functions](https://www.reddit.com/r/netsec/comments/ucgxe0/new_cloudgoat_scenario_vulnerablebydesign_lambda/) - - [Thinkstscapes Q1 2022 research round-up](https://www.reddit.com/r/netsec/comments/uclqi5/thinkstscapes_q1_2022_research_roundup/) -- Deeplinks - - [EFF to European Court: No Intermediary Liability for Social Media Users](https://www.eff.org/deeplinks/2022/04/eff-european-court-no-intermediary-liability-social-media-users) - - [DSA Agreement: No Filternet, But Human Rights Concerns Remain](https://www.eff.org/deeplinks/2022/04/dsa-agreement-no-filternet-human-rights-concerns-remain) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [INE PTP's Penetration Testing: Metasploit and ruby](https://www.reddit.com/r/netsecstudents/comments/uc7cbc/ine_ptps_penetration_testing_metasploit_and_ruby/) -- Social Engineering - - [Negativity bias runs deeper than our news cycle, it is evident in our language, neurobiology, and our judgments of others.](https://www.reddit.com/r/SocialEngineering/comments/ubzjcu/negativity_bias_runs_deeper_than_our_news_cycle/) -- TorrentFreak - - [Piracy Giants Zone-Telechargement & Tirexo Mysteriously Shut Down](https://torrentfreak.com/piracy-giants-zone-telechargement-tirexo-mysteriously-shut-down-220426/) - - [‘Upload Filters’ Don’t Violate Freedom of Expression, EU Top Court Rules](https://torrentfreak.com/upload-filters-dont-violate-freedom-of-expression-eu-top-court-rules-220426/) -- Tor Project blog - - [New Alpha Release: Tor Browser 11.5a9 (Windows/macOS/Linux)](https://blog.torproject.org/new-release-tor-browser-115a9/) -- Paul's Security Weekly - - [SWN #207 - Hare, Quantum, VMWARE, APT 34, Brakes, Elon Buys Twitter, Lapsus, & BlackCat](http://podcast.securityweekly.com/swn-207-hare-quantum-vmware-apt-34-brakes-elon-buys-twitter-lapsus-blackcat) - - [ASW #194 - Dr. Chenxi Wang](http://podcast.securityweekly.com/asw-194-dr-chenxi-wang) -- Security Affairs - - [Iran-linked APT Rocket Kitten exploited VMware bug in recent attacks](https://securityaffairs.co/wordpress/130630/apt/iran-apt-exploiting-vmware-rce.html) - - [CISA adds new Microsoft, Linux, and Jenkins flaws to its Known Exploited Vulnerabilities Catalog](https://securityaffairs.co/wordpress/130625/security/known-exploited-vulnerabilities-catalog-7-new-flaws.html) - - [Stormous ransomware gang claims to have hacked Coca-Cola](https://securityaffairs.co/wordpress/130614/cyber-crime/stormous-ransomware-hit-coca-cola.html) - - [North Korea-linked APT37 targets journalists with GOLDBACKDOOR](https://securityaffairs.co/wordpress/130606/apt/apt37-targets-journalists-goldbackdoor.html) - - [Anomaly Six, a US surveillance firm that tracks roughly 3 billion devices in real-time](https://securityaffairs.co/wordpress/130589/digital-id/anomaly-six-us-surveillance-firm.html) -- 安全客 - - [【安全头条】根据新的欧盟立法，谷歌、Meta和其他公司将不得不解释他们的算法](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769822&idx=1&sn=d8675e1276ea9ff7b4615e94c7ae89e2&chksm=88937731bfe4fe27637fec7cfd70d4161223bc11d28c7fa90da4a90060ae23547928fb5d2557&scene=58&subscene=0#rd) - - [【技术分享】HCTF逆向题目详析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649769822&idx=2&sn=47b9a1b32b54f0fab6812125d3f50ad1&chksm=88937731bfe4fe2762298985b64e793b25cc5848758887f4eeccb0d2813314edd80a956e193a&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [VulFi - Plugin To IDA Pro Which Can Be Used To Assist During Bug Hunting In Binaries](http://www.kitploit.com/2022/04/vulfi-plugin-to-ida-pro-which-can-be.html) - - [Bore - Simple CLI Tool For Making Tunnels To Localhost](http://www.kitploit.com/2022/04/bore-simple-cli-tool-for-making-tunnels.html) -- The Register - Security - - [Who is exploiting VMware right now? Probably Iran's Rocket Kitten, to name one](https://go.theregister.com/feed/www.theregister.com/2022/04/26/iran_rocket_kitten_vmware_exploit/) - - [Coca-Cola probes pro-Kremlin gang's claims of 161GB data theft](https://go.theregister.com/feed/www.theregister.com/2022/04/26/cocacola_ransomware_attack/) - - [USA's plan to decouple its tech with China lacks a strategy – report](https://go.theregister.com/feed/www.theregister.com/2022/04/26/usas_plan_to_decouple_its/) - - [DDoS attacks at an all-time-high in Q1 2022, says Kaspersky](https://go.theregister.com/feed/www.theregister.com/2022/04/26/kaspersky_ddos_up/) - - [Microsoft fixes Point of Sale bug that delayed Windows 11 startup for 40 minutes](https://go.theregister.com/feed/www.theregister.com/2022/04/26/windows_11_patch/) - - [India inks tech pact with EU – only the US has the same deal](https://go.theregister.com/feed/www.theregister.com/2022/04/26/india_eu_trade_and_technology_council/) - - [Crooks steal NFTs worth '$3m' in Bored Ape Yacht Club heist](https://go.theregister.com/feed/www.theregister.com/2022/04/26/nft_theft_bored_ape_yacht_club/) -- Your Hacking Tutorial by Zempirians - - [Wordpress Core 5.8.2 - SQL INJECTION](https://www.reddit.com/r/HowToHack/comments/uco6j0/wordpress_core_582_sql_injection/) - - [How to create a damn vulnerable network?](https://www.reddit.com/r/HowToHack/comments/ucnoy1/how_to_create_a_damn_vulnerable_network/) - - [How do I get hashcat to effectively use wordlist to crack longer passwords?](https://www.reddit.com/r/HowToHack/comments/ucpeyg/how_do_i_get_hashcat_to_effectively_use_wordlist/) - - [Why are there sometimes randomly emails in worlists?](https://www.reddit.com/r/HowToHack/comments/uclrf5/why_are_there_sometimes_randomly_emails_in/) - - [Help me with a little HW?](https://www.reddit.com/r/HowToHack/comments/uc3ijh/help_me_with_a_little_hw/) -- 黑奇士 - - [评河南消协诉辛巴燕窝事件：保护消费者权益不能耍花架子](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247486970&idx=1&sn=0f1d6656c1c5ba0e4489d866ab611958&chksm=eca20216dbd58b00fea7a65b77603329ef46ceb05d45063f1fa77e194ba795f700cd1fa2c657&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-04-29.md b/archive/2022/2022-04-29.md deleted file mode 100644 index ac6f043cdc..0000000000 --- a/archive/2022/2022-04-29.md +++ /dev/null @@ -1,209 +0,0 @@ -# 每日安全资讯（2022-04-29） - -- HackerOne Hacker Activity - - [subdomain takeover (abandoned Zendesk █.easycontactnow.com)](https://hackerone.com/reports/1486670) -- Files ≈ Packet Storm - - [nullcon Goa 2022 Call For Papers](https://packetstormsecurity.com/files/166891/nullconGoa2022-cfp.txt) - - [Ubuntu Security Notice USN-5392-1](https://packetstormsecurity.com/files/166890/USN-5392-1.txt) - - [Ubuntu Security Notice USN-5394-1](https://packetstormsecurity.com/files/166889/USN-5394-1.txt) - - [Ubuntu Security Notice USN-5371-2](https://packetstormsecurity.com/files/166888/USN-5371-2.txt) - - [Ubuntu Security Notice USN-5393-1](https://packetstormsecurity.com/files/166887/USN-5393-1.txt) - - [Home Clean Service System 1.0 SQL Injection](https://packetstormsecurity.com/files/166886/hcss10-sql.txt) -- Security Boulevard - - [Mutual TLS: Vital for Securing Microservices in a Service Mesh](https://securityboulevard.com/2022/04/mutual-tls-vital-for-securing-microservices-in-a-service-mesh/) - - [Ukraine Digital Public Conversation – April 19 – 25, 2022](https://securityboulevard.com/2022/04/ukraine-digital-public-conversation-april-19-25-2022/) - - [Cyber Insurance: What to Know for 2022 and Beyond](https://securityboulevard.com/2022/04/cyber-insurance-what-to-know-for-2022-and-beyond/) - - [What is a watering hole attack?](https://securityboulevard.com/2022/04/what-is-a-watering-hole-attack/) - - [OWASP® Global AppSec US 2021 Virtual – Joern Freydank’s ‘Security Design Anti-Patterns – Creating Awareness To Limit Security Debt’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-joern-freydanks-security-design-anti-patterns-creating-awareness-to-limit-security-debt/) - - [A New Day, A New Warning: HHS Issues Guidance to HPH Sector About Insider Threats in Healthcare](https://securityboulevard.com/2022/04/a-new-day-a-new-warning-hhs-issues-guidance-to-hph-sector-about-insider-threats-in-healthcare/) - - [Survey Surfaces Raft of Cloud Security Challenges](https://securityboulevard.com/2022/04/survey-surfaces-raft-of-cloud-security-challenges/) - - [Why we joined forces with Snyk](https://securityboulevard.com/2022/04/why-we-joined-forces-with-snyk/) - - [Software Supply Chain Security Terminology](https://securityboulevard.com/2022/04/software-supply-chain-security-terminology/) -- 安全客-有思想的安全新媒体 - - [NPS内网穿透工具使用详解](https://www.anquanke.com/post/id/272637) - - [MITRE ATT&CK v11 更新速览](https://www.anquanke.com/post/id/272658) - - [CVE-2022-22947 Spring Cloud Gateway RCE](https://www.anquanke.com/post/id/272655) - - [第九届“首都网络安全日”拉开帷幕](https://www.anquanke.com/post/id/272692) - - [Emotet恶意软件现在通过Windows快捷方式文件中的PowerShell安装](https://www.anquanke.com/post/id/272660) - - [4月28日每日安全热点 - 英国电信和东芝推出开创性的量子通信服务](https://www.anquanke.com/post/id/272691) -- 绿盟科技技术博客 - - [从Falco看如何利用eBPF检测系统调用](http://blog.nsfocus.net/falco-ebpf/) -- Jiajun的编程随想 - - [Golang migrate 做数据库变更管理](https://jiajunhuang.com/articles/2022_04_28-golang_migrate_iofs.md.html) -- 跳跳糖 - 安全与分享社区 - - [浅谈hook攻防](https://tttang.com/archive/1558/) -- Google Online Security Blog - - [The Package Analysis Project: Scalable detection of malicious open source packages](http://security.googleblog.com/2022/04/the-package-analysis-project-scalable.html) -- Sploitus.com Exploits RSS Feed - - [Home Clean Service System v1.0 - 2022 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37675&utm_source=rss&utm_medium=rss) - - [Home Clean Service System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166886&utm_source=rss&utm_medium=rss) - - [Exploit for Integer Overflow or Wraparound in Libexpat Project Libexpat exploit](https://sploitus.com/exploit?id=83517174-9759-52CB-8458-CAA51DE6014D&utm_source=rss&utm_medium=rss) - - [Exploit for Use of a Broken or Risky Cryptographic Algorithm in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=4A3B5C53-2CB2-5006-B0EC-6228432CF4CF&utm_source=rss&utm_medium=rss) - - [Exploit for Use After Free in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=E512369B-4B70-5546-9049-78495817DFD3&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-24449 exploit](https://sploitus.com/exploit?id=400F43F8-496C-519A-BA45-5699750AFBDD&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Apple Ipados exploit](https://sploitus.com/exploit?id=C7049E0A-AC30-510F-B4B2-FE149F71A7D4&utm_source=rss&utm_medium=rss) -- ZecOps Blog - - [ZecOps Announces Support for Forensics Images Acquired by GrayShift](https://blog.zecops.com/announcements/zecops-announces-support-for-forensics-images-acquired-by-grayshift/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 北京健康宝遭境外网络攻击；有文件揭示Facebook违法使用用户数据](https://www.freebuf.com/news/331648.html) - - [Linux Nimbuspwn漏洞可能允许攻击者部署复杂的威胁](https://www.freebuf.com/news/331572.html) - - [影响甚微 数据泄露后Conti活动有增无减](https://www.freebuf.com/articles/331558.html) - - [Gartner：响应网络安全事件的3个必备工具](https://www.freebuf.com/articles/331550.html) - - [美国悬赏1000万美元，征集6名俄罗斯沙虫组织成员线索](https://www.freebuf.com/news/331540.html) - - [2021年利用最多的前15个漏洞出炉，附列表](https://www.freebuf.com/news/331527.html) - - [今年一季度暴露的数据库数量创新高，Redis排第一](https://www.freebuf.com/news/331520.html) -- Chromium Blog - - [Chrome 102: Window Controls Overlay, a Host of Finished Origin Trials, PWAs as File Handlers and More](http://blog.chromium.org/2022/04/chrome-102-window-controls-overlay-host.html) -- ふるつき - - [slide attack - Plaid CTF 2022 choreography upsolve](https://furutsuki.hatenablog.com/entry/2022/04/29/031903) -- NVISO Labs - - [Cortex XSOAR Tips & Tricks – Execute Commands Using The API](https://blog.nviso.eu/2022/04/28/cortex-xsoar-tips-tricks-execute-commands-using-the-api/) -- GuidePoint Security - - [What Steps U.S. Banks Should Do to Ensure They Can Address the FDIC’s New Breach Notification Requirements](https://www.guidepointsecurity.com/blog/what-steps-u-s-banks-should-do-to-ensure-they-can-address-the-fdics-new-breach-notification-requirements/) -- Malwarebytes Labs - - [Why you should be taking security advice from your grandmother](https://blog.malwarebytes.com/scams/2022/04/why-you-should-be-taking-security-advice-from-your-grandmother/) - - [FBI warns food and agriculture to brace for seasonal ransomware attacks](https://blog.malwarebytes.com/vital-infrastructure/2022/04/fbi-warns-food-and-agriculture-to-brace-for-seasonal-ransomware-attacks/) - - [Hackers fool major tech companies into handing over data of women and minors to abuse](https://blog.malwarebytes.com/social-engineering/2022/04/hackers-fool-major-tech-companies-into-handing-over-data-of-women-and-minors-to-abuse/) - - [Call of Duty cheats can expect embarrassment with new anti-cheat feature](https://blog.malwarebytes.com/malwarebytes-news/2022/04/call-of-duty-cheats-can-expect-embarrassment-with-new-anti-cheat-feature/) - - [Fake USA for UNHCR site wants your Ukraine donations in Bitcoin](https://blog.malwarebytes.com/social-engineering/2022/04/fake-usa-for-unhcr-site-wants-your-ukraine-donations-in-bitcoin/) - - [QNAP customers urged to disable AFP to protect against severe vulnerabilities](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/04/qnap-customers-urged-to-disable-afp-to-protect-against-severe-vulnerabilities/) - - [Onyx ransomware destroys files, and also the criminal circle of trust](https://blog.malwarebytes.com/ransomware/2022/04/onyx-ransomware-destroys-files-and-also-the-criminal-circle-of-trust/) - - [Facebook phishers threaten users with Page Recovery Help Support](https://blog.malwarebytes.com/scams/2022/04/facebook-phishers-threaten-users-with-page-recovery-help-support/) -- blog.avast.com EN - - [Celebrating World Autism Awareness Month with educational activities and our Autism@IT mentoring project](https://blog.avast.com/world-autism-awareness-month) - - [This is how Elon Musk can securely achieve his mission of authenticating Twitter users](https://blog.avast.com/elon-musk-twitter-authentication) -- SentinelOne - - [Enterprise Security Essentials | Top 15 Most Routinely Exploited Vulnerabilities 2022](https://www.sentinelone.com/blog/enterprise-security-essentials-top-15-most-routinely-exploited-vulnerabilities-2022/) -- Reverse Engineering - - [Seer is a tool that recognizes the architecture of a binary file](https://www.reddit.com/r/ReverseEngineering/comments/udqgv3/seer_is_a_tool_that_recognizes_the_architecture/) - - [FindFunc: An IDA plugin for advanced function matching by assembly template, constants, string/name/byte reference](https://www.reddit.com/r/ReverseEngineering/comments/udikxq/findfunc_an_ida_plugin_for_advanced_function/) -- Yassine Aboukir - - [Exploitation of an SSRF vulnerability against EC2 IMDSv2](https://www.yassineaboukir.com//blog/exploitation-of-an-SSRF-vulnerability-against-EC2-IMDSv2/) -- Microsoft Security Response Center - - [Azure Database for PostgreSQL Flexible Server Privilege Escalation and Remote Code Execution](https://msrc-blog.microsoft.com/2022/04/28/azure-database-for-postgresql-flexible-server-privilege-escalation-and-remote-code-execution/) -- The Daily Swig | Cybersecurity news and views - - [Microsoft report unmasks at least six Russian nation-state actors responsible for cyber-attacks against Ukraine](https://portswigger.net/daily-swig/microsoft-report-unmasks-at-least-six-russian-nation-state-actors-responsible-for-cyber-attacks-against-ukraine) - - [Socket: New tool takes a proactive approach to prevent OSS supply chain attacks](https://portswigger.net/daily-swig/socket-new-tool-takes-a-proactive-approach-to-prevent-oss-supply-chain-attacks) -- Geek Freak - - [Reconnaissance](https://dhiyaneshgeek.github.io/red/teaming/2022/04/28/reconnaissance-red-teaming/) -- 博客园 - nice_0e3 - - [Java安全之JSF 反序列化 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16205220.html) -- Mozilla Hacks – the Web developer blog - - [Common Voice dataset tops 20,000 hours](https://hacks.mozilla.org/2022/04/common-voice-dataset-tops-20000-hours/) - - [MDN Plus now available in more countries](https://hacks.mozilla.org/2022/04/mdn-plus-now-available-in-more-markets/) -- KitPloit - PenTest & Hacking Tools - - [IOSSecuritySuite - iOS Platform Security And Anti-Tampering Swift Library](http://www.kitploit.com/2022/04/iossecuritysuite-ios-platform-security.html) - - [Rip Raw - Small Tool To Analyse The Memory Of Compromised Linux Systems](http://www.kitploit.com/2022/04/rip-raw-small-tool-to-analyse-memory-of.html) -- 博客园 - 郑瀚Andrew.Hann - - [《四千年农夫：中国、朝鲜和日本的永续农业》笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16202264.html) - - [《农产品物流》笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16200058.html) -- 奇客Solidot–传递最新科技情报 - - [Fedora 简化 Linux 图形处理](https://www.solidot.org/story?sid=71394) - - [中非批准比特币成为法币](https://www.solidot.org/story?sid=71393) - - [五分之一爬行动物有灭绝风险](https://www.solidot.org/story?sid=71392) - - [Onyx 勒索软件会毁掉而不是加密大文件](https://www.solidot.org/story?sid=71391) - - [FFmpeg 合并 JPEG-XL 图像格式支持](https://www.solidot.org/story?sid=71390) - - [UCSB和迪士尼想知道机器人可以跳多高](https://www.solidot.org/story?sid=71389) - - [如果人类把疾病传给动物会发生什么？](https://www.solidot.org/story?sid=71388) - - [普通铜电话线可承载千兆带宽](https://www.solidot.org/story?sid=71387) - - [研究人员开发出像纸一样薄的扬声器](https://www.solidot.org/story?sid=71386) - - [苹果开设网上自助维修店](https://www.solidot.org/story?sid=71385) - - [ARM 再次尝试重新控制中国合资公司](https://www.solidot.org/story?sid=71384) - - [朝鲜黑客与政府玩猫捉老鼠游戏](https://www.solidot.org/story?sid=71383) -- Secureworks Blog - - [SOC Operations: The XDR Attributes that Matter](https://www.secureworks.com/blog/soc-operations-the-xdr-attributes-that-matter) -- Fortinet Threat Research Blog - - [An Overview of the Increasing Wiper Malware Threat](https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat) -- TrustedSec - - [NFT Crime: From the Simple to the Ingeniously Simple](https://www.trustedsec.com/blog/nft-crime-from-the-simple-to-the-ingeniously-simple/) -- Google Online Security Blog - - [The Package Analysis Project: Scalable detection of malicious open source packages](http://security.googleblog.com/2022/04/the-package-analysis-project-scalable.html) -- - - [Keep timeless analysis records to the point with REVEN and GDB](https://blog.tetrane.com/2022/focused-system-recording-with-reven-and-gdb.html) -- Securityinfo.it - - [Privilegi di root in Linux con Nimbuspwn](https://www.securityinfo.it/2022/04/28/privilegi-di-root-in-linux-con-nimbuspwn/?utm_source=rss&utm_medium=rss&utm_campaign=privilegi-di-root-in-linux-con-nimbuspwn) - - [Svelati i bug più diffusi del 2021 nei paesi dei Cinque Occhi](https://www.securityinfo.it/2022/04/28/svelati-i-bug-piu-diffusi-del-2021-nei-paesi-dei-cinque-occhi/?utm_source=rss&utm_medium=rss&utm_campaign=svelati-i-bug-piu-diffusi-del-2021-nei-paesi-dei-cinque-occhi) -- cavallette - - [Sì, abbiamo cambiato la home di noblogs! – yes, we changed the home page of noblogs!](https://cavallette.noblogs.org/2022/04/9746) -- SANS Internet Storm Center, InfoCON: green - - [A Day of SMB: What does our SMB/RPC Honeypot see? CVE-2022-26809, (Thu, Apr 28th)](https://isc.sans.edu/diary/rss/28594) - - [ISC Stormcast For Thursday, April 28th, 2022 https://isc.sans.edu/podcastdetail.html?id=7984, (Thu, Apr 28th)](https://isc.sans.edu/diary/rss/28592) -- Schneier on Security - - [Microsoft Issues Report of Russian Cyberattacks against Ukraine](https://www.schneier.com/blog/archives/2022/04/microsoft-issues-report-of-russian-cyberattacks-against-ukraine.html) -- /dev/random - - [Botconf Day 2 Wrap-Up](https://blog.rootshell.be/2022/04/29/botconf-day-2-wrap-up/) -- Deeplinks - - [EFF Statement on the Declaration for the Future of the Internet](https://www.eff.org/deeplinks/2022/04/eff-statement-declaration-future-internet) -- Dark Reading - - [Microsoft Patches Pair of Dangerous Vulnerabilities in Azure PostgreSQL](https://www.darkreading.com/cloud/microsoft-patches-pair-of-dangerous-vulnerabilities-in-azure-postgresql) - - [IT Teams Worry Staff Lack Cloud-Specific Skills](https://www.darkreading.com/edge-threat-monitor/it-teams-worry-staff-lack-cloud-specific-skills) - - [Capital One Ventures, Snowflake Ventures, Verizon Ventures, and Wipro Ventures Join Securonix $1B+ Growth Investment as Strategic Investors](https://www.darkreading.com/press-release/capital-one-ventures-snowflake-ventures-verizon-ventures-and-wipro-ventures-join-securonix-1b-growth-investment-as-strategic-investors) - - [The Ransomware Crisis Deepens, While Data Recovery Stalls](https://www.darkreading.com/attacks-breaches/ransomware-crisis-deepens-data-recovery-stalls) - - [Bumblebee Malware Buzzes Into Cyberattack Fray](https://www.darkreading.com/attacks-breaches/bumblebee-malware-cyberattack-fray) - - [Microsoft: Russia Using Cyberattacks in Coordination With Military Invasion of Ukraine](https://www.darkreading.com/attacks-breaches/russia-using-cyberattacks-in-coordination-with-military-invasion-of-ukraine) - - [Explainable AI for Fraud Prevention](https://www.darkreading.com/analytics/explainable-ai-for-fraud-prevention) - - [A Peek into Visa's AI Tools Against Fraud](https://www.darkreading.com/edge-articles/a-peek-into-visa-s-ai-tools-against-fraud) -- /r/netsec - Information Security News & Discussion - - [Kubernetes Goat - Interactive Kubernetes Security Learning Playground 🚀](https://www.reddit.com/r/netsec/comments/ue2q4d/kubernetes_goat_interactive_kubernetes_security/) - - [Anatomy of a Zero Day - How to decrypt....a robot?](https://www.reddit.com/r/netsec/comments/udzbc2/anatomy_of_a_zero_day_how_to_decrypta_robot/) - - [FindFunc: An IDA plugin for advanced function matching by assembly template, constants, string/name/byte reference](https://www.reddit.com/r/netsec/comments/udozb3/findfunc_an_ida_plugin_for_advanced_function/) - - [How to master Google Hacking (Dorking)](https://www.reddit.com/r/netsec/comments/udyf8s/how_to_master_google_hacking_dorking/) - - [Elevation of privilege Linux vulnerability: Nimbuspwn](https://www.reddit.com/r/netsec/comments/udonya/elevation_of_privilege_linux_vulnerability/) - - [Bypassing LDAP Channel Binding with StartTLS](https://www.reddit.com/r/netsec/comments/udyf2q/bypassing_ldap_channel_binding_with_starttls/) - - [reposaur - use Rego to audit your GitHub org security posture](https://www.reddit.com/r/netsec/comments/ue1if5/reposaur_use_rego_to_audit_your_github_org/) - - [ExtraReplica: cross-account database vulnerability in Azure PostgreSQL](https://www.reddit.com/r/netsec/comments/udv0q6/extrareplica_crossaccount_database_vulnerability/) - - [nimbuspwn detector (CVE-2022-29799 & CVE-2022-29800) - check whether local system is possibly vulnerable](https://www.reddit.com/r/netsec/comments/udu4hd/nimbuspwn_detector_cve202229799_cve202229800/) - - [LAPSUS$: Recent techniques, tactics and procedures](https://www.reddit.com/r/netsec/comments/ue317v/lapsus_recent_techniques_tactics_and_procedures/) - - [Colibri Loader's Unique Persistence Technique Using Get-Variable Cmdlet](https://www.reddit.com/r/netsec/comments/ue0mrz/colibri_loaders_unique_persistence_technique/) - - [Socket: New tool takes a proactive approach to prevent OSS supply chain attacks](https://www.reddit.com/r/netsec/comments/ue41mx/socket_new_tool_takes_a_proactive_approach_to/) - - [How to save fiddler everywhere result in SEQUENCE it captured ? I'm trying to save the raw date IN SEQUENCE it captured but unable to save in sequece it captured.](https://www.reddit.com/r/netsec/comments/udyhlk/how_to_save_fiddler_everywhere_result_in_sequence/) -- Blackhat Library: Hacking techniques and research - - [Black Hat Asia 2021](https://www.reddit.com/r/blackhat/comments/udw1vc/black_hat_asia_2021/) -- Threatpost - - [Attacker Breach ‘Dozens’ of GitHub Repos Using Stolen OAuth Tokens](https://threatpost.com/github-repos-stolen-oauth-tokens/179427/) - - [Cyberattacks Rage in Ukraine, Support Military Operations](https://threatpost.com/cyberwar-ukraine-military/179421/) -- ICT Security Magazine - - [Cos’è la OT Security e come si relaziona con la sicurezza IT](https://www.ictsecuritymagazine.com/articoli/cose-la-ot-security-e-come-si-relaziona-con-la-sicurezza-it/) -- TorrentFreak - - [US Calls Out Countries For Failing to Tackle Pirate IPTV & Movie ‘Camming’](https://torrentfreak.com/us-calls-out-countries-for-failing-to-tackle-pirate-iptv-movie-camming-220428/) - - [Court Dismisses Bungie’s Copyright Claims Against Cheat Seller AimJunkies, For Now](https://torrentfreak.com/court-dismisses-bungies-copyright-claims-against-cheat-seller-aimjunkies-for-now-220528/) -- Security Affairs - - [Bumblebee, a new malware loader used by multiple crimeware threat actors](https://securityaffairs.co/wordpress/130699/cyber-crime/new-bumblebee-loader.html) - - [CISA published 2021 Top 15 most exploited software vulnerabilities](https://securityaffairs.co/wordpress/130691/hacking/top-15-most-exploited-software-vulnerabilities.html) - - [CloudFlare blocked a record HTTPs DDoS attack peaking at 15 rps](https://securityaffairs.co/wordpress/130685/hacking/cloudflare-record-https-ddos.html) - - [Russia-linked threat actors launched hundreds of cyberattacks on Ukraine](https://securityaffairs.co/wordpress/130677/apt/russia-hit-ukraine-hundreds-cyberattacks.html) -- NetSPI - - [EY Announces NetSPI CEO Aaron Shilts as an Entrepreneur Of The Year® 2022 Heartland Award Finalist](https://www.netspi.com/news/press-release/ey-entrepreneur-of-the-year-heartland-2022-aaron-shilts/) - - [Not Your Average Bug Bounty: How an Email, a Shirt, and a Sticker Compromised a High Security Datacenter](https://www.netspi.com/blog/technical/social-engineering-penetration-testing/not-your-average-bug-bounty-datacenter/) -- KitPloit - PenTest Tools! - - [IOSSecuritySuite - iOS Platform Security And Anti-Tampering Swift Library](http://www.kitploit.com/2022/04/iossecuritysuite-ios-platform-security.html) - - [Rip Raw - Small Tool To Analyse The Memory Of Compromised Linux Systems](http://www.kitploit.com/2022/04/rip-raw-small-tool-to-analyse-memory-of.html) -- Social Engineering - - [How do I social engineer on my cv, cover letter and in email too get called in for a job interview? Like what sort of things should I type? The place is a hair salon I want to do my apprenticeship in.](https://www.reddit.com/r/SocialEngineering/comments/udx0qh/how_do_i_social_engineer_on_my_cv_cover_letter/) - - [how to change a stubborn person mind](https://www.reddit.com/r/SocialEngineering/comments/udr5o9/how_to_change_a_stubborn_person_mind/) -- Graham Cluley - - [Smashing Security podcast #272: Going ape over the Kardashians, and the face of romance scams](https://grahamcluley.com/smashing-security-podcast-272/) - - [US offers $10 million reward for information about Russian military hackers implicated in NotPetya attack](https://www.bitdefender.com/blog/hotforsecurity/us-offers-10-million-reward-for-information-about-russian-military-hackers-implicated-in-notpetya-attack/) -- Your Hacking Tutorial by Zempirians - - [How to evade endpoint detection and antivirus with custom-crafted backdoors and payloads](https://www.reddit.com/r/HowToHack/comments/ue8g9h/how_to_evade_endpoint_detection_and_antivirus/) - - [Websocket sending data to server question](https://www.reddit.com/r/HowToHack/comments/udzljt/websocket_sending_data_to_server_question/) - - [Hash question](https://www.reddit.com/r/HowToHack/comments/ue3zry/hash_question/) - - [How to prevent feds from finding data on my phone](https://www.reddit.com/r/HowToHack/comments/ue63ul/how_to_prevent_feds_from_finding_data_on_my_phone/) - - [Setting up c2 framework across ssh tunnel](https://www.reddit.com/r/HowToHack/comments/udwfse/setting_up_c2_framework_across_ssh_tunnel/) - - [testfire.net injection attack question](https://www.reddit.com/r/HowToHack/comments/udo1vp/testfirenet_injection_attack_question/) -- NVISO Labs - - [Cortex XSOAR Tips & Tricks – Execute Commands Using The API](https://blog.nviso.eu/2022/04/28/cortex-xsoar-tips-tricks-execute-commands-using-the-api/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [OWASP Membership (SecureFlag Platform), TryHackMe, or HackTheBox?](https://www.reddit.com/r/netsecstudents/comments/ue1j35/owasp_membership_secureflag_platform_tryhackme_or/) - - [KrbRelayUp Mitigations](https://www.reddit.com/r/netsecstudents/comments/udljzc/krbrelayup_mitigations/) -- The Register - Security - - [Cloudflare stomps huge DDoS attack on crypto platform](https://go.theregister.com/feed/www.theregister.com/2022/04/28/cloudflare-largest-ddos-attack-/) - - [Money or your business: Ensure your ransomware defense strategy beats off disruptions, extortions](https://go.theregister.com/feed/www.theregister.com/2022/04/28/money_or_your_business_ensure/) - - [Five Eyes nations reveal 2021's fifteen most-exploited flaws](https://go.theregister.com/feed/www.theregister.com/2022/04/28/most_exploited_vulnerabilities_2021/) -- Computer Forensics - - [Android TV examination](https://www.reddit.com/r/computerforensics/comments/ue15bb/android_tv_examination/) - - [Steganography for E01 files??](https://www.reddit.com/r/computerforensics/comments/ue6dcv/steganography_for_e01_files/) -- Deep Web - - [how to stay safe on the deep web?](https://www.reddit.com/r/deepweb/comments/ue0b4h/how_to_stay_safe_on_the_deep_web/) -- Paul's Security Weekly - - [BSW #260 - Jess Burn](http://podcast.securityweekly.com/bsw-260-jess-burn) diff --git a/archive/2022/2022-04-30.md b/archive/2022/2022-04-30.md deleted file mode 100644 index 4bc5bd7593..0000000000 --- a/archive/2022/2022-04-30.md +++ /dev/null @@ -1,235 +0,0 @@ -# 每日安全资讯（2022-04-30） - -- Files ≈ Packet Storm - - [TOR Virtual Network Tunneling Tool 0.4.7.7](https://packetstormsecurity.com/files/166906/tor-0.4.7.7.tar.gz) - - [Red Hat Security Advisory 2022-1645-01](https://packetstormsecurity.com/files/166905/RHSA-2022-1645-01.txt) - - [Red Hat Security Advisory 2022-1644-01](https://packetstormsecurity.com/files/166904/RHSA-2022-1644-01.txt) - - [Red Hat Security Advisory 2022-1492-01](https://packetstormsecurity.com/files/166903/RHSA-2022-1492-01.txt) - - [Red Hat Security Advisory 2022-1643-01](https://packetstormsecurity.com/files/166902/RHSA-2022-1643-01.txt) - - [Red Hat Security Advisory 2022-1436-01](https://packetstormsecurity.com/files/166901/RHSA-2022-1436-01.txt) - - [Red Hat Security Advisory 2022-1437-01](https://packetstormsecurity.com/files/166900/RHSA-2022-1437-01.txt) - - [Red Hat Security Advisory 2022-1439-01](https://packetstormsecurity.com/files/166899/RHSA-2022-1439-01.txt) - - [Red Hat Security Advisory 2022-1438-01](https://packetstormsecurity.com/files/166898/RHSA-2022-1438-01.txt) - - [Red Hat Security Advisory 2022-1435-01](https://packetstormsecurity.com/files/166897/RHSA-2022-1435-01.txt) - - [Ubuntu Security Notice USN-5398-1](https://packetstormsecurity.com/files/166896/USN-5398-1.txt) - - [Ubuntu Security Notice USN-5397-1](https://packetstormsecurity.com/files/166895/USN-5397-1.txt) - - [Ubuntu Security Notice USN-5396-1](https://packetstormsecurity.com/files/166894/USN-5396-1.txt) - - [Ubuntu Security Notice USN-5395-1](https://packetstormsecurity.com/files/166893/USN-5395-1.txt) - - [Red Hat Security Advisory 2022-1642-01](https://packetstormsecurity.com/files/166892/RHSA-2022-1642-01.txt) -- Darknet - - [Socialscan – Command-Line Tool To Check For Email And Social Media Username Usage](https://www.darknet.org.uk/2022/04/socialscan-command-line-tool-to-check-for-email-and-social-media-username-usage/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed) -- Sploitus.com Exploits RSS Feed - - [Exploit for Out-of-bounds Read in Google Android exploit](https://sploitus.com/exploit?id=E0CC138A-5AFE-570C-A1AC-13C2252B0C66&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Google Android exploit](https://sploitus.com/exploit?id=5BAC1DED-67B0-58E9-B61A-8EB28DC128CF&utm_source=rss&utm_medium=rss) - - [Exploit for Integer Overflow or Wraparound in Openssl exploit](https://sploitus.com/exploit?id=5BCFB44C-A4FD-5890-AE9A-A60CC135A2F1&utm_source=rss&utm_medium=rss) -- HackerOne Hacker Activity - - [Reflected XSS due to vulnerable version of sockjs](https://hackerone.com/reports/1100326) - - [Hardcoded AWS credentials in ███████.msi](https://hackerone.com/reports/1368690) - - [Reflected XSS [██████]](https://hackerone.com/reports/1309385) - - [Reflected XSS [███]](https://hackerone.com/reports/1309237) - - [lfi in filePathDownload parameter via ███████](https://hackerone.com/reports/1542734) - - [Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint on ████████](https://hackerone.com/reports/1278977) - - [SSRF due to CVE-2021-27905 in www.████████](https://hackerone.com/reports/1183472) - - [██████████ vulnerable to CVE-2022-22954](https://hackerone.com/reports/1537543) - - [Blind SQL Injection](https://hackerone.com/reports/771215) - - [SQL INJECTION in https://████/██████████](https://hackerone.com/reports/723044) - - [Possibility to force an admin to install recommended applications](https://hackerone.com/reports/1403614) - - [OAUTH2 bearer not-checked for connection re-use](https://hackerone.com/reports/1552110) - - [CVE-2022-22576: OAUTH2 bearer bypass in connection re-use](https://hackerone.com/reports/1526328) - - [DoS via large console messages](https://hackerone.com/reports/1243724) - - [CVE-2022-27776: Auth/cookie leak on redirect](https://hackerone.com/reports/1551591) - - [CVE-2022-27775: Bad local IPv6 connection reuse](https://hackerone.com/reports/1551588) - - [CVE-2022-27774: Credential leak on redirect](https://hackerone.com/reports/1551586) -- 绿盟科技技术博客 - - [绿盟威胁情报月报-202204](http://blog.nsfocus.net/monthly-202204/) - - [挖矿监测“动态清零”，近期是否卓有成效？](http://blog.nsfocus.net/ntip-3/) - - [让windbg反”反调试”](http://blog.nsfocus.net/windbg-re/) -- FreeBuf网络安全行业门户 - - [法国一医疗软件公司因泄露49万患者数据被罚150万欧元](https://www.freebuf.com/articles/331808.html) - - [移动发送奇怪短信？我想起了通讯行业的核弹级漏洞](https://www.freebuf.com/news/331797.html) - - [漏洞分析篇：栈溢出（CVE-2006-3439）漏洞分析](https://www.freebuf.com/vuls/331772.html) - - [从0到1之安全运营如何做好监控？| FreeBuf甲方社群直播回顾](https://www.freebuf.com/articles/web/331762.html) - - [FreeBuf甲方群话题讨论 | 聊聊企业攻防实战演练](https://www.freebuf.com/articles/neopoints/331757.html) - - [攻击者劫持大量WordPress网站，对乌克兰进行DDoS攻击](https://www.freebuf.com/articles/331760.html) - - [FreeBuf周报 | 北京健康宝遭境外网络攻击；可口可乐证实受到网络攻击并开展调查](https://www.freebuf.com/articles/331724.html) - - [议题前瞻丨关于零信任架构在金融企业中应用的思路探讨](https://www.freebuf.com/fevents/331722.html) - - [微软修复了暴露用户数据库的ExtraReplica Azure漏洞](https://www.freebuf.com/news/331712.html) - - [研究发现，支付赎金只占勒索攻击事件总损失的 15%](https://www.freebuf.com/news/331700.html) - - [官方通告，北京健康宝遭境外网络攻击](https://www.freebuf.com/news/331681.html) -- Jiajun的编程随想 - - [使用Drone CI构建CI/CD系统](https://jiajunhuang.com/articles/2022_04_29-drone_ci.md.html) - - [PostgreSQL 操作笔记](https://jiajunhuang.com/articles/2022_04_29-postgres_notes.md.html) -- 跳跳糖 - 安全与分享社区 - - [GO逆向分析小结-goparse使用与深入理解interface](https://tttang.com/archive/1574/) -- Sucuri Blog - - [Hacked Website Threat Report 2021](https://blog.sucuri.net/2022/04/hacked-website-threat-report-2021.html) -- 安全客-有思想的安全新媒体 - - [360政企安全集团渠道政策2.0正式发布, 与合作伙伴实现共享、共创、共赢](https://www.anquanke.com/post/id/272782) - - [数字安全观察-每周简报 （20220416-20220422）](https://www.anquanke.com/post/id/272750) - - [社区活动 | 来咯来咯，前方有惊喜降落](https://www.anquanke.com/post/id/272656) - - [PSA: Onyx勒索软件破坏大文件，而不是加密它们](https://www.anquanke.com/post/id/272700) - - [4月29日每日安全热点 - 联合国收集乌克兰难民生物数据](https://www.anquanke.com/post/id/272727) -- ElcomSoft blog - - [Agent-Based Low-Level iOS File System Extraction](https://blog.elcomsoft.com/2022/04/agent-based-low-level-ios-file-system-extraction/) -- Security Boulevard - - [Tarrak Malware](https://securityboulevard.com/2022/04/tarrak-malware/) - - [Facebook’s Meta Algorithms Harming Children by Pushing Toxic Content](https://securityboulevard.com/2022/04/facebooks-meta-algorithms-harming-children-by-pushing-toxic-content/) - - [You Can Now Ask Google to Remove Your Phone Number, Email or Address from Search Results](https://securityboulevard.com/2022/04/you-can-now-ask-google-to-remove-your-phone-number-email-or-address-from-search-results/) - - [Integrating Better: What Can Integrations Do For Me?](https://securityboulevard.com/2022/04/integrating-better-what-can-integrations-do-for-me/) - - [Subtle Tweak to AI Blows Up Missile Accuracy Test](https://securityboulevard.com/2022/04/subtle-tweak-to-ai-blows-up-missile-accuracy-test/) - - [OWASP® Global AppSec US 2021 Virtual – Chuck Willis’ & Wias Issa’s ‘Data At Rest Encryption: Going Beyond The Basics To Address Modern Attacks’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-chuck-willis-wias-issas-data-at-rest-encryption-going-beyond-the-basics-to-address-modern-attacks/) - - [Twitter as Bully Pulpit: “political right enjoys higher amplification compared to the political left”](https://securityboulevard.com/2022/04/twitter-as-bully-pulpit-political-right-enjoys-higher-amplification-compared-to-the-political-left/) - - [How To Extend an EBS Volume Without an Instance Reboot](https://securityboulevard.com/2022/04/how-to-extend-an-ebs-volume-without-an-instance-reboot/) - - [XKCD ‘Lightsabers’](https://securityboulevard.com/2022/04/xkcd-lightsabers/) - - [Neighbor security: lessons learned for enterprise networks](https://securityboulevard.com/2022/04/neighbor-security-lessons-learned-for-enterprise-networks/) -- NVISO Labs - - [Analyzing VSTO Office Files](https://blog.nviso.eu/2022/04/29/analyzing-vsto-office-files/) -- Darknet - - [Socialscan – Command-Line Tool To Check For Email And Social Media Username Usage](https://www.darknet.org.uk/2022/04/socialscan-command-line-tool-to-check-for-email-and-social-media-username-usage/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed) -- Fox-IT International blog - - [Adventures in the land of BumbleBee](https://blog.fox-it.com/2022/04/29/adventures-in-the-land-of-bumblebee/) -- Didier Stevens - - [Update: oledump.py Version 0.0.65](https://blog.didierstevens.com/2022/04/29/update-oledump-py-version-0-0-65/) -- blog.avast.com EN - - [Will Elon Musk follow the rules in his takeover of Twitter?](https://blog.avast.com/eu-reminds-musk-follow-rules) -- Sucuri Blog - - [Hacked Website Threat Report 2021](https://blog.sucuri.net/2022/04/hacked-website-threat-report-2021.html) -- Reverse Engineering - - [What's a handy reverse engineering trick that you think more people should know about?](https://www.reddit.com/r/ReverseEngineering/comments/uerynp/whats_a_handy_reverse_engineering_trick_that_you/) -- SpiderLabs Blog from Trustwave - - [Stormous: The Pro-Russian, Clout Hungry Ransomware Gang Targets the US and Ukraine](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/stormous-the-pro-russian-clout-hungry-ransomware-gang-targets-the-us-and-ukraine/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 18](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-18-3/) -- The Daily Swig | Cybersecurity news and views - - [Bug Bounty Radar // The latest bug bounty programs for May 2022](https://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-may-2022) - - [Data breach at US healthcare provider ARcare impacts 345,000 individuals](https://portswigger.net/daily-swig/data-breach-at-us-healthcare-provider-arcare-impacts-345-000-individuals) - - [GitHub offers post-mortem on recent security breach](https://portswigger.net/daily-swig/github-offers-post-mortem-on-recent-security-breach) -- 4ra1n - - [反序列化漏洞的防御与拒绝服务](https://4ra1n.love/post/CMSguicYd/) -- Malwarebytes Labs - - [The top 5 most routinely exploited vulnerabilities of 2021](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/04/the-top-5-most-routinely-exploited-vulnerabilities-of-2021/) - - [Beware Twitter Messages claiming “Your blue badge Twitter account has been reviewed as spam”](https://blog.malwarebytes.com/social-engineering/2022/04/beware-twitter-messages-claiming-your-blue-badge-twitter-account-has-been-reviewed-as-spam/) - - [Beware scammers disguised as fraud busters](https://blog.malwarebytes.com/scams/2022/04/beware-scammers-disguised-as-fraud-busters/) - - [Warning! Instagram Stories hides a scam in plain sight](https://blog.malwarebytes.com/scams/2022/04/warning-instagram-stories-hides-a-scam-in-plain-sight/) - - [Google Play’s Data safety section empowers Android users to make informed app choices](https://blog.malwarebytes.com/android/2022/04/google-plays-data-safety-section-empowers-android-users-to-make-informed-app-choices/) - - [Ukraine government and pro-Ukrainian sites hit by DDoS attacks](https://blog.malwarebytes.com/security-world/2022/04/ukraine-government-and-pro-ukrainian-sites-hit-by-ddos-attacks/) -- 威尔的代码站 - - [一份面向Linux下高版本Java的Minecraft参数优化教程](https://blog.binklac.com/e6ad4dc21152/) - - [CSharp中实现一个可继承的Singleton基类](https://blog.binklac.com/8049404ed5c7/) -- rtl-sdr.com - - [SDR# and other Hobbyist Ham Radio Software Spotted in Netflix TV Show Yakamoz S-245](https://www.rtl-sdr.com/sdr-and-other-hobbyist-ham-radio-software-spotted-in-netflix-tv-show-yakamoz-s-245/) - - [SDRSharp Guide V4.2 Released](https://www.rtl-sdr.com/sdrsharp-guide-v4-2-released/) -- Security Café - - [Pentesting Azure: RECON Techniques](https://securitycafe.ro/2022/04/29/pentesting-azure-recon-techniques/) -- Hex Rays - - [Igor’s tip of the week #87: Function chunks and the decompiler](https://hex-rays.com/blog/igors-tip-of-the-week-87-function-chunks-and-the-decompiler/) -- KitPloit - PenTest & Hacking Tools - - [Osinteye - Username Enumeration And Reconnaisance Suite](http://www.kitploit.com/2022/04/osinteye-username-enumeration-and.html) - - [Lupo - Malware IOC Extractor. Debugging Module For Malware Analysis Automation](http://www.kitploit.com/2022/04/lupo-malware-ioc-extractor-debugging.html) -- Fortinet Threat Research Blog - - [Using EPSS to Predict Threats and Secure Your Network](https://www.fortinet.com/blog/threat-research/predict-threats-and-secure-networks-with-epss) -- Data Breach - - [Anonymous hacked Russian PSCB Commercial Bank and companies in the energy sector](https://securityaffairs.co/wordpress/130726/cyber-warfare-2/anonymous-hack-russian-companies.html) -- Arturo Di Corinto - - [Microsoft lancia l’allarme: le cyber-operations russe potrebbero coinvolgere i paesi Nato](https://dicorinto.it/testate/repubblica-it/microsoft-lancia-lallarme-le-cyber-operations-russe-potrebbero-coinvolgere-i-paesi-nato/) - - [Tempi duri per gli spioni in Europa](https://dicorinto.it/testate/il-manifesto/tempi-duri-per-gli-spioni-in-europa%ef%bf%bc/) -- 90Sec - 最新话题 - - [搞到一套源码不知道怎么 写入一句话 后台上传也绕不过](https://forum.90sec.com/t/topic/2097) -- Securityinfo.it - - [Bug critici in Netatalk per NAS di Synology e QNAP](https://www.securityinfo.it/2022/04/29/bug-critici-in-netatalk-per-nas-di-synology-e-qnap/?utm_source=rss&utm_medium=rss&utm_campaign=bug-critici-in-netatalk-per-nas-di-synology-e-qnap) - - [Salgono i riscatti ma un po’ anche l’attenzione](https://www.securityinfo.it/2022/04/29/salgono-i-riscatti-ma-un-po-anche-lattenzione/?utm_source=rss&utm_medium=rss&utm_campaign=salgono-i-riscatti-ma-un-po-anche-lattenzione) -- Il Disinformatico - - [La sigla di testa di Star Trek: Strange New Worlds](http://attivissimo.blogspot.com/2022/04/la-sigla-di-testa-di-star-trek-strange.html) - - [Niente podcast stamattina, sono senza voce](http://attivissimo.blogspot.com/2022/04/niente-podcast-stamattina-sono-senza.html) -- IntelTechniques Blog - - [The Privacy, Security, & OSINT Show – Episode 259](https://inteltechniques.com/blog/2022/04/29/the-privacy-security-osint-show-episode-259/) -- Hakin9 – IT Security Magazine - - [iKy - tool that collects information from an email and shows results in a nice visual interface](https://hakin9.org/iky-tool-that-collects-information-from-an-email/) - - [Securing Web Applications in 2022: XDR, DAST, PTaaS & More by Gilad David Maayan](https://hakin9.org/securing-web-applications-in-2022-xdr-dast-ptaas/) -- Schneier on Security - - [Friday Squid Blogging: Ten-Foot Long Squid Washed onto Japanese Shore — ALIVE](https://www.schneier.com/blog/archives/2022/04/friday-squid-blogging-ten-foot-long-squid-washed-onto-japanese-shore-alive.html) - - [Video Conferencing Apps Sometimes Ignore the Mute Button](https://www.schneier.com/blog/archives/2022/04/video-conferencing-apps-sometimes-ignore-the-mute-button.html) -- 奇客Solidot–传递最新科技情报 - - [疫苗造成的脊髓灰质炎呈上升趋势](https://www.solidot.org/story?sid=71402) - - [气球检测到空中“声音通道”的初步迹象](https://www.solidot.org/story?sid=71401) - - [原始微型公寓的生与死](https://www.solidot.org/story?sid=71400) - - [“长寿饮食”怎么吃才长寿](https://www.solidot.org/story?sid=71398) - - [Eric Schmidt 投资加密货币对 Web3 表达兴趣](https://www.solidot.org/story?sid=71397) - - [微软测试在 Edge 中整合 VPN](https://www.solidot.org/story?sid=71396) - - [欧盟加入 Mastodon 社交网络](https://www.solidot.org/story?sid=71395) -- /dev/random - - [Botconf Day 3 Wrap-Up](https://blog.rootshell.be/2022/04/30/botconf-day-3-wrap-up/) -- TS-WAY - - [Weekly Threats N. 17 2022](https://www.ts-way.com/it/weekly-threats/2022/04/29/weekly-threats-n-17-2022/) -- SANS Internet Storm Center, InfoCON: green - - [Using Passive DNS sources for Reconnaissance and Enumeration, (Fri, Apr 29th)](https://isc.sans.edu/diary/rss/28596) - - [ISC Stormcast For Friday, April 29th, 2022 https://isc.sans.edu/podcastdetail.html?id=7986, (Fri, Apr 29th)](https://isc.sans.edu/diary/rss/28598) -- Security Affairs - - [Anonymous hacked Russian PSCB Commercial Bank and companies in the energy sector](https://securityaffairs.co/wordpress/130726/cyber-warfare-2/anonymous-hack-russian-companies.html) - - [Hurry up, disable AFP on your QNAP NAS until the vendor fixes 8 bugs](https://securityaffairs.co/wordpress/130720/hacking/critical-afp-qnap-nas.html) - - [It’s Called BadUSB for a Reason](https://securityaffairs.co/wordpress/130715/hacking/badusb.html) - - [Ongoing DDoS attacks from compromised sites hit Ukraine](https://securityaffairs.co/wordpress/130708/hacking/ddos-attack-hit-ukraine.html) -- Graham Cluley - - [Ransomware costs show prevention is better than the cure](https://www.tripwire.com/state-of-security/security-data-protection/ransomware-costs-prevention-better-than-cure/) - - [Elon Musk says Twitter DMs should be end-to-end encrypted](https://www.bitdefender.com/blog/hotforsecurity/elon-musk-says-twitter-dms-should-be-end-to-end-encrypted-2/) -- Dark Reading - - [Good News! IAM Is Near-Universal With SaaS](https://www.darkreading.com/tech-trends/good-news-iam-is-near-universal-with-saas) - - [Critical Vulnerabilities Leave Some Network-Attached Storage Devices Open to Attack](https://www.darkreading.com/vulnerabilities-threats/critical-vulnerabilities-qnap-synology-nas-rce) - - [Cloudflare Flags Largest HTTPS DDoS Attack It's Ever Recorded](https://www.darkreading.com/attacks-breaches/cloudflare-flags-largest-https-ddos-attack-it-s-ever-recorded) - - [Take a Diversified Approach to Encryption](https://www.darkreading.com/vulnerabilities-threats/take-a-diversified-approach-to-encryption) - - [Ambient.ai Expands Computer Vision Capabilities for Better Building Security](https://www.darkreading.com/emerging-tech/ambient-ai-expands-computer-vision-capabilities-for-better-building-security) -- /r/netsec - Information Security News & Discussion - - [Introducting MutableSecurity: Seamlessly deployment and management of security solutions](https://www.reddit.com/r/netsec/comments/uenfla/introducting_mutablesecurity_seamlessly/) - - [Be aware of this trick: Python module hijacking leading to code execution](https://www.reddit.com/r/netsec/comments/ueimks/be_aware_of_this_trick_python_module_hijacking/) -- Instapaper: Unread - - [Artifacts that you have never analyzed before… namely ETL files.](https://cyberdefnerd.com/2022/04/27/artifacts-that-you-have-never-analyzed-before-namely-etl-files/) - - [Does Deep Learning-Based Super-Resolution Help Humans With Face Recognition](https://blog.ampedsoftware.com/2022/04/27/does-deep-learning-based-super-resolution-help-humans-with-face-recognition/) - - [Defence Evasion Technique Timestomping Detection – NTFS Forensics](https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html) - - [Behind the Curtains of the Ransomware Economy – The Victims and the Cybercriminals](https://research.checkpoint.com/2022/behind-the-curtains-of-the-ransomware-economy-the-victims-and-the-cybercriminals/) - - [It’s Called BadUSB for a Reason](https://securityaffairs.co/wordpress/130715/hacking/badusb.html) - - [WhatsApp, ecco come l’FBI lo sfrutta per spiare i suoi utenti](https://www.webnews.it/?p=1043304) - - [Informatici forensi bistrattati, serve una proposta di legge a tutela delle competenze](https://www.agendadigitale.eu/documenti/giustizia-digitale/informatici-forensi-bistrattati-serve-una-proposta-di-legge-a-tutela-delle-competenze/) - - [Cybersecurity, come eliminare le aziende russe dalle PA italiane le indicazioni dell’Agenzia cyber](https://www.agendadigitale.eu/sicurezza/cybersecurity-come-eliminare-le-aziende-russe-dalle-pa-italiane-le-indicazioni-dellagenzia-cyber/) -- Threatpost - - [Security Turbulence in the Cloud: Survey Says…](https://threatpost.com/security-turbulence-in-the-cloud-survey-says/179437/) - - [Cyberespionage APT Now Identified as Three Separate Actors](https://threatpost.com/apt-id-3-separate-actors/179435/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Shodan vs Criminal ip](https://www.reddit.com/r/netsecstudents/comments/uecss8/shodan_vs_criminal_ip/) -- NVISO Labs - - [Analyzing VSTO Office Files](https://blog.nviso.eu/2022/04/29/analyzing-vsto-office-files/) -- Computer Forensics - - [Reverse Engineering PsExec for fun and knowledge](https://www.reddit.com/r/computerforensics/comments/uet79h/reverse_engineering_psexec_for_fun_and_knowledge/) - - [MacOS Forensics/ SANS FOR518](https://www.reddit.com/r/computerforensics/comments/ueftld/macos_forensics_sans_for518/) - - [Current free training?](https://www.reddit.com/r/computerforensics/comments/ue9kdu/current_free_training/) - - [DoD Contracting Digital Forensics](https://www.reddit.com/r/computerforensics/comments/uedqnp/dod_contracting_digital_forensics/) -- KitPloit - PenTest Tools! - - [Osinteye - Username Enumeration And Reconnaisance Suite](http://www.kitploit.com/2022/04/osinteye-username-enumeration-and.html) - - [Lupo - Malware IOC Extractor. Debugging Module For Malware Analysis Automation](http://www.kitploit.com/2022/04/lupo-malware-ioc-extractor-debugging.html) -- Deep Web - - [I used to use a sort of dark net news thing to surf tor. Can’t remember what it was called](https://www.reddit.com/r/deepweb/comments/ue9tio/i_used_to_use_a_sort_of_dark_net_news_thing_to/) -- TG Soft Software House - News - - [Vir.IT eXplorer PRO certificato da Virus Bulletin per aver superato il test VB100 2022-04 su Win 10 PRO](http://www.tgsoft.it/italy/news_archivio.asp?id=1303) -- TorrentFreak - - [Bing Removed 143 Million ‘Pirate’ Site URLs Last Year](https://torrentfreak.com/bing-removed-143-million-pirate-site-urls-last-year-220429/) - - [Man Who Lost $90m Pirate IPTV Suit Slams DISH in Response to New Lawsuit](https://torrentfreak.com/man-who-lost-90m-pirate-iptv-suit-slams-dish-in-response-to-new-lawsuit-220429/) -- The Register - Security - - [Data-wiper malware strains surge as Ukraine battles ongoing invasion](https://go.theregister.com/feed/www.theregister.com/2022/04/29/wiper_attacks_jump_500_percent/) - - [Microsoft Edge's 'Secure Network' sounds a lot like a built-in VPN](https://go.theregister.com/feed/www.theregister.com/2022/04/29/edge_vpn/) - - [Don’t expect to get your data back from the Onyx ransomware group](https://go.theregister.com/feed/www.theregister.com/2022/04/29/onyx-ransomware-destroy-files/) - - [Interpol: We can't arrest our way out of cybercrime](https://go.theregister.com/feed/www.theregister.com/2022/04/29/interpol_cybercrime_partnerships/) - - [India gives local techies 60 days to hit 6-hour deadline for infosec incident reporting](https://go.theregister.com/feed/www.theregister.com/2022/04/29/cert_in_directive/) - - [Sina Weibo, China's Twitter analog, reveals users' locations and IP addresses](https://go.theregister.com/feed/www.theregister.com/2022/04/29/weibo_location_services_default/) - - [Bumblebee malware loader emerges as Conti's BazarLoader fades](https://go.theregister.com/feed/www.theregister.com/2022/04/29/bumblee-malware-conti-malware/) -- Your Hacking Tutorial by Zempirians - - [How to know who pinged me?](https://www.reddit.com/r/HowToHack/comments/uedden/how_to_know_who_pinged_me/) - - [Can a Nook Color be hacked in 2022?](https://www.reddit.com/r/HowToHack/comments/uej8f5/can_a_nook_color_be_hacked_in_2022/) - - ["hacking" in C](https://www.reddit.com/r/HowToHack/comments/uen1ec/hacking_in_c/) - - [well, this is a phishing page](https://www.reddit.com/r/HowToHack/comments/ue9wgk/well_this_is_a_phishing_page/) -- Social Engineering - - [how can you identify someone's love language the first time you meet them?](https://www.reddit.com/r/SocialEngineering/comments/uexuli/how_can_you_identify_someones_love_language_the/) - - [Can this be a good strategy/look “savage”?](https://www.reddit.com/r/SocialEngineering/comments/uefzzl/can_this_be_a_good_strategylook_savage/) -- Krebs on Security - - [You Can Now Ask Google to Remove Your Phone Number, Email or Address from Search Results](https://krebsonsecurity.com/2022/04/you-can-now-ask-google-to-remove-your-phone-number-email-or-address-from-search-results/) -- Paul's Security Weekly - - [PSW #738 - Michael Aminov & Marcus Sachs](http://podcast.securityweekly.com/psw-738-michael-aminov-marcus-sachs) - - [NPM, Docker, Nimbuspwn, Edge, Emotet, & Owl Grease - Wrap Up - SWN #208](http://podcast.securityweekly.com/npm-docker-nimbuspwn-edge-emotet-owl-grease-wrap-up-swn-208) diff --git a/archive/2022/2022-05-01.md b/archive/2022/2022-05-01.md deleted file mode 100644 index 4b5934590e..0000000000 --- a/archive/2022/2022-05-01.md +++ /dev/null @@ -1,87 +0,0 @@ -# 每日安全资讯（2022-05-01） - -- HackerOne Hacker Activity - - [com.nextcloud.client bypass the protection lock in andoid app v 3.18.1 latest version.](https://hackerone.com/reports/1450368) -- Sec-News 安全文摘 - - [CVE-2022-22954VMware漏洞分析](https://wiki.ioin.in/url/dN2P) -- Sploitus.com Exploits RSS Feed - - [Toll Tax Management System v1.0 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37676&utm_source=rss&utm_medium=rss) - - [Exploit for Use of Incorrectly-Resolved Name or Reference in Haxx Libcurl exploit](https://sploitus.com/exploit?id=B6770ADB-376B-5BE9-B40E-37DEEB6C6675&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Wso2 Api Manager exploit](https://sploitus.com/exploit?id=CE8F28DE-D222-53F8-833A-4D9749BFC24D&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=E872ADEA-727B-5F6F-A079-7258B7710EEB&utm_source=rss&utm_medium=rss) -- 安全客-有思想的安全新媒体 - - [基于 Chromium 的 DOM-XSS 自动检测工具](https://www.anquanke.com/post/id/272810) -- Security Boulevard - - [OWASP® Global AppSec US 2021 Virtual – Anna Lezhikova’s ‘How To Build A Security Mindset’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-anna-lezhikovas-how-to-build-a-security-mindset/) - - [What are the DifferentPenetration Testing Methods?](https://securityboulevard.com/2022/04/what-are-the-differentpenetration-testing-methods/) - - [Joy Of Tech® ‘A Psycopathic Simulation’](https://securityboulevard.com/2022/04/joy-of-tech-a-psycopathic-simulation/) - - [OWASP® Global AppSec US 2021 Virtual – Brian Glas’ ‘The How And Why Of The OWASP Top Ten 2021’](https://securityboulevard.com/2022/04/owasp-global-appsec-us-2021-virtual-brian-glas-the-how-and-why-of-the-owasp-top-ten-2021/) - - [Rivian penalized for price hike as market awards Tesla “prize” for price hike](https://securityboulevard.com/2022/04/rivian-penalized-for-price-hike-as-market-awards-tesla-prize-for-price-hike/) - - [API Security: Real-Time Blocking or Detection and Response?](https://securityboulevard.com/2022/04/api-security-real-time-blocking-or-detection-and-response/) -- Envato Tuts+ Code - Mobile Development - - [Kotlin From Scratch: Packages and Basic Functions](https://code.tutsplus.com/tutorials/kotlin-from-scratch-packages-basic-functions--cms-29445) -- povcfe's blog - - [挖洞日记](https://povcfe.github.io/posts/something/) -- Malwarebytes Labs - - [Update now! Critical patches for Chrome and Edge](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/04/update-now-important-patches-for-chrome-and-edge/) - - [Russia continues digital onslaught against Ukrainian systems](https://blog.malwarebytes.com/reports/2022/04/russia-continues-digital-onslaught-against-ukrainian-systems-which-began-before-invasion/) -- Didier Stevens - - [Quickpost: Machine Code Infinite Loop](https://blog.didierstevens.com/2022/04/30/quickpost-machine-code-infinite-loop/) -- daniel.haxx.se - - [Uncurled](https://daniel.haxx.se/blog/2022/04/30/uncurled/) -- HAHWUL - - [SAML Injection](https://www.hahwul.com/cullinan/saml-injection/) - - [Type Juggling (Loose Comparison Bug)](https://www.hahwul.com/cullinan/type-juggling/) - - [IDOR (Insecure Direct Object Reference)](https://www.hahwul.com/cullinan/idor/) -- KitPloit - PenTest & Hacking Tools - - [Dora - Find Exposed API Keys Based On RegEx And Get Exploitation Methods For Some Of Keys That Are Found](http://www.kitploit.com/2022/04/dora-find-exposed-api-keys-based-on.html) - - [Requests-Ip-Rotator - A Python Library To Utilize AWS API Gateway's Large IP Pool As A Proxy To Generate Pseudo-Infinite IPs For Web Scraping And Brute Forcing](http://www.kitploit.com/2022/04/requests-ip-rotator-python-library-to.html) -- 奇客Solidot–传递最新科技情报 - - [尼日利亚屏蔽 7300 万未登记身份的电话号码](https://www.solidot.org/story?sid=71408) - - [你可以要求 Google 从搜索结果中移除你的电话号码、邮箱和地址](https://www.solidot.org/story?sid=71407) - - [进餐的时间与长寿的关联](https://www.solidot.org/story?sid=71406) - - [苹果上海周边供应商优先复工](https://www.solidot.org/story?sid=71405) -- 90Sec - 最新话题 - - [http子域名扫描工具](https://forum.90sec.com/t/topic/2098) -- Il Disinformatico - - [Antibufala: no, la Russia non ha già deciso di lasciare la Stazione Spaziale Internazionale](http://attivissimo.blogspot.com/2022/04/antibufala-no-la-russia-non-ha-gia.html) - - [Un po’ di video di Crew-4 e di Samantha Cristoforetti, arrivata alla Stazione Spaziale Internazionale](http://attivissimo.blogspot.com/2022/04/un-po-di-video-di-crew-4-e-di-samantha.html) -- SANS Internet Storm Center, InfoCON: green - - [YARA 4.2.1 Released, (Sat, Apr 30th)](https://isc.sans.edu/diary/rss/28600) -- Instapaper: Unread - - [NFT Crime From the Simple to the Ingeniously Simple](https://www.trustedsec.com/blog/nft-crime-from-the-simple-to-the-ingeniously-simple/) - - [Agent-Based Low-Level iOS File System Extraction](https://blog.elcomsoft.com/2022/04/agent-based-low-level-ios-file-system-extraction/) - - [Due aziende su tre colpite da attacchi ransomware](https://www.punto-informatico.it/sophos-the-state-of-ransomware-2022/) - - [Criptovalute, rapine miliardarie ecco perché la sicurezza è un grosso problema](https://www.agendadigitale.eu/cittadinanza-digitale/pagamenti-digitali/criptovalute-la-sicurezza-e-solo-un-mito-rischi-di-compromissione-e-regole-necessarie/) - - [Norton fotografa il lato romantico dei truffatori](https://www.punto-informatico.it/norton-lato-romantico-truffatori/) - - [Ransomware costi sette volte superiori al riscatto](https://www.punto-informatico.it/ransomware-costi-sette-volte-superiori-riscatto/) -- TorrentFreak - - [Major & Persistent Video Game Pirates Investigated by ESA](https://torrentfreak.com/major-persistent-video-game-pirates-investigated-by-esa-220430/) -- The Register - Security - - [Facebook's Meta, tracking code, and the student financial aid website](https://go.theregister.com/feed/www.theregister.com/2022/04/30/meta_student_data/) -- LockBoxx - - [The Pros Perspective at Shmoocon 2022](http://lockboxx.blogspot.com/2022/04/the-pros-perspective-at-shmoocon-2022.html) -- KitPloit - PenTest Tools! - - [Dora - Find Exposed API Keys Based On RegEx And Get Exploitation Methods For Some Of Keys That Are Found](http://www.kitploit.com/2022/04/dora-find-exposed-api-keys-based-on.html) - - [Requests-Ip-Rotator - A Python Library To Utilize AWS API Gateway's Large IP Pool As A Proxy To Generate Pseudo-Infinite IPs For Web Scraping And Brute Forcing](http://www.kitploit.com/2022/04/requests-ip-rotator-python-library-to.html) -- Security Affairs - - [Microsoft Azure flaws could allow accessing PostgreSQL DBs of other customers](https://securityaffairs.co/wordpress/130750/security/azure-postgresql-flexible-server-flaws.html) - - [Emotet tests new attack chain in low volume campaigns](https://securityaffairs.co/wordpress/130739/cyber-crime/emotet-operators-test-new-techniques.html) - - [Pro-Russian group Killnet launched DDoS attacks on Romanian govt sites](https://securityaffairs.co/wordpress/130732/hacking/russian-hacktivists-ddos-romanian-govt.html) -- /r/netsec - Information Security News & Discussion - - [RW-Fuzzer: A Fuzzing Method for Vulnerability Mining on Router Web Interface](https://www.reddit.com/r/netsec/comments/uf67wq/rwfuzzer_a_fuzzing_method_for_vulnerability/) -- Computer Forensics - - [HELP !! with Volatility](https://www.reddit.com/r/computerforensics/comments/uf0771/help_with_volatility/) -- Deep Web - - [darkfail down?](https://www.reddit.com/r/deepweb/comments/ufbevg/darkfail_down/) -- Dark Reading - - [2022 Security Priorities: Staffing and Remote Work](https://www.darkreading.com/edge-articles/2022-security-priorities-staffing-and-remote-work) -- Your Hacking Tutorial by Zempirians - - [how to make payload in metasploit fully undetectable ?](https://www.reddit.com/r/HowToHack/comments/ufak07/how_to_make_payload_in_metasploit_fully/) - - [Can network admins trace downloads back to users with a VPN?](https://www.reddit.com/r/HowToHack/comments/ueza76/can_network_admins_trace_downloads_back_to_users/) - - [what language would be most useful in hacking? like for cracking things?](https://www.reddit.com/r/HowToHack/comments/ufglh0/what_language_would_be_most_useful_in_hacking/) - - [Phishing .txt file](https://www.reddit.com/r/HowToHack/comments/uflcnx/phishing_txt_file/) - - [tp-link tl-wn722n](https://www.reddit.com/r/HowToHack/comments/uf6kh2/tplink_tlwn722n/) -- Dark Space Blogspot - - [Come Funziona MM Finance: MMF, MMO, SVN, MUSD e NFT (Cronos Chain)](http://darkwhite666.blogspot.com/2022/05/come-funziona-mm-finance-mmf-mmo-svn.html) - - [Come Funziona Thorchain: Swap Cross Chain](http://darkwhite666.blogspot.com/2022/04/come-funziona-thorchain-swap-cross-chain.html) diff --git a/archive/2022/2022-05-03.md b/archive/2022/2022-05-03.md deleted file mode 100644 index a03ba78a1f..0000000000 --- a/archive/2022/2022-05-03.md +++ /dev/null @@ -1,160 +0,0 @@ -# 每日安全资讯（2022-05-03） - -- Sec-News 安全文摘 - - [记录一次逆向容器镜像的过程](https://wiki.ioin.in/url/jdqx) -- Microsoft Security Blog - - [Microsoft launches Defender for Business to help protect small and medium businesses](https://www.microsoft.com/security/blog/2022/05/02/microsoft-launches-defender-for-business-to-help-protect-small-and-medium-businesses/) -- Sploitus.com Exploits RSS Feed - - [Covid 19 Travel Pass Management System v1.0 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37677&utm_source=rss&utm_medium=rss) - - [Ransom.LockBit DLL Hijacking exploit](https://sploitus.com/exploit?id=PACKETSTORM:166912&utm_source=rss&utm_medium=rss) - - [Strapi 3.6.8 Password Disclosure / Insecure Handling exploit](https://sploitus.com/exploit?id=PACKETSTORM:166915&utm_source=rss&utm_medium=rss) - - [WSO Arbitrary File Upload / Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:166921&utm_source=rss&utm_medium=rss) - - [WordPress Stafflist 3.1.2 Cross Site Request Forgery exploit](https://sploitus.com/exploit?id=PACKETSTORM:166919&utm_source=rss&utm_medium=rss) - - [WordPress Stafflist 3.1.2 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166918&utm_source=rss&utm_medium=rss) - - [Covid 19 Travel Pass Management System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166910&utm_source=rss&utm_medium=rss) - - [Toll Tax Management System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:166908&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [Geopolitical Cyber Attacks — The New Battlefield](https://securityboulevard.com/2022/05/geopolitical-cyber-attacks-the-new-battlefield/) - - [A Guide to EDR, NDR, XDR, and SIEM](https://securityboulevard.com/2022/05/a-guide-to-edr-ndr-xdr-and-siem/) - - [11 Ways to Prevent Data Loss and Data Breaches in 2022](https://securityboulevard.com/2022/05/11-ways-to-prevent-data-loss-and-data-breaches-in-2022/) - - [How we use OPA at Cyral](https://securityboulevard.com/2022/05/how-we-use-opa-at-cyral/) - - [Russia to Rent Tech-Savvy Prisoners to Corporate IT?](https://securityboulevard.com/2022/05/russia-to-rent-tech-savvy-prisoners-to-corporate-it/) - - [OWASP® Global AppSec US 2021 Virtual – Michael Isbitski’s ‘How Do They Get In?! Understanding the API Attack Vector’](https://securityboulevard.com/2022/05/owasp-global-appsec-us-2021-virtual-michael-isbitskis-how-do-they-get-in-understanding-the-api-attack-vector/) - - [Compliance does not equal security: 7 cybersecurity experts share their insights](https://securityboulevard.com/2022/05/compliance-does-not-equal-security-7-cybersecurity-experts-share-their-insights/) - - [Getting Intelligent About Browser Security](https://securityboulevard.com/2022/05/getting-intelligent-about-browser-security/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Ransom.LockBit / DLL Hijacking](https://cxsecurity.com/issue/WLB-2022050007) -- ArthurChiao's Blog - - [BPF 进阶笔记（四）：调试 BPF 程序](https://arthurchiao.github.io/blog/bpf-advanced-notes-4-zh/) -- Files ≈ Packet Storm - - [Packet Storm New Exploits For April, 2022](https://packetstormsecurity.com/files/166922/202204-exploits.tgz) - - [WSO Arbitrary File Upload / Remote Code Execution](https://packetstormsecurity.com/files/166921/wso2_file_upload_rce.rb.txt) - - [Red Hat Security Advisory 2022-1665-01](https://packetstormsecurity.com/files/166920/RHSA-2022-1665-01.txt) - - [WordPress Stafflist 3.1.2 Cross Site Request Forgery](https://packetstormsecurity.com/files/166919/wpstafflist312-xsrf.txt) - - [WordPress Stafflist 3.1.2 SQL Injection](https://packetstormsecurity.com/files/166918/wpstafflist312-sql.txt) - - [Ubuntu Security Notice USN-5382-2](https://packetstormsecurity.com/files/166916/USN-5382-2.txt) - - [Strapi 3.6.8 Password Disclosure / Insecure Handling](https://packetstormsecurity.com/files/166915/CVE-2021-46440.txt) - - [Red Hat Security Advisory 2022-1661-01](https://packetstormsecurity.com/files/166914/RHSA-2022-1661-01.txt) - - [Red Hat Security Advisory 2022-1663-01](https://packetstormsecurity.com/files/166913/RHSA-2022-1663-01.txt) - - [Ransom.LockBit DLL Hijacking](https://packetstormsecurity.com/files/166912/MVID-2022-0572.txt) - - [Red Hat Security Advisory 2022-1664-01](https://packetstormsecurity.com/files/166911/RHSA-2022-1664-01.txt) - - [Covid 19 Travel Pass Management System 1.0 SQL Injection](https://packetstormsecurity.com/files/166910/c19tpms10-sql.txt) - - [Red Hat Security Advisory 2022-1662-01](https://packetstormsecurity.com/files/166909/RHSA-2022-1662-01.txt) - - [Toll Tax Management System 1.0 SQL Injection](https://packetstormsecurity.com/files/166908/ttms10-sql.txt) - - [Red Hat Security Advisory 2022-1646-01](https://packetstormsecurity.com/files/166907/RHSA-2022-1646-01.txt) -- modexp - - [Shellcode: Linux on RISC-V 64-Bit](https://modexp.wordpress.com/2022/05/02/shellcode-risc-v-linux/) -- GuidePoint Security - - [How to Peel a PowerShell Onion: A Bloodhound Case Study](https://www.guidepointsecurity.com/blog/how-to-peel-a-powershell-onion-a-bloodhound-case-study/) -- NVISO Labs - - [Girls Day at NVISO Encourages Young Guests To Find Their Dream Job](https://blog.nviso.eu/2022/05/02/girls-day-at-nviso-encourages-young-guests-to-find-their-dream-job/) -- Current Posts - Red Team Journal - - [Amplify Your Existing Risk Efforts](https://www.redteamjournal.com/blog/amplify-existing-efforts) -- blog.avast.com EN - - [Here's how self-help apps violate your privacy, sell your information](https://blog.avast.com/self-help-apps-privacy) - - [More transparency from developers is coming to the Google Play Store](https://blog.avast.com/privacy-google-play-store) -- Malwarebytes Labs - - [Watch out for these 3 small business cybersecurity mistakes](https://blog.malwarebytes.com/opinion/2022/05/watch-out-for-these-3-small-business-cybersecurity-mistakes/) - - [A week in security (April 25 – May 1)](https://blog.malwarebytes.com/a-week-in-security/2022/05/a-week-in-security-april-25-may-1/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/ugjr7h/rreverseengineerings_weekly_questions_thread/) - - [Useful Tools and Resources for Digital Forensics](https://www.reddit.com/r/ReverseEngineering/comments/ugcxkr/useful_tools_and_resources_for_digital_forensics/) -- daniel.haxx.se - - [now on HTTP/3](https://daniel.haxx.se/blog/2022/05/02/now-on-http-3/) - - [Considered “18+”](https://daniel.haxx.se/blog/2022/05/02/considered-18/) -- 博客园 - nice_0e3 - - [Java安全之freemarker 模板注入 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16217471.html) -- The Daily Swig | Cybersecurity news and views - - [Security bug in VMWare Workspace ONE could allow access to internal, cloud networks](https://portswigger.net/daily-swig/security-bug-in-vmware-workspace-one-could-allow-access-to-internal-cloud-networks) -- KitPloit - PenTest & Hacking Tools - - [Pybatfish - Python Client For Batfish (Network Configuration Analysis Tool)](http://www.kitploit.com/2022/05/pybatfish-python-client-for-batfish.html) - - [Moonwalk - Cover Your Tracks During Linux Exploitation By Leaving Zero Traces On System Logs And Filesystem Timestamps](http://www.kitploit.com/2022/05/moonwalk-cover-your-tracks-during-linux.html) -- 博客园 - 郑瀚Andrew.Hann - - [农园与可持续教育：教育学与土壤学的结合 -- 文 / [美]迪拉夫鲁兹·R·威廉姆斯 乔纳森·D·布朗 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16215078.html) -- 黑海洋 - WIKI - - [爪牙免费小说_1.0.2_纯净版_小说软件阅读神器（安卓）](https://blog.upx8.com/2739) -- 奇客Solidot–传递最新科技情报 - - [城市灯光需要考虑鸟儿](https://www.solidot.org/story?sid=71415) - - [Fedora 项目领导人谈 Linux 和开源](https://www.solidot.org/story?sid=71414) - - [俄罗斯偷走乌克兰的农机结果发现被远程锁定](https://www.solidot.org/story?sid=71413) - - [维基百科正式停止接受加密货币捐款](https://www.solidot.org/story?sid=71412) -- Arturo Di Corinto - - [INTERVISTA DI CORINTO A PROGRESS SKYTG24 IL 30 APRILE](https://dicorinto.it/tipologia/interviste/intervista-di-corinto-a-progress-skytg24-il-30-aprile/) -- AlienVault Security Essentials Blog - - [Analysis on recent wiper attacks: examples and how wiper malware works](https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works) -- Have I Been Pwned latest breaches - - [PayHere - 1,580,249 breached accounts](https://haveibeenpwned.com/PwnedWebsites#PayHere) - - [Aimware - 305,470 breached accounts](https://haveibeenpwned.com/PwnedWebsites#Aimware) -- Daniel Miessler - - [News & Analysis: NO. 329](https://danielmiessler.com/podcast/news-analysis-no-329/) - - [Why I’m Not Worried About Elon Musk Buying Twitter](https://danielmiessler.com/blog/why-im-not-worried-about-elon-musk-buying-twitter/) -- cavallette - - [Migrazione del servizio di chat / Instant messaging service migration](https://cavallette.noblogs.org/2022/05/9735) -- SANS Internet Storm Center, InfoCON: green - - [Detecting VSTO Office Files With ExifTool, (Mon, May 2nd)](https://isc.sans.edu/diary/rss/28604) - - [ISC Stormcast For Monday, May 2nd, 2022 https://isc.sans.edu/podcastdetail.html?id=7988, (Mon, May 2nd)](https://isc.sans.edu/diary/rss/28602) -- Securityinfo.it - - [66% delle aziende colpito da un attacco ransomware](https://www.securityinfo.it/2022/05/02/il-66-delle-aziende-e-stato-colpito-da-un-attacco-ransomware/?utm_source=rss&utm_medium=rss&utm_campaign=il-66-delle-aziende-e-stato-colpito-da-un-attacco-ransomware) - - [Onyx e le false promesse del ransomware](https://www.securityinfo.it/2022/05/02/onyx-e-le-false-promesse-del-ransomware/?utm_source=rss&utm_medium=rss&utm_campaign=onyx-e-le-false-promesse-del-ransomware) - - [€1.500.000 di multa ad azienda di software medico per data leak](https://www.securityinfo.it/2022/05/02/e1-500-000-di-multa-ad-azienda-di-software-medico-per-data-leak/?utm_source=rss&utm_medium=rss&utm_campaign=e1-500-000-di-multa-ad-azienda-di-software-medico-per-data-leak) -- TG Soft Software House - News - - [Phishing: i tentativi di furto credenziali e/o dati maggiormente diffusi nel mese di MAGGIO 2022...](http://www.tgsoft.it/italy/news_archivio.asp?id=1305) -- Deeplinks - - [Tracking Exposed: Demanding That the Gods Explain Themselves](https://www.eff.org/deeplinks/2022/05/tracking-exposed-demanding-gods-explain-themselves) - - [The EU Digital Markets Act Places New Obligations on “Gatekeeper” Platforms](https://www.eff.org/deeplinks/2022/04/eu-digital-markets-act-places-new-obligations-gatekeeper-platforms) - - [The EU Digital Markets Act’s Interoperability Rule Addresses An Important Need, But Raises Difficult Security Problems for Encrypted Messaging](https://www.eff.org/deeplinks/2022/04/eu-digital-markets-acts-interoperability-rule-addresses-important-need-raises) -- NVISO Labs - - [Girls Day at NVISO Encourages Young Guests To Find Their Dream Job](https://blog.nviso.eu/2022/05/02/girls-day-at-nviso-encourages-young-guests-to-find-their-dream-job/) -- Trend Micro Research, News and Perspectives - - [AvosLocker Ransomware Variant Abuses Driver File to Disable Anti-Virus, Scans for Log4shell](https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html) -- Krebs on Security - - [Russia to Rent Tech-Savvy Prisoners to Corporate IT?](https://krebsonsecurity.com/2022/05/russia-to-rent-tech-savvy-prisoners-to-corporate-it/) -- TrustedSec - - [g_CiOptions in a Virtualized World](https://www.trustedsec.com/blog/g_cioptions-in-a-virtualized-world/) -- Computer Forensics - - [Passed my GSEC!](https://www.reddit.com/r/computerforensics/comments/ugzo54/passed_my_gsec/) -- Hakin9 – IT Security Magazine - - [Lupo - Malware IOC Extractor and Debugging module for Malware Analysis Automation](https://hakin9.org/lupo-malware-ioc-extractor-and-debugging-module-for-malware-analysis-automation/) - - [DDexec - a technique to run binaries filelessly and stealthily on Linux using dd to replace the shell with another process](https://hakin9.org/ddexec-a-technique-to-run-binaries-filelessly-and-stealthily-on-linux-using-dd-to-replace-the-shell-with-another-process/) -- Social Engineering - - [To comprehend an idea, we must accept statements as true. Does this mean humans are hopelessly gullible? Not exactly, as humans have an innate tendency to suspect lies and remain epistemically vigilant:](https://www.reddit.com/r/SocialEngineering/comments/uh0p7d/to_comprehend_an_idea_we_must_accept_statements/) -- Security Affairs - - [Car rental company Sixt hit by a cyberattack that caused temporary disruptions](https://securityaffairs.co/wordpress/130820/security/sixt-suffered-cyber-attack.html) - - [The mystery behind the samples of the new REvil ransomware operation](https://securityaffairs.co/wordpress/130811/cyber-crime/samples-new-revil-ransomware.html) - - [Group-IB CEO remains in prison – the Russian-led company has been ‘blacklisted’ in Italy](https://securityaffairs.co/wordpress/130806/security/group-ib-ceo-remains-in-prison.html) - - [IoT and Cybersecurity: What’s the Future?](https://securityaffairs.co/wordpress/130802/security/iot-cybersecurity-future.html) - - [Russia-linked APT29 targets diplomatic and government organizations](https://securityaffairs.co/wordpress/130787/apt/apt29-targets-diplomats.html) -- Threatpost - - [Bad Actors Are Maximizing Remote Everything](https://threatpost.com/bad-actors-remote-everything/179458/) - - [Deep Dive: Protecting Against Container Threats in the Cloud](https://threatpost.com/container_threats_cloud_defend/179452/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [How to protect from ransomware attack loop?](https://www.reddit.com/r/netsecstudents/comments/ugzwms/how_to_protect_from_ransomware_attack_loop/) -- TorrentFreak - - [Russian Cinemas Are Showing Pirated Movies Downloaded From Torrents](https://torrentfreak.com/russian-cinemas-are-showing-pirated-movies-downloaded-from-torrents-220502/) - - [US Court Orders Every ISP in the United States to Block Illegal Streaming Sites](https://torrentfreak.com/us-court-orders-every-isp-in-the-united-states-to-block-illegal-streaming-sites-220502/) -- Blackhat Library: Hacking techniques and research - - [CYBERSOC IT Library: IT and Cyber Security Research and Development](https://www.reddit.com/r/blackhat/comments/uguhck/cybersoc_it_library_it_and_cyber_security/) - - [Cyber Security Short Film](https://www.reddit.com/r/blackhat/comments/ugx05t/cyber_security_short_film/) -- The Register - Security - - [Security is a pain for American Dental Association: Ransomware infection feared](https://go.theregister.com/feed/www.theregister.com/2022/05/02/in_brief_security/) - - [SSE kicks the ‘A’ out of SASE](https://go.theregister.com/feed/www.theregister.com/2022/05/02/see-vs-sase/) - - [Dell brings data recovery tools to Apex and the cloud](https://go.theregister.com/feed/www.theregister.com/2022/05/02/dell-apex-cyber-recovery/) - - [Spanish PM, defense minister latest Pegasus spyware victims](https://go.theregister.com/feed/www.theregister.com/2022/05/02/spain_pegasus_malware/) -- Dark Reading - - [Google Offers $1.5M Bug Bounty for Android 13 Beta](https://www.darkreading.com/vulnerabilities-threats/google-issues-1-5m-android-13-beta-bug-bounty) - - [New Regulations in India Require Orgs to Report Cyber Incidents Within 6 Hours](https://www.darkreading.com/attacks-breaches/new-regulations-give-indian-orgs-6-hours-to-report-cyber-incidents) - - [6 Best Practices to Ensure Kubernetes Security Meets Compliance Regulations](https://www.darkreading.com/dr-tech/6-best-practices-to-ensure-kubernetes-security-meets-compliance-regulations) - - [Name That Edge Toon: Flower Power](https://www.darkreading.com/edge-articles/name-that-edge-toon-flower-power) - - [Security Stuff Happens: What Do You Do When It Hits the Fan?](https://www.darkreading.com/vulnerabilities-threats/security-stuff-happens-what-do-you-do-when-it-hits-the-fan-) -- Your Hacking Tutorial by Zempirians - - [Scambaiter](https://www.reddit.com/r/HowToHack/comments/ugxiok/scambaiter/) - - [Bettercap disables internet connection to the target](https://www.reddit.com/r/HowToHack/comments/uh0w8u/bettercap_disables_internet_connection_to_the/) -- /r/netsec - Information Security News & Discussion - - [AWS Targeted by a Package Backfill Attack](https://www.reddit.com/r/netsec/comments/ugkybz/aws_targeted_by_a_package_backfill_attack/) - - [How masscan works](https://www.reddit.com/r/netsec/comments/ugqlhw/how_masscan_works/) - - [Augury Augury: Using Data Memory-Dependent Prefetchers to Leak Data at Rest (on Apple M1 and similar)](https://www.reddit.com/r/netsec/comments/ugoxny/augury_augury_using_data_memorydependent/) -- KitPloit - PenTest Tools! - - [Pybatfish - Python Client For Batfish (Network Configuration Analysis Tool)](http://www.kitploit.com/2022/05/pybatfish-python-client-for-batfish.html) - - [Moonwalk - Cover Your Tracks During Linux Exploitation By Leaving Zero Traces On System Logs And Filesystem Timestamps](http://www.kitploit.com/2022/05/moonwalk-cover-your-tracks-during-linux.html) -- Il Disinformatico - - [Videocollegamento pubblico di Samantha Cristoforetti e Matthias Maurer oggi alle 15.15 italiane](http://attivissimo.blogspot.com/2022/05/videocollegamento-pubblico-di-samantha.html) diff --git a/archive/2022/2022-06-08.md b/archive/2022/2022-06-08.md deleted file mode 100644 index fbfc856ef7..0000000000 --- a/archive/2022/2022-06-08.md +++ /dev/null @@ -1,322 +0,0 @@ -# 每日安全资讯（2022-06-08） - -- Sec-News 安全文摘 - - [BlackHat Asia 2022](https://wiki.ioin.in/url/ZQD9) - - [CVE-2022-30190 MSDT 代码注入漏洞分析](https://wiki.ioin.in/url/3JmG) -- Der Flounder - - [WWDC 2022 notes](https://derflounder.wordpress.com/2022/06/07/wwdc-2022-notes/) -- Security Boulevard - - [Decentralized Identity: Time for CIOs and CISOs to Make it Happen](https://securityboulevard.com/2022/06/decentralized-identity-time-for-cios-and-cisos-to-make-it-happen/) - - [GUEST ESSAY – The role of automation in keeping software from malicious, unintended usage](https://securityboulevard.com/2022/06/guest-essay-the-role-of-automation-in-keeping-software-from-malicious-unintended-usage/) - - [BSides:Munich 2022 – Sivaranjani Sankaralingam’s ‘Keeping Electric Vehicles Secure: The Need For A CAN Security Framework’](https://securityboulevard.com/2022/06/bsidesmunich-2022-sivaranjani-sankaralingams-keeping-electric-vehicles-secure-the-need-for-a-can-security-framework/) - - [SOC 2 Controls: Encryption of Data at Rest](https://securityboulevard.com/2022/06/soc-2-controls-encryption-of-data-at-rest/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 384’](https://securityboulevard.com/2022/06/robert-m-lees-jeff-haas-little-bobby-comic-week-384/) - - [After Hydra: Telegram, Cash-out Services, Decentralization, and a Slew of Struggling Alternatives](https://securityboulevard.com/2022/06/after-hydra-telegram-cash-out-services-decentralization-and-a-slew-of-struggling-alternatives/) - - [It Takes 2 Seconds of Silence to Skim a Credit Card](https://securityboulevard.com/2022/06/it-takes-2-seconds-of-silence-to-skim-a-credit-card/) - - [CrowdStrike Adds Automated Asset Discovery to Cloud Platform](https://securityboulevard.com/2022/06/crowdstrike-adds-automated-asset-discovery-to-cloud-platform/) - - [IBM to Acquire Randori to Provide More Cybersecurity Visibility](https://securityboulevard.com/2022/06/ibm-to-acquire-randori-to-provide-more-cybersecurity-visibility/) - - [Ransomware Attacks – The new normal?](https://securityboulevard.com/2022/06/ransomware-attacks-the-new-normal/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Poly EagleEye Director II 2.2.1.1 Command Injection / Authentication Bypass](https://cxsecurity.com/issue/WLB-2022060028) - - [Web Wallet Elrond - Open Redirect Vulnerability](https://cxsecurity.com/issue/WLB-2022060027) - - [Ransom.Haron / Code Execution](https://cxsecurity.com/issue/WLB-2022060026) - - [Backdoor.Win32.Cabrotor.10.d / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022060025) - - [Trojan-Proxy.Win32.Symbab.o / Heap Corruption](https://cxsecurity.com/issue/WLB-2022060024) - - [Trojan-Banker.Win32.Banker.agzg / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022060023) - - [Trojan-Banker.Win32.Banbra.cyt / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022060022) -- Sploitus.com Exploits RSS Feed - - [Apache 2.4.50 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37777&utm_source=rss&utm_medium=rss) - - [BootCommerce v3.2.1 - Multiple Persistent Vulnerabilities exploit](https://sploitus.com/exploit?id=VULNERABLE:2279&utm_source=rss&utm_medium=rss) - - [Ransom.Haron MVID-2022-0609 Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167436&utm_source=rss&utm_medium=rss) - - [Poly EagleEye Director II 2.2.1.1 Command Injection / Authentication Bypass Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37772&utm_source=rss&utm_medium=rss) - - [Confluence OGNL Injection Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37778&utm_source=rss&utm_medium=rss) - - [Trojan-Banker.Win32.Banbra.cyt MVID-2022-0611 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:167434&utm_source=rss&utm_medium=rss) - - [Microsoft Office Word MSDTJS Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167438&utm_source=rss&utm_medium=rss) - - [Reolink E1 Zoom Camera 3.0.0.716 Private Key Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37776&utm_source=rss&utm_medium=rss) - - [dbus-broker-29 Memory Corruption Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37773&utm_source=rss&utm_medium=rss) - - [Reolink E1 Zoom Camera 3.0.0.716 Configuration Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37775&utm_source=rss&utm_medium=rss) - - [Microsoft Office Word MSDTJS Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37779&utm_source=rss&utm_medium=rss) - - [Confluence OGNL Injection Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167430&utm_source=rss&utm_medium=rss) - - [Korenix JetPort 5601V3 Backdoor Account Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37774&utm_source=rss&utm_medium=rss) - - [Poly Studio X30 / Studio X50 / Studio X70 / G7500 Command Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37771&utm_source=rss&utm_medium=rss) - - [Trojan-Proxy.Win32.Symbab.o MVID-2022-0610 Heap Corruption exploit](https://sploitus.com/exploit?id=PACKETSTORM:167435&utm_source=rss&utm_medium=rss) - - [Trojan-Banker.Win32.Banker.agzg MVID-2022-0608 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:167433&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Cabrotor.10.d MVID-2022-0612 Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167437&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26134 exploit](https://sploitus.com/exploit?id=66468422-89C0-5AC8-9CEA-6B512338FF7C&utm_source=rss&utm_medium=rss) - - [Exploit for NULL Pointer Dereference in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=55F763D2-6084-53E5-A979-960E8F8D28D6&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=B3146F3C-4919-564B-8B1E-752FCA30B8D9&utm_source=rss&utm_medium=rss) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 意大利巴勒莫市因网络攻击断网；Facebook首次任命CISO](https://www.freebuf.com/news/335540.html) - - [关键词“转型”，Talon斩获创新沙盒大赛冠军 | 直击RSAC2022](https://www.freebuf.com/news/335501.html) - - [意大利某市欲关闭系统以抵抗网络攻击](https://www.freebuf.com/news/335462.html) - - [记一次水平越权漏洞的利用](https://www.freebuf.com/articles/web/334522.html) -- HackerOne Hacker Activity - - [Path traversal, to RCE](https://hackerone.com/reports/733072) - - [Steal private objects of other projects via project import](https://hackerone.com/reports/743953) - - [Private objects exposed through project import](https://hackerone.com/reports/767770) - - [Path traversal in Nuget Package Registry](https://hackerone.com/reports/822262) - - [Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm](https://hackerone.com/reports/1164854) - - [Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocode](https://hackerone.com/reports/1164853) -- Files ≈ Packet Storm - - [Microsoft Office Word MSDTJS Code Execution](https://packetstormsecurity.com/files/167438/word_msdtjs_rce.rb.txt) - - [Backdoor.Win32.Cabrotor.10.d MVID-2022-0612 Remote Command Execution](https://packetstormsecurity.com/files/167437/MVID-2022-0612.txt) - - [Ransom.Haron MVID-2022-0609 Code Execution](https://packetstormsecurity.com/files/167436/MVID-2022-0609.txt) - - [Trojan-Proxy.Win32.Symbab.o MVID-2022-0610 Heap Corruption](https://packetstormsecurity.com/files/167435/MVID-2022-0610.txt) - - [Trojan-Banker.Win32.Banbra.cyt MVID-2022-0611 Insecure Permissions](https://packetstormsecurity.com/files/167434/MVID-2022-0611.txt) - - [Trojan-Banker.Win32.Banker.agzg MVID-2022-0608 Insecure Permissions](https://packetstormsecurity.com/files/167433/MVID-2022-0608.txt) - - [Confluence OGNL Injection Proof Of Concept](https://packetstormsecurity.com/files/167432/CVE-2022-26134-master.zip) - - [Through The Wire CVE-2022-26134 Confluence Proof Of Concept](https://packetstormsecurity.com/files/167431/through_the_wire-main.zip) - - [Confluence OGNL Injection Remote Code Execution](https://packetstormsecurity.com/files/167430/CVE-2022-26134.py.txt) - - [Red Hat Security Advisory 2022-4929-01](https://packetstormsecurity.com/files/167429/RHSA-2022-4929-01.txt) - - [Red Hat Security Advisory 2022-4930-01](https://packetstormsecurity.com/files/167428/RHSA-2022-4930-01.txt) - - [Red Hat Security Advisory 2022-4924-01](https://packetstormsecurity.com/files/167427/RHSA-2022-4924-01.txt) - - [Ubuntu Security Notice USN-5463-1](https://packetstormsecurity.com/files/167426/USN-5463-1.txt) - - [Ubuntu Security Notice USN-5462-2](https://packetstormsecurity.com/files/167425/USN-5462-2.txt) - - [Red Hat Security Advisory 2022-4919-01](https://packetstormsecurity.com/files/167424/RHSA-2022-4919-01.txt) - - [Red Hat Security Advisory 2022-4918-01](https://packetstormsecurity.com/files/167423/RHSA-2022-4918-01.txt) - - [Red Hat Security Advisory 2022-4922-01](https://packetstormsecurity.com/files/167422/RHSA-2022-4922-01.txt) - - [Ubuntu Security Notice USN-5462-1](https://packetstormsecurity.com/files/167421/USN-5462-1.txt) - - [Ubuntu Security Notice USN-5461-1](https://packetstormsecurity.com/files/167420/USN-5461-1.txt) - - [Ubuntu Security Notice USN-5460-1](https://packetstormsecurity.com/files/167419/USN-5460-1.txt) - - [Red Hat Security Advisory 2022-4914-01](https://packetstormsecurity.com/files/167418/RHSA-2022-4914-01.txt) - - [Red Hat Security Advisory 2022-4915-01](https://packetstormsecurity.com/files/167417/RHSA-2022-4915-01.txt) - - [Red Hat Security Advisory 2022-4913-01](https://packetstormsecurity.com/files/167416/RHSA-2022-4913-01.txt) -- 绿盟科技技术博客 - - [RSA2022创新沙盒｜Talon Cyber Security为何成最大赢家？](http://blog.nsfocus.net/rsa2022-talon-cyber-security-win/) - - [绿盟科技威胁周报（20220530-20220605）](http://blog.nsfocus.net/weekly-20220530/) -- obaby@mars - - [微图坊爬虫 【22.06.07】【Windows】](http://h4ck.org.cn/2022/06/%e5%be%ae%e5%9b%be%e5%9d%8a%e7%88%ac%e8%99%ab-%e3%80%9022-06-07%e3%80%91%e3%80%90windows%e3%80%91/) -- 跳跳糖 - 安全与分享社区 - - [浅谈EDR绕过](https://tttang.com/archive/1618/) -- paper - Last paper - - [Analysis of MSDT Code Injection Vulnerability(CVE-2022-30190)](https://paper.seebug.org/1914/) - - [CVE-2022-30190 MSDT 代码注入漏洞分析](https://paper.seebug.org/1913/) -- 安全客-有思想的安全新媒体 - - [RSAC 2022 创新沙盒系列分析（一）](https://www.anquanke.com/post/id/273970) - - [活动 | ACTF 2022 | 巅峰竞技，即刻起航！](https://www.anquanke.com/post/id/273974) - - [WEB3 安全系列 || 你今天被‘钓鱼“了么，Web3被攻击及损失案例分析](https://www.anquanke.com/post/id/273843) - - [安全事件周报 (05.30-06.05)](https://www.anquanke.com/post/id/273941) - - [密码学LCG—PWNHUB—mylcg](https://www.anquanke.com/post/id/273719) - - [短链接钓鱼再掀热潮 反向隧道搭配干活不累](https://www.anquanke.com/post/id/273930) -- Blog on STAR Labs - - [Trying To Exploit A Windows Kernel Arbitrary Read Vulnerability](https://starlabs.sg/blog/2022/06/trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/) -- Forcepoint - - [Simplifying branch connectivity and security with FlexEdge Secure SD-WAN](https://www.forcepoint.com/blog/insights/simplifying-branch-connectivity-flexedge-secure-sd-wan) -- NVISO Labs - - [Cortex XSOAR Tips & Tricks – Discovering undocumented API endpoints](https://blog.nviso.eu/2022/06/07/cortex-xsoar-tips-tricks-discovering-undocumented-api-endpoints/) -- hn security - - [Multiple vulnerabilities in Zyxel zysh](https://security.humanativaspa.it/multiple-vulnerabilities-in-zyxel-zysh/) -- Hexacorn - - [A few more protocol handlers :)](https://www.hexacorn.com/blog/2022/06/07/a-few-more-protocol-handlers/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Hacking Nginx: Best ways](https://infosecwriteups.com/hacking-nginx-best-ways-7c576cc17ccc?source=rss----7b722bfd1b8d--bug_bounty) -- Malwarebytes Labs - - [Ransomware Task Force priorities see progress in first year](https://blog.malwarebytes.com/ransomware/2022/06/ransomware-task-force-priorities-see-progress-in-first-year/) - - [Hackers can take over accounts you haven’t even created yet](https://blog.malwarebytes.com/hacking-2/2022/06/hackers-can-take-over-accounts-you-havent-even-created-yet/) - - [Rotten apples banned from the App store](https://blog.malwarebytes.com/reports/2022/06/rotten-apples-banned-from-the-app-store/) -- Sucuri Blog - - [It Takes 2 Seconds of Silence to Skim a Credit Card](https://blog.sucuri.net/2022/06/it-takes-2-seconds-of-silence-to-skim-a-credit-card.html) -- Reverse Engineering - - [BlackGuard Analysis - Deobfuscation Using Dnlib](https://www.reddit.com/r/ReverseEngineering/comments/v7372l/blackguard_analysis_deobfuscation_using_dnlib/) - - [Adding rollback netplay to a Game Boy Advance game from 2005 -- Mega Man Battle Network](https://www.reddit.com/r/ReverseEngineering/comments/v74m1p/adding_rollback_netplay_to_a_game_boy_advance/) - - [ESP-IDF Setup Guide - A guide on setting up an environment for ESP32 vulnerability research](https://www.reddit.com/r/ReverseEngineering/comments/v6j77h/espidf_setup_guide_a_guide_on_setting_up_an/) -- The Daily Swig | Cybersecurity news and views - - [Google showers top cloud security researchers with kudos and cash](https://portswigger.net/daily-swig/google-showers-top-cloud-security-researchers-with-kudos-and-cash) - - [HTTP/3 evolves into RFC 9114 – a security advantage, but not without challenges](https://portswigger.net/daily-swig/http-3-evolves-into-rfc-9114-a-security-advantage-but-not-without-challenges) - - [Vast majority of ethical hackers keen to spend more time bug bounty hunting – report](https://portswigger.net/daily-swig/vast-majority-of-ethical-hackers-keen-to-spend-more-time-bug-bounty-hunting-report) -- bishopfox.com - - [Using CloudTrail to Pivot to AWS Accounts](https://bishopfox.com/blog/using-cloudtrail-to-pivot-to-aws-accounts) -- KitPloit - PenTest & Hacking Tools - - [Nipe - An Engine To Make Tor Network Your Default Gateway](http://www.kitploit.com/2022/06/nipe-engine-to-make-tor-network-your.html) - - [Sentinel-Attack - Tools To Rapidly Deploy A Threat Hunting Capability On Azure Sentinel That Leverages Sysmon And MITRE ATT&CK](http://www.kitploit.com/2022/06/sentinel-attack-tools-to-rapidly-deploy.html) -- Black Hills Information Security - - [Talkin’ About Infosec News – 5/16/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-5-16-2022/) - - [Phishing Made Easy(ish)](https://www.blackhillsinfosec.com/phishing-made-easyish/) -- Mozilla Hacks – the Web developer blog - - [Training efficient neural network models for Firefox Translations](https://hacks.mozilla.org/2022/06/training-efficient-neural-network-models-for-firefox-translations/) -- 杨龙 - - [git bash 运行redis-cli 无输出问题](https://www.yanglong.pro/git-bash-%e8%bf%90%e8%a1%8credis-cli-%e6%97%a0%e8%be%93%e5%87%ba%e9%97%ae%e9%a2%98/) -- LuxSci - - [What is the Difference Between Asynchronous and Synchronous Communications?](https://luxsci.com/blog/difference-between-asynchronous-and-synchronous-communications.html) -- Secureworks Blog - - [How to Prevent Multi-factor Authentication Bypass](https://www.secureworks.com/blog/how-to-prevent-multi-factor-authentication-bypass) -- Chaos Computer Club - last 100 events feed - - [Mediacenter für Eltern (petitfoo)](https://cdn.media.ccc.de/contributors/essen/petitfoo/h264-hd/petitfoo-56-deu-Mediacenter_fuer_Eltern_hd.mp4) -- 奇客Solidot–传递最新科技情报 - - [德意志银行将数百 IT 专家从俄罗斯迁移到德国](https://www.solidot.org/story?sid=71758) - - [上海研究发现过度使用屏幕影响儿童发育](https://www.solidot.org/story?sid=71757) - - [苹果宣布类似 AMD FSR 和 Nvidia DLSS 的图像缩放技术](https://www.solidot.org/story?sid=71756) - - [Telegram 据报道向德国政府提供用户数据](https://www.solidot.org/story?sid=71755) - - [英国试行薪酬不变的四天工作制](https://www.solidot.org/story?sid=71754) - - [韦伯望远镜将于 7 月 12 日发布首批全彩图片和光谱数据](https://www.solidot.org/story?sid=71753) - - [AI 购物创业公司的AI实际上只是菲律宾的廉价劳工](https://www.solidot.org/story?sid=71752) - - [研究生证明素数猜想](https://www.solidot.org/story?sid=71751) - - [NASA DAVINCI 探测器如何穿越金星地狱般的大气层](https://www.solidot.org/story?sid=71750) - - [Tails 5.1 释出](https://www.solidot.org/story?sid=71749) - - [苹果演示无密码身份验证 Passkeys](https://www.solidot.org/story?sid=71748) - - [意大利 Palermo 市在网络攻击后关闭所有服务](https://www.solidot.org/story?sid=71747) - - [苹果宣布 M2 芯片](https://www.solidot.org/story?sid=71746) - - [马斯克威胁终止与 Twitter 的交易](https://www.solidot.org/story?sid=71745) -- bellingcat - - [Clues to the Fate of Five Damaged Cultural Heritage Sites in Ukraine](https://www.bellingcat.com/news/uk-and-europe/2022/06/07/clues-to-the-fate-of-five-damaged-cultural-heritage-sites-in-ukraine/) -- Cobalt Strike Research and Development - - [There’s Another New Deputy in Town](https://www.cobaltstrike.com/blog/theres-another-new-deputy-in-town/) -- Khaled Nassar - - [Don’t use List in python](https://knassar702.github.io/2022/06/07/pylist/) -- Qualys Security Blog - - [Close the Gap Between IT & Security with Our New App: Qualys VMDR for ITSM](https://blog.qualys.com/category/product-tech) -- IT Service Management News - - [Poste italiane ferme per un errore di aggiornamento ai sistemi](http://blog.cesaregallotti.it/2022/06/poste-italiane-ferme-per-un-errore-di.html) -- Securityinfo.it - - [Sophos: cresce la permanenza dei cybercriminali nelle reti delle vittime](https://www.securityinfo.it/2022/06/07/sophos-cresce-la-permanenza-dei-cybercriminali-nelle-reti-delle-vittime/?utm_source=rss&utm_medium=rss&utm_campaign=sophos-cresce-la-permanenza-dei-cybercriminali-nelle-reti-delle-vittime) - - [Rischio di attacchi omografici in Microsoft Office](https://www.securityinfo.it/2022/06/07/rischio-di-attacchi-omografici-in-microsoft-office/?utm_source=rss&utm_medium=rss&utm_campaign=rischio-di-attacchi-omografici-in-microsoft-office) -- Rasta Mouse - - [Protected: OUs and GPOs and WMI Filters, Oh My!](https://rastamouse.me/ous-and-gpos-and-wmi-filters-oh-my/) -- SANS Internet Storm Center, InfoCON: green - - [Atlassian Confluence Exploits Seen By Our Honeypots (CVE-2022-26134), (Tue, Jun 7th)](https://isc.sans.edu/diary/rss/28722) - - [ISC Stormcast For Tuesday, June 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=8038, (Tue, Jun 7th)](https://isc.sans.edu/diary/rss/28720) -- Instapaper: Unread - - [How to Reverse Engineer and Patch an iOS Application for Beginners Part I](https://www.inversecos.com/2022/06/how-to-reverse-engineer-and-patch-ios.html) - - [macOS permesso necessario per gli accessori USB-C](https://www.punto-informatico.it/macos-permesso-necessario-per-gli-accessori-usb-c/) - - [iOS Settings Display Auto-Lock & Require Passcode](https://dfir.pubpub.org/pub/khnqi0ff/release/1) - - [AlphaBay Is Taking Over the Dark Web—Again](https://www.wired.com/story/alphabay-dark-web-market-ranking/) - - [Cyber Triage Lite – Identifying OS Configuration](https://www.cybertriage.com/blog/digital-forensics-tool-kit/cyber-triage-lite-identifying-os-configuration/) - - [Researchers Demonstrate Ransomware for IoT Devices That Targets IT and OT Networks](https://thehackernews.com/2022/06/researchers-demonstrate-ransomware-for.html) - - [Meet the Vigilantes Who Hack Millions in Crypto to Save It From Thieves](https://www.vice.com/en/article/z34be3/meet-the-vigilantes-who-hack-millions-in-crypto-to-save-it-from-thieves) - - [Lockbit ransomware gang claims to have hacked cybersecurity giant Mandiant](https://securityaffairs.co/wordpress/132011/cyber-crime/lockbit-claims-mandiant-hack.html) -- Security Affairs - - [Evil Corp gang starts using LockBit Ransomware to evade sanctions](https://securityaffairs.co/wordpress/132031/cyber-crime/evil-corp-lockbit-ransomware.html) - - [Black Basta ransomware operators leverage QBot for lateral movements](https://securityaffairs.co/wordpress/132018/hacking/black-basta-ransomware-qbot.html) -- NetSPI - - [2022 RSA Conference: What Makes Us the Most Innovative Pentesting Company?](https://www.netspi.com/blog/executive/netspi-updates/rsac-2022-penetration-testing-award/) -- Dark Reading - - [An Emerging Threat: Attacking 5G Via Network Slices](https://www.darkreading.com/threat-intelligence/an-emerging-threat-attacking-5g-via-network-slices) - - [Mandia: Keep 'Shields Up' to Survive the Current Escalation of Cyberattacks](https://www.darkreading.com/threat-intelligence/mandia-keep-shields-up-to-survive-the-current-escalation-of-cyberattacks) - - [Multilevel Extortion: DeadBolt Ransomware Targets Internet-Facing NAS Devices](https://www.darkreading.com/threat-intelligence/multilevel-extortion-deadbolt-ransomware-targets-internet-facing-nas-devices) - - [How the C-Suite Puts Shoulders Into Zero Trust in 2022](https://www.darkreading.com/cloud/c-suite-shoulders-zero-trust-2022) - - [RSAC Opens With Message of Transformation](https://www.darkreading.com/careers-and-people/rsac-opens-message-transformation) - - [Enterprise Security Around the Dinner Table](https://www.darkreading.com/omdia/enterprise-security-around-the-dinner-table) - - [7 NFT Scams That Could Be Targeting Your Brand](https://www.darkreading.com/vulnerabilities-threats/7-nft-scams-that-could-be-targeting-your-brand) - - [Harnessing AI to Proactively Thwart Threats](https://www.darkreading.com/dr-tech/harnessing-ai-to-proactively-thwart-threats) - - [Akamai Launches New Malware Protection for Uploaded Files](https://www.darkreading.com/attacks-breaches/akamai-launches-new-malware-protection-for-uploaded-files) - - [Cybersecurity Industry Leaders Launch Campaign to Close the Cybersecurity Talent Gap](https://www.darkreading.com/careers-and-people/cybersecurity-industry-leaders-launch-campaign-to-close-the-cybersecurity-talent-gap) - - [CISA Challenges Partners and Public to Push for 'More Than a Password' in New Social Media Campaign](https://www.darkreading.com/endpoint/cisa-challenges-partners-and-public-to-push-for-more-than-a-password-in-new-social-media-campaign) - - [Forescout Announces Intent to Acquire Cysiv to Deliver Data-Powered Threat Detection and Response](https://www.darkreading.com/cloud/forescout-announces-intent-to-acquire-cysiv-to-deliver-data-powered-threat-detection-and-response) - - [CyberRatings.org Announces Test on Cloud Network Firewall](https://www.darkreading.com/cloud/cyberratings-org-announces-test-on-cloud-network-firewall) - - [Bugcrowd Expands Pen Testing Solutions with New Platform Services](https://www.darkreading.com/application-security/bugcrowd-expands-pen-testing-solutions-with-new-platform-services) - - [Snowflake Debuts Cybersecurity Workload to Aid Visibility, Automation](https://www.darkreading.com/dr-tech/snowflake-debuts-cybersecurity-workload-to-aid-visibility-automation) - - [Fortinet Unveils New Digital Risk Protection Offering](https://www.darkreading.com/threat-intelligence/fortinet-unveils-new-digital-risk-protection-offering) -- NVISO Labs - - [Cortex XSOAR Tips & Tricks – Discovering undocumented API endpoints](https://blog.nviso.eu/2022/06/07/cortex-xsoar-tips-tricks-discovering-undocumented-api-endpoints/) -- Posts By SpecterOps Team Members - Medium - - [Managed Identity Attack Paths, Part 2: Logic Apps](https://posts.specterops.io/managed-identity-attack-paths-part-2-logic-apps-52b29354fc54?source=rss----f05f8696e3cc---4) -- KCon黑客大会 - - [KCon 2022 议题大众评选火热进行中！不要错过“心仪”的议题哦～](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651134617&idx=1&sn=6e2f9d7eb9ae656a0d3437225b8e8a0b&chksm=f2c11bf9c5b692efd7ae704766908425875e3e83fc0273915a91e2c572e76497b893a87a0cb7&scene=58&subscene=0#rd) -- Threatpost - - [Cyber Risk Retainers: Not Another Insurance Policy](https://threatpost.com/cyber-risk-retainers-not-another-insurance-policy/179895/) - - [Conducting Modern Insider Risk Investigations](https://threatpost.com/conducting-modern-insider-risk-investigations/179869/) - - [Follina Exploited by State-Sponsored Hackers](https://threatpost.com/follina-exploited-by-state-sponsored-hackers/179890/) - - [Attackers Use Public Exploits to Throttle Atlassian Confluence Flaw](https://threatpost.com/public-exploits-atlassian-confluence-flaw/179887/) -- Krebs on Security - - [KrebsOnSecurity in New Netflix Series on Cybercrime](https://krebsonsecurity.com/2022/06/krebsonsecurity-in-new-netflix-series-on-cybercrime/) -- 字节跳动技术团队 - - [以一次 Data Catalog 架构升级为例聊业务系统的性能优化](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494350&idx=1&sn=31bffb44e1897a752b3ed2a7b5a22919&chksm=e9d3212cdea4a83a14a6f98a0e0ba002c333f24bea664bdbee4dcd311406a7955ee435ba3c9f&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [加油！高考生！](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247504173&idx=1&sn=1becc3087e4054ba8c489c7725a7a046&chksm=eb700f12dc0786045971fb5169ed8a7ac63e0e928079c9bf127a3079d7ee47f805f95966b8b0&scene=58&subscene=0#rd) -- Deep Web - - [What's the safest way I can browse the deep web?](https://www.reddit.com/r/deepweb/comments/v76qz7/whats_the_safest_way_i_can_browse_the_deep_web/) -- Computer Forensics - - [Memory forensics analysis with Volatility | HackTheBox Export | Intro to Blue Team.](https://www.reddit.com/r/computerforensics/comments/v6o1qx/memory_forensics_analysis_with_volatility/) - - [Tip on working with E01 images of a Linux system -> accessing an LVM partition (Tsurugi Linux as a forensic workstation)](https://www.reddit.com/r/computerforensics/comments/v6x0rx/tip_on_working_with_e01_images_of_a_linux_system/) -- /r/netsec - Information Security News & Discussion - - [Open source automated NIST SP 800-53 r5 benchmark for AWS (120+ controls!)](https://www.reddit.com/r/netsec/comments/v6vbc6/open_source_automated_nist_sp_80053_r5_benchmark/) - - [DogWalk 0-day vulnerability in Microsoft's Diagnostic Tool](https://www.reddit.com/r/netsec/comments/v77oee/dogwalk_0day_vulnerability_in_microsofts/) - - [CVE-2022–29622: (In)vulnerability Analysis](https://www.reddit.com/r/netsec/comments/v6rccw/cve202229622_invulnerability_analysis/) - - [Multiple vulnerabilities in Zyxel zysh](https://www.reddit.com/r/netsec/comments/v6oyyw/multiple_vulnerabilities_in_zyxel_zysh/) - - [AWS S3 Scanner: Online tool for finding misconfigurations](https://www.reddit.com/r/netsec/comments/v756tm/aws_s3_scanner_online_tool_for_finding/) - - [Observed In The Wild: Atlassian Confluence Server CVE-2022-26134](https://www.reddit.com/r/netsec/comments/v6iia0/observed_in_the_wild_atlassian_confluence_server/) - - [Building Safe End-to-End Encrypted Services for Business - a Google Workspace perspective](https://www.reddit.com/r/netsec/comments/v6ixlq/building_safe_endtoend_encrypted_services_for/) - - [Network analysis of a targeted phish that got past Defender](https://www.reddit.com/r/netsec/comments/v707vn/network_analysis_of_a_targeted_phish_that_got/) - - [Scanning statistics of vulnerable Atlassian Confluence Server(CVE-2022-26134) : Still lots of servers are exposed to the internet.](https://www.reddit.com/r/netsec/comments/v6lbvh/scanning_statistics_of_vulnerable_atlassian/) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第22期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491825&idx=1&sn=c255c3be1aed3a608afd91dca32df6d3&chksm=fd74d038ca03592e8d619f99b8b587f43ecac5806d46d348014e4dff702fb11883f2b552979e&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220530-20220605)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491825&idx=2&sn=57f8a4022a8fd3918649a58cc76cdc4a&chksm=fd74d038ca03592edbb37dc72abeb8f4774f57076e6d218a8800aeec303f29d86cfb01b4da06&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [Could I scan the private IPs seen here if i use the redacted public ip as a proxy?](https://www.reddit.com/r/HowToHack/comments/v6xxx8/could_i_scan_the_private_ips_seen_here_if_i_use/) - - [Clearing cache with JavaScript hook or DNS spoofed website.](https://www.reddit.com/r/HowToHack/comments/v6xtcq/clearing_cache_with_javascript_hook_or_dns/) - - [In phishing attacks, how does the data get sent back to the hacker?](https://www.reddit.com/r/HowToHack/comments/v6rmsx/in_phishing_attacks_how_does_the_data_get_sent/) -- Blackhat Library: Hacking techniques and research - - [Did your ISP leave a surprise bind shell on your router? Mine did...](https://www.reddit.com/r/blackhat/comments/v6snyj/did_your_isp_leave_a_surprise_bind_shell_on_your/) - - [Verification of TVTools AlterID](https://www.reddit.com/r/blackhat/comments/v6zmek/verification_of_tvtools_alterid/) -- Deeplinks - - [When DRM Comes For Your Wheelchair](https://www.eff.org/deeplinks/2022/06/when-drm-comes-your-wheelchair) -- M01NTeam - - [洞见RSA2022：从云创新看网络安全转型战略方向](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247488252&idx=1&sn=f86b9115f5786167dabf765f3594a8e1&chksm=c187d2edf6f05bfbfaa8298e24384ec0143ad8483a81478cc525a8c7d5ae0a1a32ffb49fc51d&scene=58&subscene=0#rd) -- Social Engineering - - [Selling a car. People asking for my number instead of using sales portal. What's the angle?](https://www.reddit.com/r/SocialEngineering/comments/v6ywd5/selling_a_car_people_asking_for_my_number_instead/) -- 安全威胁情报 - - [首功！这只“老狐狸”又被我们抓住了](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172572&idx=1&sn=53fecc1f5f465db4e2d0da934ffa9c45&chksm=f4489720c33f1e3641ab32f9b7edafe2ca0d1de08e2bbf6e5dd10e0fd7ce276efe9ed6c12704&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [CNVD漏洞周报2022年第22期](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496726&idx=1&sn=d0860fc41c405027399d1fdcc5a36f82&chksm=973ac774a04d4e623b815ca7e6d30e3bdead698d2734564442c1ae563e04fc6e7cf9d68d99a2&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220530-20220605)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496726&idx=2&sn=75bb0ccd9104d516ceabcabe29468ca9&chksm=973ac774a04d4e62aa7b6d30b1b67ec78d6fc4f8efdbd69f697c8de7c8dc5aae79508d843fce&scene=58&subscene=0#rd) -- Tor Project blog - - [New Release: Tor Browser 11.0.14 (Android, Windows, macOS, Linux)](https://blog.torproject.org/new-release-tor-browser-11014/) -- 安全牛 - - [《移动金融客户端应用软件安全管理规范》技术解读](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114163&idx=1&sn=47b89f26244fff6710c88d879b6f1af6&chksm=bd147a608a63f376314854057bb75f1331e0a1eeabc18a530c888a1414af0c6e29597dc955d0&scene=58&subscene=0#rd) - - [威胁企业云应用安全的五个常见错误](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114163&idx=2&sn=2b37d5484578b0ce282a5baf803fff5b&chksm=bd147a608a63f376d4c43f59804c0d3258cc8608101fd1e7a55641b0c572190ca2f3b583bb5c&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [Nipe - An Engine To Make Tor Network Your Default Gateway](http://www.kitploit.com/2022/06/nipe-engine-to-make-tor-network-your.html) - - [Sentinel-Attack - Tools To Rapidly Deploy A Threat Hunting Capability On Azure Sentinel That Leverages Sysmon And MITRE ATT&CK](http://www.kitploit.com/2022/06/sentinel-attack-tools-to-rapidly-deploy.html) -- 东软网络安全 - - [东软NetEye云安全系统荣获新一代信息技术创新产品奖](https://mp.weixin.qq.com/s?__biz=MjM5NTAyODkxNw==&mid=2649212381&idx=1&sn=8e27152a34de01af3f3c4e655c83b608&chksm=beedaf07899a261170faf761068a33b6421be657159f8be93becde78043bb684ca8495fe1a45&scene=58&subscene=0#rd) -- 雷神众测 - - [ATT&CK-Spring Framework(CVE-2022-22965)远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652497555&idx=1&sn=34ad39b51376d97a86d271794f0971b2&chksm=f2584520c52fcc3642230fc02b4e94a296f0d35f8fec8b4a4e3e13498a8fbff11c725f98cc30&scene=58&subscene=0#rd) -- 安全客 - - [【安全头条】短链接钓鱼再掀热潮 反向隧道搭配干活不累](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771247&idx=1&sn=007df49822a32adfb7fb3d18fdd7253a&chksm=88937c80bfe4f596157f48a901fe6bd9572db61f4226db469981f9072b1f5092e32e2403c88f&scene=58&subscene=0#rd) - - [【技术分享】Anatova勒索病毒详细分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771247&idx=2&sn=10422927cf5118b3d186d20baa5eb166&chksm=88937c80bfe4f596d81dc9e076fd364a1f085c86b09f0867a4acde10f9f552346962721bee25&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [《绿盟君的咖啡时间》| 洞见RSA2022：从云创新看网络安全转型战略方向](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492150&idx=1&sn=99c4732ec845d0261de51b2885bf6470&chksm=e84c44e9df3bcdffeaaa156e0d3b6006c74733d5d07abcf79770cd458f97e9ae5905c6111235&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-07)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958486&idx=1&sn=2409595fa5c81743caec0eeb81eb6498&chksm=8baecc49bcd9455f2825fdb2b20a332f86ec65117333effd6f2e2442c68ffe1db6569d171820&scene=58&subscene=0#rd) -- Seebug漏洞平台 - - [CVE-2022-30190 MSDT 代码注入漏洞分析](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650961305&idx=1&sn=5d27d89f79f036101db5acffdf124014&chksm=807937abb70ebebd10830cd2aa7822df3e266174fd12ff27f0a8b303661771fbc68d5c528a7a&scene=58&subscene=0#rd) -- TorrentFreak - - [‘Copyright Troll’ Has Already Filed Over 1,000 Piracy Lawsuits This Year](https://torrentfreak.com/copyright-troll-has-already-filed-over-1000-piracy-lawsuits-this-year-220607/) - - [IPTV Pirate Must Pay £963K or 88 Month Prison Sentence Becomes 168 Months](https://torrentfreak.com/iptv-pirate-must-pay-963k-or-88-month-prison-sentence-becomes-168-220607/) -- 关键基础设施安全应急响应中心 - - [加强电信行业关键信息基础设施安全保护](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527114&idx=1&sn=bb7526da0bc5b3cecd34ce3641971e34&chksm=c1e9e69bf69e6f8d6e58c48b403dcfadfcba906f502e099a0cdbcb5837d1ea25d03709eb7db5&scene=58&subscene=0#rd) - - [数字化转型下的智慧油储网络安全主动防御技术研究与实践](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527114&idx=2&sn=100cdb18c10ea2c3011f9560b287852d&chksm=c1e9e69bf69e6f8d8476336f6eb417b0b61afcefef54a25f618c5ee3adc161addc16b402740c&scene=58&subscene=0#rd) - - [美国BIS发布网络安全漏洞出口禁令，全球漏洞共享机制遭严峻挑战](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527114&idx=3&sn=bc36689958f0aa95f4c9d42c74760da5&chksm=c1e9e69bf69e6f8d4dffdbe985b50d58a7a1b21c9f430e4de16ace50ea9bb6d7e97a7b80d5ba&scene=58&subscene=0#rd) -- 数世咨询 - - [俄乌信息作战升级](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493605&idx=1&sn=921732b16ec56d4e21f068df1cf2978d&chksm=c1449558f6331c4e6d927f4d0535b825d8f2a57bc2e894a0a4240aedb008759bd4414a7cf0ad&scene=58&subscene=0#rd) - - [RSA2022创新沙盒｜Talon Cyber Security为何成最大赢家？](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493605&idx=2&sn=2753f86c90143e31ca4d09bdd6588680&chksm=c1449558f6331c4e6d6c0fc9eed09841c46f687e154c52443b178c41087b2750eebbda467f57&scene=58&subscene=0#rd) -- 青藤云安全 - - [5年“研究”3年“实战” 之后的满分答卷](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650834646&idx=1&sn=54c217ae0d94698299799c782e283912&chksm=80dbe573b7ac6c65ad855338914a68ca1193a046dbc6a025098df77bb78a8f5cd2ec3b3db56d&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [美商务部出台新规：未经审批禁止向中国分享安全漏洞，微软反对无效！](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247489848&idx=1&sn=1dc3a8dd3d06d8666392a69df9630047&chksm=feb5982bc9c2113d18235b6386351752d880b4e0e5f639a8eaeee73598e8fc7aa02b16796537&scene=58&subscene=0#rd) - - [决战高考！愿你能查缺补漏，不惧疫情阴霾](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247489848&idx=2&sn=db23fbcd2afb6a0f954aa58676be6e71&chksm=feb5982bc9c2113d4fcbabe3a82d26288b7fb893d189bd673d808029f76b1a073d72f847cc2e&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.06.07）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491047&idx=1&sn=b0fc3ad3ad55bd22a3071e51c7586ca5&chksm=fe2518e6c95291f0a8a61afee81ce422beb08b3bbb7650d1fe174316f427da5edac66d6b6bd1&scene=58&subscene=0#rd) -- 互联网安全内参 - - [企业浏览器厂商Talon Cyber​​ Security斩获RSAC2022创新沙盒冠军](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503351&idx=1&sn=55d6149db13ead1e19b5a50cad49b725&chksm=ebfa8ad7dc8d03c1aa8f9501e86314736f9749aa936718438a6947ef3e5aaa9027325f3c9304&scene=58&subscene=0#rd) - - [知名安全厂商Mandiant遭LockBit勒索软件入侵？官方否认](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503351&idx=2&sn=4ca731633d1d0009787db646c478e3c4&chksm=ebfa8ad7dc8d03c1c2dc662b7f6cdb7efaf71d77f6d9a2ac219823b19b4b119bab3f25269e14&scene=58&subscene=0#rd) - - [全球经济受威胁：海运供应链易遭网络攻击](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503351&idx=3&sn=cbf594dab854790615db112fd02fa718&chksm=ebfa8ad7dc8d03c1bcb56b9070014c3f42b8baf5ef5d12a2bebd1558f18a0f0e93d09796063e&scene=58&subscene=0#rd) - - [美国能源部《2022制造业网络安全路线图》概述](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503351&idx=4&sn=28b60910b94f8b4ef9f78e69aed72049&chksm=ebfa8ad7dc8d03c1260738bc9469a7d6654f992b3b802488de0a9b5307ff4056e6ba0b716460&scene=58&subscene=0#rd) -- The Register - Security - - [IBM buys Randori to address multicloud security messes](https://go.theregister.com/feed/www.theregister.com/2022/06/07/ibm_buys_randori_rsa_news/) - - [Microsoft seizes 41 domains tied to 'Iranian phishing ring'](https://go.theregister.com/feed/www.theregister.com/2022/06/07/microsoft_bohrium_domains/) -- 永安在线情报平台 - - [重磅预告：永安在线IP风险画像携IPv6风险识别技术全新升级](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493369&idx=1&sn=8cf91feb2a7f91ecf9ca17a78c607125&chksm=eb12c0c2dc6549d46c34e6c47f1948ae53e72b97c738b166fc637a78e0e8d163cdb519da0301&scene=58&subscene=0#rd) -- 看雪学院 - - [PWN入门-格式化字符串漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451595&idx=1&sn=745cf76fb3ee0b1f35dd530b7146b017&chksm=b18fce0186f84717d542b5ae309eec80c2242099578d154522f4cba65fa3b74dbeee1d40c432&scene=58&subscene=0#rd) - - [Mandiant否认遭LockBit勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451595&idx=2&sn=664d351e4002ddd00c94c50db35ba5c3&chksm=b18fce0186f847179e3965253374a5da0b44e73a5053f2677227e91580e160ee381782cc7fe3&scene=58&subscene=0#rd) - - [《物联网安全入门》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451595&idx=3&sn=6a9ce0e0d118818fe46d45a5b87695d1&chksm=b18fce0186f84717da1e107ae8b1f933d60f905e25443c5860f15b1be5d4c51c8f34945501b9&scene=58&subscene=0#rd) -- 黑奇士 - - [众人乱题“泄欲亭” 宝玉显才贾政前 也说中国人的人情世故](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247487028&idx=1&sn=b67d5cba0fa8996b5ade9c3ccaf2feee&chksm=eca201d8dbd588ce415ed3ccf56418cfdbc86a2a22a0ccdef0416063112de8c003c1cc7500b9&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [0CTF 2017-zer0IIvm题目分析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493921&idx=1&sn=a4e11f61f9b7a4aaa23f5d62f61dcc9a&chksm=fa523c9fcd25b589240d66ce197b59227cbd49f897e545c5c57fb98ebf5eecbf5d373ab7415b&scene=58&subscene=0#rd) -- 情报分析师 - - [【分析师干货】数据分析在政治和战争中的重要应用及俄乌战争数据分析报告](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650504428&idx=1&sn=b03af1b281ce2fb6c77f5b30d7e1932b&chksm=871652a7b061dbb1c22e2944e658b23b09bf3f22814d221e0ce3858e95e2360b358eb4ea7c8e&scene=58&subscene=0#rd) - - [数据集：美国枪支制造30年](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650504428&idx=2&sn=0498527c20ae8ccc908519b583343108&chksm=871652a7b061dbb1dcf6c293c41317453a4370b4883ed1d4eaa3ceb6218942970625656040c9&scene=58&subscene=0#rd) -- Dark Space Blogspot - - [Drenati I Pools Su Mirror Protocol: Oracoli Ingannati](http://darkwhite666.blogspot.com/2022/06/drenati-i-pools-su-mirror-protocol.html) diff --git a/archive/2022/2022-06-09.md b/archive/2022/2022-06-09.md deleted file mode 100644 index c8e2cc9b18..0000000000 --- a/archive/2022/2022-06-09.md +++ /dev/null @@ -1,260 +0,0 @@ -# 每日安全资讯（2022-06-09） - -- Tenable Blog - - [So Many CVEs, So Little Time: Zero In and ‘Zero Click’ into the Current Vulnerability Landscape](https://www.tenable.com/blog/so-many-vulnerabilities-so-little-time) -- HackerOne Hacker Activity - - [Several Subdomains Takeover](https://hackerone.com/reports/1591085) - - [XSS by clicking Jira's link](https://hackerone.com/reports/1194254) - - [Gitlab Pages token theft using service workers](https://hackerone.com/reports/1439552) - - ["External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request](https://hackerone.com/reports/1375393) - - [Stored XSS on issue comments and other pages which contain notes](https://hackerone.com/reports/1398305) - - [Reflected XSS on https://www.glassdoor.com/parts/header.htm](https://hackerone.com/reports/1073712) - - [Reflected XSS on https://help.glassdoor.com/gd_requestsubmitpage](https://hackerone.com/reports/1094224) - - [Open redirect on https://www.glassdoor.com/profile/siwa.htm via state parameter](https://hackerone.com/reports/1097208) -- Files ≈ Packet Storm - - [Atlassian Confluence Namespace OGNL Injection](https://packetstormsecurity.com/files/167449/atlassian_confluence_namespace_ognl_injection.rb.txt) - - [WordPress Download Manager 3.2.42 Cross Site Scripting](https://packetstormsecurity.com/files/167448/wpdownloadmanager3242-xss.txt) - - [Ubuntu Security Notice USN-5471-1](https://packetstormsecurity.com/files/167447/USN-5471-1.txt) - - [Ubuntu Security Notice USN-5469-1](https://packetstormsecurity.com/files/167446/USN-5469-1.txt) - - [Ubuntu Security Notice USN-5470-1](https://packetstormsecurity.com/files/167445/USN-5470-1.txt) - - [Ubuntu Security Notice USN-5468-1](https://packetstormsecurity.com/files/167444/USN-5468-1.txt) - - [Ubuntu Security Notice USN-5467-1](https://packetstormsecurity.com/files/167443/USN-5467-1.txt) - - [Ubuntu Security Notice USN-5466-1](https://packetstormsecurity.com/files/167442/USN-5466-1.txt) - - [Ubuntu Security Notice USN-5465-1](https://packetstormsecurity.com/files/167441/USN-5465-1.txt) - - [Ubuntu Security Notice USN-5464-1](https://packetstormsecurity.com/files/167440/USN-5464-1.txt) - - [Red Hat Security Advisory 2022-4932-01](https://packetstormsecurity.com/files/167439/RHSA-2022-4932-01.txt) -- Blog & What's New | Offensive Security - - [OffSec Live](https://www.offensive-security.com/offsec/offsec-live/) -- Security Boulevard - - [IOCs in your APIs](https://securityboulevard.com/2022/06/iocs-in-your-apis/) - - [Ransomware Trends Show Lockbit Most Active, New Tactics, Healthcare Hit Hard](https://securityboulevard.com/2022/06/ransomware-trends-show-lockbit-most-active-new-tactics-healthcare-hit-hard/) - - [Product Feature | How To Detect Google/Microsoft 365 Ransomware Indicators Using ManagedMethods](https://securityboulevard.com/2022/06/product-feature-how-to-detect-google-microsoft-365-ransomware-indicators-using-managedmethods/) - - [Blowing up DevOps bottlenecks with pull requests](https://securityboulevard.com/2022/06/blowing-up-devops-bottlenecks-with-pull-requests/) - - [MITRE’s System of Trust: A proposed standard for software supply chain security](https://securityboulevard.com/2022/06/mitres-system-of-trust-a-proposed-standard-for-software-supply-chain-security/) - - [BSides:Munich 2022 – Daniel Feichter’s ‘Master Of Puppets: How To Tamper The EDR?’](https://securityboulevard.com/2022/06/bsidesmunich-2022-daniel-feichters-master-of-puppets-how-to-tamper-the-edr/) - - [US Seizes SSNDOB Market, Which Sold PII of 24 Million People](https://securityboulevard.com/2022/06/us-seizes-ssndob-market-which-sold-pii-of-24-million-people/) - - [How Vulnerable Is Your Organization to the Growing Ransomware Threat? It May Be Time to Modernize Your Cybersecurity Approach.](https://securityboulevard.com/2022/06/how-vulnerable-is-your-organization-to-the-growing-ransomware-threat-it-may-be-time-to-modernize-your-cybersecurity-approach/) - - [Shining a brighter light on what’s dwelling in your network](https://securityboulevard.com/2022/06/shining-a-brighter-light-on-whats-dwelling-in-your-network/) - - [Software supply chain security is no game. Or is it?](https://securityboulevard.com/2022/06/software-supply-chain-security-is-no-game-or-is-it/) -- Sploitus.com Exploits RSS Feed - - [Atlassian Confluence Namespace OGNL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167449&utm_source=rss&utm_medium=rss) - - [WordPress Download Manager 3.2.42 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167448&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26134 exploit](https://sploitus.com/exploit?id=2A83DE3B-242D-51BE-84C8-5EB39AE1800E&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Vmware Spring Cloud Gateway exploit](https://sploitus.com/exploit?id=EEA12A00-A397-5497-AFD6-3427AD52C0BF&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=11042BCC-1F42-5B57-B4AE-C5167CE829D6&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-1609 exploit](https://sploitus.com/exploit?id=94B81DF8-7A79-5158-92DA-9B27ADC3F3EF&utm_source=rss&utm_medium=rss) -- 跳跳糖 - 安全与分享社区 - - [SpringBoot Actuator之 logging.config grovvy rce分析及内存马注入](https://tttang.com/archive/1620/) -- 安全客-有思想的安全新媒体 - - [RSAC 2022 创新沙盒系列分析（二）](https://www.anquanke.com/post/id/273979) - - [活动 | 第五期个人能力认证考核专场报名开启！](https://www.anquanke.com/post/id/274002) - - [分享几个比较有意思的储存桶测试案例](https://www.anquanke.com/post/id/274008) - - [CVE-2022-30190 MSDT 代码注入漏洞分析](https://www.anquanke.com/post/id/273944) - - [初识Java反序列化](https://www.anquanke.com/post/id/273745) - - [强强联合 Black Basta勒索软件与QBot达成合作](https://www.anquanke.com/post/id/273945) -- 绿盟科技技术博客 - - [汽车以太网协议之 SOME/IP（上）](http://blog.nsfocus.net/some-ip-1/) -- FreeBuf网络安全行业门户 - - [企业抵御网络风险 应关注安全平台 | 直击RSAC2022](https://www.freebuf.com/articles/335630.html) - - [FreeBuf | 欧盟强制苹果等设备使用type C接口；信通院发布《软件物料清单实践指南》](https://www.freebuf.com/articles/335616.html) - - [网络资产攻击面管理（CAASM）成安全新解法 | 直击RSAC2022](https://www.freebuf.com/news/335615.html) - - [黑客团伙又增“一员”，AI 黑客或很快登场 | 直击RSAC2022](https://www.freebuf.com/news/335602.html) - - [在恶意软件、供应链攻击呈上升趋势下，企业需重新考虑安全策略 | 直击RSAC2022](https://www.freebuf.com/news/335600.html) - - [谷歌因侵犯隐私向居民赔偿1 亿美元](https://www.freebuf.com/news/335570.html) -- NowSecure - - [Executive Order 14028 Updates & Why SBOMs Are Important](https://www.nowsecure.com/blog/2022/06/08/executive-order-14028-updates-why-sboms-are-important/) -- Sandfly Security Blog RSS Feed - - [BPFDoor Coverage in Bleeping Computer](https://www.sandflysecurity.com/blog/bpfdoor-coverage-in-bleeping-computer) -- Reverse Engineering - - [Exploiting the Wii U's USB Descriptor parsing](https://www.reddit.com/r/ReverseEngineering/comments/v7oj04/exploiting_the_wii_us_usb_descriptor_parsing/) - - [A detailed analysis of the new malware used by the Russian APT28/Sofacy called SkinnyBoy](https://www.reddit.com/r/ReverseEngineering/comments/v7y9xl/a_detailed_analysis_of_the_new_malware_used_by/) - - [CVE-2022-26937: Microsoft Windows Network File System NLM Portmap Stack Buffer Overflow](https://www.reddit.com/r/ReverseEngineering/comments/v7qy3c/cve202226937_microsoft_windows_network_file/) -- SentinelOne - - [Top 10 Ways to Protect Your Active Directory](https://www.sentinelone.com/blog/top-10-ways-to-protect-your-active-directory/) -- SpiderLabs Blog from Trustwave - - [Not all "Internet Connections" are Equal](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/not-all-internet-connections-are-equal/) -- blog.avast.com EN - - [FakeCrack: Crypto stealing campaign spread via fake cracked software](https://blog.avast.com/fakecrack-campaign) -- Intigriti - - [Bug Bytes #173 – JDBC attacks reloaded, RCE via email & Benchmarking port scanners](https://blog.intigriti.com/2022/06/08/bug-bytes-173-jdbc-attacks-reloaded-rce-via-email-benchmarking-port-scanners/) -- The Daily Swig | Cybersecurity news and views - - [WWDC 2022: Apple showcases next-gen security tech at annual developer event](https://portswigger.net/daily-swig/wwdc-2022-apple-showcases-next-gen-security-tech-at-annual-developer-event) - - [Indian VPN providers resist incoming data-logging law](https://portswigger.net/daily-swig/indian-vpn-providers-resist-incoming-data-logging-law) -- 小草窝博客 - - [自动化获得微软漏洞赏金的经历.md](https://x.hacking8.com/post-443.html) -- Malwarebytes Labs - - [MakeMoney malvertising campaign adds fake update template](https://blog.malwarebytes.com/threat-intelligence/2022/06/makemoney-malvertising-campaign-adds-fake-update-template/) - - [Awful 4chan chat bot spouts racial slurs and antisemitic abuse](https://blog.malwarebytes.com/opinion/2022/06/awful-4chan-chat-bot-spouts-racial-slurs-and-antisemitic-abuse/) - - [5 Linux malware families SMBs should protect themselves against](https://blog.malwarebytes.com/business-2/2022/06/5-linux-malware-families-smbs-should-protect-themselves-against/) - - [SSNDOB stolen data marketplace shut down by global law enforcement operation](https://blog.malwarebytes.com/privacy-2/2022/06/ssndob-marketplace-shut-down-by-global-law-enforcement-operation/) - - [Coffee app in hot water for constant tracking of user location](https://blog.malwarebytes.com/privacy-2/2022/06/coffee-app-in-hot-water-for-constant-tracking-of-user-location/) -- daniel.haxx.se - - [Making libcurl init more thread-safe](https://daniel.haxx.se/blog/2022/06/08/making-libcurl-init-more-thread-safe/) -- KitPloit - PenTest & Hacking Tools - - [AutoPWN Suite - Project For Scanning Vulnerabilities And Exploiting Systems Automatically](http://www.kitploit.com/2022/06/autopwn-suite-project-for-scanning.html) - - [Socialhunter - Crawls The Website And Finds Broken Social Media Links That Can Be Hijacked](http://www.kitploit.com/2022/06/socialhunter-crawls-website-and-finds.html) -- Hc1m1 - - [Windows 驱动开发学习之获取CPU温度](https://nobb.site/2022/06/08/0x77/) -- 奇客Solidot–传递最新科技情报 - - [Waymo 和 Uber 在自动卡车上展开合作](https://www.solidot.org/story?sid=71771) - - [Telegram 准备推出订阅服务](https://www.solidot.org/story?sid=71770) - - [MongoDB 6.0 引入加密查询和时间序列数据](https://www.solidot.org/story?sid=71769) - - [小型癌症试验完全缓解所有患者](https://www.solidot.org/story?sid=71768) - - [自供电智能枕头跟踪睡眠](https://www.solidot.org/story?sid=71767) - - [任天堂希望黑客的监禁判决能引人注目](https://www.solidot.org/story?sid=71766) - - [沙特阿拉伯计划每年花费 10 亿美元寻找延缓衰老的方法](https://www.solidot.org/story?sid=71765) - - [拜托，不要再造大强子对撞机了](https://www.solidot.org/story?sid=71764) - - [俄罗斯法庭下令逮捕《地铁2033》作者](https://www.solidot.org/story?sid=71763) - - [OnlyFans 的用户数没有像 Netflix 那样放缓](https://www.solidot.org/story?sid=71762) - - [喝咖啡或能降低死亡风险](https://www.solidot.org/story?sid=71761) - - [欧盟同意采用通用充电器端口](https://www.solidot.org/story?sid=71760) -- 90Sec - 最新话题 - - [掩日工具问题](https://forum.90sec.com/t/topic/2130) -- ICT Security Magazine - - [Le nuove sfide di cyber security per l’Intelligenza Artificiale: la mappatura dell’ecosistema e la tassonomia delle minacce](https://www.ictsecuritymagazine.com/articoli/le-nuove-sfide-di-cyber-security-per-lintelligenza-artificiale-la-mappatura-dellecosistema-e-la-tassonomia-delle-minacce/) -- Securityinfo.it - - [Aggiornamento Android risolve vulnerabilità critiche](https://www.securityinfo.it/2022/06/08/aggiornamento-android-risolve-vulnerabilita-critiche/?utm_source=rss&utm_medium=rss&utm_campaign=aggiornamento-android-risolve-vulnerabilita-critiche) - - [Exploit pubblici sfruttati per attaccare istanze di Confluence](https://www.securityinfo.it/2022/06/08/exploit-pubblici-sfruttati-per-attaccare-istanze-di-confluence/?utm_source=rss&utm_medium=rss&utm_campaign=exploit-pubblici-sfruttati-per-attaccare-istanze-di-confluence) - - [Hacker cinesi attaccano dispositivi di rete internazionali](https://www.securityinfo.it/2022/06/08/hacker-cinesi-attaccano-dispositivi-di-rete-internazionali/?utm_source=rss&utm_medium=rss&utm_campaign=hacker-cinesi-attaccano-dispositivi-di-rete-internazionali) -- CFC4N的博客 - - [Tetragon进程阻断原理](https://www.cnxct.com/how-tetragon-preventing-attacks/) -- Blog Archive | NTT Application Security - - [Retail Organizations’ Answer to Application Security | AppSec Solutions for Industries](https://www.whitehatsec.com/blog/retail-organizations-answer-to-application-security-appsec-solutions-for-industries/) -- SANS Internet Storm Center, InfoCON: green - - [ISC Stormcast For Wednesday, June 8th, 2022 https://isc.sans.edu/podcastdetail.html?id=8040, (Wed, Jun 8th)](https://isc.sans.edu/diary/rss/28724) -- Schneier on Security - - [Leaking Military Secrets on Gaming Discussion Boards](https://www.schneier.com/blog/archives/2022/06/leaking-military-secrets-on-gaming-discussion-boards.html) -- LockBoxx - - [Bootcamp #23: When to Escalate an Alert](http://lockboxx.blogspot.com/2022/06/bootcamp-23-when-to-escalate-alert.html) -- Securelist - - [Router security in 2021](https://securelist.com/router-security-2021/106711/) -- Daniel Miessler - - [How Good is DALL·E 2 at Creating NFT Artwork?](https://danielmiessler.com/blog/how-good-is-dall%c2%b7e-2-at-creating-nft-artwork/) -- Posts By SpecterOps Team Members - Medium - - [Managed Identity Attack Paths, Part 3: Function Apps](https://posts.specterops.io/managed-identity-attack-paths-part-3-function-apps-300065251cbe?source=rss----f05f8696e3cc---4) -- Diritto dell'Informatica - - [Risolvi problemi e ritardi con i fornitori: il contratto ad hoc per il per il Procurement](https://www.dirittodellinformatica.it/ict/risolvi-problemi-e-ritardi-con-i-fornitori-il-contratto-ad-hoc-per-il-per-il-procurement.html) -- TorrentFreak - - [‘Make VPN Detection Tools Mandatory to Fight Geo-Piracy’](https://torrentfreak.com/make-vpn-detection-tools-mandatory-to-fight-geo-piracy-220608/) - - [NHL Broadcasters Win Canada’s First ‘Dynamic’ Pirate IPTV Blocking Order](https://torrentfreak.com/nhl-broadcasters-win-canadas-first-dynamic-pirate-iptv-blocking-order-220608/) -- Security Affairs - - [0Patch released unofficial security patch for new DogWalk Windows zero-day](https://securityaffairs.co/wordpress/132070/hacking/unofficial-security-patch-dogwalk.html) - - [US dismantled and seized SSNDOB cybercrime marketplace](https://securityaffairs.co/wordpress/132061/cyber-crime/us-seized-ssndob-marketplace.html) - - [China-linked threat actors have breached telcos and network service providers](https://securityaffairs.co/wordpress/132042/apt/us-warns-china-linked-threat-actors.html) - - [Black Basta ransomware now supports encrypting VMware ESXi servers](https://securityaffairs.co/wordpress/132037/hacking/black-basta-ransomware-vmware-esxi.html) -- KitPloit - PenTest Tools! - - [AutoPWN Suite - Project For Scanning Vulnerabilities And Exploiting Systems Automatically](http://www.kitploit.com/2022/06/autopwn-suite-project-for-scanning.html) - - [Socialhunter - Crawls The Website And Finds Broken Social Media Links That Can Be Hijacked](http://www.kitploit.com/2022/06/socialhunter-crawls-website-and-finds.html) -- Instapaper: Unread - - [Tip on working with E01 images of a Linux system - accessing an LVM partition (Tsurugi Linux as a forensic workstation)](https://www.reddit.com/r/computerforensics/comments/v6x0rx/tip_on_working_with_e01_images_of_a_linux_system/) - - [Apple Just Killed the Password—for Real This Time](https://www.wired.com/story/apple-passkeys-password-ios16-ventura/) - - [Cellebrite CTF 2022 - Marsha's PC](https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-marshas-pc.html) - - [How to Report Sextortion – 4 Steps for Sextortion Victims](https://www.digitalforensics.com/blog/sextortion/how-to-report-sextortion-4-steps-for-sextortion-victims/) - - [KrebsOnSecurity in New Netflix Series on Cybercrime](https://krebsonsecurity.com/2022/06/krebsonsecurity-in-new-netflix-series-on-cybercrime/) - - [Decentralized Crypto Exchange Offline After Hacker Steals $113M](https://www.vice.com/en/article/88q45a/decentralized-crypto-exchange-maiar-offline-after-hacker-steals-dollar113m) -- Forensic Focus - - [FTK Feature Focus: Project Vic](https://www.forensicfocus.com/articles/ftk-feature-focus-project-vic/) -- The Register - Security - - [Google has more reasons why it doesn't like antitrust law that affects Google](https://go.theregister.com/feed/www.theregister.com/2022/06/08/google_antitrust_legislation/) - - [Feds raid dark web market selling data on 24 million Americans](https://go.theregister.com/feed/www.theregister.com/2022/06/08/us_feds_raid_dark_web/) - - [Intel offers 'server on a card' reference design for network security](https://go.theregister.com/feed/www.theregister.com/2022/06/08/intel_security_reference_design/) - - [Beijing-backed baddies target unpatched networking kit to attack telcos](https://go.theregister.com/feed/www.theregister.com/2022/06/08/cisa_fbi_nsa_china_attack_advisory/) - - [US cyber chiefs: Moving to Shields Down isn't gonna happen](https://go.theregister.com/feed/www.theregister.com/2022/06/08/us_shields_down/) - - [Ukraine's secret cyber-defense that blunts Russian attacks: Excellent backups](https://go.theregister.com/feed/www.theregister.com/2022/06/08/silverados_alperovitch_viasat_attack/) -- Security Through Education - - [Internet Safety Month: Stop, Think, Connect](https://www.social-engineer.org/social-engineering/internet-safety-month-stop-think-connect/) -- /r/netsec - Information Security News & Discussion - - [People’s Republic of China State-Sponsored Actors Exploit Network Providers and Devices](https://www.reddit.com/r/netsec/comments/v7simm/peoples_republic_of_china_statesponsored_actors/) - - [Confluence Webshells being dropped into the honeypot](https://www.reddit.com/r/netsec/comments/v7kls9/confluence_webshells_being_dropped_into_the/) - - [Using Windows Event Log IDs for Threat Hunting](https://www.reddit.com/r/netsec/comments/v7u5ai/using_windows_event_log_ids_for_threat_hunting/) - - [CVE-2022-30287 - Remote Code Execution via Email in Horde Webmail](https://www.reddit.com/r/netsec/comments/v7q4gd/cve202230287_remote_code_execution_via_email_in/) - - [New Technique: Extracting Clear-Text Credentials Directly From Chromium’s Memory](https://www.reddit.com/r/netsec/comments/v7xtdp/new_technique_extracting_cleartext_credentials/) -- Seebug漏洞平台 - - [KCon 2022 议题大众评选火热进行中！不要错过“心仪”的议题哦～](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650961307&idx=1&sn=47935e9a368de29aafd70f5f0eaaf673&chksm=807937a9b70ebebf17daff4bd3e8edb8e29d2ee596ab2986b91c1ccc80d4a300cf0a302b15fc&scene=58&subscene=0#rd) -- 慢雾科技 - - [慢雾 AML 与 Go+ Security 达成合作，为反洗钱再增力量](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495722&idx=1&sn=549f60d14755634fd32c9e7a41a64774&chksm=fdde8eadcaa907bb16d75cdcffb1788467ec7845aa506f785a66ff10276cdd954a10bf7cb793&scene=58&subscene=0#rd) -- 看雪学院 - - [看雪2022 KCTF 春季赛 | 第12题设计思路及解析](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451757&idx=1&sn=b8d9b155a1e3bf870e3a3fb67e14ea72&chksm=b18fcfa786f846b1e250caaa6acd44fbd4549b9699d3bb34b17bdbf0530513ec0d3f0375aadc&scene=58&subscene=0#rd) - - [美国拆除SSNDOB地下市场](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451757&idx=2&sn=8c05a7b55b8e443a07c82af2e28633af&chksm=b18fcfa786f846b1cb9dfe363a8d2e360d701939da2c0cee82422cbf3ca0e0ed25208d5a2b64&scene=58&subscene=0#rd) - - [《IDA插件开发入门》为你的逆向工作添砖加瓦](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451757&idx=3&sn=4beebefc30a7c26381bc097f177d9fe9&chksm=b18fcfa786f846b100c9690ed201c5279f15ce181c1f341a6519e483ef4511cb0f51f3fe1d9b&scene=58&subscene=0#rd) -- 星阑科技 - - [回顾篇之小阑5月那些事～](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493431&idx=1&sn=1bfb12f4bc7511af2546af54489c8219&chksm=c0074aabf770c3bdea29c9951ba48630167e8667eeb99c42ddc119c61dcd853a0bb9a98d2ce4&scene=58&subscene=0#rd) -- SecIN技术平台 - - [原创 | 记一次对VAuditDemo平台的代码审计（上）](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494147&idx=1&sn=c7c3c4a3f893049867496fb115b52dbe&chksm=eb84b757dcf33e4185bb0522788c5ade18258cd862ce91e4a69b3523ab7cb1ad7bcfb5a95aad&scene=58&subscene=0#rd) -- 360Quake空间测绘 - - [Confluence服务器全球影响分布分析](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247485689&idx=1&sn=c84af68759b5f701b6109c3b99718c1d&chksm=c37b8f12f40c0604cb0613e6a13042784fc359d49ea5c68e4f0ada980dbd156fc057e08a8b2f&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [Any Idea on how to make an easy access DIY tool?](https://www.reddit.com/r/HowToHack/comments/v80a3d/any_idea_on_how_to_make_an_easy_access_diy_tool/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Where To Go After Pentesting](https://www.reddit.com/r/netsecstudents/comments/v7nqcg/where_to_go_after_pentesting/) - - [TyphoonCon CTF Is Coming Up!](https://www.reddit.com/r/netsecstudents/comments/v7oj0l/typhooncon_ctf_is_coming_up/) -- 深信服千里目安全实验室 - - [【安全公告】泛微E-Office SQL注入和文件包含漏洞通告](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261313&idx=1&sn=629f90327e19f23c1edac38d7b08d00b&chksm=f3e27d35c495f423c03f704ee85493dcfbb230a43b1b9e233bdc36b5db45cebd69e280d95d50&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [亿级用户背后的字节跳动云原生计算最佳实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494351&idx=1&sn=1ce678fe3f380f620d5810f7ba3a0450&chksm=e9d3212ddea4a83b683d769f5b477683e81c8287b8cdc9680ae22634f70edaa15ea9217801ea&scene=58&subscene=0#rd) - - [免费报名赢好礼！字节跳动 Dev Better 技术沙龙 | 字节技术分享汇](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494351&idx=2&sn=15557a655a758cf84bb6db6a3da46f08&chksm=e9d3212ddea4a83b476ac230e8a6401debaee66ed9bff1be9b3b2f7d64eca4065090590a2b6b&scene=58&subscene=0#rd) -- Threatpost - - [Taming the Digital Asset Tsunami](https://threatpost.com/digital-asset-tsunami/179917/) - - [Paying Ransomware Paints Bigger Bullseye on Target’s Back](https://threatpost.com/paying-ransomware-bullseye-back/179915/) - - [Black Basta Ransomware Teams Up with Malware Stalwart Qbot](https://threatpost.com/black-basta-ransomware-qbot/179909/) -- Trend Micro Research, News and Perspectives - - [Cuba Ransomware Group’s New Variant Found Using Optimized Infection Techniques](https://www.trendmicro.com/en_us/research/22/f/cuba-ransomware-group-s-new-variant-found-using-optimized-infect.html) -- Dark Reading - - [DeepSurface Security: Risk-Based Prioritization Adds New Depth to Vulnerability Management](https://www.darkreading.com/risk/risk-based-prioritization-adds-new-depth-to-vulnerability-management) - - [China-Sponsored Cyberattackers Target Networking Gear to Build Widespread Attack Infrastructure](https://www.darkreading.com/threat-intelligence/china-sponsored-cyberattackers-target-networking-gear-to-build-widespread-attack-infrastructure) - - [Concentric: How To Maximize Your AI Returns, In and Out of the SOC](https://www.darkreading.com/threat-intelligence/concentric-concentric-how-to-maximize-your-ai-returns-in-and-out-of-the-soc) - - [Cracking the Email Security Code: 12 Best Practices for Small and Midsize Businesses](https://www.darkreading.com/vulnerabilities-threats/cracking-the-email-security-code-12-best-practices-for-small-and-midsize-businesses) - - [Lookout: Getting It Right at the Secure Service Edge](https://www.darkreading.com/cloud/getting-it-right-at-the-secure-service-edge) - - [Talon Grasps Victory at a Jubilant RSAC Innovation Sandbox](https://www.darkreading.com/dr-tech/talon-grasps-victory-at-a-jubilant-rsac-innovation-sandbox) - - [Black Basta Ransomware Targets ESXi Servers in Active Campaign](https://www.darkreading.com/threat-intelligence/black-basta-ransomware-esxi-servers-active-campaign) - - [How Do We Secure Our Cities From Attack?](https://www.darkreading.com/physical-security/how-do-we-secure-our-cities-from-attack-) - - [Now Is the Time to Plan for Post-Quantum Cryptography](https://www.darkreading.com/dr-tech/now-is-the-time-to-plan-for-post-quantum-cryptography) -- 奇安信威胁情报中心 - - [Operation(काराकोरम) Tejas：蜷居在昆仑山脉的残喘枯象](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247501416&idx=1&sn=e4ae298d2b57b4154b62d79ca0aefdfe&chksm=ea66311fdd11b809fc5686053e68dbad3275c0dd05d3170dab065991133117fccb1141e7e62e&scene=58&subscene=0#rd) -- 代码卫士 - - [《2022年道德黑客洞察报告》：不少人计划当全职漏洞猎人](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512217&idx=1&sn=695daaf2d00a8140749841523279263a&chksm=ea9481f3dde308e53ddaf06265f0cb4e13b91c90ff1268dba7dbdf22c4585a6fc9a29e2bcdd7&scene=58&subscene=0#rd) - - [DogWalk：Windows 新0day 获得非官方补丁](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512217&idx=2&sn=3780aed7f5cd6cb969207042687f44c0&chksm=ea9481f3dde308e5eadec773aa2e2e09e91f2ff17adcd39cf882f40ff93c3f574c50cfd9235f&scene=58&subscene=0#rd) - - [BCS2022系列活动直击RSAC 零时差解密2022创新沙盒冠军](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512217&idx=3&sn=becebff214883b2ae00dadc7e13d2956&chksm=ea9481f3dde308e5a29b6d30675bcd08217e9c7b7844d9eb1c8437644ec8a5caae119326bfd8&scene=58&subscene=0#rd) - - [RSAC2022| 从创新沙盒看网安技术创新趋势](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512217&idx=4&sn=cc9aeabd3b79d58d3fcd84836b949cee&chksm=ea9481f3dde308e513316c7df9c43bd01669cea48414ca9081e7b34ccd640e05f1b16e58f167&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-08)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958490&idx=1&sn=73d2e6b82df5f14ed3b0f17cae517e82&chksm=8baecc45bcd94553227f1f102cfb2082e4171e6d6d99d3c78e3c4e563ac2d3b7f905dff4df7a&scene=58&subscene=0#rd) -- 互联网安全内参 - - [RSAC 2022现场热议医疗设备安全：遗留技术是最大难题](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503369&idx=1&sn=d9c285e0edc0912929470f57e3b1b23d&chksm=ebfa8929dc8d003f37b9ebeaaec6a73e46ec4f12b898bcb29db8f0ff6f786fca5a0ca973a46b&scene=58&subscene=0#rd) - - [RSAC 2022现场：美国家情报局局长称网络安全越来越难了](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503369&idx=2&sn=27eec4affad6cc0ddfdf66c9c979d150&chksm=ebfa8929dc8d003f2e4d2355a0d59839f712574a8677882d7ab3b48889a6efb62be8a9db8c3c&scene=58&subscene=0#rd) - - [RSAC 2022展会的13款热门网络安全产品](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503369&idx=3&sn=0df223dfdb4a9195fd00f6e2f715c507&chksm=ebfa8929dc8d003f8ed47f3fc8fce7ff0824f6343b3422ed51368188ea41684388a01bcc2c9c&scene=58&subscene=0#rd) - - [国家安全部公布部门规章《公民举报危害国家安全行为奖励办法》(附全文)](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503369&idx=4&sn=9dfc1a4efd016fbecb6070daf796fdcd&chksm=ebfa8929dc8d003f03ba3adf98c2b6d6ed4d688f39d74edc82a75d8c0d4cba6f24a7c5d28b2b&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [新兴僵尸网络借远程办公崛起，互联网和直播行业需警惕！](https://mp.weixin.qq.com/s?__biz=MzA5MDc1NDc1MQ==&mid=2247494074&idx=1&sn=549faee07b5725879e0592932c010072&chksm=9004726aa773fb7cf82d882b21dc56f3a58b07a88d4289775f13ef71e5497a41b97b3e0c4619&scene=58&subscene=0#rd) -- 安全客 - - [【安全头条】强强联合 Black Basta勒索软件与QBot达成合作](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771372&idx=1&sn=43d5efdabec51df107e480f42f3a04a6&chksm=88937d03bfe4f415dd79a2d5cd44bf1f48300a95367ab6053e1facb1f2139dd1e404c49d9ec5&scene=58&subscene=0#rd) - - [【技术分享】fireShellCTF 2019 RE&PWN](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771372&idx=2&sn=810ed69f73a6ad2cd698da90b676e2bc&chksm=88937d03bfe4f415dc921a3ef5d280e37e54c519f938fdacdafb803580052a8437c8cfc892b0&scene=58&subscene=0#rd) -- 情报分析师 - - [【重磅】美国情报界半年度报告发布提及五眼连盟（非机密版本可下载）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650504669&idx=1&sn=c5640e2e6d6b6269cbb18b68dba9dfd1&chksm=87165396b061da806628685cda68c5fb962dd223a5785be18608ed7c0828de83d02310177a38&scene=58&subscene=0#rd) - - [【资料】了解俾路支解放军：新兴趋势分析（附俾路支资料）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650504669&idx=2&sn=a322459318460f7965bac36478d8bd3d&chksm=87165396b061da80764abd70cd9893406ae576494f3b82e1792985ae9df3514142562a106655&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [关于vivo千镜安全架构的深度解析](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247488400&idx=1&sn=b4a5e2ba780517834e91161d73f442d2&chksm=e9b935fcdecebcea40839eac52d1c4e137418f910177e603edc19e868e5f97ff84d4ed3e26dc&scene=58&subscene=0#rd) -- Computer Forensics - - [EnCase 20.2 not detecting local storage or removable media on Add Evidence menu](https://www.reddit.com/r/computerforensics/comments/v7uyyz/encase_202_not_detecting_local_storage_or/) - - [what is your preferred tool to capture websites?](https://www.reddit.com/r/computerforensics/comments/v7zqrs/what_is_your_preferred_tool_to_capture_websites/) - - [Should I be able to create an AXIOM portable case that allows the user to view the file system?](https://www.reddit.com/r/computerforensics/comments/v7rnj8/should_i_be_able_to_create_an_axiom_portable_case/) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-06-08](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490279&idx=1&sn=dbdcc0439b851461626e209ecf78b4d9&chksm=c060343ef717bd28e9c8be3aefa1ac03dc5287da732b6dfdf419fcb7004cbfec7d930d631136&scene=58&subscene=0#rd) -- 数世咨询 - - [苹果资本论：网络安全市场冰火两重天](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493621&idx=1&sn=3b434c6e44c22b527b7eaa805a7343ef&chksm=c1449548f6331c5eda7139e1c813c0fbfc2f35382d97316be68ff689468eb364b5240f4214d3&scene=58&subscene=0#rd) - - [数安行完成Pre-A轮融资 持续打造基于DataSecOps的数据安全生态](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493621&idx=2&sn=ef0b833d7de754b5cd11cfdf42d29c2d&chksm=c1449548f6331c5e412a1bd4f7507fe8f21888f9739aa20db7c8b66dec7547ffe4e4bb7e3f43&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.06.08）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491050&idx=1&sn=9049face97ab4457aafe25d4bb681e23&chksm=fe2518ebc95291fdfd205ebd6e2477f844f3c01ba9f7e1a3e443f71c80df576766f0e74d7c8b&scene=58&subscene=0#rd) -- 安全牛 - - [全球主流零信任厂商的产品化实践与观察](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114266&idx=1&sn=236528f1368f781fe99480c2bd2bd23b&chksm=bd147bc98a63f2dfdfec22e0e1618de1d40d0876bd000091d6159e0b073273de81010a09c96d&scene=58&subscene=0#rd) - - [CNNVD通报Microsoft Windows Support Diagnostic Tool安全漏洞，23家安全厂商提供支持](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114266&idx=2&sn=d46cc7c19d763eff8878931ac9831377&chksm=bd147bc98a63f2df1b5c4b6b1a045c14c9123701b71e9f039b154fc398479f88e9985e2d8b5a&scene=58&subscene=0#rd) - - [数安行宣布完成Pre-A轮融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114266&idx=3&sn=93a735961c1fbaad8ae5243f5dd02f1b&chksm=bd147bc98a63f2df8353f34b83948259bb422588482f400a26f691d9272958aee905dca799e0&scene=58&subscene=0#rd) -- Deeplinks - - [Platform Liability Trends Around the Globe: Moving Forward](https://www.eff.org/deeplinks/2022/05/platform-liability-trends-around-globe-conclusions-and-recommendations-moving) - - [Mandatory Student Spyware Is Creating a Perfect Storm of Human Rights Abuses](https://www.eff.org/deeplinks/2022/06/mandatory-student-spyware-creating-perfect-storm-human-rights-abuses) - - [The EU's New Message-Scanning Regulation Must Be Stopped](https://www.eff.org/deeplinks/2022/06/eus-new-message-scanning-regulation-must-be-stopped) -- 关键基础设施安全应急响应中心 - - [国家安全部公布部门规章《公民举报危害国家安全行为奖励办法》（附全文）](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527152&idx=1&sn=8e20546ed45674fa0748128c76f25640&chksm=c1e9e6a1f69e6fb720c12d161e31a6038cb9eab24133229366c308b28c89e2a2c7b99fe49004&scene=58&subscene=0#rd) - - [全球经济的威胁 海运供应链易遭网络攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527152&idx=2&sn=3e1950ff04308f90797726d3cdf6bc10&chksm=c1e9e6a1f69e6fb7d15a175bd83cabb8018aa40e6bca135c543f0aea76b8cd27f38e3262216d&scene=58&subscene=0#rd) - - [意大利某市欲关闭系统以抵抗网络攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527152&idx=3&sn=2efe9905eb063e223e6c513658fb9d99&chksm=c1e9e6a1f69e6fb7c344919a7f6a278ee309a537dcd75faddaacb912036c7db5d4b086d801d0&scene=58&subscene=0#rd) -- Dark Space Blogspot - - [Come Funziona Egld: Scalabilità e Il Problema Centralizzazione](http://darkwhite666.blogspot.com/2022/06/come-funziona-egld-scalabilita-e-il.html) diff --git a/archive/2022/2022-06-10.md b/archive/2022/2022-06-10.md deleted file mode 100644 index 9ead3d5f34..0000000000 --- a/archive/2022/2022-06-10.md +++ /dev/null @@ -1,270 +0,0 @@ -# 每日安全资讯（2022-06-10） - -- Tenable Blog - - [Everybody Does Good VM When S#*t Hits the Fan](https://www.tenable.com/blog/everybody-does-good-vm-when-st-hits-the-fan) -- Security Boulevard - - [Thirst for workers leads to poisoned resumés](https://securityboulevard.com/2022/06/thirst-for-workers-leads-to-poisoned-resumes/) - - [Unify Your Stack](https://securityboulevard.com/2022/06/unify-your-stack/) - - [Detect Insider Threats with Cloud Native LogRhythm UEBA](https://securityboulevard.com/2022/06/detect-insider-threats-with-cloud-native-logrhythm-ueba/) - - [Smilodon Credit Card Skimming Malware Shifts to WordPress](https://securityboulevard.com/2022/06/smilodon-credit-card-skimming-malware-shifts-to-wordpress/) - - [How to Overcome Common SSH Machine Identity Risks with Automation](https://securityboulevard.com/2022/06/how-to-overcome-common-ssh-machine-identity-risks-with-automation/) - - [“New AI technology will filter out any user bias”](https://securityboulevard.com/2022/06/new-ai-technology-will-filter-out-any-user-bias/) - - [BSides:Munich 2022 – Thomas Schreck’s ‘Is There Anybody Out There?’](https://securityboulevard.com/2022/06/bsidesmunich-2022-thomas-schrecks-is-there-anybody-out-there/) - - [Should Chief Security Officers Bear Responsibility for Digital Executive Protection?](https://securityboulevard.com/2022/06/should-chief-security-officers-bear-responsibility-for-digital-executive-protection/) - - [QR Code Phishing: A New Threat?](https://securityboulevard.com/2022/06/qr-code-phishing-a-new-threat/) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-4956-01](https://packetstormsecurity.com/files/167459/RHSA-2022-4956-01.txt) - - [Ubuntu Security Notice USN-5472-1](https://packetstormsecurity.com/files/167458/USN-5472-1.txt) - - [Red Hat Security Advisory 2022-4940-01](https://packetstormsecurity.com/files/167457/RHSA-2022-4940-01.txt) - - [Red Hat Security Advisory 2022-4959-01](https://packetstormsecurity.com/files/167456/RHSA-2022-4959-01.txt) - - [Red Hat Security Advisory 2022-4941-01](https://packetstormsecurity.com/files/167455/RHSA-2022-4941-01.txt) - - [Red Hat Security Advisory 2022-4957-01](https://packetstormsecurity.com/files/167454/RHSA-2022-4957-01.txt) - - [Red Hat Security Advisory 2022-4942-01](https://packetstormsecurity.com/files/167453/RHSA-2022-4942-01.txt) - - [Ubuntu Security Notice USN-5474-1](https://packetstormsecurity.com/files/167452/USN-5474-1.txt) - - [Ubuntu Security Notice USN-5396-2](https://packetstormsecurity.com/files/167451/USN-5396-2.txt) - - [Ubuntu Security Notice USN-5473-1](https://packetstormsecurity.com/files/167450/USN-5473-1.txt) -- HackerOne Hacker Activity - - [Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic](https://hackerone.com/reports/1520685) - - [Integer overflows in unescape_word()](https://hackerone.com/reports/1564922) - - [match](https://hackerone.com/reports/1555440) -- A Few Thoughts on Cryptographic Engineering - - [In defense of crypto(currency)](https://blog.cryptographyengineering.com/2022/06/09/in-defense-of-cryptocurrency/) -- ElcomSoft blog - - [Filling the Gaps: iOS 14 Full File System Extracted](https://blog.elcomsoft.com/2022/06/filling-the-gaps-ios-14-full-file-system-extracted/) -- paper - Last paper - - [CVE-2021-40444-Microsoft MSHTML 远程命令执行漏洞分析（三）](https://paper.seebug.org/1806/) - - [CVE-2021-40444-Microsoft MSHTML 远程命令执行漏洞分析（二）](https://paper.seebug.org/1795/) - - [CVE-2021-40444-Microsoft MSHTML 远程命令执行漏洞分析（一）](https://paper.seebug.org/1792/) -- 绿盟科技技术博客 - - [洞见RSA2022 | 绿盟抗拒绝服务（抗DDoS）解决方案的三大“转型”](http://blog.nsfocus.net/rsa2022-ddos/) - - [云原生服务风险测绘分析](http://blog.nsfocus.net/cloud-5-share/) -- Sploitus.com Exploits RSS Feed - - [Atlassian Confluence Namespace OGNL Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37781&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26134 exploit](https://sploitus.com/exploit?id=796BB1A4-EF64-57CA-862E-996A72F2FBE5&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=1E1DD2F1-F609-5686-A0EF-1C08ACABF537&utm_source=rss&utm_medium=rss) -- Exodus Intelligence - - [Mitel Web Management Interface Buffer Overflow Vulnerability](https://blog.exodusintel.com/2022/06/09/mitel-web-management-interface-buffer-overflow-vulnerability/?utm_source=rss&utm_medium=rss&utm_campaign=mitel-web-management-interface-buffer-overflow-vulnerability) - - [SalesAgility SuiteCRM ‘deleteAttachment’ Type Confusion Vulnerability](https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability/?utm_source=rss&utm_medium=rss&utm_campaign=salesagility-suitecrm-deleteattachment-type-confusion-vulnerability) - - [SalesAgility SuiteCRM ‘export’ Request SQL Injection Vulnerability](https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/?utm_source=rss&utm_medium=rss&utm_campaign=salesagility-suitecrm-export-request-sql-injection-vulnerability) -- FreeBuf网络安全行业门户 - - [FreeBuf | 网络安全人才危机持续恶化；27 名老人信息泄露被骗 150 余万元](https://www.freebuf.com/news/335733.html) - - [两部门开展数据安全管理认证工作，规范网络数据处理活动](https://www.freebuf.com/news/335720.html) - - [大规模 Facebook 网络钓鱼活动，预计产生数百万美元收益](https://www.freebuf.com/news/335701.html) - - [77%的高管将增加对零信任安全建设的支出 ｜ 直击RSCA 2022](https://www.freebuf.com/news/335698.html) - - [微软揭露针对以色列的 POLONIUM 组织攻击活动](https://www.freebuf.com/articles/network/335684.html) - - [恶意软件正”借壳“知名清理程序CCleaner进行传播](https://www.freebuf.com/news/335665.html) -- 安全客-有思想的安全新媒体 - - [ISCx安全客直击：RSAC 2022专题报道——零信任](https://www.anquanke.com/post/id/274090) - - [RSA2022创新沙盒｜Talon Cyber Security为何成最大赢家？](https://www.anquanke.com/post/id/274063) - - [攻击面管理（ASM）技术详解和实现](https://www.anquanke.com/post/id/274004) - - [Discover 闪电贷攻击事件分析](https://www.anquanke.com/post/id/274003) - - [美国封杀涉嫌贩卖2400万人信息的SSNDOB市场](https://www.anquanke.com/post/id/274010) -- Blog & What's New | Offensive Security - - [Celebrate the Release of Our 100th PG-Practice Machine](https://www.offensive-security.com/offsec/100th-pg-practice-machine/) -- Insinuator.net - - [Security Advisories for Broadcom Automic Automation (UC4)](https://insinuator.net/2022/06/security-advisories-for-broadcom-automic-automation-uc4/) -- GuidePoint Security - - [GRIT Ransomware Report: May 2022](https://www.guidepointsecurity.com/blog/grit-ransomware-report-may-2022/) -- Trail of Bits Blog - - [Themes from PyCon US 2022](https://blog.trailofbits.com/2022/06/09/themes-from-pycon-us-2022/) -- blog.avast.com EN - - [Hacked Instagram accounts are scamming users](https://blog.avast.com/instagram-scams) - - [Avast Ultimate Business Security upgrade for existing customers](https://blog.avast.com/ultimate-business-security-upgrade) -- SpiderLabs Blog from Trustwave - - [Trustwave's Action Response: More MSDT Fallout with “Dogwalk”](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trustwaves-action-response-more-msdt-fallout-with-dogwalk/) -- SentinelOne - - [RSA 2022 Conference Recap: Securing the Cloud, Experiencing FOMO, and Evolving XDR](https://www.sentinelone.com/blog/rsa-2022-conference-recap-securing-the-cloud-experiencing-fomo-and-evolving-xdr/) -- Reverse Engineering - - [Cracking 22 year-old DRM](https://www.reddit.com/r/ReverseEngineering/comments/v8tl42/cracking_22_yearold_drm/) - - [IDA Plugin for loading extracted firmware images (SVD loader alternative)](https://www.reddit.com/r/ReverseEngineering/comments/v8h53y/ida_plugin_for_loading_extracted_firmware_images/) - - [New blog about RE games](https://www.reddit.com/r/ReverseEngineering/comments/v8aok1/new_blog_about_re_games/) -- Malwarebytes Labs - - [Cloud data breaches: 4 biggest threats to cloud storage security](https://blog.malwarebytes.com/business/2022/06/cloud-data-breaches-4-biggest-threats-to-cloud-storage-security/) - - [ASyncRat surpasses Dridex, TrickBot and Emotet to become dominant email threat](https://blog.malwarebytes.com/threat-analysis/2022/06/asyncrat-surpasses-dridex-trickbot-and-emotet-to-become-dominant-email-threat/) - - [Facebook users targeted in massive phishing campaign](https://blog.malwarebytes.com/scams/2022/06/facebook-users-targeted-in-massive-phishing-campaign/) - - [BlackBasta is the latest ransomware to target ESXi virtual machines on Linux](https://blog.malwarebytes.com/ransomware/2022/06/blackbasta-is-the-latest-ransomware-to-target-esxi-virtual-machines-on-linux/) - - [Update now! Patch against vulnerabilities in Meeting Owl Pro and Whiteboard Owl devices](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/update-now-patch-against-vulnerabilities-in-meeting-owl-pro-and-whiteboard-owl-devices/) - - [Apple’s passkeys attempt to solve the password problem](https://blog.malwarebytes.com/privacy-2/2022/06/apples-passkeys-attempt-to-solve-the-password-problem/) -- Intigriti - - [Getting (back) together to hack!](https://blog.intigriti.com/2022/06/09/getting-back-together-to-hack/) -- The Daily Swig | Cybersecurity news and views - - [Chinese cyber threat actors are widely abusing well-known attacks to infiltrate networks, CISA warns](https://portswigger.net/daily-swig/chinese-cyber-threat-actors-are-widely-abusing-well-known-attacks-to-infiltrate-networks-cisa-warns) - - [Formidable developer fights back against ‘critical’ CVE vulnerability assignment](https://portswigger.net/daily-swig/formidable-developer-fights-back-against-critical-cve-vulnerability-assignment) - - [Turkish flight operator Pegasus Airlines suffers data breach](https://portswigger.net/daily-swig/turkish-flight-operator-pegasus-airlines-suffers-data-breach) -- Sucuri Blog - - [Smilodon Credit Card Skimming Malware Shifts to WordPress](https://blog.sucuri.net/2022/06/smilodon-credit-card-skimming-malware-shifts-to-wordpress.html) -- KitPloit - PenTest & Hacking Tools - - [Blackbird - An OSINT Tool To Search For Accounts By Username In 101 Social Networks](http://www.kitploit.com/2022/06/blackbird-osint-tool-to-search-for.html) - - [Offensive-Azure - Collection Of Offensive Tools Targeting Microsoft Azure](http://www.kitploit.com/2022/06/offensive-azure-collection-of-offensive.html) -- 黑海洋 - WIKI - - [猫影视TV 电视TV【更新接口】](https://blog.upx8.com/2785) - - [Wise Registry Cleaner v10.8.1.702（系统优化）](https://blog.upx8.com/2784) - - [电脑C盘垃圾辅助清理小工具](https://blog.upx8.com/2783) - - [PC微信快捷聊天助手小工具](https://blog.upx8.com/2782) -- 奇客Solidot–传递最新科技情报 - - [南极降雪发现塑料微粒](https://www.solidot.org/story?sid=71785) - - [泰国合法化大麻加工食品的消费](https://www.solidot.org/story?sid=71784) - - [FTC 考虑限制使用竞业禁止条款](https://www.solidot.org/story?sid=71783) - - [FAST 发现持续活跃的 FRB 源](https://www.solidot.org/story?sid=71782) - - [报告称微软试图在 2023 年之前“杀死”机械硬盘](https://www.solidot.org/story?sid=71781) - - [热浪很快会有名字](https://www.solidot.org/story?sid=71780) - - [等离子点火系统将发动机效率提高 20%](https://www.solidot.org/story?sid=71779) - - [最大流问题的新算法“快得离谱”](https://www.solidot.org/story?sid=71778) - - [TikTok Shop 在英国遭遇文化冲突](https://www.solidot.org/story?sid=71777) - - [GitHub 终止 Atom 项目](https://www.solidot.org/story?sid=71776) - - [耐克跑步应用将停止在华运营](https://www.solidot.org/story?sid=71775) - - [50万册中日古籍触手可及](https://www.solidot.org/story?sid=71774) - - [MacOS 将默认自动屏蔽未知 USB-C 设备](https://www.solidot.org/story?sid=71773) - - [Python 3.11 性能比 3.10 提升最高 60%](https://www.solidot.org/story?sid=71772) -- Tails - News - - [Tails report for May 2022](https://tails.boum.org/news/report_2022_05/) -- DEF CON Announcements! - - [First Batch of DEF CON 30 speakers is Live!](https://forum.defcon.org/node/241811) -- Securityinfo.it - - [Black Basta attacca i server Linux con VMware ESXi](https://www.securityinfo.it/2022/06/09/black-basta-attacca-i-server-linux-con-vmware-esxi/?utm_source=rss&utm_medium=rss&utm_campaign=black-basta-attacca-i-server-linux-con-vmware-esxi) - - [Gestire il rischio dei cyber attacchi](https://www.securityinfo.it/2022/06/09/gestire-il-rischio-dei-cyber-attacchi/?utm_source=rss&utm_medium=rss&utm_campaign=gestire-il-rischio-dei-cyber-attacchi) -- SANS Internet Storm Center, InfoCON: green - - [TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt), (Thu, Jun 9th)](https://isc.sans.edu/diary/rss/28728) - - [ISC Stormcast For Thursday, June 9th, 2022 https://isc.sans.edu/podcastdetail.html?id=8042, (Thu, Jun 9th)](https://isc.sans.edu/diary/rss/28726) -- Schneier on Security - - [Friday Squid Blogging: Squid Changes Color from Black to Transparent](https://www.schneier.com/blog/archives/2022/06/friday-squid-blogging-squid-changes-color-from-black-to-transparent.html) - - [Twitter Used Two-Factor Login Details for Ad Targeting](https://www.schneier.com/blog/archives/2022/06/twitter-used-two-factor-login-details-for-ad-targeting.html) - - [Smartphones and Civilians in Wartime](https://www.schneier.com/blog/archives/2022/06/smartphones-and-civilians-in-wartime.html) -- Pentestmag - - [Get your mag subscription 22% OFF for Summer ‘22!](https://pentestmag.com/get-your-mag-subscription-22-off-for-summer-22/?utm_source=rss&utm_medium=rss&utm_campaign=get-your-mag-subscription-22-off-for-summer-22) -- TrustedSec - - [WMI Providers for Script Kiddies](https://www.trustedsec.com/blog/wmi-providers-for-script-kiddies/) -- Instapaper: Unread - - [Feds raid dark web market selling data on 24 million Americans](https://www.theregister.com/2022/06/08/us_feds_raid_dark_web/) - - [Laptop Water Damage Data Recovery](https://www.gillware.com/hard-drive-data-recovery/laptop-water-damage-data-recovery/) - - [Cellebrite CTF 2022 - Heisenberg's Android](https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html) - - [Spiavano ignari cittadini hackerando telecamere di videosorveglianza e vendendo le immagini sui social. La Polizia di Stato mette KO 2 gruppi criminali](https://www.cybersecitalia.it/spiavano-ignari-cittadini-hackerando-telecamere-di-videosorveglianza-e-vendendo-le-immagini-sui-social-la-polizia-di-stato-mette-ko-2-gruppi-criminali/19664/) -- Dark Reading - - [Sysdig Takes a Deeper Cut at Cloud Security](https://www.darkreading.com/cloud/sysdig-takes-a-deeper-cut-at-cloud-security) - - [Noname: Proactiveness Is the Name of the Game in App Security](https://www.darkreading.com/application-security/noname-proactiveness-is-the-name-of-the-game-in-app-security) - - [Lacework Blends Artificial Intelligence and Automation to Bolster Cloud Security](https://www.darkreading.com/cloud/lacework-blends-artificial-intelligence-and-automation-to-bolster-cloud-security) - - [Prevent Breaches and Malware With Proactive Defenses](https://www.darkreading.com/risk/prevent-breaches-and-malware-with-proactive-defenses) - - [DigiCert Acquires DNS Made Easy](https://www.darkreading.com/operations/digicert-acquires-dns-made-easy) - - [Identity-First Security Helps Reduce and Neutralize Enterprise Threats](https://www.darkreading.com/remote-workforce/identity-first-security-helps-reduce-and-neutralize-enterprise-threats) - - [Emotet Banking Trojan Resurfaces, Skating Past Email Security](https://www.darkreading.com/threat-intelligence/emotet-banking-trojan-resurfaces-email-security) - - [Cisco Makes Resilience a Cornerstone of Security Strategy](https://www.darkreading.com/cloud/cisco-makes-resilience-a-cornerstone-of-security-strategy) - - [Sophos: Keeping Tabs on the Bad Guys Using Threat Research](https://www.darkreading.com/vulnerabilities-threats/sophos-keeping-tabs-on-the-bad-guys-using-threat-research) - - [Cisco Revamps Cloud Security Strategy With New Secure Access, SASE Portfolio](https://www.darkreading.com/dr-tech/cisco-revamps-cloud-security-strategy-with-new-secure-access-sase-portfolio) - - [How AI Is Useful — and Not Useful — for Cybersecurity](https://www.darkreading.com/attacks-breaches/how-ai-is-useful-and-not-useful-for-cybersecurity) - - [Want Better Security? Up Your Collaboration Game](https://www.darkreading.com/cloud/want-better-security-up-your-collaboration-game) - - [Uptycs: Observability Is Key to Cloud Security](https://www.darkreading.com/cloud/uptycs-observability-is-key-to-cloud-security) - - [Automox Adds Automation to Patching, Vuln Management](https://www.darkreading.com/vulnerabilities-threats/automox-adds-automation-to-patching-vuln-management) - - [Why AIs Will Become Hackers](https://www.darkreading.com/dr-tech/why-ais-will-become-hackers) - - [ReliaQuest Bolsters Extended Detection With Threat Intelligence](https://www.darkreading.com/threat-intelligence/reliaquest-bolsters-extended-detection-with-threat-intelligence) - - [37 Major Companies and Organizations Pledge to Enhance Cyber Resiliency and Counter Evolving Global Threats](https://www.darkreading.com/risk/37-major-companies-and-organizations-pledge-to-enhance-cyber-resiliency-and-counter-evolving-global-threats) - - [How Poor Communication Opens the Door to Ransomware and Extortion](https://www.darkreading.com/vulnerabilities-threats/how-poor-communication-opens-the-door-to-ransomware-and-extortion) - - [Security & Productivity: The New Power Couple](https://www.darkreading.com/risk/security-productivity-the-new-power-couple) - - [Anjuna Security: Tapping ‘Confidential Computing’ to Secure Data, Users, and Organizations](https://www.darkreading.com/cloud/tapping-confidential-computing-to-secure-data-users-and-organizations) -- /r/netsec - Information Security News & Discussion - - [Technical Advisory – FUJITSU CentricStor Control Center <= V8.1 – Unauthenticated Command Injection (pre-auth)](https://www.reddit.com/r/netsec/comments/v8oov6/technical_advisory_fujitsu_centricstor_control/) - - [Apache Pinot SQLi & RCE Cheat Sheet](https://www.reddit.com/r/netsec/comments/v8duyf/apache_pinot_sqli_rce_cheat_sheet/) - - [AOL Keyword Hacks (1990s - 2001)](https://www.reddit.com/r/netsec/comments/v8gb0j/aol_keyword_hacks_1990s_2001/) - - [Shielder - Autodesk Fusion 360 <= 2.0.12887 "Insert SVG" Blind XXE](https://www.reddit.com/r/netsec/comments/v8gs55/shielder_autodesk_fusion_360_2012887_insert_svg/) - - [IDA Plugin for loading extracted firmware images (SVD loader alternative)](https://www.reddit.com/r/netsec/comments/v8h5gp/ida_plugin_for_loading_extracted_firmware_images/) -- 情报分析师 - - [加拿大情报：多极世界中的情报合作——五眼的未来](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505068&idx=1&sn=b733155426db14ba33a30d2c3c9078dd&chksm=87165127b061d831596684657430e3d88a744a1c7e431affd86d5805d3880f4085ed75b6b414&scene=58&subscene=0#rd) - - [秘笈：用于调查的监视设备和间谍装备](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505068&idx=2&sn=89b7c8f5f62280a53feabb209f16b8da&chksm=87165127b061d83104bef7e2f74a6fe7c9c1f4b3bef4dca57cb6f7e9f8b1d23c259d8feea5a2&scene=58&subscene=0#rd) -- 默安科技 - - [一场高能直播，就在6月16日晚7点](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247491604&idx=1&sn=f09db30b2224792ccc72d620b82f9280&chksm=e93b1736de4c9e2093cf77e34182efd8684caf383ac1c6c9937bc90852b3a935037ca2a390f4&scene=58&subscene=0#rd) -- Graham Cluley - - [Smashing Security podcast #278: Tim Hortons, avoiding sanctions, and good faith security research](https://grahamcluley.com/smashing-security-podcast-278/) - - [Microsoft disrupts Bohrium spear-phishing ring by seizing 41 domains](https://www.bitdefender.com/blog/hotforsecurity/microsoft-disrupts-bohrium-spear-phishing-ring-by-seizing-41-domains/) -- GeekPwn - - [会窃密的文档：SVCReady恶意软件利用钓鱼邮件和Word文档属性进行传播](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650344733&idx=1&sn=27af9b9b4cf27247438a224ea580af85&chksm=8740b6d8b0373fceecea7d8e2005657160608d6c2fd99b99cfbe94a5d4761e2cce9699dfade6&scene=58&subscene=0#rd) -- Security Affairs - - [Symbiote, a nearly-impossible-to-detect Linux malware](https://securityaffairs.co/wordpress/132113/malware/symbiote-linux-malware.html) - - [Previously undocumented Aoqin Dragon APT targets entities in Southeast Asia and Australia](https://securityaffairs.co/wordpress/132099/apt/aoqin-dragon-targets-south-asia-australia.html) - - [New Emotet variant uses a module to steal data from Google Chrome](https://securityaffairs.co/wordpress/132090/cyber-crime/emotet-google-chrome-info-stealer.html) - - [Tainted CCleaner Pro Cracker spreads via Black Seo campaign](https://securityaffairs.co/wordpress/132076/cyber-crime/ccleaner-black-seo-malware-fakecrack.html) -- 陌陌安全 - - [SOS！请求援助，快来加入我们](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487161&idx=1&sn=18d35aeaf6c9f12c61005fc58dde2c2f&chksm=eadc04dbddab8dcd6155d51420853fbbd79ce3402ece04486b6efa242a103c7161ea84cf83a7&scene=58&subscene=0#rd) -- Social Engineering - - [Millions of revenue generated luring Facebook Messenger users by a massive phishing attack leveraging malvertising techniques.](https://www.reddit.com/r/SocialEngineering/comments/v8bijj/millions_of_revenue_generated_luring_facebook/) - - [How to get someone in my neighborhood to give me their number](https://www.reddit.com/r/SocialEngineering/comments/v8kjog/how_to_get_someone_in_my_neighborhood_to_give_me/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Is it true that most of security is really about bothering other teams to get in compliance and writing documentation?](https://www.reddit.com/r/netsecstudents/comments/v8p272/is_it_true_that_most_of_security_is_really_about/) -- Computer Forensics - - [Magnet business strategy and pricing (Cyber?)](https://www.reddit.com/r/computerforensics/comments/v8rf82/magnet_business_strategy_and_pricing_cyber/) - - [moto stylus](https://www.reddit.com/r/computerforensics/comments/v8ldm3/moto_stylus/) - - [Mount Navigation Device as Mass Storage instead of MTP](https://www.reddit.com/r/computerforensics/comments/v8e9lm/mount_navigation_device_as_mass_storage_instead/) - - [Filesystem Imaging iOS](https://www.reddit.com/r/computerforensics/comments/v86bia/filesystem_imaging_ios/) -- 互联网安全内参 - - [RSAC 2022现场：美国家网络总监称网络防御重保已成为新常态](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503391&idx=1&sn=d52ffb59f3d9d5416cf9d8d435e3e026&chksm=ebfa893fdc8d0029ac830839991e7ed6dab572248f3eac2417ab9500128f0c46527ebf0b0deb&scene=58&subscene=0#rd) - - [RSAC 2022现场：SANS发布2022年最危险的网络安全威胁](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503391&idx=2&sn=1ad6b6b70fd0e07c3836e0273fa549d5&chksm=ebfa893fdc8d0029dcb2cc6c0b86e3574fcf0d3841d69410cb5f95393af0cc1a6bfb7a644f21&scene=58&subscene=0#rd) - - [我国宣布开展数据安全管理认证工作：认证证书有效期三年](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503391&idx=3&sn=2a6d16fef31d1e40d0bc0126f5a7de8e&chksm=ebfa893fdc8d0029b6918d76bc0e2c5034ec28cd3c9567c784f78d82b4685a9880c2378148a3&scene=58&subscene=0#rd) - - [美国网络空间日光浴委员会2.0发布《网络安全劳动力发展》报告](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503391&idx=4&sn=569d466c1bfebef931d2803ff237f050&chksm=ebfa893fdc8d0029227564a6ad309f1d38e06a63a02d76a4a69ffab7b24b7bb48a13dce405a1&scene=58&subscene=0#rd) -- 雷神众测 - - [ATT&CK-Log4j2远程代码执行漏洞（CVE-2021-44228）漏洞分析](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652497576&idx=1&sn=d0482c3cf9412ae3d040c378f9613ec8&chksm=f258451bc52fcc0d6d4857054f33c9960197d3175be7562739ad89f219d6d441243a2073efec&scene=58&subscene=0#rd) -- 火线Zone - - [ServerLess Aws Lambda攻击与横向方法研究](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495445&idx=1&sn=e519f4bfb8e76749687e7830badacb02&chksm=eaa96735dddeee23f86bbb892f097699e4084c803c9c6039beb15115c2db7dbeff4cfb655bd7&scene=58&subscene=0#rd) - - [从Fastjson和Log4j2学习JNDI注入](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495445&idx=2&sn=e40af45aaa060cde5061547aca183261&chksm=eaa96735dddeee23d7f4962dfb5e7e9aaad5f55a36a49804bb0bab45e7512cbd9c91aa73d854&scene=58&subscene=0#rd) -- 代码卫士 - - [RSA | ISACA发布全球软件供应链报告](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512232&idx=1&sn=490e8e387ee7617d16c771929ff65ad5&chksm=ea9481c2dde308d4ed1eeb8f3039ae3aba8a2e600920453310b9f38b1399b1ba9daeb6d49ef7&scene=58&subscene=0#rd) - - [RSA | 微软：供应链攻击会越来越严重](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512232&idx=2&sn=d5318dbeb0887bdce3f0a42b60af684f&chksm=ea9481c2dde308d4ba7af531d877751fde2f40dbdf9dab60ad478fad938e9805bcf6738e73dd&scene=58&subscene=0#rd) -- 安全威胁情报 - - [我，TDP，正式官宣一个0day检测新能力！](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172601&idx=1&sn=9a18ab52336f06584aa6fc8ee2b428ca&chksm=f4489705c33f1e13f63f10becd9276bf9f46e663e95bdb7d1bef405a1f0f6fc4cc6fa2de0b63&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | 国际最新API安全漏洞](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493445&idx=1&sn=e76269a88625e90cdc093e162f6e23cf&chksm=c0074ad9f770c3cf739e422130f5e8d656bc368c913a40da98e1076163e4fd8125a0b2fcff69&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [第三届HCON线上安全技术峰会预告](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493946&idx=1&sn=cbfdf36ff66be7a6a39d6ff1f6a773c4&chksm=fa523c84cd25b592fbedaefd504cfc977d1d90909089d1e5ab25d3ba2697fa4b9a9d7a19a687&scene=58&subscene=0#rd) -- TorrentFreak - - [Pirate Streaming Lawsuit Plaintiffs Want Cloudflare Held in Contempt of Court](https://torrentfreak.com/pirate-streaming-lawsuit-plaintiffs-want-cloudflare-held-in-contempt-of-court-220609/) - - [EU Piracy Rates are the Highest Among Well Educated Youth](https://torrentfreak.com/eu-piracy-rates-are-the-highest-among-well-educated-youth-220609/) -- 信息安全国家工程研究中心 - - [最新公告 | 两部门：开展数据安全管理认证工作](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247489905&idx=1&sn=8501d2f9b426e015d1af7a5feb5ca85e&chksm=feb59862c9c2117449abd150c17c0ee49ed6a60e9355bbe4fdd4f8d5af42371bf2ded6c1a597&scene=58&subscene=0#rd) -- 安全牛 - - [2022年攻击面管理调查：七成企业还在用电子表格管理IT资产](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114391&idx=1&sn=d6526902e78dec237f110bc3f4a76a9b&chksm=bd147b448a63f252dab7e5735e95f3b8ebfe064d76f7e33317e0bd8603adb4ad6e87e566c333&scene=58&subscene=0#rd) -- 看雪学院 - - [STM32固件逆向](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451784&idx=1&sn=477120810249eab4d5e39ae594249e73&chksm=b18fcfc286f846d4c586183ad9c4222730975eeb3bb75e8bc7afff6aca6e31ac413bf4398043&scene=58&subscene=0#rd) - - [趋势科技发现古巴勒索软件新变种](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451784&idx=2&sn=4eaafbc22cca34362e262ea6d9112560&chksm=b18fcfc286f846d46a1f26de5f642bfc37c357713afc1c7cc0b8e0b7257819c32a469b5ed03a&scene=58&subscene=0#rd) - - [《安卓逆向入门》学懂学透](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458451784&idx=3&sn=f2699288851e895ac9a7f6d3bffcf515&chksm=b18fcfc286f846d473d25b6d9e268ce913c4fb58bae1c3d1f91977af1b7702e440f11a2fae33&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [再跨越！永安在线IP风险画像2.0带着IPv6风险识别能力来了](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493393&idx=1&sn=349286c38f5ae8973bee1be122696145&chksm=eb12c12adc65483c4b65ba7a64ed5decb747cbbe27fb933f15ed25daf273ffd3d38d1485603a&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jun. 9th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495542&idx=1&sn=8c215e451a391d419566219772e212b5&chksm=ce96a248f9e12b5ed3e47dfeac1bf75dd3fd9ad22f64b159cb1a8ced8efd0e0c037582c6d22b&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [my device does not have enough memory to crack a hash, I’ve heard of using external recourses to try but idk any ?](https://www.reddit.com/r/HowToHack/comments/v8jten/my_device_does_not_have_enough_memory_to_crack_a/) - - [What does "Ping' even do](https://www.reddit.com/r/HowToHack/comments/v8hyvq/what_does_ping_even_do/) -- Trend Micro Research, News and Perspectives - - [Amazon EKS vs Azure Kubernetes Service](https://www.trendmicro.com/en_us/devops/22/f/amazon-eks-vs-azure-kubernetes-service-aks.html) -- 青藤云安全 - - [青藤“合作伙伴计划2.0”全新开启](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650834666&idx=1&sn=bc15727e31ee2c186919b3dcb7e541d6&chksm=80dbe54fb7ac6c59457c8fb5a09c1cc4a14c3e75fc0587f79ad66b53b516ec1bbb34b86b636f&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-06-09 DeepDi](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490288&idx=1&sn=aa7f157bee3d26eea26a0f0dcf28a1e3&chksm=c0603429f717bd3f43ea2fcc8540235ed2b149638068f91722f5da37048719dce536cb5e7078&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.06.09）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491053&idx=1&sn=1a8b8a32a5257cf0ee48461a2d03973c&chksm=fe2518ecc95291faf8e57f521201cfc1cd8f9110c8a969f0f2bb76168e7be2588c9a18e849e5&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [vsomeip — SOME/IP 开源实现](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492198&idx=1&sn=6a258e632f9f640fbb5de37017d679a3&chksm=e84c44b9df3bcdaff14a704d202e4f7569cfa9feb2fb858b85c1e2ca8f5cf0d37395d85b56ef&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-09)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958494&idx=1&sn=16aee949c760cbed45a1db29bd922c9d&chksm=8baecc41bcd9455731e6373f490a282914dd79c6165c90512791cb729ab9f52568bbf6488005&scene=58&subscene=0#rd) -- 数世咨询 - - [人机合智：第二届数字安全大会重磅启动](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493635&idx=1&sn=edeb3396648ea4a77b0cbc2e7589e500&chksm=c1449abef63313a8cad7f7171c6474ba1441840950adc28f053726fe16daa1a96e28820f3ffa&scene=58&subscene=0#rd) - - [[调研]网络安全人才危机持续恶化](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493635&idx=2&sn=7562d1665a892168f972850188cf54cf&chksm=c1449abef63313a859e96833dd0f0f7a5f6ae24b5e682ced76cf20c0c5c19a59d583faef83b1&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [WIRTE组织近期针对中东地区的攻击活动分析](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247487601&idx=1&sn=f5eadce11d9e98226cac61de9df08337&chksm=f9ee7ccece99f5d86c9a91786a5195661eb0872e0c451fcc0b4424858fd2731ae5b524734049&scene=58&subscene=0#rd) -- Threatpost - - [Feds Forced Travel Firms to Share Surveillance Data on Hacker](https://threatpost.com/feds-forced-travel-firms-to-share-surveillance-data-on-hacker/179929/) -- 字节跳动技术团队 - - [移动端渲染原理浅析](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494456&idx=1&sn=eca7771eef7ef137f3ed0deb3fd4f6ea&chksm=e9d320dadea4a9cca3eb1227dd10d5bd81b6a166af9c09d375bb4be61ca773dc0171d84d4d3a&scene=58&subscene=0#rd) - - [这项国际级图像质量评价顶尖赛事，字节跳动 VIDA 团队斩获 top 名次](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494456&idx=2&sn=38679dd011f14e71de68d2a7a03a966e&chksm=e9d320dadea4a9ccfd01fdcfb87cb465036f20c7930cf629d549164737a078a310b80bf564d5&scene=58&subscene=0#rd) -- 锦行信息安全 - - [守望相助，共克时艰——锦行党支部捐赠防疫物资助力疫情防控！](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489837&idx=1&sn=7ce6be87d1537a9f134f2bc358789465&chksm=9799e288a0ee6b9ed3a1d6518b34719ddd100c3dcc5d40225ea2fdc705f3a051fb63038c86ee&scene=58&subscene=0#rd) -- The Register - Security - - [What keeps Mandiant Intelligence EVP Sandra Joyce up at night? The coming storm](https://go.theregister.com/feed/www.theregister.com/2022/06/09/mandiant_intelligence_joyce/) - - [Cloud services proving handy for cybercriminals, SANS Institute warns](https://go.theregister.com/feed/www.theregister.com/2022/06/09/criminals_cloud_sans/) - - [Facebook phishing campaign nets millions in IDs and cash](https://go.theregister.com/feed/www.theregister.com/2022/06/09/facebook_phishing_campaign/) - - [Symantec: More malware operators moving in to exploit Follina](https://go.theregister.com/feed/www.theregister.com/2022/06/09/symantec-follina-microsoft/) - - [Five Eyes alliance’s top cop says techies are the future of law enforcement](https://go.theregister.com/feed/www.theregister.com/2022/06/09/five_eyes_chair_tech_talk/) - - [Supply chain attacks will get worse: Microsoft Security Response Center boss](https://go.theregister.com/feed/www.theregister.com/2022/06/09/microsoft_supply_chain_attacks/) - - [Now Windows Follina zero-day exploited to infect PCs with Qbot](https://go.theregister.com/feed/www.theregister.com/2022/06/09/qbot-malware-microsoft-follina/) -- 安全客 - - [聚焦：【安全专题】RSAC 2022 探索 发现 转型](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771392&idx=1&sn=9fe19bff98b0a10d5094f708bd75b1f4&chksm=88937defbfe4f4f91591c881b1cc8d07bd9997180c65d93ccc7f5887bfd444662724dd0f30a5&scene=58&subscene=0#rd) - - [【安全头条】美国封杀涉嫌贩卖2400万人信息的SSNDOB市场](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771392&idx=2&sn=27ef49ec19892f7a992ac3e3f7183013&chksm=88937defbfe4f4f9838e9d1213fe3ea65966918c62ec8348eec5d05ce301e8848e4267b24e16&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [Blackbird - An OSINT Tool To Search For Accounts By Username In 101 Social Networks](http://www.kitploit.com/2022/06/blackbird-osint-tool-to-search-for.html) - - [Offensive-Azure - Collection Of Offensive Tools Targeting Microsoft Azure](http://www.kitploit.com/2022/06/offensive-azure-collection-of-offensive.html) diff --git a/archive/2022/2022-06-11.md b/archive/2022/2022-06-11.md deleted file mode 100644 index e4e5878905..0000000000 --- a/archive/2022/2022-06-11.md +++ /dev/null @@ -1,284 +0,0 @@ -# 每日安全资讯（2022-06-11） - -- Files ≈ Packet Storm - - [Kik Messenger XMPP Stanza Smuggling](https://packetstormsecurity.com/files/167463/GS20220610141737.tgz) - - [Red Hat Security Advisory 2022-4909-01](https://packetstormsecurity.com/files/167462/RHSA-2022-4909-01.txt) - - [Red Hat Security Advisory 2022-4985-01](https://packetstormsecurity.com/files/167461/RHSA-2022-4985-01.txt) - - [WordPress Motopress Hotel Booking Lite 4.2.4 Cross Site Scripting](https://packetstormsecurity.com/files/167460/wpmotopresshbl424-xss.txt) -- Sec-News 安全文摘 - - [Horde Webmail - Remote Code Execution via Email](https://wiki.ioin.in/url/gdk3) -- Sploitus.com Exploits RSS Feed - - [WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50951&utm_source=rss&utm_medium=rss) - - [WordPress Motopress Hotel Booking Lite 4.2.4 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167460&utm_source=rss&utm_medium=rss) - - [Confluence Data Center 7.18.0 - Remote Code Execution (RCE) exploit](https://sploitus.com/exploit?id=EDB-ID:50952&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=8FDF5020-8C7F-5695-ADD0-58100BD21FFF&utm_source=rss&utm_medium=rss) - - [Exploit for Server-Side Request Forgery in Apache Http Server exploit](https://sploitus.com/exploit?id=4373C92A-2755-5538-9C91-0469C995AA9B&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Sourcegraph exploit](https://sploitus.com/exploit?id=80CAA8B5-66F7-5860-AC56-3DF8638639E1&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26134 exploit](https://sploitus.com/exploit?id=0989C9B1-62A8-505A-B12F-586D7FAADEEE&utm_source=rss&utm_medium=rss) -- 绿盟科技技术博客 - - [洞见RSA2022 | 云原生安全剑指敏捷、弹性、轻量化](http://blog.nsfocus.net/rsa2022-cloud-1/) - - [洞见RSA2022 | “弹性”拼高下，“转型”定存亡](http://blog.nsfocus.net/rsa2022-transform/) -- Security Boulevard - - [China is Exploiting Network Providers and Devices, Says US Cybersecurity Advisory](https://securityboulevard.com/2022/06/china-is-exploiting-network-providers-and-devices-says-us-cybersecurity-advisory/) - - [Using NIST CSF & the FAIR Risk Model Together | Webinar Included](https://securityboulevard.com/2022/06/using-nist-csf-the-fair-risk-model-together-webinar-included/) - - [BSides:Munich 2022 – Dimitris Prasakis’ ‘Attacking The Malware With AI: Where The Finest Concepts Of Data Science & Cybersecurity Meet’](https://securityboulevard.com/2022/06/bsidesmunich-2022-dimitris-prasakis-attacking-the-malware-with-ai-where-the-finest-concepts-of-data-science-cybersecurity-meet/) - - [Azure Misconfiguration Leaves 30.5GB of Student Data Exposed](https://securityboulevard.com/2022/06/azure-misconfiguration-leaves-30-5gb-of-student-data-exposed/) - - [This Week in Malware—npm malware exfiltrates Windows SAM, Amazon EC2 credentials](https://securityboulevard.com/2022/06/this-week-in-malware-npm-malware-exfiltrates-windows-sam-amazon-ec2-credentials/) - - [Making Sense of RFCs: Reading List](https://securityboulevard.com/2022/06/making-sense-of-rfcs-reading-list/) - - [Joy Of Tech® ‘Lock Screen Insanity’](https://securityboulevard.com/2022/06/joy-of-tech-lock-screen-insanity/) - - [How to Choose Your Vendors](https://securityboulevard.com/2022/06/how-to-choose-your-vendors/) -- HackerOne Hacker Activity - - [bd-j exploit chain](https://hackerone.com/reports/1379975) - - [RXSS on █████████](https://hackerone.com/reports/1555582) -- 安全客-有思想的安全新媒体 - - [RSAC 2022 创新沙盒系列分析（三）](https://www.anquanke.com/post/id/274145) - - [ISCx安全客直击：RSAC 2022专题报道——DevSecOps](https://www.anquanke.com/post/id/274116) - - [Terraform 使用入门以及在云上攻防中的作用](https://www.anquanke.com/post/id/273994) - - [《Windows7操作系统安全加固指引》发布，360 Win7盾甲全力支持!](https://www.anquanke.com/post/id/274030) - - [构筑政企办公第一入口，企业浏览器演变简史](https://www.anquanke.com/post/id/274039) - - [护航数字政府建设，360开启电子政务安全运营新模式](https://www.anquanke.com/post/id/274042) - - [CVE-2022-26134 Confluence OGNL RCE 漏洞分析](https://www.anquanke.com/post/id/274026) - - [Linux僵尸网络张开怀抱迎接Confluence漏洞](https://www.anquanke.com/post/id/274048) -- FreeBuf网络安全行业门户 - - [FreeBuf周报 | RSAC 2022关键词”转型“；美安全局首度承认美军黑客多次支援乌克兰](https://www.freebuf.com/articles/335872.html) - - [20个炙手可热的网络安全新产品 | 直击RSAC2022](https://www.freebuf.com/news/335869.html) - - [警惕！Emotet新变体正从Google Chrome中窃取你的信用卡信息](https://www.freebuf.com/news/335861.html) - - [恶意软件Symbiote将感染Linux系统上所有正在运行的进程](https://www.freebuf.com/news/335834.html) - - [云原生安全怎么做？| FreeBuf甲方群话题讨论](https://www.freebuf.com/articles/neopoints/335830.html) - - [40万人观看！「网安新势力」SOLO发布季完美收官](https://www.freebuf.com/articles/335810.html) - - [多年终端安全沉淀，源自支付宝的全链路安全防护建设 | 6月24日19点公开课](https://www.freebuf.com/articles/334892.html) -- paper - Last paper - - [CVE-2022-0540 Atlassian JIRA 存在认证绕过漏洞影响范围广泛](https://paper.seebug.org/1896/) - - [CVE-2022-1388 F5 BIG-IP iControl REST 处理进程分析与认证绕过漏洞复现](https://paper.seebug.org/1895/) -- 跳跳糖 - 安全与分享社区 - - [libmalloc初探——TinyHeap](https://tttang.com/archive/1572/) -- Forcepoint - - [Webinar: Don't Miss The Quickest Proof of Concept Ever! Zero Trust CDR vs Malware](https://www.forcepoint.com/blog/insights/webinar-dont-miss-quickest-proof-concept-ever-zero-trust-cdr-vs-malware) -- SpiderLabs Blog from Trustwave - - [ModBus 101: One Protocol to Rule the OT World](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modbus-101-one-protocol-to-rule-the-ot-world/) -- Hex Rays - - [Igor’s tip of the week #93: COM reverse engineering and COM Helper](https://hex-rays.com/blog/igors-tip-of-the-week-93-com-reverse-engineering-and-com-helper/) -- Malwarebytes Labs - - [WhatsApp spam offers up “B&Q Father’s Day Contest 2022”](https://blog.malwarebytes.com/scams/2022/06/whatsapp-spam-offers-up-bq-fathers-day-contest-2022/) -- Reverse Engineering - - [The Current State and Future of Reversing Flutter Apps](https://www.reddit.com/r/ReverseEngineering/comments/v967bf/the_current_state_and_future_of_reversing_flutter/) - - [Finding Vulnerabilities with VulFi IDA Plugin | Accenture](https://www.reddit.com/r/ReverseEngineering/comments/v985wz/finding_vulnerabilities_with_vulfi_ida_plugin/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-06-09 - TA578 Contact Forms campaign Bumblebee infection with Cobalt Strike](https://www.malware-traffic-analysis.net/2022/06/079/index.html) - - [2022-06-07 - obama186 distribution Qakbot with DarkVNC and spambot activity](https://www.malware-traffic-analysis.net/2022/06/07/index2.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [[BugBounty] Tips to Find Stored XSS](https://infosecwriteups.com/bugbounty-tips-to-find-stored-xss-9995814d353f?source=rss----7b722bfd1b8d--bug_bounty) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 24](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-24-3/) -- blog.avast.com EN - - [Ease your kids into a hybrid play model with these tips](https://blog.avast.com/kids-hybrid-play) - - [Karakurt data extortion group: CISA issues alert](https://blog.avast.com/karakurt-data-extortion-group) -- Pulse Security - - [Practical Vehicle Reverse Engineering - Ducati ECU part II](https://pulsesecurity.co.nz/articles/ducati-696-part2) -- Intigriti - - [Intigriti achieves ISO 27001 – the industry’s most highly regarded security standard](https://blog.intigriti.com/2022/06/10/intigriti-achieves-iso-27001-industrys-most-highly-regarded-security-standard/) -- The Daily Swig | Cybersecurity news and views - - [US Justice Department offers blueprint for more ‘innovative, secure IT capabilities’](https://portswigger.net/daily-swig/us-justice-department-offers-blueprint-for-more-innovative-secure-it-capabilities) - - [Separate Fujitsu cloud storage vulnerabilities could enable attackers to destroy virtual backups](https://portswigger.net/daily-swig/separate-fujitsu-cloud-storage-vulnerabilities-could-enable-attackers-to-destroy-virtual-backups) -- Data Breach - - [Vice Society ransomware gang adds the Italian City of Palermo to its data leak site](https://securityaffairs.co/wordpress/132122/cyber-crime/city-of-palermo-vice-society-ransomware.html) -- KitPloit - PenTest & Hacking Tools - - [Jeeves - Time-Based Blind SQLInjection Finder](http://www.kitploit.com/2022/06/jeeves-time-based-blind-sqlinjection.html) - - [PacketStreamer - Distributed Tcpdump For Cloud Native Environments](http://www.kitploit.com/2022/06/packetstreamer-distributed-tcpdump-for.html) -- 黑海洋 - WIKI - - [TikTok 抖音海外版 24.6.3_去广告解除封锁版](https://blog.upx8.com/2791) - - [宇宙工具箱 v1.4.0 会员版 三百多款功能（安卓）](https://blog.upx8.com/2790) - - [NFC卡模拟 v8.1.3 专业版已付费](https://blog.upx8.com/2789) - - [一起看TV 2.1.9 盒子点播 去广告纯净版](https://blog.upx8.com/2788) - - [添字大神：给电影名/书名加一个字，有趣的文字游戏](https://blog.upx8.com/2787) - - [ANN人工神经网络之Keras项目实战](https://blog.upx8.com/2786) -- 90Sec - 最新话题 - - [关于RDP远程登录的问题](https://forum.90sec.com/t/topic/2132) - - [批量检测站思路优化2](https://forum.90sec.com/t/topic/2131) -- 奇客Solidot–传递最新科技情报 - - [Windows 剪切板无最大数据容量限制](https://www.solidot.org/story?sid=71794) - - [芯片荒蔓延到先进制程芯片](https://www.solidot.org/story?sid=71793) - - [NASA 建立团队研究 UFO](https://www.solidot.org/story?sid=71792) - - [一篇论文如何摧毁比特币的匿名性](https://www.solidot.org/story?sid=71791) - - [Google Cloud 将 π 计算到 100 万亿位](https://www.solidot.org/story?sid=71790) - - [物理学家可能发现了新粒子](https://www.solidot.org/story?sid=71789) - - [专家称猴痘可通过空气传播](https://www.solidot.org/story?sid=71788) - - [微型流星击中韦伯望远镜镜片](https://www.solidot.org/story?sid=71787) - - [《最后生还者》将登陆 PC](https://www.solidot.org/story?sid=71786) -- 博客园 - 郑瀚Andrew.Hann - - [《苔》袁枚 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16365200.html) - - [软件供应链安全现状分析 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16362572.html) -- Exploit-DB.com RSS Feed - - [[webapps] Confluence Data Center 7.18.0 - Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/50952) - - [[webapps] WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/50951) -- Securityinfo.it - - [Pagare il ransomware su una piattaforma di gioco](https://www.securityinfo.it/2022/06/10/pagare-il-ransomware-su-una-piattaforma-di-gioco/?utm_source=rss&utm_medium=rss&utm_campaign=pagare-il-ransomware-su-una-piattaforma-di-gioco) - - [Phishig su Facebook raccoglie milioni di dollari](https://www.securityinfo.it/2022/06/10/phishig-su-facebook-raccoglie-milioni-di-dollari/?utm_source=rss&utm_medium=rss&utm_campaign=phishig-su-facebook-raccoglie-milioni-di-dollari) -- IntelTechniques Blog - - [HP Dev One with Pop!_OS](https://inteltechniques.com/blog/2022/06/10/hp-dev-one-with-pop_os/) - - [The Privacy, Security, & OSINT Show – Episode 265](https://inteltechniques.com/blog/2022/06/10/the-privacy-security-osint-show-episode-265/) -- Forensic Focus - - [Detego Global’s Ballistic Imager Selected as SC Media’s Trust Award Finalist](https://www.forensicfocus.com/news/detego-globals-ballistic-imager-selected-as-sc-medias-trust-award-finalist/) - - [Get More From the Cloud: Health Apps](https://www.forensicfocus.com/news/get-more-from-the-cloud-health-apps/) -- Il Disinformatico - - [Podcast RSI - Apple Newton, storia di un flop rivoluzionario che compie trent'anni](http://attivissimo.blogspot.com/2022/06/podcast-rsi-apple-newton-storia-di-un.html) -- Security Art Work - - [Hunting with Artificial Intelligence: Detection of malicious domains (III)](https://www.securityartwork.es/2022/06/10/hunting-with-artificial-intelligence-detection-of-malicious-domains-iii/) -- TS-WAY - - [Weekly Threats N. 23 2022](https://www.ts-way.com/it/weekly-threats/2022/06/10/weekly-threats-n-23-2022/) -- HolisticInfoSec - - [Posts](https://holisticinfosec.io/post/) -- SANS Internet Storm Center, InfoCON: green - - [EPSScall: An Exploit Prediction Scoring System App, (Fri, Jun 10th)](https://isc.sans.edu/diary/rss/28732) - - [ISC Stormcast For Friday, June 10th, 2022 https://isc.sans.edu/podcastdetail.html?id=8044, (Fri, Jun 10th)](https://isc.sans.edu/diary/rss/28730) -- Security Affairs - - [Threat actors exploit recently disclosed Atlassian Confluence flaw in cryptomining campaign](https://securityaffairs.co/wordpress/132140/cyber-crime/cryptomining-campaign-atlassian-confluence-flaw.html) - - [Experts spotted a new variant of the Cuba Ransomware with optimized infection techniques](https://securityaffairs.co/wordpress/132134/malware/cuba-ransomware-new-variant.html) - - [Vice Society ransomware gang adds the Italian City of Palermo to its data leak site](https://securityaffairs.co/wordpress/132122/cyber-crime/city-of-palermo-vice-society-ransomware.html) -- Instapaper: Unread - - [GPG Memory Forensics by Nils Amiet and Sylvain Pelissier | Nullcon Berlin](https://www.youtube.com/watch?v=6oH6gfhOlNs) - - [Symantec More malware operators moving in to exploit Follina](https://www.theregister.com/2022/06/09/symantec-follina-microsoft/) - - [Hardware flaws give Bluetooth chipsets unique fingerprints that can be tracked](https://www.theregister.com/2022/06/10/smartphone-bluetooth-tracking/) - - [Cellebrite CTF 2022 - Beth's iPhone](https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-beths-iphone.html) - - [Filling the Gaps iOS 14 Full File System Extracted](https://blog.elcomsoft.com/2022/06/filling-the-gaps-ios-14-full-file-system-extracted/) - - [Live forensics from the perspective of Law Enforcement (EN)](https://www.tipiloschi.net/drupal/live-forensics-law-enforcement-EN) - - [Android Stalkerware ‘TruthSpy’ Exposing Images of Children Online](https://www.vice.com/en/article/5d3mkx/android-stalkerware-truthspy-exposing-images-of-children-online) - - [Symbiote, a nearly-impossible-to-detect Linux malware](https://securityaffairs.co/wordpress/132113/malware/symbiote-linux-malware.html) - - [Blackbird - An OSINT Tool To Search For Accounts By Username In 101 Social Networks](http://www.kitploit.com/2022/06/blackbird-osint-tool-to-search-for.html) - - [Sanzioni Gdpr e riconoscimento facciale a scopi di polizia i paletti EDPB](https://www.agendadigitale.eu/sicurezza/privacy/sanzioni-gdpr-e-riconoscimento-facciale-a-scopi-di-polizia-i-paletti-edpb/) -- Threatpost - - [U.S. Water Utilities Prime Cyberattack Target, Experts](https://threatpost.com/water-cyberattack-target/179935/) - - [Potent Emotet Variant Spreads Via Stolen Email Credentials](https://threatpost.com/potent-emotet-variant-spreads-via-stolen-email-credentials/179932/) -- 火线安全平台 - - [火线安全荣获“国家信息安全漏洞库（CNNVD）技术支撑单位二级证书”](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247491163&idx=1&sn=1a56d85bee41dd17ab7fe9004569df79&chksm=fdbc37f0cacbbee688aa7e3956188b62818f77e1fef1ad28e61c40f32d53ffb95cc78de47b7f&scene=58&subscene=0#rd) - - [洞态在陌陌的最佳落地实践](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247491163&idx=2&sn=170d6fc451f961ea5894c8fd53522546&chksm=fdbc37f0cacbbee6f5998dc83f46b82fe3e3629c9b78b9e5bd40544655ae08764f908c802175&scene=58&subscene=0#rd) -- 安全威胁情报 - - [面对网络钓鱼，谁不是一边吃瓜看戏，一边心有戚戚](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172643&idx=1&sn=7a2880738321f8daba0c637776fa5a58&chksm=f448975fc33f1e49c546786cfba488de7861cc63757d869465244c47dd12f069858ad9f85d08&scene=58&subscene=0#rd) -- Daniel Miessler - - [News & Analysis | NO. 334](https://danielmiessler.com/podcast/news-analysis-no-334/) -- Microsoft Browser Vulnerability Research - - [A Story of a Bug Found Fuzzing](https://microsoftedge.github.io/edgevr/posts/a-story-of-a-bug-found-fuzzing/) -- Yak Project - - [XSS 启发式检测基础设施](https://mp.weixin.qq.com/s?__biz=MzAxOTAzOTU3Mw==&mid=2247487771&idx=1&sn=f656fc09aebcac08dced39c744a3f7cd&chksm=9bcc4521acbbcc379033589db2deb59890bc666e6a1b251f595c4c22c4d14e8618bbcd7f11d0&scene=58&subscene=0#rd) -- SecurityCurrent - - [Fireside Chat: With Uncertainty and Market Volatility Looming, What Will the Demands Be on CISOs?](https://us06web.zoom.us/meeting/register/tZcrdOusrT4jHdF8Zpr3oNOrTLM_yp71Pr5L#new_tab) - - [Research Shows Increased Use of Cloud Weighs on CISOs](/research-shows-increased-use-of-cloud-weighs-on-cisos/) - - [Fireside Chat: Accumulating Wealth for Retirement Funds Tax Efficiently with Loretta Richard](https://us06web.zoom.us/meeting/register/tZ0rdemrqz0pH9IJ8MLfUtVZhYmy3WO2A2-_#new_tab) -- 字节跳动技术团队 - - [大规模实时分位数计算——Quantile Sketches 简史](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494699&idx=1&sn=e556891d413fc237118f6b5ca2e4e4cc&chksm=e9d327c9dea4aedf20fe163fa2dd84138b09086f1eccbad7362aeea49acd08a0567444cb725a&scene=58&subscene=0#rd) - - [CloudWeGo：从开源、开放到企业落地](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494699&idx=2&sn=bb6ff9c7eb862fa23c5ae8a257effdc1&chksm=e9d327c9dea4aedfb5e79f2ee5e6789fc84c07ee1fd9ff6418274e1d0c16b751cefca860296b&scene=58&subscene=0#rd) -- Dark Reading - - [CrowdStrike Introduces Humio for Falcon, Redefining Threat Hunting with Unparalleled Scale and Speed](https://www.darkreading.com/cloud/crowdstrike-introduces-humio-for-falcon-redefining-threat-hunting-with-unparalleled-scale-and-speed) - - [Symbiote Malware Poses Stealthy, Linux-Based Threat to Financial Industry](https://www.darkreading.com/threat-intelligence/symbiote-malware-stealthy-linux-based-threat-financial-industry) - - [CrowdStrike Introduces CrowdStrike Asset Graph to Help Organizations Proactively Identify and Eliminate Blind Spots](https://www.darkreading.com/cloud/crowdstrike-introduces-crowdstrike-asset-graph-to-help-organizations-proactively-identify-and-eliminate-blind-spots) - - [CrowdStrike Adds Strategic Partners to CrowdXDR Alliance and Expands Falcon XDR Capabilities](https://www.darkreading.com/cloud/crowdstrike-adds-strategic-partners-to-crowdxdr-alliance-and-expands-falcon-xdr-capabilities) - - [EU Debates AI Act to Protect Human Rights, Define High-Risk Uses](https://www.darkreading.com/edge-articles/eu-debates-ai-act-to-protect-human-rights-define-high-risk-uses) - - [How to Blunt the Virulence of the New Ransomware](https://www.darkreading.com/vulnerabilities-threats/how-to-blunt-the-virulence-of-the-new-ransomware) - - [How to Secure a High-Profile Event Like the Super Bowl](https://www.darkreading.com/application-security/how-to-secure-a-high-profile-event-like-the-super-bowl) - - [Application Security Testing Is on the Mend With Automated Remediation](https://www.darkreading.com/application-security/application-security-testing-is-on-the-mend-with-automated-remediation) - - [New Linux Malware 'Nearly Impossible to Detect'](https://www.darkreading.com/threat-intelligence/new-linux-malware-nearly-impossible-to-detect-) - - [Mitigating the Security Skills Shortage](https://www.darkreading.com/careers-and-people/mitigating-the-security-skills-shortage) - - [A Few Simple Ways to Transform Your Cybersecurity Hiring](https://www.darkreading.com/careers-and-people/a-few-simple-ways-to-transform-your-cybersecurity-hiring) - - [Artificial Intelligence and Security: What You Should Know](https://www.darkreading.com/attacks-breaches/artificial-intelligence-and-security-what-you-should-know) - - [How 4 Young Musicians Hacked Sheet Music to Help Fight the Cold War](https://www.darkreading.com/edge-articles/how-4-young-musicians-hacked-sheet-music-to-help-fight-the-cold-war) - - [In a Quickly Evolving Landscape, CISOs Shift Their 2022 Priorities](https://www.darkreading.com/cloud/quickly-evolving-landscape-cisos-shift-2022-priorities) - - [Design Weakness Discovered in Apple M1 Kernel Protections](https://www.darkreading.com/dr-tech/design-weakness-discovered-in-apple-m1-kernel-protections) -- 陌陌安全 - - [公告 | 创新类产品、游戏范围更新及业务范围汇总](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487197&idx=1&sn=f1b7a93c076863f291f241bba11fe2dc&chksm=eadc04bfddab8da957740260a382dc8153d7705d5a2120d6b8dec57df782b0a44aabf61f8e37&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [PACMAN - Attacking ARM Pointer Authentication with Speculative Execution](https://www.reddit.com/r/netsec/comments/v9cc4a/pacman_attacking_arm_pointer_authentication_with/) - - [Exploration of the Dirty Pipe Vulnerability (Linux kernel) w/ Debugging Setup](https://www.reddit.com/r/netsec/comments/v97ro3/exploration_of_the_dirty_pipe_vulnerability_linux/) - - [Symbiote: A New, Hard-to-Detect Linux Threat](https://www.reddit.com/r/netsec/comments/v9awqq/symbiote_a_new_hardtodetect_linux_threat/) - - [CVE-2022-29225 - Denial of Service Vulnerability in Envoy Proxy](https://www.reddit.com/r/netsec/comments/v9fig7/cve202229225_denial_of_service_vulnerability_in/) - - [Raptor WAF - web application firewall made in C from the scratch](https://www.reddit.com/r/netsec/comments/v8xjdq/raptor_waf_web_application_firewall_made_in_c/) - - [Finding Vulnerabilities with VulFi IDA Plugin | Accenture](https://www.reddit.com/r/netsec/comments/v950jb/finding_vulnerabilities_with_vulfi_ida_plugin/) - - [Security Vulnerability in Gitlab: Sending Arbitrary Requests Through Jupyter Notebooks](https://www.reddit.com/r/netsec/comments/v9a0qs/security_vulnerability_in_gitlab_sending/) -- Your Hacking Tutorial by Zempirians - - [What exactly is a script kiddie?](https://www.reddit.com/r/HowToHack/comments/v9387c/what_exactly_is_a_script_kiddie/) - - [can i have helpfixing this with websploit ?](https://www.reddit.com/r/HowToHack/comments/v9gks4/can_i_have_helpfixing_this_with_websploit/) - - [What percentage of CPTC competitors are doing bug bounties? Anyone do both?](https://www.reddit.com/r/HowToHack/comments/v90sxw/what_percentage_of_cptc_competitors_are_doing_bug/) -- TorrentFreak - - [Bungie & Destiny 2 Cheat Creator Agree $13.5m Copyright Damages Judgment](https://torrentfreak.com/bungie-destiny-2-cheat-creator-agree-13-5m-damages-judgment-220610/) - - [Forwarding Piracy Warnings Violates Privacy Law, Dutch Court Rules](https://torrentfreak.com/forwarding-piracy-warnings-violates-privacy-law-dutch-court-rules-220610/) -- 互联网安全内参 - - [美国司法部查封了乌克兰IT军的网络攻击资源｜俄乌冲突](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503413&idx=1&sn=766ab538d318bd3fe8164c8844b0f59c&chksm=ebfa8915dc8d0003372b25bc28f39305d84f5921e21a22b5bbd7e62b033bceaf0d40d7e3d116&scene=58&subscene=0#rd) - - [RSAC 2022现场：5G面临“网络切片攻击”重大威胁](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503413&idx=2&sn=21598cd7655776cfc5ba74b50aa9af14&chksm=ebfa8915dc8d000303ff6c186277d07d3445ab9dd20f38080df31a908500aca8febdbb23ce7b&scene=58&subscene=0#rd) - - [RSAC 2022现场：微软SRC负责人称供应链攻击会越来越严重](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503413&idx=3&sn=09bdcf2d6f594ca17b0b4357834bd7e6&chksm=ebfa8915dc8d00036315136b15769134b0a2b58f0eb5cad814764a642d4d4fdc12a89ba72a1d&scene=58&subscene=0#rd) - - [工信部召开2022年信息通信行业防范治理电信网络诈骗电视电话会议](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503413&idx=4&sn=054c354b37217312e6fa329fcf4e2bf1&chksm=ebfa8915dc8d00030dc9437e1d3679b3c580917b63e4226aa5461fdcbf19859130a93e2d155f&scene=58&subscene=0#rd) -- 火线Zone - - [K8S中使用Ingress时的小技巧](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495495&idx=1&sn=5097259ac3b6acda2da87a3ef68b74de&chksm=eaa96767dddeee71cd083365c79f95a5d0f34f12616044142a71acbae47ce7ff6f5dc7b01e48&scene=58&subscene=0#rd) - - [某Nginx配置管理平台代码审计分析](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495495&idx=2&sn=fd89180f63d591d8c6c082d51e6eda2b&chksm=eaa96767dddeee7110809bc282bbb6ace971062cb4ff55cc5fc2ff3b88bbb2bb170c50d81638&scene=58&subscene=0#rd) -- Graham Cluley - - [You can be tracked via your Bluetooth signal, researchers claim](https://grahamcluley.com/you-can-be-tracked-via-your-bluetooth-signal/) - - [DogWalk zero-day Windows bug receives patch – but not from Microsoft](https://www.bitdefender.com/blog/hotforsecurity/dogwalk-zero-day-windows-bug-receives-patch-but-not-from-microsoft/) -- 腾讯玄武实验室 - - [每日安全动态推送(06-10)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958498&idx=1&sn=21d2c96451c2878d7bbeabd36b92d8aa&chksm=8baecc7dbcd9456b5e05ef7ac02890945d418e3a5d52ec5c424122acf9a5fd3d606805fac23d&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [主机安全技术剖析-手把手教会你防御Java内存马](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247489470&idx=1&sn=f59d1490d6d230b5dbbd3d2410b19b38&chksm=96f408d3a18381c59f68a2f0d2415b1328cc00f819a72896e1d10a73eaeda86b61771e10628a&scene=58&subscene=0#rd) -- 安全牛 - - [我国数据安全产业链发展观察](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114465&idx=1&sn=90551ce9d95f0576458a6c4ef28e50b8&chksm=bd147b328a63f2243c193d1f7667950b00a68c83725f6fe6f095a7c9e3556800b94aaaff0736&scene=58&subscene=0#rd) - - [平均任期只有26个月，CISO该如何缓解工作压力？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114465&idx=2&sn=1a36023ebb30871d56aecd555ceb7e29&chksm=bd147b328a63f224fc824c033d14bebe553b5c23451208f3d5a6bb0e0bdf72ccb75bcd10d1c0&scene=58&subscene=0#rd) - - [通过MTD技术应对勒索软件和其他高级威胁](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114465&idx=3&sn=16e47ff3a4869b7cb5e04c1d3f044961&chksm=bd147b328a63f224a7bf5d9503f187ede05e8784196380f57a1174fcfaa4ad0a1cdc321fc5a9&scene=58&subscene=0#rd) -- 慢雾科技 - - [2000 万 OP 代币被盗关键：交易重放](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495732&idx=1&sn=bb707c74e5724a603fc4b59296c2d92e&chksm=fdde8eb3caa907a54be4e62e86795007fb358e945ccbd10603c3a5c6fee0e153d90df2c4cdea&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [2021年度中国通信学会科技奖获奖成果推介系列 | 《面向超大规模流量的网络生物数据安全检测关键技术及应用》项目荣获一等奖](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527257&idx=1&sn=8a71940cab9e93961508efdf086acd96&chksm=c1e9e708f69e6e1e5affdc3ce002a2dc1c12f54bdae94722fe158bc8eb48a35aa12075da1cb9&scene=58&subscene=0#rd) - - [RSAC 2022现场：美国家网络总监称网络防御重保已成为新常态](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527257&idx=2&sn=bf0044de1cc387f69a6dba4d580f00b1&chksm=c1e9e708f69e6e1e6aa4279809dd5386b80fcc0897bcbeefe699ed9b56683d5371fdefb2af65&scene=58&subscene=0#rd) - - [市场监管总局、国家网信办发文 开展数据安全管理认证工作](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527257&idx=3&sn=5758a3d04039f660b0f1eb3f09d33d55&chksm=c1e9e708f69e6e1e2e6fbacaad433a4c0fee65fc50020deb9a39d5428e524caf8934706ba349&scene=58&subscene=0#rd) - - [恶意软件正”借壳“知名清理程序CCleaner进行传播](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527257&idx=4&sn=dae5474b99281e81330591c9d9388ed2&chksm=c1e9e708f69e6e1e8fe898a1c0afc178c11b632158368fcb2569acb6074696319f2363089d81&scene=58&subscene=0#rd) - - [我国数据安全产业链发展观察](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527257&idx=5&sn=5e71233027a511be2995f36a0b80f61b&chksm=c1e9e708f69e6e1e59468da4fe909be2773da24c2fd44c1199f217346dd551fda1078b372cd5&scene=58&subscene=0#rd) -- 奇安信CERT - - [PHP多个远程代码执行漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496265&idx=1&sn=a5ca4709547add642a019e6c5c182ebb&chksm=fe79d6d1c90e5fc789f85ff961c1e6e4077ca5682bceb4aec3fc1ae5df931d102f23a576e9a6&scene=58&subscene=0#rd) - - [GitLab账户接管漏洞(CVE-2022-1680)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496265&idx=2&sn=5bcac3621449253e58b06d34c965cfba&chksm=fe79d6d1c90e5fc7814bcde0373501ab52a338e1797d814366f85e18babf522725f4c30d691f&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [每周勒索威胁摘要](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247489845&idx=1&sn=05d0552a0b4bccb7cb38e1c37a2a2e1e&chksm=ec6a691ddb1de00b58317518c3222744f6043cf057241aa15bce6bb6a0f073836051f6f996c6&scene=58&subscene=0#rd) -- 情报分析师 - - [现代世界的情报合作：挑战和问题（附国际化情报合作白皮书）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505268&idx=1&sn=710c1df088835602d42ad4198af1f9b0&chksm=8716ae7fb0612769c8b5cdbd0f46ae7ab0e78193e3467bec68818dc3c2cb3fe9d123de1f8ad7&scene=58&subscene=0#rd) - - [重点来了！《军事平衡2022》彩色全图中文完整版](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505268&idx=2&sn=3b1f493556e534b2ba3b320e74e87705&chksm=8716ae7fb0612769675e4d9f1de6106e6f64df1a6b1742d84e442cce09c6a9311327ba64b074&scene=58&subscene=0#rd) - - [开源情报工具汇总网站—TII](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505268&idx=3&sn=0fcd5de6023a31c8a2cedb79788dbae7&chksm=8716ae7fb061276901844d8d8d5bf899eea420c34c612be0cd8fb53b0324ac1243b3e931a4f3&scene=58&subscene=0#rd) -- Computer Forensics - - [HP Server Raid](https://www.reddit.com/r/computerforensics/comments/v9478t/hp_server_raid/) -- 代码卫士 - - [Formidable 项目开发人员驳斥：MITRE 发的这个CVE漏洞纯属“碰瓷”](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512256&idx=1&sn=fd26c082e19e42b9579bfdc16d90cc36&chksm=ea9481aadde308bc8754e712723fe813063ab2ddc7a80a171069b724a6eedf732b4fa71a7684&scene=58&subscene=0#rd) - - [RSA | 新型威胁：通过网络切片攻击5G](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512256&idx=2&sn=125c25ebac16a39e6ab372c60d6c6d8c&chksm=ea9481aadde308bc075a5b7bf5b033fb6b8d4d108939f1b8e8cc818ca570d99532a928c84ddb&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [每周高级威胁情报解读(2022.06.02~06.09)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247501477&idx=1&sn=6d846a67f95370e20de86be5fbeece5f&chksm=ea6631d2dd11b8c4253017cca04613a77adf25f255b7cbcc6244402dc1d96e88d326784740e7&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [前沿研究 | 容器逃逸即集群管理员？你的集群真的安全吗？](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492240&idx=1&sn=06991ce468f9491a546e87a49d216318&chksm=e84c444fdf3bcd598c60a63f33cb0859f206430cce8ab71e4d9669a4e09100906445b1228cc8&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [浅析LuCI系统的漏洞挖掘](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493980&idx=1&sn=8d000e5a38e37dddb934e3665cd90d69&chksm=fa523ce2cd25b5f4759b0e3dc883196c63cbceef292eaac7e12c6fb15b6d9945619cc31aeef2&scene=58&subscene=0#rd) -- 星阑科技 - - [【技术干货】2022-29464 WSO2 API Manager 任意文件上传、远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493511&idx=1&sn=f058ea91433fda6529a6e116cf21ca6f&chksm=c0074a1bf770c30d6ec8076f3b09c10f8ac82de42d444df77f90fb0da7828b233ae0aef1cb85&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [【火绒安全周报】意大利城市被黑全城断网/俄顶级律所1TB数据泄露](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247504485&idx=1&sn=ca68621d3d8485f44a16b951d796a99c&chksm=eb700c5adc07854c34f64038819a284ede4f0fd2443f31bd1b077ad77a886dc8731657d77583&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [Jeeves - Time-Based Blind SQLInjection Finder](http://www.kitploit.com/2022/06/jeeves-time-based-blind-sqlinjection.html) - - [PacketStreamer - Distributed Tcpdump For Cloud Native Environments](http://www.kitploit.com/2022/06/packetstreamer-distributed-tcpdump-for.html) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-06-10 Fuzzingbook](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490301&idx=1&sn=cc7890fcbd497349443ecf34556e4eae&chksm=c0603424f717bd329a2ee721355ee0843de08ef848e0544acbcc268772971348bc3251381612&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.06.10）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491056&idx=1&sn=559da7e1b924f7369fbbf1e402699704&chksm=fe2518f1c95291e71827ae6e2c8e1f966bf5d94ea91d7a35c7dc5a2d0036ee3740ae92f5b67b&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [报名围观|安全范儿沙龙带你学习甲方视角下的安全运营](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247488770&idx=1&sn=2fae758e7029953ff47fca912a3bf899&chksm=fa9eee54cde9674256b1b33a8a4095b89d140a0ba35acb324004281b255ff561296e923f527c&scene=58&subscene=0#rd) -- The Register - Security - - [World Economic Forum wants a global map of online crime](https://go.theregister.com/feed/www.theregister.com/2022/06/10/atlas_wef_rsa/) - - [Threat and risk specialists signal post-COVID conference season is back on](https://go.theregister.com/feed/www.theregister.com/2022/06/10/rsa-conference-covid/) - - [Symbiote Linux malware spotted, and infections are 'very hard to detect'](https://go.theregister.com/feed/www.theregister.com/2022/06/10/symbiote_linux_malware/) - - [Apple M1 chip contains hardware vulnerability that bypasses memory defense](https://go.theregister.com/feed/www.theregister.com/2022/06/10/apple_m1_pacman_flaw/) - - [Emotet malware gang re-emerges with Chrome-based credit card heistware](https://go.theregister.com/feed/www.theregister.com/2022/06/10/emotet-malware-chrome-credit-cards/) - - [Chinese 'Aoqin Dragon' gang runs undetected ten-year espionage spree](https://go.theregister.com/feed/www.theregister.com/2022/06/10/aoqin_dragon_china_apt/) - - [Hardware flaws give Bluetooth chipsets unique fingerprints that can be tracked](https://go.theregister.com/feed/www.theregister.com/2022/06/10/smartphone-bluetooth-tracking/) - - [Russia, China, warn US its cyber support of Ukraine has consequences](https://go.theregister.com/feed/www.theregister.com/2022/06/10/russia_china_usa_ukraine_cyberdefense/) -- SecPulse安全脉搏 - - [【漏洞预警】Owl Labs Meeting Owl Pro信息泄露漏洞](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044511&idx=1&sn=937b1528d16837b905b2e7287c73c747&chksm=803fa8c1b74821d77b34ad8c9c930fbbc8f62a9fc4614d2c9c30f6c5503a5b9cad357132dc70&scene=58&subscene=0#rd) -- M01NTeam - - [每周蓝军技术推送（2022.6.4-6.10）](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247488263&idx=1&sn=90cd401ce0ca1c397c18c631676171ce&chksm=c187d316f6f05a001d2db1db1172272ff6c38e4c68c87a7bdd43b699b7980967e1c31952615c&scene=58&subscene=0#rd) -- 中通安全应急响应中心 - - [双倍积分+额外奖励加码，不来看看？](https://mp.weixin.qq.com/s?__biz=MzUyMTcwNTY3Mg==&mid=2247485957&idx=1&sn=5c9f486792fe1978adb8465193baf4b4&chksm=f9d64ba2cea1c2b41e5ae9847d69f4163decb195e96cbe5d190114374c98842200ff26378f93&scene=58&subscene=0#rd) -- 补天平台 - - [全稿首发 | 《奇安信攻防社区-攻防专刊》成刊啦！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247493661&idx=1&sn=e93471c9af023b9c1dba5a283f426851&chksm=eaf9a051dd8e29471f1bd57fef97607cf262b5cfe88b6710f7a5e26d1c440b9629b1cb83f2d9&scene=58&subscene=0#rd) -- 安全客 - - [ISCx安全客直击：RSAC 2022专题报道——零信任](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771657&idx=1&sn=ca9302434377e1dc335e14f9efeff527&chksm=88937ee6bfe4f7f03d3fcd510c84eba111398548bbb1fcbe41f10095d4b14285e9f8875cf968&scene=58&subscene=0#rd) - - [直击RSAC 2022：从“转型”看数字时代的威胁情报](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771657&idx=2&sn=d98ec39e22d19f65aeb52bf95a6e8c7a&chksm=88937ee6bfe4f7f079c43595fedbb7653c908a5df163aeba4ada804b1b39425530ae3e3d4321&scene=58&subscene=0#rd) - - [【安全头条】Linux僵尸网络张开怀抱迎接Confluence漏洞](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771657&idx=3&sn=614d32e629d1d8d2480258d77c54a706&chksm=88937ee6bfe4f7f0d862453c78811f0523ad4a0964ffe05b6e47c1f8d1f24406e28d1d7a01f2&scene=58&subscene=0#rd) - - [【技术分享】Fastjson <1.2.48 入门调试](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771657&idx=4&sn=4e298cefb4077d5e0bc65521c2c6ed7d&chksm=88937ee6bfe4f7f06a9b3dba809b4fae3117f36f48f77a7b11072f98c260a297940c58f1a74b&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-06-12.md b/archive/2022/2022-06-12.md deleted file mode 100644 index abff3640cc..0000000000 --- a/archive/2022/2022-06-12.md +++ /dev/null @@ -1,105 +0,0 @@ -# 每日安全资讯（2022-06-12） - -- HackerOne Hacker Activity - - [All user password hash can be seen from admin panel](https://hackerone.com/reports/1489892) - - [CVE-2022-30115: HSTS bypass via trailing dot](https://hackerone.com/reports/1565622) - - [CVE-2022-27780: percent-encoded path separator in URL host](https://hackerone.com/reports/1565619) - - [CVE-2022-27779: cookie for trailing dot TLD](https://hackerone.com/reports/1565615) - - [disclosure the live_analytics information of any livestream.](https://hackerone.com/reports/1561299) - - [Email address disclosure via invite token validatiion](https://hackerone.com/reports/1560072) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Microsoft Office Word MSDTJS Code Execution](https://cxsecurity.com/issue/WLB-2022060034) - - [WEB SITE Yas Arghavani System XSS](https://cxsecurity.com/issue/WLB-2022060033) - - [Serdivan Belediyesi Cross Site Scripting Vulnerablity](https://cxsecurity.com/issue/WLB-2022060032) - - [Confluence Data Center 7.18.0 Remote Code Execution (RCE)](https://cxsecurity.com/issue/WLB-2022060031) - - [WordPress Download Manager 3.2.42 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022060030) - - [Prime95 Version 30.7 build 9 Remote Code Execution (RCE)](https://cxsecurity.com/issue/WLB-2022060029) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-30075 exploit](https://sploitus.com/exploit?id=309CF278-6D7E-52A9-B334-68CE5324F681&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [BSides:Munich 2022 – Hido Cohen’s And Arnold Osipov’s ‘From A Simple Log To Sophisticated Crypter’](https://securityboulevard.com/2022/06/bsidesmunich-2022-hido-cohens-and-arnold-osipovs-from-a-simple-log-to-sophisticated-crypter/) - - [XKCD ‘Shuttle Skeleton’](https://securityboulevard.com/2022/06/xkcd-shuttle-skeleton/) - - [BSides:Munich 2022 – Christian Bauer’s ‘Building A Security Program For SaaS Product Development’](https://securityboulevard.com/2022/06/bsidesmunich-2022-christian-bauers-building-a-security-program-for-saas-product-development/) - - [Identity and Access Management in Multi-Cloud Environments](https://securityboulevard.com/2022/06/identity-and-access-management-in-multi-cloud-environments/) - - [Adconion Execs Plead Guilty in Federal Anti-Spam Case](https://securityboulevard.com/2022/06/adconion-execs-plead-guilty-in-federal-anti-spam-case/) -- Envato Tuts+ Code - Mobile Development - - [How to Write a Product Feature Set](https://code.tutsplus.com/articles/how-to-write-a-product-feature-set--cms-22968) -- Bug Bounty in InfoSec Write-ups on Medium - - [[Bug Bounty] How I was able edit AWS’s files from file upload function?](https://infosecwriteups.com/bug-bounty-how-i-was-able-edit-awss-files-from-file-upload-function-cb33bc3bd3a9?source=rss----7b722bfd1b8d--bug_bounty) -- HAHWUL - - [Input/Custom Vectors를 사용하여 ZAP에서 정밀하게 취약점 스캔하기 🎯](https://www.hahwul.com/2022/06/12/zap-custom-vectors-in-ascan/) -- yzddMr6's Blog - - [精简JRE,打造无依赖的Java-ShellCode-Loader](https://yzddmr6.com/posts/litejre-for-shellcode-loader/) - - [Java表达式注入的武器化利用](https://yzddmr6.com/posts/java-expression-exploit/) -- 奇客Solidot–传递最新科技情报 - - [MIT 研究人员发现苹果 M1 芯片无法修复的硬件漏洞](https://www.solidot.org/story?sid=71801) - - [卖家在 eBay 上用假名销售象牙](https://www.solidot.org/story?sid=71800) - - [微软不再禁止员工向竞争对手求职](https://www.solidot.org/story?sid=71799) - - [为何亚洲地区的近视率如此高？](https://www.solidot.org/story?sid=71798) -- KitPloit - PenTest & Hacking Tools - - [Pulsar - Data Exfiltration And Covert Communication Tool](http://www.kitploit.com/2022/06/pulsar-data-exfiltration-and-covert.html) - - [WhiteBeam - Transparent Endpoint Security](http://www.kitploit.com/2022/06/whitebeam-transparent-endpoint-security.html) -- 90Sec - 最新话题 - - [白嫖验证码识别工具分享](https://forum.90sec.com/t/topic/2133) -- Il Disinformatico - - [Domattina finalmente volerò in mongolfiera; diretta, se possibile, dalle 6.00](http://attivissimo.blogspot.com/2022/06/domattina-finalmente-volero-in.html) - - [Due anni di guida puramente elettrica; scambio batterie contro carica senza cavi](http://attivissimo.blogspot.com/2022/06/due-anni-di-guida-puramente-elettrica.html) -- blackMORE Ops - - [Ubiquiti Dream Machine (UDM) – unable to connect to NBN](https://www.blackmoreops.com/2022/06/11/ubiquiti-dream-machine-udm-unable-to-connect-to-nbn/) -- Full Disclosure - - [SEC Consult SA-20220609-0 :: Multiple vulnerabilities in SoftGuard SNMP Network Management Extension](https://seclists.org/fulldisclosure/2022/Jun/34) - - [SEC Consult SA-20220608-0 :: Stored Cross-Site Scripting & Unsafe Java Deserializiation in Gentics CMS](https://seclists.org/fulldisclosure/2022/Jun/33) - - [SEC Consult SA-20220607-0 :: Multiple Vulnerabilities in Infiray IRAY-A8Z3 thermal camera](https://seclists.org/fulldisclosure/2022/Jun/16) - - [HNS-2022-02 - HN Security Advisory - Multiple vulnerabilities in Zyxel zysh](https://seclists.org/fulldisclosure/2022/Jun/15) - - [Hidden Functionality (Backdoor) (CWE-912) / CVE-2022-29854, CVE-2022-29855](https://seclists.org/fulldisclosure/2022/Jun/32) - - [Trojan-Banker.Win32.Banbra.cyt / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Jun/31) - - [Backdoor.Win32.Cabrotor.10.d / Unauthenticated Remote Command Execution](https://seclists.org/fulldisclosure/2022/Jun/30) - - [Trojan-Proxy.Win32.Symbab.o / Heap Corruption](https://seclists.org/fulldisclosure/2022/Jun/29) - - [Trojan-Banker.Win32.Banker.agzg / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Jun/28) - - [Ransom.Haron / Code Execution](https://seclists.org/fulldisclosure/2022/Jun/14) - - [[SYSS-2022-024]: Lepin EP-KP001 - Violation of Secure Design Principles (CWE-657) (CVE-2022-29948)](https://seclists.org/fulldisclosure/2022/Jun/27) - - [[SYSS-2022-017]: Verbatim Fingerprint Secure Portable Hard Drive - Insufficient Verification of Data Authenticity (CWE-345) (CVE-2022-28385)](https://seclists.org/fulldisclosure/2022/Jun/26) - - [[SYSS-2022-016]: Verbatim Fingerprint Secure Portable Hard Drive - Missing Immutable Root of Trust in Hardware (CWE-1326) (CVE-2022-28383)](https://seclists.org/fulldisclosure/2022/Jun/25) - - [[SYSS-2022-015]: Verbatim Fingerprint Secure Portable Hard Drive - Use of a Cryptographic Primitive with a Risky Implementation (CWE-1240) (CVE-2022-28382)](https://seclists.org/fulldisclosure/2022/Jun/24) - - [[SYSS-2022-014]: Verbatim Fingerprint Secure Portable Hard Drive - Use of a Cryptographic Primitive with a Risky Implementation (CWE-1240) (CVE-2022-28387)](https://seclists.org/fulldisclosure/2022/Jun/13) -- Reverse Engineering - - [Binary Analysis with Strace](https://www.reddit.com/r/ReverseEngineering/comments/va61bw/binary_analysis_with_strace/) -- The Register - Security - - [OMIGOD: Cloud providers still using secret middleware](https://go.theregister.com/feed/www.theregister.com/2022/06/11/in-brief-security/) -- Security Affairs - - [Iran-linked Lyceum APT adds a new .NET DNS Backdoor to its arsenal](https://securityaffairs.co/wordpress/132164/apt/lyceum-apt-target-energy-dns-backdoor.html) - - [PACMAN, a new attack technique against Apple M1 CPUs](https://securityaffairs.co/wordpress/132154/hacking/pacman-attack-apple-m1-cpus.html) -- TorrentFreak - - [ACE Shuts Down Pirate Site that Caused $0.50 in Damages, Per Visit](https://torrentfreak.com/ace-shuts-down-pirate-site-that-caused-0-50-in-damages-per-visit-220611/) - - [Nintendo Nemesis Max Louarn: Hacker, Rebel, and Wanted by the FBI](https://torrentfreak.com/nintendo-nemesis-max-louarn-hacker-rebel-and-wanted-by-the-fbi-220611/) -- 深信服千里目安全实验室 - - [【漏洞通告】GitLab身份绕过漏洞(CVE-2022-1680)](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261441&idx=1&sn=e17bbd9725c30f851b0d6383fa45daab&chksm=f3e27db5c495f4a31fa40a81b543f37f18bee264f3a2534d3878800695d86f62a007d8a65111&scene=58&subscene=0#rd) -- 情报分析师 - - [【反恐巨著1312页】恐怖主义预防和战备手册（激进篇）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505459&idx=1&sn=56ac69562cb2e34237255c93808a433c&chksm=8716aeb8b06127aea1587f9b4124427963c10eb9af8499ee08c35b5dd1bd572fcc0abdf39173&scene=58&subscene=0#rd) - - [网络世界中的隐私与安全](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505459&idx=2&sn=8a17793c405c47cccbbe0ef02dd22a5f&chksm=8716aeb8b06127ae7b25865b6b0474bcf9e967c8a0c72704899bfef0a4bd65d38d1afffc88c5&scene=58&subscene=0#rd) - - [开源情报工具—— mindat.org](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505459&idx=3&sn=fc4c7fa0a6931f68a4c11abb4a31996c&chksm=8716aeb8b06127ae9d746b7333f4e337bdb1dd097b81ab105d27b2d02fb2543b46a4ddd3a226&scene=58&subscene=0#rd) -- Krebs on Security - - [Adconion Execs Plead Guilty in Federal Anti-Spam Case](https://krebsonsecurity.com/2022/06/adconion-execs-plead-guilty-in-federal-anti-spam-case/) -- Computer Forensics - - [What is your experience with being a digital forensic investigator?](https://www.reddit.com/r/computerforensics/comments/va6p6m/what_is_your_experience_with_being_a_digital/) - - [FTK toolkit 6.3.1, software completely unusable during index and index merge](https://www.reddit.com/r/computerforensics/comments/va01lw/ftk_toolkit_631_software_completely_unusable/) -- /r/netsec - Information Security News & Discussion - - [A Story of a Bug Found Fuzzing](https://www.reddit.com/r/netsec/comments/v9rhxf/a_story_of_a_bug_found_fuzzing/) - - [SIEMCraft - Security Information and Event Management in Minecraft](https://www.reddit.com/r/netsec/comments/v9lrl8/siemcraft_security_information_and_event/) -- Your Hacking Tutorial by Zempirians - - [Any good guides on learning how to hack OWASP Juice Box?](https://www.reddit.com/r/HowToHack/comments/va5fxo/any_good_guides_on_learning_how_to_hack_owasp/) -- 安全牛 - - [网安产业新闻35期](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114488&idx=1&sn=9bf0db243b86966941099e8236eeff59&chksm=bd147b2b8a63f23d10fdce5b112fc73c89cbbb97622e52a8f6342bc3b100e64dac1d6da30eb6&scene=58&subscene=0#rd) - - [牛聘 | 2022年度岗位招聘第15期](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114487&idx=1&sn=eaa3c440112cab6f85258789143fe382&chksm=bd147b248a63f232d48604333a1270f7d0829476c2cfabb797bda535d579ed1f08ff5ade8259&scene=58&subscene=0#rd) -- 安全学术圈 - - [通过NPM生态系统中的依赖树揭开脆弱性传播及其演化的神秘面纱](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247487919&idx=1&sn=2ffb74cbc068ee2abae39974dc62b5cb&chksm=fe2eee24c9596732f30c709f665ae74d16f12ac9631fcfe602ab5035f1481083ce569c17cefb&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [Apache Httpd AJP请求走私 CVE-2022-26377 漏洞分析](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247487602&idx=1&sn=03f65b30c42885ff3b5daab6ad8bf689&chksm=f9ee7ccdce99f5dbe4d36d131e4524e4f1c3dfc7adb06855e33d5cb87278b5830b7e8460c58c&scene=58&subscene=0#rd) -- 看雪学院 - - [llvm NewPassManager API分析及适配方案](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452010&idx=1&sn=3f6aa96ecfc41b5ae1a1acd2b60f936b&chksm=b18e30a086f9b9b6a4c913f6ad135fd46042e8c04004b975e677161b9639ecd09ee02a8ab090&scene=58&subscene=0#rd) - - [『就业班预售9折』零基础红蓝对抗攻防研修班](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452010&idx=2&sn=302087eee7fdfd0e215774c2550ae438&chksm=b18e30a086f9b9b656c29561470fd7a6fd518d7aa86a64e0ee62c47ad46e929dd642513f6f42&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [[Book/Resource Recommendation] How do I get started in learning Cybersecurity?](https://www.reddit.com/r/netsecstudents/comments/va8m5j/bookresource_recommendation_how_do_i_get_started/) -- KitPloit - PenTest Tools! - - [Pulsar - Data Exfiltration And Covert Communication Tool](http://www.kitploit.com/2022/06/pulsar-data-exfiltration-and-covert.html) - - [WhiteBeam - Transparent Endpoint Security](http://www.kitploit.com/2022/06/whitebeam-transparent-endpoint-security.html) diff --git a/archive/2022/2022-06-13.md b/archive/2022/2022-06-13.md deleted file mode 100644 index 25148521b9..0000000000 --- a/archive/2022/2022-06-13.md +++ /dev/null @@ -1,83 +0,0 @@ -# 每日安全资讯（2022-06-13） - -- Sploitus.com Exploits RSS Feed - - [Exploit for Uncontrolled Resource Consumption in Axios exploit](https://sploitus.com/exploit?id=BEFCD594-3E6F-5A25-BB86-667B5FB11FA0&utm_source=rss&utm_medium=rss) - - [Exploit for OS Command Injection in Zyxel Usg Flex 100W Firmware exploit](https://sploitus.com/exploit?id=D1D08792-13CE-5DC6-B23F-F93330D78E39&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26134 exploit](https://sploitus.com/exploit?id=FD4859A0-D69F-503C-BFDB-0C9025BDC68F&utm_source=rss&utm_medium=rss) -- Sec-News 安全文摘 - - [PlayStation disclosed on HackerOne: bd-j exploit chain](https://wiki.ioin.in/url/G7nN) - - [Finding vulnerabilities in curl 7.83.0 without reading a single-line of C code](https://wiki.ioin.in/url/lE8p) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Atlassian Confluence Namespace OGNL Injection](https://cxsecurity.com/issue/WLB-2022060035) -- Security Boulevard - - [BSides:Munich 2022 – Sebastian Banescu’s ‘Not Quite Water Under The Bridge: Review Of Cross-Chain Bridge Hacks’](https://securityboulevard.com/2022/06/bsidesmunich-2022-sebastian-banescus-not-quite-water-under-the-bridge-review-of-cross-chain-bridge-hacks/) - - [XKCD ‘Exercise Progression’](https://securityboulevard.com/2022/06/xkcd-exercise-progression/) - - [BSides:Munich 2022 – Marcus Osterloh’s ‘Measuring Cyber Defense With The MITRE Framework’](https://securityboulevard.com/2022/06/bsidesmunich-2022-marcus-osterlohs-measuring-cyber-defense-with-the-mitre-framework/) - - [Lessons from the Gartner Security & Risk Management Summit](https://securityboulevard.com/2022/06/lessons-from-the-gartner-security-risk-management-summit/) -- FreeBuf网络安全行业门户 - - [新增网络安全专业！香港“护国歌校长”欢迎大家报考](https://www.freebuf.com/news/335952.html) - - [破解关机的iPhone：漏洞永不休眠](https://www.freebuf.com/articles/mobile/335950.html) -- cloud world - - [[摘要]如何构建分布式数据库 severless 服务?](https://cloudsjhan.github.io/2022/06/12/%E6%91%98%E8%A6%81-%E5%A6%82%E4%BD%95%E6%9E%84%E5%BB%BA%E5%88%86%E5%B8%83%E5%BC%8F%E6%95%B0%E6%8D%AE%E5%BA%93-severless-%E6%9C%8D%E5%8A%A1/) -- Reverse Engineering - - [Binary Ninja 3.1 Released](https://www.reddit.com/r/ReverseEngineering/comments/vatlxf/binary_ninja_31_released/) - - [PS3-PS5 bd-j exploit chain](https://www.reddit.com/r/ReverseEngineering/comments/vaihdf/ps3ps5_bdj_exploit_chain/) - - [What utilities allow you to debug a process without pausing execution?](https://www.reddit.com/r/ReverseEngineering/comments/vawb35/what_utilities_allow_you_to_debug_a_process/) - - [My tutorial for reverse engineering the map format in "You Have To Win The Game"](https://www.reddit.com/r/ReverseEngineering/comments/vacuko/my_tutorial_for_reverse_engineering_the_map/) - - [Examining memory without attaching to the process by using /proc/$PID/mem?](https://www.reddit.com/r/ReverseEngineering/comments/vawamn/examining_memory_without_attaching_to_the_process/) -- KitPloit - PenTest & Hacking Tools - - [DOMDig - DOM XSS Scanner For Single Page Applications](http://www.kitploit.com/2022/06/domdig-dom-xss-scanner-for-single-page.html) - - [Exfilkit - Data Exfiltration Utility For Testing Detection Capabilities](http://www.kitploit.com/2022/06/exfilkit-data-exfiltration-utility-for.html) -- 奇客Solidot–传递最新科技情报 - - [台北的死火山被发现是活火山](https://www.solidot.org/story?sid=71804) - - [相信 AI 有生命的 Google 工程师](https://www.solidot.org/story?sid=71803) - - [英国准备调查苹果和 Google 在移动市场上的垄断行为](https://www.solidot.org/story?sid=71802) -- 黑海洋 - WIKI - - [15天引爆所有实体餐饮店客流](https://blog.upx8.com/2794) - - [Apktool M v2.4.0反汇编神器（安卓）](https://blog.upx8.com/2793) - - [基于Python打造数据挖掘实战](https://blog.upx8.com/2792) -- Posts on 青鸟的博客 - - [挖掘iframe通信安全漏洞](https://blue-bird1.github.io/posts/iframesec/) -- Troy Hunt's Blog - - [Weekly Update 299](https://www.troyhunt.com/weekly-update-299/) -- SANS Internet Storm Center, InfoCON: green - - [&#xa;Quickie: Follina, RTF & Explorer Preview Pane, (Sun, Jun 12th)](https://isc.sans.edu/diary/rss/28734) -- Computer Forensics - - [How can I tell if a document has come straight from the official source or if it has been opened and edited off that official site? I](https://www.reddit.com/r/computerforensics/comments/vatjhx/how_can_i_tell_if_a_document_has_come_straight/) - - [How to Check Google Doc for when spesific entries was made?](https://www.reddit.com/r/computerforensics/comments/vau3xn/how_to_check_google_doc_for_when_spesific_entries/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [[Career Advice] What should I do next to make my career in cyber securities?](https://www.reddit.com/r/netsecstudents/comments/vaj853/career_advice_what_should_i_do_next_to_make_my/) -- 青藤云安全 - - [【漏洞通告】PHP 远程代码执行漏洞（CVE-2022-31625、CVE-2022-31626）](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650834910&idx=1&sn=5096efb28e423a5dccc66f41583ef9c2&chksm=80dbe47bb7ac6d6d4d5bc5aaedd70a3d6b59b3569d70335b43a358d2138cce25460543acf131&scene=58&subscene=0#rd) -- Security Affairs - - [Security Affairs newsletter Round 369 by Pierluigi Paganini](https://securityaffairs.co/wordpress/132194/breaking-news/security-affairs-newsletter-round-369-by-pierluigi-paganini.html) - - [Ransomware gangs are exploiting CVE-2022-26134 RCE in Atlassian Confluence servers](https://securityaffairs.co/wordpress/132186/cyber-crime/ransomware-gangs-cve-2022-26134-rce-atlassian-confluence.html) - - [HID Mercury Access Controller flaws could allow to unlock Doors](https://securityaffairs.co/wordpress/132175/hacking/hid-mercury-access-controller-flaws.html) -- Daniel Miessler - - [Why Everyone Needs a Blog](https://danielmiessler.com/blog/why-everyone-needs-a-blog/) - - [News & Analysis | NO. 334](https://danielmiessler.com/podcast/news-analysis-no-334/) - - [News & Analysis | NO. 333](https://danielmiessler.com/podcast/news-analysis-no-333/) - - [How Good is DALL·E at Creating NFT Artwork?](https://danielmiessler.com/blog/how-good-is-dall%c2%b7e-at-creating-nft-artwork/) - - [Just Copy What Works](https://danielmiessler.com/blog/just-copy-what-works/) -- /r/netsec - Information Security News & Discussion - - [I wrote a non technical post on my blog regarding security specialists, nihilistic behavior, and how to stay positive. Sometimes we need a reminder that, after all, things are not that bad.](https://www.reddit.com/r/netsec/comments/vap5my/i_wrote_a_non_technical_post_on_my_blog_regarding/) - - [I made a browser extension that spoofs your location data to match your VPN. It can also spoof your user agent.](https://www.reddit.com/r/netsec/comments/vac50s/i_made_a_browser_extension_that_spoofs_your/) - - [bevigil-cli : A handy tool to extract assets like subdomains, URL params, hosts, S3 buckets, URLs from android applications through BeVigil OSINT API with ease.](https://www.reddit.com/r/netsec/comments/vaif2f/bevigilcli_a_handy_tool_to_extract_assets_like/) - - [NGINX security: Everything you may not need to know about NGINX error logs - complete guide](https://www.reddit.com/r/netsec/comments/vaf63c/nginx_security_everything_you_may_not_need_to/) -- 数世咨询 - - [身份图谱：弥补静态身份认证与动态网络攻击之间的缺失](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493687&idx=1&sn=3b722a76892f1dd2f7d284f6fea00b1b&chksm=c1449a8af633139c8106bd6fd7b503b7df4414fafc416290868171e340d7fb1c96565e09b980&scene=58&subscene=0#rd) - - [思科：让所有人脱离网络安全贫困线](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493687&idx=2&sn=2c876fbd35f07ddc773e34bd1cd77d3c&chksm=c1449a8af633139cfda4b8a58f0fd3184166dd4dd770f5134bca56976ec9e09302f14ddef654&scene=58&subscene=0#rd) -- 情报分析师 - - [全球分析报告《驾驭全球制裁格局》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505509&idx=1&sn=2ab1f957f2f603bda6519bcb98492f67&chksm=8716af6eb06126781ae1c28a95ebf2116027e2266911cb38559e7e4d249a39e7363d494eccd1&scene=58&subscene=0#rd) - - [情报：俄乌冲突中的手机战争](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505509&idx=2&sn=ef2435d201827e8961274c7abc525686&chksm=8716af6eb06126785a562c963f0c2ac1442a1600f6fb5d91d3f5f522f0c43aa4d263951002fc&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [DOMDig - DOM XSS Scanner For Single Page Applications](http://www.kitploit.com/2022/06/domdig-dom-xss-scanner-for-single-page.html) - - [Exfilkit - Data Exfiltration Utility For Testing Detection Capabilities](http://www.kitploit.com/2022/06/exfilkit-data-exfiltration-utility-for.html) -- TorrentFreak - - [Proposed Freedom to Repair Act Seems Unlikely to Make Streaming Piracy Worse](https://torrentfreak.com/proposed-freedom-to-repair-act-seems-unlikely-to-make-streaming-piracy-worse-220612/) -- 云鼎实验室 - - [每周云安全资讯-2022年第24周](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494468&idx=1&sn=1ecde61ee4e55cc4f89d47005b6c329d&chksm=fd7917c2ca0e9ed495e85e5176549aa97635dea2a8028ec39e908959a0c0cd8c1237cf015f60&scene=58&subscene=0#rd) -- 黑奇士 - - [唐山打人案：如果我在现场，好像没有“正当防卫、见义勇为”的机会](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247487035&idx=1&sn=68337503dfeace514ecb045ff4e9dafd&chksm=eca201d7dbd588c1269a716f12d3a6cc8a6511b493d888b72675381d801df617b1b28164aaed&scene=58&subscene=0#rd) -- 互联网安全内参 - - [俄罗斯频遭网络攻击！俄外交部称将反击](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503423&idx=1&sn=66ee556960566f1defee0e2faf185d6e&chksm=ebfa891fdc8d0009b89d883ec91a49696133a03a1f5ed7285417082bc1d4da6f0ca59b4329b5&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-06-14.md b/archive/2022/2022-06-14.md deleted file mode 100644 index f0bcd0c015..0000000000 --- a/archive/2022/2022-06-14.md +++ /dev/null @@ -1,236 +0,0 @@ -# 每日安全资讯（2022-06-14） - -- Security Boulevard - - [BWAA-ck to Basics: Insights from the 2022 Verizon DBIR on Basic Web Application Attacks](https://securityboulevard.com/2022/06/bwaa-ck-to-basics-insights-from-the-2022-verizon-dbir-on-basic-web-application-attacks/) - - [Researchers Demonstrate They Can Steal Data During Homomorphic Encryption](https://securityboulevard.com/2022/06/researchers-demonstrate-they-can-steal-data-during-homomorphic-encryption/) - - [The Macquarie Telecom SD-WAN Turbo Cloud Encabulator](https://securityboulevard.com/2022/06/the-macquarie-telecom-sd-wan-turbo-cloud-encabulator/) - - [Username & Password Pairs: Why Banning Just Passwords Isn’t Enough](https://securityboulevard.com/2022/06/username-password-pairs-why-banning-just-passwords-isnt-enough/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 385’](https://securityboulevard.com/2022/06/robert-m-lees-jeff-haas-little-bobby-comic-week-385/) - - [ggshield [Security Zines]](https://securityboulevard.com/2022/06/ggshield-security-zines/) - - [Ransomware is the result, what is the cause?](https://securityboulevard.com/2022/06/ransomware-is-the-result-what-is-the-cause/) - - [Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers](https://securityboulevard.com/2022/06/technical-analysis-of-purecrypter-a-fully-functional-loader-distributing-remote-access-trojans-and-information-stealers/) - - [How to Protect Your Business Against the Cybersecurity Labor Shortage](https://securityboulevard.com/2022/06/how-to-protect-your-business-against-the-cybersecurity-labor-shortage/) -- HackerOne Hacker Activity - - [lack of rate limit on athentification login page & forgot password page](https://hackerone.com/reports/1591764) -- 绿盟科技技术博客 - - [洞见RSA2022 | 云原生安全为何是今年流量担当？](http://blog.nsfocus.net/rsa2022-cloud/) - - [洞见RSA2022 | 电话诈骗与验证码安全](http://blog.nsfocus.net/rsa2022-tele/) - - [绿盟科技威胁周报（20220606-20220612）](http://blog.nsfocus.net/weekly-20220606/) - - [洞见RSA2022 | 新形势下的工业互联网安全动向](http://blog.nsfocus.net/rsa2022-ind/) -- Sec-News 安全文摘 - - [How I found a Critical Bug in Instagram and Got 49500$ Bounty From Facebook](https://wiki.ioin.in/url/LXoB) -- Tenable Blog - - [Microsoft Azure Synapse Pwnalytics](https://www.tenable.com/blog/microsoft-azure-synapse-pwnalytics) -- No Headback - - [memory ballast 和 gc tuner 成为历史](http://xargin.com/the-new-api-for-heap-limit/) -- 安全客-有思想的安全新媒体 - - [从反恐到大国网络战，美国情报界手中究竟有何底牌？](https://www.anquanke.com/post/id/274181) - - [直击RSAC 2022：从“转型”看数字时代的威胁情报](https://www.anquanke.com/post/id/274167) - - [直击RSAC 2022：数字时代情报体系如何应对网空新挑战](https://www.anquanke.com/post/id/274169) - - [揭秘TAO：美国国家安全局APT-C-40黑客组织幕后黑手](https://www.anquanke.com/post/id/274207) - - [活动 | 报名围观-安全范儿沙龙带你学习甲方视角下的安全运营](https://www.anquanke.com/post/id/274171) - - [安全事件周报 (06.06-06.12)](https://www.anquanke.com/post/id/274189) - - [极致CMS建站系统代码审计之旅](https://www.anquanke.com/post/id/272911) - - [数字安全观察-每周简报 （2022.05.30 -2022.06.05）](https://www.anquanke.com/post/id/274157) - - [k8s中各组件和kube apiserver通信时的认证和鉴权](https://www.anquanke.com/post/id/274074) - - [别有用心还是无意为之 勒索软件要求用游戏货币支付赎金](https://www.anquanke.com/post/id/274106) -- Sploitus.com Exploits RSS Feed - - [Exploit for Off-by-one Error in Sudo Project Sudo exploit](https://sploitus.com/exploit?id=7AB13657-1E3A-536C-87B2-C058EBBA92A7&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=56417A88-33CB-520F-8FC3-4F3E49561DDC&utm_source=rss&utm_medium=rss) - - [Exploit for OS Command Injection in Zyxel Usg Flex 100W Firmware exploit](https://sploitus.com/exploit?id=0A536389-CEE0-5E64-89BE-1A54E16285BE&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26134 exploit](https://sploitus.com/exploit?id=FD4859A0-D69F-503C-BFDB-0C9025BDC68F&utm_source=rss&utm_medium=rss) -- 跳跳糖 - 安全与分享社区 - - [CVE-2022-26923 Active Directory 域提权 复现与分析](https://tttang.com/archive/1613/) -- Microsoft Security Blog - - [The many lives of BlackCat ransomware](https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/) - - [5 ways to connect with Microsoft Security at Identiverse 2022](https://www.microsoft.com/security/blog/2022/06/13/5-ways-to-connect-with-microsoft-security-at-identiverse-2022/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | Apple M1 芯片曝出严重漏洞；WiFi探测可窃取用户隐私信息](https://www.freebuf.com/news/336103.html) - - [2021 Owasp top 10 逐个击破，A05:2021 – Security Misconfiguration](https://www.freebuf.com/vuls/336072.html) - - [漫谈数据泄露排查 | FreeBuf甲方社群直播回顾](https://www.freebuf.com/articles/database/336048.html) - - [小心！Atlassian Confluence服务器中的RCE漏洞正被积极利用](https://www.freebuf.com/news/336037.html) - - [Confluence服务器被黑客部署AvosLocker、Cerber2021勒索软件](https://www.freebuf.com/news/336011.html) - - [PACMAN，一种针对 Apple M1 芯片的新攻击技术](https://www.freebuf.com/news/336009.html) - - [HID Mercury曝严重漏洞，可解锁访问控制系统](https://www.freebuf.com/news/336005.html) -- Envato Tuts+ Code - Mobile Development - - [How to Get Started With an Android App Template](https://code.tutsplus.com/tutorials/get-started-with-android-app-template--cms-27499) -- paper - Last paper - - [聊下最近的 CVE-2022-30190](https://paper.seebug.org/1915/) -- gynvael.coldwind//vx.log (en) - - [Screams of Power vulnerabilities (Powertek-based PDUs)](https://gynvael.coldwind.pl/?id=748) -- Objective-See's Blog - - [SeaFlower 藏海花](https://objective-see.com/blog/blog_0x6F.html) -- Didier Stevens - - [Update: oledump.py Version 0.0.68](https://blog.didierstevens.com/2022/06/13/update-oledump-py-version-0-0-68/) -- SentinelOne - - [Apple’s macOS Ventura | 7 New Security Changes to Be Aware Of](https://www.sentinelone.com/blog/apples-macos-ventura-7-new-security-changes-to-be-aware-of/) -- Rayanfam Blog - - [HyperDbg’s One Thousand and One Nights](https://rayanfam.com/topics/hyperdbg-one-thousand-and-one-nights/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/vb64jb/rreverseengineerings_weekly_questions_thread/) -- Malwarebytes Labs - - [Taking down the IP2Scam tech support campaign](https://blog.malwarebytes.com/threat-intelligence/2022/06/taking-down-the-ip2scam-tech-support-campaign/) - - [Update Chrome now: Four high risk vulnerabilities found](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/update-chrome-now-four-high-risk-vulnerabilities-found/) - - [Serious vulnerabilities found in ITarian software, patches available for SaaS products](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/serious-vulnerabilities-found-in-itarian-software-patches-available-for-saas-products/) - - [A week in security (June 6 – June 12)](https://blog.malwarebytes.com/a-week-in-security/2022/06/a-week-in-security-june-6-june-12/) -- Webroot Blog - - [Girl Scouts and OpenText empower future leaders of tomorrow with cyber resilience](https://www.webroot.com/blog/2022/06/13/girl-scouts-and-opentext-empower-future-leaders-of-tomorrow-with-cyber-resilience/) -- 4ra1n - - [一种Tomcat的利用方式](https://4ra1n.love/post/o0xGfbHpj/) -- KitPloit - PenTest & Hacking Tools - - [SharpEventPersist - Persistence By Writing/Reading Shellcode From Event Log](http://www.kitploit.com/2022/06/sharpeventpersist-persistence-by.html) - - [confluencePot - Simple Honeypot For Atlassian Confluence (CVE-2022-26134)](http://www.kitploit.com/2022/06/confluencepot-simple-honeypot-for.html) -- FireShell Security Team - - [justCTF 2022 - Symple Unzipper - [PT-BR]](https://fireshellsecurity.team/justctf2022-symple-unzipper/) -- The Daily Swig | Cybersecurity news and views - - [Kaiser Permanente data breach exposed healthcare records of 70,000 patients](https://portswigger.net/daily-swig/kaiser-permanente-data-breach-exposed-healthcare-records-of-70-000-patients) - - [Cybercriminals use reverse tunneling and URL shorteners to launch ‘virtually undetectable’ phishing campaigns](https://portswigger.net/daily-swig/cybercriminals-use-reverse-tunneling-and-url-shorteners-to-launch-virtually-undetectable-phishing-campaigns) - - [French government launches private bug bounty program for identity authentication app](https://portswigger.net/daily-swig/french-government-launches-private-bug-bounty-program-for-identity-authentication-app) -- 黑海洋 - WIKI - - [Webpack全面实战企业级项目搭建](https://blog.upx8.com/2795) -- 奇客Solidot–传递最新科技情报 - - [K-9 Mail 加入 Thunderbird](https://www.solidot.org/story?sid=71817) - - [IT 行业的高校毕业生薪酬最高](https://www.solidot.org/story?sid=71816) - - [为什么我们没有婴儿时期的记忆？](https://www.solidot.org/story?sid=71815) - - [物理学家证实量子回旋镖效应](https://www.solidot.org/story?sid=71814) - - [PyPI 多个软件包因拼写错误包含后门](https://www.solidot.org/story?sid=71813) - - [Bethesda 首次公开演示 《星空（Starfield）》](https://www.solidot.org/story?sid=71812) - - [CEO 建议创建永久性的公开的员工业绩数据库](https://www.solidot.org/story?sid=71811) - - [科学家为一个机器人手指覆上了人类皮肤活体](https://www.solidot.org/story?sid=71810) - - [大型海洋研究发现数千种以前未记载过的病毒](https://www.solidot.org/story?sid=71809) - - [基于 CRISPR 的新图谱将人类的每一个基因同功能联系在一起](https://www.solidot.org/story?sid=71808) - - [天文学家可能探测到一个流浪黑洞](https://www.solidot.org/story?sid=71807) - - [为什么人们相信麦田怪圈？](https://www.solidot.org/story?sid=71806) - - [滴滴结束美国上市之旅](https://www.solidot.org/story?sid=71805) -- Secureworks Blog - - [Operational Technology Security: The Other Threat Surface](https://www.secureworks.com/blog/operational-technology-security-the-other-threat-surface) -- Forensic Focus - - [Preparing for an Advanced Cyber Battlefield: The Digital Forensics for National Security Symposium](https://www.forensicfocus.com/event-info/preparing-for-an-advanced-cyber-battlefield-the-digital-forensics-for-national-security-symposium/) -- Securityinfo.it - - [Nuovi attacchi ransomware ai server Confluence](https://www.securityinfo.it/2022/06/13/nuovi-attacchi-ransomware-ai-server-confluence/?utm_source=rss&utm_medium=rss&utm_campaign=nuovi-attacchi-ransomware-ai-server-confluence) - - [Dati a rischio con le probe request del Wi-fi](https://www.securityinfo.it/2022/06/13/dati-a-rischio-con-le-probe-request-del-wi-fi/?utm_source=rss&utm_medium=rss&utm_campaign=dati-a-rischio-con-le-probe-request-del-wi-fi) -- SANS Internet Storm Center, InfoCON: green - - [Translating Saitama's DNS tunneling messages, (Mon, Jun 13th)](https://isc.sans.edu/diary/rss/28738) - - [ISC Stormcast For Monday, June 13th, 2022 https://isc.sans.edu/podcastdetail.html?id=8046, (Mon, Jun 13th)](https://isc.sans.edu/diary/rss/28736) -- Schneier on Security - - [Cryptanalysis of ENCSecurity’s Encryption Implementation](https://www.schneier.com/blog/archives/2022/06/cryptanalysis-of-encsecuritys-encryption-implementation.html) -- HACKMAGEDDON - - [1-15 May 2022 Cyber Attacks Timeline](https://www.hackmageddon.com/2022/06/13/1-15-may-2022-cyber-attacks-timeline/) -- ICT Security Magazine - - [Blockchain e Data Protection: il quadro definitorio e regolamentare](https://www.ictsecuritymagazine.com/articoli/blockchain-e-data-protection-il-quadro-definitorio-e-regolamentare/) -- Daniel Miessler - - [News & Analysis | NO. 333](https://danielmiessler.com/podcast/news-analysis-no-333/) - - [News & Analysis | NO. 334](https://danielmiessler.com/podcast/news-analysis-no-334/) - - [News & Analysis | NO. 335](https://danielmiessler.com/podcast/news-analysis-no-335/) - - [Why Everyone Needs a Blog](https://danielmiessler.com/blog/why-everyone-needs-a-blog/) - - [How Good is DALL·E 2 at Creating NFT Artwork?](https://danielmiessler.com/blog/how-good-is-dall%c2%b7e-at-creating-nft-artwork/) - - [Just Copy What Works](https://danielmiessler.com/blog/just-copy-what-works/) -- Computer Forensics - - [Anatomy of an NTFS FILE Record - Windows File System Forensics](https://www.reddit.com/r/computerforensics/comments/vbaub5/anatomy_of_an_ntfs_file_record_windows_file/) - - [Remote Forensics on Live Systems](https://www.reddit.com/r/computerforensics/comments/vbcuds/remote_forensics_on_live_systems/) -- /r/netsec - Information Security News & Discussion - - [JWT attacks (with online labs)](https://www.reddit.com/r/netsec/comments/vbcgi9/jwt_attacks_with_online_labs/) - - [Exposed Travis CI API Leaves All Free-Tier Users Open to Attack](https://www.reddit.com/r/netsec/comments/vbmbaz/exposed_travis_ci_api_leaves_all_freetier_users/) - - [The State of CSRF Vulnerability in 2022](https://www.reddit.com/r/netsec/comments/vb941p/the_state_of_csrf_vulnerability_in_2022/) - - [The many lives of BlackCat ransomware](https://www.reddit.com/r/netsec/comments/vbgh61/the_many_lives_of_blackcat_ransomware/) - - [Privilege Escalation in Microsoft Azure Synapse Analytics](https://www.reddit.com/r/netsec/comments/vbboxn/privilege_escalation_in_microsoft_azure_synapse/) -- 山石网科安全技术研究院 - - [第三届HCON倒计时](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493981&idx=1&sn=8f0e30636380f3748db46e93abeadfc7&chksm=fa523ce3cd25b5f519f68a2efbe223900904c2b9d271efaabe6c30f8394488753fabf9779227&scene=58&subscene=0#rd) -- 青藤云安全 - - [青藤“基于工业互联网的安全方案”成功入选信通院守卫者计划](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650834981&idx=1&sn=6061e0722fdd7a6b91be0b0257a2b992&chksm=80dbeb80b7ac629634b834d53fc74d6bf57f3fcae5b3a72d848dc87712a370524aef03154307&scene=58&subscene=0#rd) -- Threatpost - - [Bluetooth Signals Can Be Used to Track Smartphones, Say Researchers](https://threatpost.com/bluetooth-signals-track-smartphones/179937/) -- The Register - Security - - [HelloXD ransomware bulked up with better encryption, nastier payload](https://go.theregister.com/feed/www.theregister.com/2022/06/13/helloxd-ransomware-evolving/) -- Security Affairs - - [Russia-linked APT targets Ukraine by exploiting the Follina RCE vulnerability](https://securityaffairs.co/wordpress/132227/apt/cert-ua-sandworm-follina-rce.html) - - [GALLIUM APT used a new PingPull RAT in recent campaigns](https://securityaffairs.co/wordpress/132217/apt/gallium-apt-pingpull-trojan.html) - - [HelloXD Ransomware operators install MicroBackdoor on target systems](https://securityaffairs.co/wordpress/132207/malware/helloxd-ransomware-installs-microbackdoor.html) - - [Using WiFi connection probe requests to track users](https://securityaffairs.co/wordpress/132193/mobile-2/wifi-probe-requests-track-users.html) -- 字节跳动技术团队 - - [行为序列模型在抖音风控中的应用](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494761&idx=1&sn=902b53d1439e3c99778fa4b5413e169d&chksm=e9d3278bdea4ae9d3411f8c2c48bf46986a74b12dc1ff24a1b6dbf4bb1b392ad2883ba3dd9e8&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jun. 13th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495557&idx=1&sn=1a416ea7bce978018d38ee80a21b4996&chksm=ce96a2bbf9e12bad57b12ae496754a8121757580c440c00fee10be08372ba98b9a9d3afa5703&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [活动 | 6月考试季，美团SRC也给你出了一张试卷，快来看看吧~](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247489488&idx=1&sn=d9608ad4ba2876d37e4b723c741fd4e5&chksm=ec1bf603db6c7f15c7e93034d9522833b9ea962fa13b1c47738a5809eba68284dc731dfda334&scene=58&subscene=0#rd) -- TorrentFreak - - [The U.S. ‘Small’ Copyright Claims Board Goes Live this Week](https://torrentfreak.com/the-u-s-small-copyright-claims-board-goes-live-this-week-220613/) - - [IPTV Pirates Who Lost $90m Lawsuit Lose Another Worth $130m](https://torrentfreak.com/iptv-pirates-who-lost-90m-lawsuit-lose-another-worth-130m-220613/) -- KitPloit - PenTest Tools! - - [SharpEventPersist - Persistence By Writing/Reading Shellcode From Event Log](http://www.kitploit.com/2022/06/sharpeventpersist-persistence-by.html) - - [confluencePot - Simple Honeypot For Atlassian Confluence (CVE-2022-26134)](http://www.kitploit.com/2022/06/confluencepot-simple-honeypot-for.html) -- 雷神众测 - - [雷神众测漏洞周报2022.06.06-2022.06.12-4](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652497685&idx=1&sn=f4376357029a3618887b0d8509c29243&chksm=f25844a6c52fcdb0f907fdd6e4f24debf6e514cd3f22a1b97d90f29396e883adc536d3d3d5d1&scene=58&subscene=0#rd) -- 互联网安全内参 - - [俄罗斯知名媒体电台遭黑客攻击：奏响乌克兰国歌](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503459&idx=1&sn=6b88533aa266754bb72f404a01112fa5&chksm=ebfa8943dc8d005565f6e1df8479f4a2b1b0f88012c5c69e31aab20bd447ab75dcdc9c6a2a19&scene=58&subscene=0#rd) - - [MIT爆出苹果M1芯片重大漏洞：补丁无法修复](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503459&idx=2&sn=c4e82a9f42389835c41505c8ba543295&chksm=ebfa8943dc8d00550f0162b3367a9a3d1af2d15f7a7c67555bd5cff3fb6f71271dcdfc4438f3&scene=58&subscene=0#rd) - - [2022安全运营发展论坛在京召开](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503459&idx=3&sn=7e9e28e143edfa6230b35a4cf515e56d&chksm=ebfa8943dc8d0055183a31e913f96bc021cc39c49f85e6acd44f573ea73bfa5ab917fa299c06&scene=58&subscene=0#rd) - - [英特尔启动琥珀计划：机密计算SaaS化](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503459&idx=4&sn=1967fb9adc11f0e9382663f23e59efaa&chksm=ebfa8943dc8d00552f7df667fd949eac20483da250ee89716c1760e834b2300cd8e0943dc3b5&scene=58&subscene=0#rd) -- 安全客 - - [【安全头条】别有用心还是无意为之 勒索软件要求用游戏货币支付赎金](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771762&idx=1&sn=5c76e07b56e3e74b9f57255e6b84c043&chksm=88937e9dbfe4f78b89fccd412110627d3c30b8f8aa6cc148feeddb194b936feb9cc99be2e86c&scene=58&subscene=0#rd) - - [【技术分享】Emotet木马运行原理完全分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771762&idx=2&sn=d92b0006c5b5e27627cd2eb726f56d99&chksm=88937e9dbfe4f78b55e9b0365bd9c3839d1990963b6cd66251281d08d3a06030d0bc8e8956a3&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-13)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958502&idx=1&sn=d5be2fea5a81f263598cca39e0ae90eb&chksm=8baecc79bcd9456fd19ea1c22e1a762ebf217825dba639414558e8ddd699f4a234d98ff61d8c&scene=58&subscene=0#rd) -- Social Engineering - - [What would be a good social engineering assignment and should there be a website where people can find social engineering assignments?](https://www.reddit.com/r/SocialEngineering/comments/vb01q4/what_would_be_a_good_social_engineering/) - - [Twitter account restricted - Sensitive content. HELP](https://www.reddit.com/r/SocialEngineering/comments/vb4ag7/twitter_account_restricted_sensitive_content_help/) -- 火线Zone - - [K8S污点容忍度横向主节点](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495526&idx=1&sn=310e97d8b6f880675461ced57bbd0f12&chksm=eaa96746dddeee50c89b3ac246257822417c458c95d8bca2f7ab33aacd489cea16e42c02a8e0&scene=58&subscene=0#rd) - - [ThinkPHP系列漏洞分析-2.x任意代码执行](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495526&idx=2&sn=88f885d60dca173473f4cbfd7b7b7960&chksm=eaa96746dddeee501ce2261cdc5565c16f9b1167328404c929c476a78b326dbeccafe52a6455&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220613期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527296&idx=1&sn=06a2bbdae065aff567b6c341d2378ccc&chksm=c1e9e7d1f69e6ec73198c5aa43cf2a5b97cccb0f332e3724f4011650cae4479ff18a21a40fab&scene=58&subscene=0#rd) - - [物联网勒索软件攻击或成为关键基础设施安全保护的噩梦](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527296&idx=2&sn=c4b47ccd04423b011229123ab4c06156&chksm=c1e9e7d1f69e6ec7e0db737be84d455ce742be1961181398b36006b42ca4132cae79d576249c&scene=58&subscene=0#rd) - - [大规模Facebook网络钓鱼活动，预计产生数百万美元收益](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527296&idx=3&sn=0bc5e522ccb0f15a48b6236e695080e9&chksm=c1e9e7d1f69e6ec724ad8ca37eb6cca73f49d65326608fe1992901d37220f3206dc17a69e40f&scene=58&subscene=0#rd) -- 星阑科技 - - [本周Gartner网络研讨会，9大精彩议题等你来看！](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493564&idx=1&sn=d9a3f4d35c0fbb994079deb7b584dedb&chksm=c0074a20f770c336a0124270d01073b04792c6e1f85a7d5676af3b023bc440ec140eabfdc872&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [Addressing Cyber Risk with a Unified Platform](https://www.trendmicro.com/en_us/ciso/22/f/addressing-cyber-risk-with-a-unified-platform.html) -- 陌陌安全 - - [初夏派对，没你不行！](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487198&idx=1&sn=1e8f5aa9520c93f1c31ed6805d4eaef9&chksm=eadc04bcddab8daabfed8eb850a9e9c6675b1e799bc26374ab20d0457ea5df0ed43e77f667f2&scene=58&subscene=0#rd) -- Dark Reading - - [Corel Acquires Awingu](https://www.darkreading.com/remote-workforce/corel-acquires-awingu) - - [CISA Recommends Organizations Update to the Latest Version of Google Chrome](https://www.darkreading.com/vulnerabilities-threats/cisa-encourages-organizations-to-updated-to-latest-chrome-version) - - [Kaiser Permanente Breach Exposes Data on 70K Patients](https://www.darkreading.com/attacks-breaches/kaiser-permanente-breach-exposes-70k-patients-data) - - [Exposed Travis CI API Leaves All Free-Tier Users Open to Attack](https://www.darkreading.com/threat-intelligence/exposed-travis-ci-api-leaves-all-free-tier-users-open-to-attack) - - [In Security, Less Is More](https://www.darkreading.com/edge-articles/in-security-less-is-more) - - [Tony Jarvis on Shifting Security Gears as We Move to the Cloud](https://www.darkreading.com/tech-talks/tony-jarvis-on-shifting-security-gears-as-we-move-to-the-cloud) - - [3 Big Takeaways From the Verizon DBIR 2022](https://www.darkreading.com/attacks-breaches/3-big-takeaways-from-the-verizon-dbir-2022) - - [DoS Vulnerability Allows Easy Envoy Proxy Crashes](https://www.darkreading.com/cloud/dos-vulnerability-envoy-proxy-crashes) -- 代码卫士 - - [热门工业访问控制系统中存在8个严重0day](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512281&idx=1&sn=371c8c2da75df09506fe20a95f3dbe10&chksm=ea9481b3dde308a5fea3d23bd48bcbb36b3d924ac6d8fae85e882d49a0dc1803005630b8a316&scene=58&subscene=0#rd) - - [两个严重的富士通云存储漏洞可用于破坏虚拟备份](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512281&idx=2&sn=d4fe854721aa8050ee66a20a176080a1&chksm=ea9481b3dde308a5dc2fe7ffe9a71d112a0dafbf6fd6f05a2f6895852e794b2d7b9b353b2258&scene=58&subscene=0#rd) - - [麻省理工研究员发现苹果 M1 CPU 中无法修复的新缺陷](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512281&idx=3&sn=1bae3c23b647e073efcb6df3fa15dcce&chksm=ea9481b3dde308a5b6ece11817a148a6d20a38c366288e9c3183f774bd4a6768612fac6f33cb&scene=58&subscene=0#rd) -- 情报分析师 - - [有组织犯罪评估：《全球有组织犯罪指数2021》公布各国排名！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505730&idx=1&sn=25bcdcb65e4ddeb74fcaa13c7d465962&chksm=8716ac49b061255f61da0c7ebd1544bbdc031f5ee00c7882fdcf71b6ce35f71cc80adc4c48dd&scene=58&subscene=0#rd) - - [塔利班临时政府组织机构人物关系图](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505730&idx=2&sn=6e1e3c2487e743774675f6e208b6491e&chksm=8716ac49b061255fb12328ce7ccf0a37ff50df23afce4b2bbd3900bc1e0100c070cd4959e046&scene=58&subscene=0#rd) - - [OSINT工具箱](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505730&idx=3&sn=b93c11ccce847f33a88e28ac7d631b8a&chksm=8716ac49b061255fe7460c05c6e5a255da51da9c4ad0172d8458f887c071b626545ac9ff595f&scene=58&subscene=0#rd) -- 看雪学院 - - [cgibin中与upnp协议有关的一些漏洞分析与复现](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452267&idx=1&sn=1485f8a3c82d0f4e175e5574016311d0&chksm=b18e31a186f9b8b7c793f36dd47b8027f896de18b0001f5bf7951e9378649d9590b99ea05eb9&scene=58&subscene=0#rd) - - [直播预告|平安SRC线上沙龙第二期：新视角下的安全攻防对抗](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452267&idx=2&sn=d602c6e3072ad142313f9b6facde1c89&chksm=b18e31a186f9b8b76398ac30f7833cc643bd9c2e90bcf833fac5f24d0bf61a7a84de1b563ce8&scene=58&subscene=0#rd) - - [研究人员新发现一种极为隐蔽的Linux恶意软件](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452267&idx=3&sn=d0524ed2bb6fd0368eb29b4ec5d84974&chksm=b18e31a186f9b8b72594195b56b833711824bb9adb423f94ab40c3daf3440fbe18743b8ee131&scene=58&subscene=0#rd) - - [Unicorn高级逆向与反混淆](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452267&idx=4&sn=b09bd7d338a9d1100b6e4a2890b427b2&chksm=b18e31a186f9b8b77c409451674f5779207697ac2a55b5f86b6d148bb61d6304bf7d51b279be&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (06.06-06.12)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491060&idx=1&sn=c4aac96edcfb24a3959e28429e0fa016&chksm=fe2518f5c95291e39d9c25131c6bd002d129f015ef4c1a26fa4307b362c52eeb0411a9cb9140&scene=58&subscene=0#rd) - - [安全日报（2022.06.13）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491060&idx=2&sn=c0feaa15cc4e9d9e22e024cf0f399527&chksm=fe2518f5c95291e32ac10ddf3d4adced39c33fb122c3c1e2de046d9338fe5eb3c4391969dc64&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [进击的“8220”！深信服捕获8220挖矿团伙使用最新Confluence高危漏洞发起攻击](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261620&idx=1&sn=a3f274a7451e778870f2a6e1995a8e27&chksm=f3e27200c495fb16be54c296c10086a85393ce6539658d5dfed46896905212bfff4a903f58bc&scene=58&subscene=0#rd) - - [MedusaLocker黑客组织Windows LPE 1day新组件披露](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261620&idx=2&sn=59d2ac3ae7592ca527ac3c4544573013&chksm=f3e27200c495fb1697c51ba2d3160d39df535c5c77f52d772c1e7464bf7ecd330d6f4df4bcd0&scene=58&subscene=0#rd) -- 安全威胁情报 - - [HFish溯源版开放下载，攻防演练最新情报即刻获得](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172675&idx=1&sn=2be1a9f978fc8ecdd751cec9c43ef2a5&chksm=f44896bfc33f1fa9f84a838d3f33c524209031f2eaf510e4744ec2b7080ced0f481cc8324137&scene=58&subscene=0#rd) -- 奇安信CERT - - [【已复现】Linux Kernel eBPF权限提升漏洞 (CVE-2022-23222)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496290&idx=1&sn=33f714add8320edd7103491825e65a86&chksm=fe79d6fac90e5fecfc269b09e0d01bf2a38fce6f9ec538acc4fbc47cdba0d4e482fa0d29d49b&scene=58&subscene=0#rd) - - [安全热点周报|第二百四十八期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496290&idx=2&sn=9143714031c0a140c32f1db58b26acd5&chksm=fe79d6fac90e5fec8db9945eef7057b30c30724672688e4e72d4a504c6904c61a907d56a3d4a&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [IPv6的黑产秒拨IP真相，企业可能一无所知......](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493466&idx=1&sn=98900f017f9aabe332daa7d3dc5f8167&chksm=eb12c161dc654877cdb92e9781f21fe730df5d9a870c82551549039221823690e0f59d341c01&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第23期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491859&idx=1&sn=0a31942b7776fd8366027cd54f8aef60&chksm=fd74d1daca0358cc084442cf5323b790dc0c18cc63e6251156baff886e5631dcab4b9ba0820f&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220606-20220612)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491859&idx=2&sn=5098a08f2b8a1d7d0c746a958a97b6c0&chksm=fd74d1daca0358cc7244cb7604455c28cd3c3f42181244a9f2930c38845687296eae8ac32731&scene=58&subscene=0#rd) -- 安全牛 - - [XDR落地应用的挑战、变革与发展](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114530&idx=1&sn=6f74aaf7d79401726b39184a20a15b50&chksm=bd147cf18a63f5e720dbaeb8269df491d3abb961c27338f72cb4d314469ca13b1b3f337e87c7&scene=58&subscene=0#rd) - - [安全头条 | 我国自主创新“长安链”可对抗量子攻击；工信部：构建全国一体化反诈技防体系](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114530&idx=2&sn=54fd558baec1f7dc1976a6fd3e7a5dc2&chksm=bd147cf18a63f5e7c46afb735d92eee3eb0ee7a13cd7485cfebd2910d1875ebaee24b0191041&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（26期）：《中华人民共和国个人信息保护法》深度解读](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114530&idx=3&sn=9fc38154bf606a5c3a30ad9eece31a76&chksm=bd147cf18a63f5e7155e9d4b0fa636c9c241950bc97efa55b1880431838500298e6a9f121db2&scene=58&subscene=0#rd) -- Deeplinks - - [How the Federal Government Buys Our Cell Phone Location Data](https://www.eff.org/deeplinks/2022/06/how-federal-government-buys-our-cell-phone-location-data) - - [EFF’s Flagship Jewel v. NSA Dragnet Spying Case Rejected by the Supreme Court](https://www.eff.org/deeplinks/2022/06/effs-flagship-jewel-v-nsa-dragnet-spying-case-rejected-supreme-court) -- Dark Space Blogspot - - [Cos'è Successo A Celsius Network? Bank Run? Insolvenza? Scam?](http://darkwhite666.blogspot.com/2022/06/cose-successo-celsius-network-bank-run.html) diff --git a/archive/2022/2022-06-15.md b/archive/2022/2022-06-15.md deleted file mode 100644 index a5e0dde3ed..0000000000 --- a/archive/2022/2022-06-15.md +++ /dev/null @@ -1,321 +0,0 @@ -# 每日安全资讯（2022-06-15） - -- Vulnerabilities and Threat Research – Qualys Security Blog - - [June 2022 Patch Tuesday | Microsoft Releases 55 Vulnerabilities with 3 Critical; Adobe Releases 6 Advisories, 46 Vulnerabilities with 40 Critical.](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Sec-News 安全文摘 - - [Zimbra Email - Stealing Clear-Text Credentials via Memcache injection](https://wiki.ioin.in/url/J48o) - - [Azure Synapse Analytics Service Vulnerability](https://wiki.ioin.in/url/YDB0) - - [From open redirect to RCE in one week](https://wiki.ioin.in/url/bkEq) - - [Windows 上最小的「HelloWorld.exe」能有多小？](https://wiki.ioin.in/url/EokV) - - [MetaMask 浏览器扩展钱包 Clickjacking 漏洞分析](https://wiki.ioin.in/url/4VA1) -- 跳跳糖 - 安全与分享社区 - - [Enumeration and lateral movement in GCP environments(译文)](https://tttang.com/archive/1626/) -- HackerOne Hacker Activity - - [HTML Injection in E-mail](https://hackerone.com/reports/1536899) - - [Reflected Cross Site Scripting at ColdFusion Debugging Panel http://www.grouplogic.com/CFIDE/debug/cf_debugFr.cfm](https://hackerone.com/reports/1166918) - - [Reflected Cross Site Scripting at http://www.grouplogic.com/files/glidownload/verify3.asp [Uppercase Filter Bypass]](https://hackerone.com/reports/1167034) - - [Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag](https://hackerone.com/reports/1530898) -- 绿盟科技技术博客 - - [洞见RSA2022 | 安全运营下的资产攻击面管理](http://blog.nsfocus.net/rsa2022-oper/) - - [洞见RSA2022 | 从RSA十大热词看2022网络安全趋势](http://blog.nsfocus.net/rsa2022-10/) - - [洞见RSA2022 | 将零信任带进ICS](http://blog.nsfocus.net/rsa2022-ics/) - - [洞见RSA2022 | 基于网络的威胁狩猎：教训和技巧](http://blog.nsfocus.net/rsa2022-skil/) - - [洞见RSA2022 | 使用原力：利用Shodan对工控系统进行威胁狩猎](http://blog.nsfocus.net/rsa2022-shodan/) -- Sploitus.com Exploits RSS Feed - - [Real Player v.20.0.8.310 G2 Control - 'DoGoToURL()' Remote Code Execution (RCE) exploit](https://sploitus.com/exploit?id=EDB-ID:50953&utm_source=rss&utm_medium=rss) - - [Virtua Software Cobranca 12S - SQLi exploit](https://sploitus.com/exploit?id=EDB-ID:50958&utm_source=rss&utm_medium=rss) - - [Marval MSM v14.19.0.12476 - Remote Code Execution (Authenticated) Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37787&utm_source=rss&utm_medium=rss) - - [ChurchCRM 4.4.5 - SQLi exploit](https://sploitus.com/exploit?id=EDB-ID:50965&utm_source=rss&utm_medium=rss) - - [Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF) exploit](https://sploitus.com/exploit?id=EDB-ID:50957&utm_source=rss&utm_medium=rss) - - [Marval MSM v14.19.0.12476 - Cross-Site Request Forgery Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37788&utm_source=rss&utm_medium=rss) - - [HP LaserJet Professional M1210 MFP Series Receive Fax Service - Unquoted Service Path exploit](https://sploitus.com/exploit?id=1337DAY-ID-37790&utm_source=rss&utm_medium=rss) - - [Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE) exploit](https://sploitus.com/exploit?id=EDB-ID:50954&utm_source=rss&utm_medium=rss) - - [Algo 8028 Control Panel - Remote Code Execution (Authenticated) Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37791&utm_source=rss&utm_medium=rss) - - [Real Player 16.0.3.51 - external::Import() Directory Traversal to Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37786&utm_source=rss&utm_medium=rss) - - [Old Age Home Management System 1.0 - SQLi Authentication Bypass exploit](https://sploitus.com/exploit?id=EDB-ID:50966&utm_source=rss&utm_medium=rss) - - [JM-DATA ONU JF511-TV Multiple Remote Vulnerabilities exploit](https://sploitus.com/exploit?id=ZSL-2022-5708&utm_source=rss&utm_medium=rss) - - [Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:50961&utm_source=rss&utm_medium=rss) - - [Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE) exploit](https://sploitus.com/exploit?id=EDB-ID:50964&utm_source=rss&utm_medium=rss) - - [SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50967&utm_source=rss&utm_medium=rss) - - [TP-Link Router AX50 firmware 210730 - Remote Code Execution (Authenticated) Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37793&utm_source=rss&utm_medium=rss) - - [Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:50960&utm_source=rss&utm_medium=rss) - - [Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50955&utm_source=rss&utm_medium=rss) - - [TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:50962&utm_source=rss&utm_medium=rss) - - [Sourcegraph Gitserver 3.36.3 - Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37795&utm_source=rss&utm_medium=rss) - - [phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:50963&utm_source=rss&utm_medium=rss) - - [SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50968&utm_source=rss&utm_medium=rss) - - [Real Player v.20.0.8.310 G2 Control - DoGoToURL() Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37785&utm_source=rss&utm_medium=rss) - - [Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:50956&utm_source=rss&utm_medium=rss) -- 安全客-有思想的安全新媒体 - - [活动｜[陌陌/探探]初夏派对，没你不行！](https://www.anquanke.com/post/id/274172) - - [记一次供应链攻击的应急响应和防御思考](https://www.anquanke.com/post/id/274399) - - [从云服务器 SSRF 漏洞到接管你的阿里云控制台](https://www.anquanke.com/post/id/274073) - - [周鸿祎出席《网络安全法》座谈会 建言免费帮扶中小微企业安全](https://www.anquanke.com/post/id/273859) - - [全方位守护政企机构数字资产安全，360星绘正式发布](https://www.anquanke.com/post/id/274203) - - [十二种不常见密码及部分实现脚本](https://www.anquanke.com/post/id/272987) - - [PyPI包keep意外引入密码窃取模块](https://www.anquanke.com/post/id/274232) -- FreeBuf网络安全行业门户 - - [信安标委发布《APP个人信息处理活动管理指南》征求意见稿](https://www.freebuf.com/news/336188.html) - - [保持警觉，勒索软件HelloXD可能在你的系统上部署新后门](https://www.freebuf.com/news/336186.html) - - [FreeBuf早报 | 微软今日起终止对IE浏览器的支持；智能商业建筑网络安全风险凸显](https://www.freebuf.com/news/336170.html) - - [俄沙虫组织利用Follina漏洞，入侵乌克兰重点机构](https://www.freebuf.com/news/336151.html) - - [45% 的网络安全从业者因压力过大，考虑退出该行业](https://www.freebuf.com/news/336142.html) - - [SASE何时迎来市场爆发？](https://www.freebuf.com/articles/network/336137.html) - - [宜宾凯翼汽车有限公司招聘信息](https://www.freebuf.com/jobs/336133.html) - - [WiFi探测正在跟踪、泄露隐私](https://www.freebuf.com/news/336129.html) - - [微软：Exchange 服务器正被用来部署 BlackCat 勒索软件](https://www.freebuf.com/news/336125.html) - - [CHAOS勒索病毒分析](https://www.freebuf.com/articles/paper/334499.html) -- Tenable Blog - - [Microsoft’s June 2022 Patch Tuesday Addresses 55 CVEs (CVE-2022-30190)](https://www.tenable.com/blog/microsofts-june-2022-patch-tuesday-addresses-55-cves-cve-2022-30190) -- Security Boulevard - - [Clear Majority of Cybersecurity Professionals Believe They are in a Perpetual State of Cyberwar: Venafi Survey](https://securityboulevard.com/2022/06/clear-majority-of-cybersecurity-professionals-believe-they-are-in-a-perpetual-state-of-cyberwar-venafi-survey/) - - [In the News | ManagedMethods Named A Winner In The 2022 Fortress Cyber Security Awards](https://securityboulevard.com/2022/06/in-the-news-managedmethods-named-a-winner-in-the-2022-fortress-cyber-security-awards/) - - [How much do fraudsters invest to take down your company?](https://securityboulevard.com/2022/06/how-much-do-fraudsters-invest-to-take-down-your-company/) - - [Patch Tuesday Made Easy With JumpCloud Patch Management](https://securityboulevard.com/2022/06/patch-tuesday-made-easy-with-jumpcloud-patch-management/) - - [Wicked Good Development: The Evolution of Supply Chain Attacks](https://securityboulevard.com/2022/06/wicked-good-development-the-evolution-of-supply-chain-attacks/) - - [Security Advisory Regarding Splunk Enterprise Deployment Servers](https://securityboulevard.com/2022/06/security-advisory-regarding-splunk-enterprise-deployment-servers/) - - [Ransomware Group Debuts Searchable Victim Data](https://securityboulevard.com/2022/06/ransomware-group-debuts-searchable-victim-data/) - - [SANS ICS HyperEncabulator](https://securityboulevard.com/2022/06/sans-ics-hyperencabulator/) - - [Hell Yeah, I Want an Automated Content Security Policy!](https://securityboulevard.com/2022/06/hell-yeah-i-want-an-automated-content-security-policy/) - - [DTEX Systems Wins “Most Innovative Data Loss Prevention” and “Publisher’s Choice Insider Threat Prevention” in Global InfoSec Awards During RSA Conference 2022](https://securityboulevard.com/2022/06/dtex-systems-wins-most-innovative-data-loss-prevention-and-publishers-choice-insider-threat-prevention-in-global-infosec-awards-during-rsa-conference-2022/) -- Sucuri Blog - - [What is a Scam?](https://blog.sucuri.net/2022/06/what-is-a-scam.html) -- Google Online Security Blog - - [SBOM in Action: finding vulnerabilities with a Software Bill of Materials](http://security.googleblog.com/2022/06/sbom-in-action-finding-vulnerabilities.html) -- Trustwave Blog - - [With Trustwave, the Best in MDR Just Got Better](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/with-trustwave-the-best-in-mdr-just-got-better/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [contactform7 - Cross Site Scripting Vulnerability (XSS)](https://cxsecurity.com/issue/WLB-2022060036) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [A Compilation of Known Conti Ransomware Themed Malicious and Fraudulent MD5s - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/a-compilation-of-known-conti-ransomware.html) - - [A Compilation of Conti Ransomware Gang BitCoin Transaction IDs - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/a-compilation-of-conti-ransomware-gang.html) -- Didier Stevens - - [Update: python-per-line.py Version 0.0.8](https://blog.didierstevens.com/2022/06/14/update-python-per-line-py-version-0-0-8/) -- Project Zero - - [An Autopsy on a Zombie In-the-Wild 0-day](https://googleprojectzero.blogspot.com/2022/06/an-autopsy-on-zombie-in-wild-0-day.html) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-06-13 - TA578 thread-hijacked email --> Bumblebee --> Cobalt Strike](https://www.malware-traffic-analysis.net/2022/06/14/index.html) - - [2022-06-13 - TA578 thread-hijacked emails push Bumblebee or IcedID](https://www.malware-traffic-analysis.net/2022/06/13/index.html) -- SentinelOne - - [Gartner Summit 2022 Recap: Reframing Risk & Simplifying Security](https://www.sentinelone.com/blog/gartner-summit-2022-recap-reframing-risk-simplifying-security/) -- Malwarebytes Labs - - [Karakurt extortion group: Threat profile](https://blog.malwarebytes.com/cybercrime/2022/06/karakurt-extortion-group-threat-profile/) - - [Instagram scam steals your selfies to trick your friends](https://blog.malwarebytes.com/personal/scams-personal/2022/06/instagram-scam-steals-your-selfies-to-trick-your-friends/) - - [“Multiple adversaries” exploiting Confluence vulnerability, warns Microsoft](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/multiple-adversaries-exploiting-confluence-vulnerability-warns-microsoft/) - - [Introducing Malwarebytes Vulnerability Assessment for OneView: How to check for Common Vulnerabilities and Exposures (CVEs)](https://blog.malwarebytes.com/malwarebytes-news/2022/06/introducing-malwarebytes-vulnerability-assessment-for-oneview-how-to-check-for-common-vulnerabilities-and-exposures-cves/) - - [Don’t panic! “Unpatchable” Mac vulnerability discovered](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/dont-panic-unpatchable-mac-vulnerability-discovered/) -- PortSwigger Research - - [Bypassing CSP with dangling iframes](https://portswigger.net/research/bypassing-csp-with-dangling-iframes) -- Sucuri Blog - - [What is a Scam?](https://blog.sucuri.net/2022/06/what-is-a-scam.html) -- Intigriti - - [U.S. Justice Department will no longer bring charges against good-willed security researchers](https://blog.intigriti.com/2022/06/14/us-justice-department-no-longer-bring-charges-against-good-willed-security-researchers/) -- Application Security Blog - - [Why supply chain risk management is a top priority](https://www.synopsys.com/blogs/software-security/supply-chain-risk-management-federal-government/) -- Exploit-DB.com RSS Feed - - [[webapps] SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/50968) - - [[webapps] SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/50967) - - [[webapps] Old Age Home Management System 1.0 - SQLi Authentication Bypass](https://www.exploit-db.com/exploits/50966) - - [[webapps] ChurchCRM 4.4.5 - SQLi](https://www.exploit-db.com/exploits/50965) - - [[remote] Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/50964) - - [[webapps] phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/50963) - - [[remote] TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/50962) - - [[webapps] Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/50961) - - [[remote] Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/50960) - - [[local] HP LaserJet Professional M1210 MFP Series Receive Fax Service - Unquoted Service Path](https://www.exploit-db.com/exploits/50959) - - [[remote] Virtua Software Cobranca 12S - SQLi](https://www.exploit-db.com/exploits/50958) - - [[remote] Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF)](https://www.exploit-db.com/exploits/50957) - - [[remote] Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/50956) - - [[webapps] Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/50955) - - [[local] Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/50954) - - [[local] Real Player v.20.0.8.310 G2 Control - 'DoGoToURL()' Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/50953) -- r2c website - - [Write custom rules with the new Playground](https://r2c.dev/blog/2022/new-playground/) -- The Daily Swig | Cybersecurity news and views - - [HID Mercury access control vulnerabilities leave door open to lock manipulation](https://portswigger.net/daily-swig/hid-mercury-access-control-vulnerabilities-leave-door-open-to-lock-manipulation) - - [Oblivious DNS-over-HTTPS offers privacy enhancements to secure lookup protocol](https://portswigger.net/daily-swig/oblivious-dns-over-https-offers-privacy-enhancements-to-secure-lookup-protocol) - - [GhostTouch: Hackers can reach your phone’s touchscreen without even touching it](https://portswigger.net/daily-swig/ghosttouch-hackers-can-reach-your-phones-touchscreen-without-even-touching-it) -- Mozilla Hacks – the Web developer blog - - [Everything Is Broken: Shipping rust-minidump at Mozilla – Part 1](https://hacks.mozilla.org/2022/06/everything-is-broken-shipping-rust-minidump-at-mozilla/) -- 奇客Solidot–传递最新科技情报 - - [腾讯阿里巴巴云业务增长放缓或停滞](https://www.solidot.org/story?sid=71828) - - [尼日利亚制定草案监管互联网公司](https://www.solidot.org/story?sid=71827) - - [新冠免疫力能持续多久？](https://www.solidot.org/story?sid=71826) - - [亚马逊将在加州试点无人机送货](https://www.solidot.org/story?sid=71825) - - [科学家用废料制造水泥](https://www.solidot.org/story?sid=71824) - - [用于 COVID 监控的 AI 工具为城市拥堵提供解决方案](https://www.solidot.org/story?sid=71823) - - [盖亚探测器揭示恒星 DNA 和星震](https://www.solidot.org/story?sid=71822) - - [大强子对撞机重启物理学家再燃希望](https://www.solidot.org/story?sid=71821) - - [河南村镇银行储户健康码突然变红](https://www.solidot.org/story?sid=71820) - - [工程师构建类似乐高的 AI 芯片](https://www.solidot.org/story?sid=71819) - - [加密货币市场市值跌破一万亿美元](https://www.solidot.org/story?sid=71818) -- Qualys Security Blog - - [Detect the Follina MSDT Vulnerability (CVE-2022-30190) with Qualys Multi-Vector EDR & Context XDR](https://blog.qualys.com/category/product-tech) - - [June 2022 Patch Tuesday | Microsoft Releases 55 Vulnerabilities with 3 Critical; Adobe Releases 6 Advisories, 46 Vulnerabilities with 40 Critical.](https://blog.qualys.com/category/vulnerabilities-threat-research) -- 黑海洋 - WIKI - - [Photoshop 2022 茶末余香增强版](https://blog.upx8.com/2798) - - [Win11优化 Windows 11 Manager v1.1.1 免激活便携版](https://blog.upx8.com/2797) - - [红帽OpenStack平台实战课程](https://blog.upx8.com/2796) -- Chaos Computer Club - last 100 events feed - - [Gebrauchte Thinkpads (petitfoo)](https://cdn.media.ccc.de/contributors/essen/petitfoo/h264-hd/petitfoo-57-deu-Gebrauchte_Thinkpads_hd.mp4) -- Light Blue Touchpaper - - [Reporting cybercrime is hard: NCA link to Action Fraud broken for 3 years](https://www.lightbluetouchpaper.org/2022/06/14/reporting-cybercrime-is-hard-nca-link-to-action-fraud-broken-for-3-years/) -- Google Online Security Blog - - [SBOM in Action: finding vulnerabilities with a Software Bill of Materials](http://security.googleblog.com/2022/06/sbom-in-action-finding-vulnerabilities.html) -- Forensic Focus - - [Global Incident Response: DFRWS-EU Keynote, 2022](https://www.forensicfocus.com/webinars/global-incident-response-dfrws-eu-keynote-2022/) -- Black Hills Information Security - - [For Web Content Discovery, Who You Gonna Call? Gobuster!](https://www.blackhillsinfosec.com/for-web-content-discovery-who-you-gonna-call-gobuster/) -- ICT Security Magazine - - [MDR nella sanità. Cyber Security in ambienti critici](https://www.ictsecuritymagazine.com/notizie/mdr-nella-sanita-cyber-security-in-ambienti-critici/) -- Schneier on Security - - [Upcoming Speaking Engagements](https://www.schneier.com/blog/archives/2022/06/upcoming-speaking-engagements-20.html) - - [Hacking Tesla’s Remote Key Cards](https://www.schneier.com/blog/archives/2022/06/hacking-teslas-remote-key-cards.html) -- Posts By SpecterOps Team Members - Medium - - [Introducing Ghostwriter v3.0](https://posts.specterops.io/introducing-ghostwriter-v3-0-db462a1c688c?source=rss----f05f8696e3cc---4) -- Taszk Labs on taszk.io labs - - [[BugTales] UnZiploc: From 0-click To Platform Compromise](https://labs.taszk.io/articles/post/unziploc/) -- Deeplinks - - [Victory! New York’s Vaccine Privacy Bill Heads to Governor’s Desk](https://www.eff.org/deeplinks/2022/06/victory-new-yorks-vaccine-privacy-bill-heads-governors-desk) - - [Senator Declares Amazon Ring's Audio Surveillance Capabilities "Threaten the Public"](https://www.eff.org/deeplinks/2022/06/senator-declares-concern-about-amazon-rings-audio-surveillance-capabilities) - - [EFF Urges Congress to Strengthen the American Data Privacy and Protection Act](https://www.eff.org/deeplinks/2022/06/eff-urges-congress-strengthen-american-data-privacy-and-protection-act) -- LuxSci - - [Infrastructure Requirements for Marketing and Transactional Email](https://luxsci.com/blog/infrastructure-requirements-for-marketing-and-transactional-email.html) -- Tor Project blog - - [Volunteer as an alpha tester](https://blog.torproject.org/vounteer-as-an-alpha-tester/) -- TorrentFreak - - [Publishers & Internet Archive Both Seek Piracy Lawsuit Win Without Full Trial](https://torrentfreak.com/publishers-internet-archive-both-seek-piracy-lawsuit-win-without-full-trial-220614/) - - [YouTube and Facebook Are the Top ‘Pirate Sites’ in Denmark](https://torrentfreak.com/youtube-and-facebook-are-the-top-pirate-sites-in-denmark-220614/) -- Krebs on Security - - [Ransomware Group Debuts Searchable Victim Data](https://krebsonsecurity.com/2022/06/ransomware-group-debuts-searchable-victim-data/) - - [“Downthem” DDoS-for-Hire Boss Gets 2 Years in Prison](https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-boss-gets-2-years-in-prison/) -- Have I Been Pwned latest breaches - - [DivX SubTitles - 783,058 breached accounts](https://haveibeenpwned.com/PwnedWebsites#DivXSubTitles) -- /r/netsec - Information Security News & Discussion - - [What if you don't secure SSH on EC2? - Analysis of the real threats](https://www.reddit.com/r/netsec/comments/vc5zeg/what_if_you_dont_secure_ssh_on_ec2_analysis_of/) - - [Hertzbleed - a new family of side-channel attacks](https://www.reddit.com/r/netsec/comments/vcba4z/hertzbleed_a_new_family_of_sidechannel_attacks/) - - [If you want to play with Dogwalk windows vulnerability](https://www.reddit.com/r/netsec/comments/vc4m59/if_you_want_to_play_with_dogwalk_windows/) - - [Quick Malware Analysis: Emotet Epoch 5 infection with spambot traffic pcap from 2022-04-04](https://www.reddit.com/r/netsec/comments/vc3utl/quick_malware_analysis_emotet_epoch_5_infection/) - - [Oblivious HTTP](https://www.reddit.com/r/netsec/comments/vc9bt7/oblivious_http/) - - [CVE-2022-25845 – Analyzing the Fastjson “Auto Type Bypass” RCE vulnerability](https://www.reddit.com/r/netsec/comments/vc6a3p/cve202225845_analyzing_the_fastjson_auto_type/) - - [Credential Protection in Chromium-based Browsers](https://www.reddit.com/r/netsec/comments/vc54d8/credential_protection_in_chromiumbased_browsers/) - - [Zimbra Email - Stealing Clear-Text Credentials via Memcache injection](https://www.reddit.com/r/netsec/comments/vc77h9/zimbra_email_stealing_cleartext_credentials_via/) - - [Chaining vulnerabilities to criticality in Progress WhatsUp Gold](https://www.reddit.com/r/netsec/comments/vc5e79/chaining_vulnerabilities_to_criticality_in/) -- 字节跳动安全中心 - - [让你单日收入16w+的活动，又来啦！！](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247488792&idx=1&sn=9db7673e031f80ba84caa28ed3f8f66d&chksm=fa9eee4ecde967588946b8d216dd36371dd47b7db376b1afa485db0ea2bc7d3df581707772fb&scene=58&subscene=0#rd) -- Instapaper: Unread - - [Cellebrite CTF 2022 - Marsha's iPhone](https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-marshas-iphone.html) - - [The importance of fully charged devices in your digital forensic investigation](https://belkasoft.com/importance_of_fully_charged_devices) - - [How China Hacked US Phone Networks](https://www.wired.com/story/china-hacking-phone-network-security-roundup/) - - [Your browser stores passwords and sensitive data in clear text in memory](https://www.ghacks.net/2022/06/12/your-browser-stores-passwords-and-sensitive-data-in-clear-text-in-memory/) - - [New msgstore – Who ‘Dis A Look At An Updated WhatsApp On Android](https://thebinaryhick.blog/2022/06/09/new-msgstore-who-dis-a-look-at-an-updated-whatsapp-on-android/) - - [Preparing for an Advanced Cyber Battlefield The Digital Forensics for National Security Symposium](https://www.forensicfocus.com/event-info/preparing-for-an-advanced-cyber-battlefield-the-digital-forensics-for-national-security-symposium/) - - [MIT researchers find new hardware vulnerability in the Apple M1 chip](https://www-therecord.recfut.com/mit-researchers-find-new-hardware-vulnerability-in-the-apple-m1-chip/) - - [Using WiFi connection probe requests to track users](https://securityaffairs.co/wordpress/132193/mobile-2/wifi-probe-requests-track-users.html) -- Threatpost - - [Kaiser Permanente Exposes Nearly 70K Medical Records in Data Breach](https://threatpost.com/kaiser-permanente-breach/179949/) - - [Linux Malware Deemed ‘Nearly Impossible’ to Detect](https://threatpost.com/linux-malware-impossible-detect/179944/) -- CNCERT风险评估 - - [关于Mirai变种Miori僵尸网络大规模传播的风险提示](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496763&idx=1&sn=f53b75a0440a39d5036c05bd85523350&chksm=973ac759a04d4e4ff04de37be0dfcbe178b7b94bda88cc4d83128b91e1c094c5ca34f3e4ba7e&scene=58&subscene=0#rd) - - [CNVD漏洞周报2022年第23期](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496763&idx=2&sn=8f1c78df98ebbff7b41bfa7d027c1ac9&chksm=973ac759a04d4e4ff8e7d445aca633c1ff5fd7bb536e1c1a294ff0a2665199b95edd4574ac30&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220606-20220612)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496763&idx=3&sn=a186020c19626529c2a5365485d4f085&chksm=973ac759a04d4e4f3f932b49cc69d0731998eff83514101a71026eb4c149dd856de1c973c3a3&scene=58&subscene=0#rd) - - [每周移动恶意程序传播渠道安全监测报告（2022年06月06日—2022年06月12日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496763&idx=4&sn=1f04abcc403d6bb0694db4540d34c826&chksm=973ac759a04d4e4f0167ba1741c9f434f6648dc667915cf7ededcf546f90883a97f26cefb09d&scene=58&subscene=0#rd) -- The Register - Security - - [Cloudflare says it thwarted record-breaking HTTPS DDoS flood](https://go.theregister.com/feed/www.theregister.com/2022/06/14/cloudflare-record-ddos-attack/) - - [Man gets two years in prison for selling 200,000 DDoS hits](https://go.theregister.com/feed/www.theregister.com/2022/06/14/man-sentenced-ddos-attacks/) - - [Azure issues not adequately fixed for months, complain bug hunters](https://go.theregister.com/feed/www.theregister.com/2022/06/14/security_azure_patch/) - - [UK health privacy watchdog still in talks over who is accessing country's COVID data store](https://go.theregister.com/feed/www.theregister.com/2022/06/14/ndg_covid_data_store/) - - [Inside the RSAC expo: Buzzword bingo and the bear in the room](https://go.theregister.com/feed/www.theregister.com/2022/06/14/rsa_2020/) - - [Chinese-sponsored gang Gallium upgrades to sneaky PingPull RAT](https://go.theregister.com/feed/www.theregister.com/2022/06/14/gallium-pingpull-rat/) -- SANS Internet Storm Center, InfoCON: green - - [Microsoft June 2022 Patch Tuesday, (Tue, Jun 14th)](https://isc.sans.edu/diary/rss/28742) - - [ISC Stormcast For Tuesday, June 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=8048, (Tue, Jun 14th)](https://isc.sans.edu/diary/rss/28740) -- KitPloit - PenTest Tools! - - [Gshell - A Flexible And Scalable Cross-Plaform Shell Generator Tool](http://www.kitploit.com/2022/06/gshell-flexible-and-scalable-cross.html) - - [Goreplay - Open-Source Tool For Capturing And Replaying Live HTTP Traffic Into A Test Environment In Order To Continuously Test Your System With Real Data](http://www.kitploit.com/2022/06/goreplay-open-source-tool-for-capturing.html) -- 字节跳动技术团队 - - [从单机到分布式数据库存储系统的演进](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494798&idx=1&sn=a3862b4c38c02fac7ba866c90116d8c0&chksm=e9d3276cdea4ae7ad099d77ffbd97cfa576c399ba2e0095dd85eab673d50a50171acff4abfa0&scene=58&subscene=0#rd) - - [报名围观丨安全范儿沙龙带你学习甲方视角下的安全运营](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247494798&idx=2&sn=62b5aea9b4e292bf40fd47d93e42f506&chksm=e9d3276cdea4ae7aaca2898402fae228a74718c6d846572b2f08156576f75f28653b14730a22&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [Anyone run scans at an AirBnb they are staying at to see if there are any red flags? If so, have you discovered any?](https://www.reddit.com/r/HowToHack/comments/vcan15/anyone_run_scans_at_an_airbnb_they_are_staying_at/) - - [How hard is it to track threatening emails?](https://www.reddit.com/r/HowToHack/comments/vc9k4v/how_hard_is_it_to_track_threatening_emails/) -- 青藤云安全 - - [先睹为快 | 卓越示范中心ETB003云原生安全实验测试床](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650835031&idx=1&sn=4b906ecd59b8302441a0942555a20846&chksm=80dbebf2b7ac62e4d45eb82ce5aec9b522d23f3ee4bb7c2ea689cc8daf6109c0003b093c12f6&scene=58&subscene=0#rd) -- Security Affairs - - [A flaw in Zimbra email suite allows stealing login credentials of the users](https://securityaffairs.co/wordpress/132269/hacking/zimbra-email-suite-flaw.html) - - [API Security Best Practices](https://securityaffairs.co/wordpress/132244/security/api-security-best-practices.html) - - [SeaFlower campaign distributes backdoored versions of Web3 wallets to steal seed phrases](https://securityaffairs.co/wordpress/132250/cyber-crime/seaflower-malware-campaign.html) - - [Experts spotted Syslogk, a Linux rootkit under development](https://securityaffairs.co/wordpress/132232/malware/syslogk-linux-rootkit.html) -- NetSPI - - [Important Trends Among Masked Identities](https://www.netspi.com/blog/executive/network-security/important-trends-among-masked-identities/) -- 关键基础设施安全应急响应中心 - - [从零信任技术角度探索数据安全的新思路](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527332&idx=1&sn=1ea95782407e1535d0236b479fea85ac&chksm=c1e9e7f5f69e6ee37aec91feb9a49ce52fa7007eaf888fab42cae02ae7bda95ef5aa3ab2fe7f&scene=58&subscene=0#rd) - - [从数据利用视角探讨数据出境安全问题](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527332&idx=2&sn=1b4a4dfbc8b8cc9221c561708c8129ff&chksm=c1e9e7f5f69e6ee3f22ba8c4b56fae63fce2f78e35c2850bdbf64a995bcafe746f337d8d54c6&scene=58&subscene=0#rd) - - [CISA公布新漏洞，可以远程解锁任意门锁](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527332&idx=3&sn=b6f0ef5db53ab44fd2637a3681efcb51&chksm=c1e9e7f5f69e6ee33063bceb3223964f66ce3ba7fc0e65b6267f048caad8fad60bf803b58eb7&scene=58&subscene=0#rd) -- Securityinfo.it - - [Cybersicurezza per gli edifici smart](https://www.securityinfo.it/2022/06/14/cybersicurezza-per-gli-edifici-smart/?utm_source=rss&utm_medium=rss&utm_campaign=cybersicurezza-per-gli-edifici-smart) - - [Backdoor in pacchetti di PyPI](https://www.securityinfo.it/2022/06/14/backdoor-in-pacchetti-di-pypi/?utm_source=rss&utm_medium=rss&utm_campaign=backdoor-in-pacchetti-di-pypi) -- Full Disclosure - - [SEC Consult SA-20220614-0 :: Reflected Cross Site Scripting in SIEMENS-SINEMA Remote Connect](https://seclists.org/fulldisclosure/2022/Jun/35) -- M01NTeam - - [攻防战队王者攻略 | 从菜鸟到大佬](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247488321&idx=1&sn=81c35b76693ad53ad24c5348efe83df9&chksm=c187d350f6f05a461d512b9e8a4ea8152369904ea74df2285dbb19e3b478d716f8f601622390&scene=58&subscene=0#rd) -- Computer Forensics - - [Windows Subsystem for Linux](https://www.reddit.com/r/computerforensics/comments/vcefdq/windows_subsystem_for_linux/) - - [Entry level Certification recommendations](https://www.reddit.com/r/computerforensics/comments/vcdckj/entry_level_certification_recommendations/) - - [Passware On T2 macboo air help.](https://www.reddit.com/r/computerforensics/comments/vc898o/passware_on_t2_macboo_air_help/) - - [Volatility2 RHEL 8 profile](https://www.reddit.com/r/computerforensics/comments/vc6btx/volatility2_rhel_8_profile/) - - [Locked Cellphone](https://www.reddit.com/r/computerforensics/comments/vc7e4k/locked_cellphone/) -- KCon黑客大会 - - [【余额不足提醒】KCon 2022 议题大众评选时间仅剩2天！](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651134666&idx=1&sn=02cecc20ba2aa343e572c8ba420d848c&chksm=f2c11baac5b692bc26c0526854c75f589e31f1e8bff615157854be1a3c0b8e9c7bfe43dd59bc&scene=58&subscene=0#rd) -- 锦行信息安全 - - [【漏洞预警】PHP远程代码执行](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489844&idx=1&sn=a09c6bf3e96a5f5810e18ed8a2821350&chksm=9799e291a0ee6b87fb7e7c7d08699288d6a2f83d9bf007857ae091b22d15e3ecf54684cd493e&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报秘笈】间谍技术内部人士指南](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505909&idx=1&sn=d4e9756524e025605d0d59085e0d1acc&chksm=8716acfeb06125e85667f8d29f53dc4eca031f6d028fde7753875fb6a8e1c31a39c45f1ee36e&scene=58&subscene=0#rd) - - [电子和防空武器：在特种作战中打击无人机](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505909&idx=2&sn=3898cebc22e03936ab22366d2ca4af44&chksm=8716acfeb06125e81842c93ca03a90af0ef52f0c25ccbd3d6fc0039596b50e11061eebc48531&scene=58&subscene=0#rd) - - [开源情报工具——ItaMilRadar](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650505909&idx=3&sn=363eed65042141a446573590971e7e49&chksm=8716acfeb06125e8116bcb9ae0c5703d9079d7711a75579b390de6bab6af22dea61e3efde6c5&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [响尾蛇（APT-Q-39）利用Google Play传播的恶意Android软件分析](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247501516&idx=1&sn=c589254023f5ae93da7be53754610de8&chksm=ea6631bbdd11b8ad7da1a46f74af1d8a2a853675b459d60855bd1e95776001f3fd6f458c2a5e&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-14)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958506&idx=1&sn=ca6fe7186d02ac80501b4bf3c64b8e8f&chksm=8baecc75bcd9456330b9b149b7b1408029e0d5159f978aa1d5628749d31ea7384c589136837c&scene=58&subscene=0#rd) -- 安全牛 - - [常用恶意软件分析方法及工具汇总](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114594&idx=1&sn=819f27f284a60138cb3d42e5513e8b96&chksm=bd147cb18a63f5a7a824a39fd007642b521e86e08b3c58de04585882bb0f653b70efd2bac59f&scene=58&subscene=0#rd) - - [《网上银行系统信息安全通用规范》技术解读](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114594&idx=2&sn=4ba057b09cb51ff0a636a74d0ebc6360&chksm=bd147cb18a63f5a74838aea06cd5251d770b7217583c4d686c8d530708a0b2f50005eb9c5ffc&scene=58&subscene=0#rd) - - [“互联网+政务服务”下的数据安全治理](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114594&idx=3&sn=dee4459eab1f9e0720294284688c93d5&chksm=bd147cb18a63f5a77ed3a1a920c34ad44348a47a36d7cb9d6e71e783c8a128da0f86a6e24474&scene=58&subscene=0#rd) -- 数世咨询 - - [第二届数字安全大会：13位重量级安全大咖解读数字安全](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493776&idx=1&sn=6cc7eea1918ff4431c7e6dd438c8ed74&chksm=c1449a2df633133b8a55dc5fe8fed6c2563ce652f29ecd26c13d80a27997cdae88316091b3f0&scene=58&subscene=0#rd) - - [乌克兰秘密网络防御挫败俄罗斯网络攻击](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493776&idx=2&sn=252d2f952a281d5997a80588e62b8d5c&chksm=c1449a2df633133bed375bb99af232206a8c7408d2ed361950158eefd7e105419a7a0f7b887c&scene=58&subscene=0#rd) -- 星阑科技 - - [喜讯｜星阑科技CEO王郁荣获“中关村创业之星”](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493581&idx=1&sn=30f1f4f3783ff0f64666cb9340232d1b&chksm=c0074a51f770c3477c9686b426515dfd0f801ff46130eec7002458b4c0129e37e68c968abdbc&scene=58&subscene=0#rd) -- Secureworks Blog - - [XDR vs SOAR: Finding the Right Tool for the Job](https://www.secureworks.com/blog/xdr-vs-soar-finding-the-right-tool-for-the-job) -- 安全客 - - [直击RSAC 2022：如何综合评估威胁情报指标](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771972&idx=1&sn=13b6227b87926b6ccf398f674cc297de&chksm=88937fabbfe4f6bdd418125d621df139fe2023477c62c0678e0fc7b708dc07c352b329dfbc4d&scene=58&subscene=0#rd) - - [【安全头条】PyPI包keep意外引入密码窃取模块](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771972&idx=2&sn=48433262488e3982f3cefe01825a65a1&chksm=88937fabbfe4f6bd8caa38ad80eca35146d49c63072a92ccc95e633fec4625b8e88cc2c231dd&scene=58&subscene=0#rd) - - [直击RSAC 2022：ISAC在加强网络安全监管环境中的关键作用](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771972&idx=3&sn=657baaa29be68f3368ceee79d91bc990&chksm=88937fabbfe4f6bdd68d2794908087ddbbd3b452db1a7c266246a99eeacca9bc0f32b6fead61&scene=58&subscene=0#rd) - - [【技术分享】工控安全入门（四）—— DNP3协议](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649771972&idx=4&sn=11b05a686402af64a086654f117ed44c&chksm=88937fabbfe4f6bdbc8b15f691bd26a97c4eff12f6fb8b6f4750f785637631e4e516c83773f7&scene=58&subscene=0#rd) -- Social Engineering - - [What's the best approach when discussing incorrect pay for the last 10 years?](https://www.reddit.com/r/SocialEngineering/comments/vc1wyu/whats_the_best_approach_when_discussing_incorrect/) - - [Tips to improve myself](https://www.reddit.com/r/SocialEngineering/comments/vc6xci/tips_to_improve_myself/) - - [What other social engineering CTFs are there besides the Collegiate one and DEFCON’s old SECTF? I can’t seem to find other ones.](https://www.reddit.com/r/SocialEngineering/comments/vce726/what_other_social_engineering_ctfs_are_there/) -- Dark Reading - - [In Case You Missed RSA Conference 2022: A News Digest](https://www.darkreading.com/threat-intelligence/in-case-you-missed-it-what-went-down-at-rsa-conference-2022) - - [Microsoft Patches 'Follina' Zero-Day Flaw in Monthly Security Update](https://www.darkreading.com/vulnerabilities-threats/microsoft-june-security-update-includes-patch-for-follina-zero-day-flaw) - - [DDoS Subscription Service Operator Gets 2 Years in Prison](https://www.darkreading.com/attacks-breaches/operator-of-ddos-attack-subscription-service-gets-2-years-in-prison) - - [Quantifying the SaaS Supply Chain and Its Risks](https://www.darkreading.com/tech-trends/quantifying-the-saas-supply-chain-and-its-risks) - - [Incognia Introduces Location-Based Liveness Spoofing Detection Solution](https://www.darkreading.com/risk/incognia-introduces-location-based-liveness-spoofing-detection-solution) - - [Google: SBOMs Effective Only if They Map to Known Vulns](https://www.darkreading.com/vulnerabilities-threats/sboms-only-effective-if-they-map-to-known-flaws) - - [Chinese Threat Actor Employs Fake Removable Devices as Lures in Cyber-Espionage Campaign](https://www.darkreading.com/attacks-breaches/chinese-threat-actor-employs-fake-removable-devices-as-lures-in-cyber-espionage-campaign) - - [How Can Security Partnerships Help to Mitigate the Increasing Cyber Threat?](https://www.darkreading.com/physical-security/how-can-security-partnerships-help-to-mitigate-the-increasing-cyber-threat-) - - [Optiv MXDR Enhances Detection Coverage With Expanded Cloud Integration](https://www.darkreading.com/cloud/optiv-mxdr-enhances-detection-coverage-with-expanded-cloud-integration) - - [Beware the 'Secret Agent' Cloud Middleware](https://www.darkreading.com/cloud/beware-the-secret-agent-cloud-middleware) - - [Understanding and Mitigating Single Sign-on Risk](https://www.darkreading.com/endpoint/understanding-and-mitigating-single-sign-on-risk) -- KitPloit - PenTest & Hacking Tools - - [Gshell - A Flexible And Scalable Cross-Plaform Shell Generator Tool](http://www.kitploit.com/2022/06/gshell-flexible-and-scalable-cross.html) - - [Goreplay - Open-Source Tool For Capturing And Replaying Live HTTP Traffic Into A Test Environment In Order To Continuously Test Your System With Real Data](http://www.kitploit.com/2022/06/goreplay-open-source-tool-for-capturing.html) -- 云鼎实验室 - - [首批 | 腾讯云完成国内首个云原生安全成熟度评估](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494493&idx=1&sn=4e11dd517d8194bc314430c6ec7066a2&chksm=fd7917dbca0e9ecd8efa1b5ca95a6af02f1e153be401e0c3f1490ce44ec3fc05c4a01026f3d8&scene=58&subscene=0#rd) -- 看雪学院 - - [看雪2022 KCTF春季赛完美收官！排名揭晓](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452356&idx=1&sn=630b993cc1e17c80f8487fd5fd42b0dc&chksm=b18e310e86f9b818eec3b2ca843b171f5e10d444298abe074e1d678ea68bd71c8879e77a9c8f&scene=58&subscene=0#rd) - - [万字长文详解CVE-2014-1767提权漏洞分析与利用（x86x64）](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452356&idx=2&sn=013a06dec954773a9b481bc28ab06cf9&chksm=b18e310e86f9b818d0907e714c43d0d7adf60733714ef32d144bea0edfecbef268a5f148bac5&scene=58&subscene=0#rd) - - [谷歌修复四个高风险chrome浏览器漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452356&idx=3&sn=333cb10507c25556639cd25558d125a7&chksm=b18e310e86f9b818b7d06aa10579ebb4283620fdac9472add2a8e2cc088b3f9f4a61e52513a5&scene=58&subscene=0#rd) - - [怎样才能学好LLVM与代码混淆技术？](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452356&idx=4&sn=e2e0b5ca6b27bb5953ae38c73fb66b7a&chksm=b18e310e86f9b818b800d3334a0ab8934c1850881c0acde3ca5efab5269de2607eabd4dd2613&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-06-16.md b/archive/2022/2022-06-16.md deleted file mode 100644 index 41fd544864..0000000000 --- a/archive/2022/2022-06-16.md +++ /dev/null @@ -1,263 +0,0 @@ -# 每日安全资讯（2022-06-16） - -- HackerOne Hacker Activity - - [Rate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact)](https://hackerone.com/reports/1578121) - - [Delete direct message history without access the proper conversation_id](https://hackerone.com/reports/1487804) - - [Remote 0click exfiltration of Safari user's IP address](https://hackerone.com/reports/1392211) - - [The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more su](https://hackerone.com/reports/1591504) - - [Golang : Add Query To Detect PAM Authorization Bugs](https://hackerone.com/reports/1597437) - - [Golang : Hardcoded secret used for signing JWT](https://hackerone.com/reports/1595009) - - [CPP: Add query for CWE-243 Creation of chroot Jail Without Changing Working Directory](https://hackerone.com/reports/1582697) - - [Hyper Link Injection while signup](https://hackerone.com/reports/1166073) -- Sec-News 安全文摘 - - [CVE-2022-25845 – Analyzing the Fastjson “Auto Type Bypass” RCE vulnerability](https://wiki.ioin.in/url/9N3l) -- Microsoft Security Blog - - [Why strong security solutions are critical to privacy protection](https://www.microsoft.com/security/blog/2022/06/15/why-strong-security-solutions-are-critical-to-privacy-protection/) -- Trustwave Blog - - [Now is the time to Partner With Trustwave MDR](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/now-is-the-time-to-partner-with-trustwave-mdr/) -- Sploitus.com Exploits RSS Feed - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=6AF23F99-AE40-5899-AD81-AE3F71760F38&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-30023 exploit](https://sploitus.com/exploit?id=A94BAED2-ECA6-5A42-BDEB-B67BE67FCAFF&utm_source=rss&utm_medium=rss) -- Envato Tuts+ Code - Mobile Development - - [16 Best React Native App Templates of 2022 (+3 Free)](https://code.tutsplus.com/articles/best-react-native-app-templates--cms-29602) -- 绿盟科技技术博客 - - [洞见RSA2022 | 守护5G终端隐私](http://blog.nsfocus.net/rsa2022-5g/) - - [洞见RSA2022 | 网络安全网格架构（CSMA）分析](http://blog.nsfocus.net/rsa2022-csma/) - - [CyberBattleSim（内网自动化渗透）研究分析](http://blog.nsfocus.net/cyber-battlesim/) -- paper - Last paper - - [下一代 Windows 漏洞利用：攻击通用日志文件系统](https://paper.seebug.org/1920/) - - [Adobe Reader 漏洞 CVE-2021-44711 利用浅析](https://paper.seebug.org/1919/) - - [机架式设备漏洞挖掘](https://paper.seebug.org/1918/) - - [Math.abs JIT Optimization Bug in JSC](https://paper.seebug.org/1917/) - - [USMA:用户态映射攻击](https://paper.seebug.org/1916/) -- Security Boulevard - - [Koverse Unveils Zero-Trust Platform for Managing Data](https://securityboulevard.com/2022/06/koverse-unveils-zero-trust-platform-for-managing-data/) - - [Slack for Security – How to Make Security Announcements in Slack](https://securityboulevard.com/2022/06/slack-for-security-how-to-make-security-announcements-in-slack/) - - [What’s happening with Java? A discussion with the LJC](https://securityboulevard.com/2022/06/whats-happening-with-java-a-discussion-with-the-ljc/) - - [Journey to the Median](https://securityboulevard.com/2022/06/journey-to-the-median/) - - [The Biggest Takeaway from the 2022 Verizon DBIR](https://securityboulevard.com/2022/06/the-biggest-takeaway-from-the-2022-verizon-dbir/) - - [BSides:Munich 2022 – Steffen Ullrich’s ‘MIME Is Broken’](https://securityboulevard.com/2022/06/bsidesmunich-2022-steffen-ullrichs-mime-is-broken/) - - [Phishing in the Metaverse: The New Reality of Brand Protection](https://securityboulevard.com/2022/06/phishing-in-the-metaverse-the-new-reality-of-brand-protection/) - - [Account Takeover Prevention: Bad Habits That Make You More Vulnerable to ATO Fraud](https://securityboulevard.com/2022/06/account-takeover-prevention-bad-habits-that-make-you-more-vulnerable-to-ato-fraud/) - - [Joy Of Tech© ‘Together Time’](https://securityboulevard.com/2022/06/joy-of-tech-together-time/) - - [How Risk Management Increases MSSP Value to Customers](https://securityboulevard.com/2022/06/how-risk-management-increases-mssp-value-to-customers/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 尼日利亚制定草案监管互联网公司；谷歌修复 7 个 Chrome 浏览器漏洞](https://www.freebuf.com/news/336328.html) - - [恶意软件竟被上架谷歌商店，下载次数甚至超200万次](https://www.freebuf.com/news/336280.html) - - [勒索又玩新花样，让受害者主动查询数据是否被盗](https://www.freebuf.com/news/336265.html) - - [《移动互联网应用程序信息服务管理规定》将于8月1日施行](https://www.freebuf.com/news/336254.html) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [New Qualys Research Report: Inside a Redline InfoStealer Campaign](https://blog.qualys.com/category/vulnerabilities-threat-research) -- 安全客-有思想的安全新媒体 - - [主机安全技术剖析-手把手教会你防御Java内存马](https://www.anquanke.com/post/id/274443) - - [WEB3 安全系列 || 盗取数字资产的方式，看看你是否中招？](https://www.anquanke.com/post/id/274208) - - [ServerLess Aws Lambda攻击方法研究的副本](https://www.anquanke.com/post/id/274143) - - [Kaiser Permanente数据泄露影响7万人](https://www.anquanke.com/post/id/274404) -- Didier Stevens - - [New Tool: dns-query-async.py](https://blog.didierstevens.com/2022/06/15/new-tool-dns-query-async-py/) -- Marco Ramilli Web Corner - - [Running Shellcode Through Windows Callbacks](https://marcoramilli.com/2022/06/15/running-shellcode-through-windows-callbacks/) -- Malwarebytes Labs - - [Stealthy Symbiote Linux malware is after financial institutions](https://blog.malwarebytes.com/reports/2022/06/stealthy-symbiote-linux-malware-is-after-financial-institutions/) - - [Record breaking HTTPS DDoS attack](https://blog.malwarebytes.com/cybercrime/2022/06/record-breaking-https-ddos-attack/) - - [Firefox stops advertisers tracking you as you browse, calls itself the most “private and secure major browser”](https://blog.malwarebytes.com/privacy-2/2022/06/firefox-stops-advertisers-tracking-you-as-you-browse-calls-itself-the-most-private-and-secure-major-browser/) - - [Update now!  Microsoft patches Follina, and many other security updates](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/update-now-microsoft-patches-follina-and-many-other-security-updates/) - - [It’s official, today you can say goodbye to Internet Explorer. Or can you?](https://blog.malwarebytes.com/reports/2022/06/its-official-today-you-can-say-goodbye-to-internet-explorer-or-can-you/) - - [Email compromise leads to healthcare data breach at Kaiser Permanente](https://blog.malwarebytes.com/cybercrime/2022/06/email-compromise-leads-to-healthcare-data-breach-at-kaiser-permanente/) -- Reverse Engineering - - [Breaking Secure Boot on Google Nest Hub (2nd Gen) to run Ubuntu](https://www.reddit.com/r/ReverseEngineering/comments/vcv731/breaking_secure_boot_on_google_nest_hub_2nd_gen/) - - [Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup](https://www.reddit.com/r/ReverseEngineering/comments/vcnlkg/pwn2own_2021_canon_imageclass_mf644cdw_writeup/) - - [Pulling MikroTik into the Limelight](https://www.reddit.com/r/ReverseEngineering/comments/vd3nqw/pulling_mikrotik_into_the_limelight/) -- blog.avast.com EN - - [Lottery scams: Don’t be fooled](https://blog.avast.com/lottery-scams) -- SentinelOne - - [Research Paper | Emulating Phineas Phisher Attacks in Modern EDR Environments](https://www.sentinelone.com/blog/research-paper-emulating-phineas-phisher-attacks-in-modern-edr-environments/) -- Securelist - - [How much does access to corporate infrastructure cost?](https://securelist.com/initial-access-data-price-on-the-dark-web/106740/) -- Intigriti - - [Bug Bytes #174 – From $0 bounties to $150k, Hacker summer school & How to hack Apache Pinot](https://blog.intigriti.com/2022/06/15/bug-bytes-174-from-0-bounties-to-150k-hacker-summer-school-how-to-hack-apache-pinot/) -- Geek Freak - - [AWS Misconfigurations](https://dhiyaneshgeek.github.io/cloud/security/2022/06/15/aws-misconfigurations/) -- The Daily Swig | Cybersecurity news and views - - [Dark web awash with breached credentials, study finds](https://portswigger.net/daily-swig/dark-web-awash-with-breached-credentials-study-finds) - - [Security researcher receives legal threat over patched Powertek data center vulnerabilities](https://portswigger.net/daily-swig/security-researcher-receives-legal-threat-over-patched-powertek-data-center-vulnerabilities) - - [Data breach at US ambulance billing service Comstar exposed patients’ healthcare information](https://portswigger.net/daily-swig/data-breach-at-us-ambulance-billing-service-comstar-exposed-patients-healthcare-information) -- text/plain - - [Chromium Startup](https://textslashplain.com/2022/06/15/chromium-startup/) -- 奇客Solidot–传递最新科技情报 - - [让 Pornhub 为内容承担责任的女性](https://www.solidot.org/story?sid=71843) - - [日本制定法律惩罚网络侮辱](https://www.solidot.org/story?sid=71842) - - [中国天眼发现地外文明候选信号](https://www.solidot.org/story?sid=71841) - - [三星电视机被发现会针对测试作弊](https://www.solidot.org/story?sid=71840) - - [科技巨头的 AR 梦醒](https://www.solidot.org/story?sid=71839) - - [首款成本低于 1 便士的高产量塑料处理器](https://www.solidot.org/story?sid=71838) - - [大脑“节能模式”会削弱我们的感官](https://www.solidot.org/story?sid=71837) - - [甲骨文数据库的地位正被云优先的竞争对手侵蚀？](https://www.solidot.org/story?sid=71836) - - [基因狗仔队即将出现](https://www.solidot.org/story?sid=71835) - - [抗生素抗性基因通过土壤食物网影响人类](https://www.solidot.org/story?sid=71834) - - [《鱿鱼游戏》将改编为真人秀奖金 456 万美元](https://www.solidot.org/story?sid=71833) - - [研究人员披露针对 x86 CPU 的旁道攻击 Hertzbleed](https://www.solidot.org/story?sid=71832) - - [Adobe 准备推出免费版的 Photoshop](https://www.solidot.org/story?sid=71831) -- Qualys Security Blog - - [New Qualys Research Report: Inside a Redline InfoStealer Campaign](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Forensic Focus - - [Granular Reporting in Oxygen Forensic Detective](https://www.forensicfocus.com/webinars/granular-reporting-in-oxygen-forensic-detective/) - - [Cyacomb announce Mike Burridge as VP of Sales for North America Expansion](https://www.forensicfocus.com/news/cyacomb-announce-mike-burridge-as-vp-of-sales-for-north-america-expansion/) -- ICT Security Magazine - - [Machine Learning, “Deep Fake” ed i rischi in un mondo iperconnesso](https://www.ictsecuritymagazine.com/articoli/machine-learning-deep-fake-ed-i-rischi-in-un-mondo-iperconnesso/) -- Securityinfo.it - - [Gruppo ransomware crea sito per i dati rubati](https://www.securityinfo.it/2022/06/15/gruppo-ransomware-crea-sito-per-i-dati-rubati/?utm_source=rss&utm_medium=rss&utm_campaign=gruppo-ransomware-crea-sito-per-i-dati-rubati) - - [Attacco DDos HTTPS record per Cloudfare](https://www.securityinfo.it/2022/06/15/attacco-ddos-https-record-per-cloudfare/?utm_source=rss&utm_medium=rss&utm_campaign=attacco-ddos-https-record-per-cloudfare) -- Securelist - - [How much does access to corporate infrastructure cost?](https://securelist.com/initial-access-data-price-on-the-dark-web/106740/) -- bellingcat - - [How Janez Janša’s Media Empire Pushed Slovenia’s Extremes into the Mainstream](https://www.bellingcat.com/news/2022/06/15/how-janez-jansas-media-empire-pushed-slovenias-extremes-into-the-mainstream%e2%80%a8%e2%80%a8/) -- SANS Internet Storm Center, InfoCON: green - - [Terraforming Honeypots. Installing DShield Sensors in the Cloud, (Wed, Jun 15th)](https://isc.sans.edu/diary/rss/28748) - - [ISC Stormcast For Wednesday, June 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=8050, (Wed, Jun 15th)](https://isc.sans.edu/diary/rss/28744) -- Schneier on Security - - [M1 Chip Vulnerability](https://www.schneier.com/blog/archives/2022/06/m1-chip-vulnerability.html) -- D3Lab - - [Phishing ai danni di Cornèr Banca](https://www.d3lab.net/phishing-ai-danni-di-corner-banca/) -- Krebs on Security - - [Microsoft Patch Tuesday, June 2022 Edition](https://krebsonsecurity.com/2022/06/microsoft-patch-tuesday-june-2022-edition/) -- Graham Cluley - - [Smashing Security podcast #279: Encrypted notes, and a deadly case of AirTag spying](https://grahamcluley.com/smashing-security-podcast-279/) - - [DDoS-for-hire service which bombarded websites with attacks earns man two years in prison](https://www.bitdefender.com/blog/hotforsecurity/ddos-for-hire-service-which-bombarded-websites-with-attacks-earns-man-two-years-in-prison/) -- Dark Reading - - [Cisco’s Ash Devata on the Future of Secure Access](https://www.darkreading.com/cloud/cisco-s-ash-devata-on-the-future-of-secure-access) - - [7 Ways to Bring AI to Cybersecurity](https://www.darkreading.com/the-cyber-future/7-ways-to-bring-ai-to-cybersecurity) - - ['Hertzbleed' Side-Channel Attack Threatens Cryptographic Keys for Servers](https://www.darkreading.com/attacks-breaches/hertzbleed-side-channel-attack-cryptographic-keys-servers) - - [Veterans Explain How Military Service Prepared Them for Cybersecurity Careers](https://www.darkreading.com/edge-articles/veterans-explain-how-military-service-prepared-them-for-cybersecurity-careers) - - [Critical Citrix Bugs Impact All ADM Servers, Agents](https://www.darkreading.com/vulnerabilities-threats/critical-citrix-bugs-impact-all-adm-servers-agents) - - [Two Platforms to Rule Them All: CNAPP and SASE](https://www.darkreading.com/cloud/two-platforms-to-rule-them-all-cnapp-and-sase) - - [Thousands Arrested in Global Raids on Social-Engineering Scammers](https://www.darkreading.com/threat-intelligence/thousands-arrested-global-raids-social-engineering-scammers) - - [How Information Security Teams Can Help Reduce Stress and Burnout](https://www.darkreading.com/careers-and-people/how-information-security-teams-can-help-reduce-stress-and-burnout) - - [Cybercriminals Capitalizing on Resurgence in Travel](https://www.darkreading.com/attacks-breaches/cybercriminals-capitalizing-on-resurgence-in-travel) - - [Wormable Panchan Peer-to-Peer Botnet Harvests Linux Server Keys](https://www.darkreading.com/vulnerabilities-threats/panchan-peer-to-peer-botnet-harvests-ssh-keys) - - [Why We Need Security Knowledge and Not Just Threat Intel](https://www.darkreading.com/threat-intelligence/why-we-need-security-knowledge-and-not-just-threat-intel) - - [24+ Billion Credentials Circulating on the Dark Web in 2022 — So Far](https://www.darkreading.com/vulnerabilities-threats/24-billion-credentials-circulate-dark-web-2022) -- TorrentFreak - - [Canadian Judge: Movie Company’s Piracy Evidence Just Not Good Enough](https://torrentfreak.com/canadian-judge-movie-companys-piracy-evidence-not-good-enough-220615/) - - [Ghost Piracy: Work-From-Home Software Piracy Worries BSA](https://torrentfreak.com/ghost-piracy-work-from-home-software-piracy-worries-bsa-220615/) -- The Register - Security - - [Heineken says there’s no free beer, warns of phishing scam](https://go.theregister.com/feed/www.theregister.com/2022/06/15/heineken_phishing_scam/) - - [Microsoft continues cyber security spending spree with Miburo buy](https://go.theregister.com/feed/www.theregister.com/2022/06/15/miburo/) - - [Malaysia-linked DragonForce hacktivists attack Indian targets](https://go.theregister.com/feed/www.theregister.com/2022/06/15/dragonforce_malaysia_india_attacks/) - - [Unpatched Exchange server, stolen RDP logins... How miscreants get BlackCat ransomware on your network](https://go.theregister.com/feed/www.theregister.com/2022/06/15/blackcat-ransomware-microsoft/) - - [Microsoft fixes under-attack Windows zero-day Follina](https://go.theregister.com/feed/www.theregister.com/2022/06/15/microsoft_patch_tuesday/) - - [Former US state agency CIO, IT exec plead guilty to bribery and extortion scheme](https://go.theregister.com/feed/www.theregister.com/2022/06/15/maryland_bribery_extortion_charges/) -- Security Affairs - - [Hertzbleed Side-Channel Attack allows to remotely steal encryption keys from AMD and Intel chips](https://securityaffairs.co/wordpress/132316/hacking/hertzbleed-side-channel-attack-allows-to-remotely-steal-encryption-keys-from-amd-and-intel-chips.html) - - [A critical flaw in Citrix Application Delivery Management allows resetting admin passwords](https://securityaffairs.co/wordpress/132299/security/citrix-application-delivery-management-flaw.html) - - [Panchan Golang P2P botnet targeting Linux servers in cryptomining campaign](https://securityaffairs.co/wordpress/132290/cyber-crime/panchan-p2p-botnet.html) - - [Let’s give a look at the Dark Web Price Index 2022](https://securityaffairs.co/wordpress/132256/deep-web/dark-web-index-2022.html) -- Computer Forensics - - [RAM acquisitions are extremely useful, but not often collected. This video shows how to speed up suspect password cracking with wordlists generated from RAM.](https://www.reddit.com/r/computerforensics/comments/vcyha1/ram_acquisitions_are_extremely_useful_but_not/) - - [Practical Network Penetration Free Live Course](https://www.reddit.com/r/computerforensics/comments/vczbye/practical_network_penetration_free_live_course/) -- 火线Zone - - [APISIX 安全评估](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495573&idx=1&sn=1d4b7327a43c3c63212d466aef06130d&chksm=eaa967b5dddeeea37569e53a7216db24785a4e92ba2ab8e6c2c721d117fb3e5daad3da469393&scene=58&subscene=0#rd) -- 阿里安全响应中心 - - [钉钉高危/严重漏洞双倍奖励活动](https://mp.weixin.qq.com/s?__biz=MzIxMjEwNTc4NA==&mid=2652992694&idx=1&sn=2f500d1eff1e6203b8597f0e95abc1f1&chksm=8c9efbe1bbe972f7cfbf8332a5db22d25816a2b1407b5d351aaccc126958fe0ee717dc46508b&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [第三届HCON倒计时1天](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493986&idx=1&sn=88feee3f6160f7a38e70760dec36d1bc&chksm=fa523cdccd25b5ca500fb625861f12afb94a4a9a147660bf27159b96d023155e439485d54966&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [最新公告 | 新修订《移动互联网应用程序信息服务管理规定》8月1日起施行](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247490631&idx=1&sn=9374c68745b26c6a597abd4c152396c6&chksm=feb59d54c9c21442e2127e239c5f48f25cb8ee0d948bc0ba89f88548da71d096405266869b21&scene=58&subscene=0#rd) -- Threatpost - - [DragonForce Gang Unleash Hacks Against Govt. of India](https://threatpost.com/hackers-india-government/179968/) - - [Travel-related Cybercrime Takes Off as Industry Rebounds](https://threatpost.com/travel-related-cybercrime-takes-off/179962/) - - [In Cybersecurity, What You Can’t See Can Hurt You](https://threatpost.com/cybersecurity-cant-see-can-hurt-you/179954/) -- Deeplinks - - [Stop This California Bill that Bans Affordable Broadband Rules](https://www.eff.org/deeplinks/2022/06/stop-california-bill-bans-affordable-broadband-rules) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于微软6月补丁日多个产品高危漏洞风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495567&idx=1&sn=6783d3100e5c485bcbf8c1ba86f53696&chksm=ce96a2b1f9e12ba74b9495067cafda43bf50bc0e7fdd1334d6116bffc9daaa16f967bbfd8a84&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Jun. 15th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495567&idx=2&sn=a597d8449e448ea843d055ebaaa6ebe2&chksm=ce96a2b1f9e12ba7a633d2a3d1336355bf8dc9cb1571435f3aa783fb964e63ea37cd7187e178&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [Microsoft发布2022年6月安全更新](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491863&idx=1&sn=16d667a0fefbbe52d4851ec6fba832e7&chksm=fd74d1deca0358c845319f45dd5e7878eb16c7d79b1f30946fc5f0bb11c76d2cfc5f488ff8c7&scene=58&subscene=0#rd) -- Blackhat Library: Hacking techniques and research - - [PChunter equivalent on Linux?](https://www.reddit.com/r/blackhat/comments/vcr587/pchunter_equivalent_on_linux/) -- 情报分析师 - - [【焦点报告】221页《俄罗斯与西方的信息战》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506117&idx=1&sn=1b5c3fa6287ca263795f268f53208344&chksm=8716adceb06124d8847ab76b47b7f35a005d3e67dbd680f86d311dd0ba25dc8361fddc44a510&scene=58&subscene=0#rd) - - [中国公安首个免费开放的资金分析平台免费开放注册了！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506117&idx=2&sn=a96ac7cfa653e5f36264269051c5217a&chksm=8716adceb06124d8d8cd1937de3dcf16f75891d4365cbe2c2447d34565943381bd2ac67b022a&scene=58&subscene=0#rd) - - [海上力量的作用](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506117&idx=3&sn=db3416b0d92cc5955eab4d456e3f5109&chksm=8716adceb06124d8162c841895a267de846b89f5907d935cc07290e534c6f436db8d161574ab&scene=58&subscene=0#rd) -- Social Engineering - - [What makes Lalo Salamanca from Better Call Saul so charming?](https://www.reddit.com/r/SocialEngineering/comments/vct1r0/what_makes_lalo_salamanca_from_better_call_saul/) -- 腾讯玄武实验室 - - [每日安全动态推送(06-15)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958510&idx=1&sn=7ef64737e3f259a4f934ea7ba7adf233&chksm=8baecc71bcd945670a95db46649ebb2f2c7697531d23d6b5ea3a5fa9d1f67bd45a1efd753efc&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [网络空间测绘 | 一招教你如何快速识别CDN节点和防火墙](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247493529&idx=1&sn=d148a49439d9d1a631733d0d9f53c701&chksm=cfca848df8bd0d9bf67cf8093d102278e55ba5aabcdd475a833054c67d96f5ab35e99c157921&scene=58&subscene=0#rd) -- SecPulse安全脉搏 - - [【漏洞预警】Linux Kernel ebpf权限提升漏洞](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044516&idx=1&sn=cb95654633224cd07d57d8e90b1cdbbf&chksm=803fa8fab74821ec3b23e081a7d4bfc725d0b453c2897726d10612ed29c82893fe3bc30fa881&scene=58&subscene=0#rd) -- 安全威胁情报 - - [有图有真相，OneEDR检测能力获中国信通院认可](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172682&idx=1&sn=a05ab284862dadfa0f75d81492ebd36f&chksm=f44896b6c33f1fa0688c25c35a1f288bd8a74150506ee5cd0a4a8fda45453557d6284c3f247c&scene=58&subscene=0#rd) -- 看雪学院 - - [CVE-2018-15664：符号链接替换漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452452&idx=1&sn=45e52124810e59e65a86ef7931c30160&chksm=b18e316e86f9b878e2497c82fce3813b09f238af469e4e868c131a0d98cf0b9125fada6094f9&scene=58&subscene=0#rd) - - [美国国防承包商计划收购间谍软件公司NSO](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452452&idx=2&sn=7bbcd78d5bf9ea84a49fd199fe79ad2e&chksm=b18e316e86f9b8786e30f3abea85b2e5cce5de0260cbfff326ded9588f173ccef300938ba1bc&scene=58&subscene=0#rd) - - [精品课程 | 4h入门PHP代码审计之反序列化](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452452&idx=3&sn=83e4b5fe81869a116e5b0ff3e7c0673e&chksm=b18e316e86f9b878cdd53c558f3deeca83e1113cf4964b89b3311fa2d6ec28105a99ce8d9da0&scene=58&subscene=0#rd) -- 安全牛 - - [一文详解网络安全攻防演练中的防御规划与实施](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114655&idx=1&sn=db8fd076572dd2f7860288cec9741d20&chksm=bd147c4c8a63f55aab24b7d78288364305fb5810674107a4230bdb20c844c3a55e573284bfc7&scene=58&subscene=0#rd) - - [九种常见的计算机病毒，工作机理比想象的更复杂](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114655&idx=2&sn=fefde2c409795e84993de7ec2376bee7&chksm=bd147c4c8a63f55abbd73b50a52157688321707b3295363bd1262127dced3c3d9b25cd527d3a&scene=58&subscene=0#rd) - - [云安全的主要挑战与应对](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114655&idx=3&sn=e4d98a5fd873eb72149b5bc9510b52bd&chksm=bd147c4c8a63f55a22ceb2dbc468bc6b5af09b835ee225e98cd1b46faa03eb6f7a52991eecd8&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【安全公告】微软补丁日安全通告|6月份](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261728&idx=1&sn=0e2e703abe345691fa90d88f0c5e3389&chksm=f3e27294c495fb822f92c56675bad4b7f5d375d505b17187a54729930607facbd9e7ff668fbd&scene=58&subscene=0#rd) - - [【漏洞通告】Windows Installer本地提权漏洞CVE-2022-30147](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261728&idx=2&sn=b59a6c99398146844e5c4554a470ce5a&chksm=f3e27294c495fb82419e46ba264e1a8784a27a683aa10c41a43035e0afddcc0adb512dedd7c0&scene=58&subscene=0#rd) - - [【漏洞通告】Windows Advanced Local Procedure Call权限提升漏洞CVE-2022-30160](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261728&idx=3&sn=6f3394590e86c8583aced110a53df3c8&chksm=f3e27294c495fb82599cda1b8f74164d21b43b8c734be66cdddd259ac3fac14573aecd01bbff&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键信息基础设施网络安全（物联网安全专题）监测月报202205期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527395&idx=1&sn=6379dc0a75762fdf77f349adaf9db654&chksm=c1e9e7b2f69e6ea4efaed7df77f4659b686dd89b20b75ffe779deda0db555ecef85dde4206ec&scene=58&subscene=0#rd) - - [发布 | 国家网信办修订《移动互联网应用程序信息服务管理规定》发布施行（附全文）](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527395&idx=2&sn=f06081d8af650fee28de8fc4af4c8a0a&chksm=c1e9e7b2f69e6ea4537f2e8a6b2b73aad5490356f26864f36d0cb0bc8c146235b29acb47df8c&scene=58&subscene=0#rd) - - [数据安全复合治理实践与治理科技](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527395&idx=3&sn=c74ac941e96e50dced5f8ecef5906877&chksm=c1e9e7b2f69e6ea4fe9ba39bb4aacbdb52ce4e8d6c551d0ee743133e78a3a65180d1cc6fae01&scene=58&subscene=0#rd) - - [Bumblebee 恶意软件通过电子邮件劫持在韩国传播](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527395&idx=4&sn=5d58ad6d83b7c9b7701727f8977de443&chksm=c1e9e7b2f69e6ea47fb69e5fd4de2e402d46dbe331f7a5305a6f8a8eef92e9873db96111a076&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [2022-06微软漏洞通告](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247504566&idx=1&sn=8c67e0a8744c95efe6c772bee085ea77&chksm=eb700c89dc07859f71ca15098052c2e56bcde9c015f2af206b24cd7a8381a48e218089470aa2&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [您有一条新的美团订单，请查收~](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247489526&idx=1&sn=34f32dffe80077872d87ccee81b6fd1d&chksm=ec1bf625db6c7f3357d5561d4e271352ceca649e79055cce6696e3436edba0eddbcfe2939520&scene=58&subscene=0#rd) -- IT Service Management News - - [Fornire segreti militari in discussioni sui giochi](http://blog.cesaregallotti.it/2022/06/fornire-segreti-militari-in-discussioni.html) -- /r/netsec - Information Security News & Discussion - - [Breaking Secure Boot on Google Nest Hub (2nd Gen) to run Ubuntu](https://www.reddit.com/r/netsec/comments/vcv661/breaking_secure_boot_on_google_nest_hub_2nd_gen/) - - [Pulling MikroTik into the Limelight](https://www.reddit.com/r/netsec/comments/vd3nel/pulling_mikrotik_into_the_limelight/) - - [Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup](https://www.reddit.com/r/netsec/comments/vcnlgi/pwn2own_2021_canon_imageclass_mf644cdw_writeup/) - - [TPM Sniffing Attacks Against Non-Bitlocker Targets](https://www.reddit.com/r/netsec/comments/vciv14/tpm_sniffing_attacks_against_nonbitlocker_targets/) - - [Bypassing CSP with dangling iframes](https://www.reddit.com/r/netsec/comments/vcittx/bypassing_csp_with_dangling_iframes/) - - [Quick Malware Analysis: TA578 Thread-hijacked email, Bumblebee, and Cobalt Strike pcap from 2022-06-14](https://www.reddit.com/r/netsec/comments/vcvay2/quick_malware_analysis_ta578_threadhijacked_email/) -- 代码卫士 - - [Follina呢？IE呢？](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512333&idx=1&sn=6128b41ba0c0e7cfb51d22309b0ef8b3&chksm=ea948067dde309710a0d113203e4191cd5f70ab1d6a99f6ebe4de65a44736cbd6332eaa8f924&scene=58&subscene=0#rd) - - [Travis CI API 漏洞未修复，可暴露用户机密访问令牌引发供应链攻击](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512333&idx=2&sn=941187896fb7a8b1aa8894038839d4db&chksm=ea948067dde309712677a3c1025833ce2d2b6124a230df150c3d899e8252a0d9214dbea3d276&scene=58&subscene=0#rd) - - [开源邮件平台Zimbra 出现新漏洞，用户登录凭据可被盗](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512333&idx=3&sn=8b2d3c40a59f28ad4ef19cca4e7de98c&chksm=ea948067dde3097194f650240489cdb2bfb2ee4a852e63ff960607da69af4ddc744d0a0e03d5&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [DrayTek Bruteforce](https://www.reddit.com/r/HowToHack/comments/vcq6sc/draytek_bruteforce/) - - [Port fowarding for Veil Evasion?](https://www.reddit.com/r/HowToHack/comments/vckj0r/port_fowarding_for_veil_evasion/) - - [Anyone ever heard of a Segeet hashcat server?](https://www.reddit.com/r/HowToHack/comments/vckh3u/anyone_ever_heard_of_a_segeet_hashcat_server/) - - [Resources after nmap scan](https://www.reddit.com/r/HowToHack/comments/vcirp2/resources_after_nmap_scan/) - - [Can someone with Hack the Box’s bug hunting certification have enough knowledge to do OffSec’s OSWE course in order to get an OSWE certification?](https://www.reddit.com/r/HowToHack/comments/vcmldr/can_someone_with_hack_the_boxs_bug_hunting/) - - [STARTTLS Decryption?](https://www.reddit.com/r/HowToHack/comments/vci4p8/starttls_decryption/) -- 威努特工控安全 - - [十年三倍！OT漏洞增长88%！](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651084683&idx=1&sn=4ed8497406f88548b340cc4c67cbf471&chksm=80e64d3bb791c42dd6b65bfcf679a5b1dd717692cce846c124cd2d6ca4d92390ef030d585d14&scene=58&subscene=0#rd) -- 奇安信CERT - - [微软2022年6月补丁日多产品安全漏洞风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496307&idx=1&sn=dc2778ba9aa52569476df57c9077810d&chksm=fe79d6ebc90e5ffd24f29d0ac3c3031d90003450fdaec0b7d420c976707fc51524e8827a1b45&scene=58&subscene=0#rd) -- 默安科技 - - [火线云XDR推出攻防演练期间限时免费服务](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247491774&idx=1&sn=fc979b1e55256d8989ffc343e7bf26d3&chksm=e93b179cde4c9e8ad3375f618de0f797c9f8e83ff9680ac8e4d0dfc568aae684aaf5ac03e14c&scene=58&subscene=0#rd) -- 安全客 - - [直击RSAC 2022：人工智能如何颠覆自动化威胁分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772184&idx=1&sn=631791d35ced060af3eb30d6e1992703&chksm=889360f7bfe4e9e1f41d020ce1c6c8063cb821278b792a77563fd1cc7dca9b48ee1ade5804a4&scene=58&subscene=0#rd) - - [【安全头条】Kaiser Permanente数据泄露影响7万人](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772184&idx=2&sn=642500309fc4ed7cb74d5b3b1678f1e5&chksm=889360f7bfe4e9e114a2a4f7402a68451adf3be1d3f07017ab10a070083aa9e7bf2a1f34fc65&scene=58&subscene=0#rd) - - [【技术分享】FRIDA脚本系列（一）入门篇：在安卓8.1上dump蓝牙接口和实例](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772184&idx=3&sn=63a5ebc06c41b53ab8da6a7839bbb39f&chksm=889360f7bfe4e9e117db8219251e87a2f761b8d4f5f76d508b4b9654097de181e13e5fc53402&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | 关于智能汽车API安全](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493585&idx=1&sn=e6997be743a69891822c5cfca55069c0&chksm=c0074a4df770c35b4174c3788199c5132d41286063889e49258fc8fb033f432d2da5bdfac380&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [从响应式编程到 Combine 实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495012&idx=1&sn=89b85dd6e2e85d708a2415b78343e9a0&chksm=e9d32686dea4af907761abab69bf4e26fe0dc1215f51e33d4e55a10eef5b9d2f838052304cdf&scene=58&subscene=0#rd) - - [一些我们关于端到端语音翻译的思考和尝试](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495012&idx=2&sn=9ef788ea828777bbac085797d50c9695&chksm=e9d32686dea4af9016aae79c56ef940961aebb1d7f7ec8ae0e5bb06f9f7575d457004985bb25&scene=58&subscene=0#rd) -- 腾讯安全威胁情报中心 - - [微软六月补丁日：广泛关注的Follina漏洞（CVE-2022-30190）得以修复](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500336&idx=1&sn=92ca5f0d1ee950a26b072189baa995c0&chksm=ec9f1b43dbe89255c9f79100d53536c39f259e25aef32b091e5dca1f91ef1de93ed153d6f0d7&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [After living and breathing info sec for the past 3 years, here are the best resources I've found.](https://www.reddit.com/r/netsecstudents/comments/vd26mf/after_living_and_breathing_info_sec_for_the_past/) - - [Need a mentor.](https://www.reddit.com/r/netsecstudents/comments/vd0l4i/need_a_mentor/) -- 互联网安全内参 - - [乌克兰将国家重要数据迁移至北约邻国｜俄乌冲突](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503492&idx=1&sn=4246407c158af7b642d7824cb50f8642&chksm=ebfa89a4dc8d00b2495ea4555f8dad13bbbfd22b5cbb1d0a03fdbef8bc84fc36b7f240bb4fc1&scene=58&subscene=0#rd) - - [《电力行业网络安全管理办法》修订版公开征求意见](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503492&idx=2&sn=fb32b49587d3a37b0431b709ce0cfcb9&chksm=ebfa89a4dc8d00b28b81a7b353a0182d5120fc99f3bf095d9212b46d41bc41c0199f93386d2b&scene=58&subscene=0#rd) - - [2021年路由器漏洞数量超过去十年总和](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503492&idx=3&sn=216f95b82cd464319c96816b9bf47f2d&chksm=ebfa89a4dc8d00b29c93480ea864c40d85c2af9b3a2af665c4cbdf78d3f1e3ff5dc30fcf50f3&scene=58&subscene=0#rd) - - [美国成立数字军团，吸引40多名科技精英“入伍”](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503492&idx=4&sn=8e3db2cabbca270362e672973231c157&chksm=ebfa89a4dc8d00b2c451f27eec020afe4f051acafd7065d3060a9ed3c6c8b8bde184cb4463d3&scene=58&subscene=0#rd) -- 三六零CERT - - [2022-06 补丁日: 微软多个漏洞安全更新通告](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491068&idx=1&sn=9492ae74cc1baa7b5c182c5a5a908fa1&chksm=fe2518fdc95291ebd1bbe03d7efc891d0fe6e2ad67df3beaa8825dcf3919b26044ec19448ad9&scene=58&subscene=0#rd) - - [安全日报（2022.06.15）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491068&idx=2&sn=5526e337153e145c02dd3c61b6b293ef&chksm=fe2518fdc95291ebc3f8a37f5be0332a1f8f673042ddd68c7b145edb1445d9cad3c3920d7811&scene=58&subscene=0#rd) -- Dark Space Blogspot - - [Bull e Bear Market: Come Riconoscerli? Quanto Durano?](http://darkwhite666.blogspot.com/2022/06/bull-e-bear-market-come-riconoscerli.html) diff --git a/archive/2022/2022-06-17.md b/archive/2022/2022-06-17.md deleted file mode 100644 index 642aa2381d..0000000000 --- a/archive/2022/2022-06-17.md +++ /dev/null @@ -1,282 +0,0 @@ -# 每日安全资讯（2022-06-17） - -- Sec-News 安全文摘 - - [Cloud I Hack into Google Cloud](https://wiki.ioin.in/url/k4PV) -- HackerOne Hacker Activity - - [xmlrpc file enabled](https://hackerone.com/reports/1575401) - - [curl "globbing" can lead to denial of service attacks](https://hackerone.com/reports/1572120) - - [CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit !](https://hackerone.com/reports/1480569) - - [Stored XSS on TikTok Live Form](https://hackerone.com/reports/1542703) -- Der Flounder - - [Slides from the “Leveling Up – Managing admin rights in the enterprise” session at Penn State MacAdmins Conference 2022](https://derflounder.wordpress.com/2022/06/16/slides-from-the-leveling-up-managing-admin-rights-in-the-enterprise-session-at-penn-state-macadmins-conference-2022/) -- Tenable Blog - - [Tenable Capture the Flag 2022: The Results Are In!](https://www.tenable.com/blog/tenable-capture-the-flag-2022-the-results-are-in) -- Microsoft Security Blog - - [Making the world a safer place with Microsoft Defender for individuals](https://www.microsoft.com/security/blog/2022/06/16/making-the-world-a-safer-place-with-microsoft-defender-for-individuals/) -- Sploitus.com Exploits RSS Feed - - [Microsoft Office Word DOC Silent Arbitrary Code Execution Builder Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37800&utm_source=rss&utm_medium=rss) - - [Exploit for Use After Free in Apple Mac Os X exploit](https://sploitus.com/exploit?id=6270F5E2-E546-52C1-885A-D84E83073E3D&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-30136 exploit](https://sploitus.com/exploit?id=0BCFFC1F-A546-5E9E-91AB-7B975740524D&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [Build or Buy an Application to Run FAIR Cyber Risk Quantification?](https://securityboulevard.com/2022/06/build-or-buy-an-application-to-run-fair-cyber-risk-quantification/) - - [Get that ‘We’ve been hacked!’ press release ready NOW](https://securityboulevard.com/2022/06/get-that-weve-been-hacked-press-release-ready-now/) - - [WooCommerce Credit Card Skimmer Uses Telegram Bot to Exfiltrate Stolen Data](https://securityboulevard.com/2022/06/woocommerce-credit-card-skimmer-uses-telegram-bot-to-exfiltrate-stolen-data/) - - [Stalkerware: A Growing Threat to Individual Security?](https://securityboulevard.com/2022/06/stalkerware-a-growing-threat-to-individual-security/) - - [BSides:Munich 2022 – Main Stage (9 Hours)](https://securityboulevard.com/2022/06/bsidesmunich-2022-main-stage-9-hours/) - - [Transgender women found and created community in the 1980s internet](https://securityboulevard.com/2022/06/transgender-women-found-and-created-community-in-the-1980s-internet/) - - [Live off the land: The fundamental rethink for Zero Trust SecOps](https://securityboulevard.com/2022/06/live-off-the-land-the-fundamental-rethink-for-zero-trust-secops/) - - [Radware Survey Reveals API Security Weaknesses](https://securityboulevard.com/2022/06/radware-survey-reveals-api-security-weaknesses/) - - [Fixing Lost Motivation](https://securityboulevard.com/2022/06/fixing-lost-motivation/) -- 绿盟科技技术博客 - - [新的僵尸网络家族Boat和Boota正在进行大规模传播](http://blog.nsfocus.net/boat-booat-0day/) - - [洞见RSA2022 | 实践NIST网络安全框架，重塑容器安全](http://blog.nsfocus.net/rsa2022-nist/) - - [洞见RSA2022|入侵和攻击模拟技术探索实践](http://blog.nsfocus.net/rsa2022-int/) - - [洞见RSA2022 | 什么是云原生？](http://blog.nsfocus.net/rsa2022-cloud-2/) - - [洞见RSA2022 | 对IP视频监控系统进行固件分析时面临的挑战](http://blog.nsfocus.net/rsa2022-ip/) - - [洞见RSA2022 | 关于飞机域及衍生的安全设计思考](http://blog.nsfocus.net/rsa2022-airplan/) - - [洞见RSA2022 | 网络防御矩阵助力安全协同防御持续演进](http://blog.nsfocus.net/rsa2022-sec/) - - [微软6月安全更新多个产品高危漏洞通告](http://blog.nsfocus.net/microsoft-monthly-2022-6/) -- Sucuri Blog - - [WooCommerce Credit Card Skimmer Uses Telegram Bot to Exfiltrate Stolen Data](https://blog.sucuri.net/2022/06/woocommerce-credit-card-skimmer-uses-telegram-bot-to-exfiltrate-stolen-data.html) -- obaby@mars - - [微图坊爬虫 【22.06.16】【Windows】](http://h4ck.org.cn/2022/06/%e5%be%ae%e5%9b%be%e5%9d%8a%e7%88%ac%e8%99%ab-%e3%80%9022-06-16%e3%80%91%e3%80%90windows%e3%80%91/) - - [终于，那条6年前埋的网线上岗了](http://h4ck.org.cn/2022/06/%e7%bb%88%e4%ba%8e%ef%bc%8c%e9%82%a3%e6%9d%a16%e5%b9%b4%e5%89%8d%e5%9f%8b%e7%9a%84%e7%bd%91%e7%ba%bf%e4%b8%8a%e5%b2%97%e4%ba%86/) -- Envato Tuts+ Code - Mobile Development - - [15 Best Ionic App Templates (With Source Code)](https://code.tutsplus.com/articles/best-ionic-app-templates--cms-28563) -- Blog & What's New | Offensive Security - - [Offensive Security Hails Passage of Several Cybersecurity Bills in Congress](https://www.offensive-security.com/offsec/offsec-greets-cybersecurity-bills-in-congress/) - - [Helping Educational Institutions Align to NCAE-C](https://www.offensive-security.com/offsec/achieve-and-maintain-cae-c-designation/) -- paper - Last paper - - [CodeQL 数据库创建原理分析](https://paper.seebug.org/1921/) -- The DFIR Report - - [SANS Ransomware Summit 2022, Can You Detect This?](https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/) -- 跳跳糖 - 安全与分享社区 - - [WMI攻守之道](https://tttang.com/archive/1624/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 美陆军将云计算技术运用于实战；乌克兰将国家重要数据迁移至邻国](https://www.freebuf.com/articles/336440.html) - - [国际刑警查获五千万美元，逾两千名“社会工程师”被捕](https://www.freebuf.com/news/336400.html) - - [「网安新势力」创始人联盟季 6月22日10点强势来袭！](https://www.freebuf.com/fevents/336391.html) - - [构建低延时高并发的企业防护架构 | CIS夏日版议题前瞻](https://www.freebuf.com/fevents/336382.html) - - [邮件巨头Zimbra曝严重漏洞，黑客无需密码即可登录](https://www.freebuf.com/news/336379.html) - - [思科电子邮件存在安全漏洞，攻击者可利用漏洞登录其Web管理界面](https://www.freebuf.com/news/336376.html) - - [攻击者利用三年前的 Telerik 漏洞部署 Cobalt Strike](https://www.freebuf.com/news/336370.html) - - [多年终端安全沉淀，源自支付宝的全链路安全防护建设 | 6月24日19点公开课](https://www.freebuf.com/articles/334892.html) -- Forcepoint - - [The Million-Dollar Question in 2022](https://www.forcepoint.com/blog/insights/million-dollar-question-emilie-mclaughlin) -- 安全客-有思想的安全新媒体 - - [WEB3 安全系列 || 攻击者如何通过Discord软件进行各类钓鱼攻击](https://www.anquanke.com/post/id/274434) - - [2022-06 补丁日: 微软多个漏洞安全更新通告](https://www.anquanke.com/post/id/274491) - - [人才故事 | 360龚广：守护国家网络安全的“白帽黑客”](https://www.anquanke.com/post/id/274496) - - [K8s污点容忍度横向主节点](https://www.anquanke.com/post/id/274380) - - [勒索软件组织模仿HIBP建立数据泄露检测站](https://www.anquanke.com/post/id/274446) -- Didier Stevens - - [Discovering A Forensic Artifact](https://blog.didierstevens.com/2022/06/16/discovering-a-forensic-artifact/) -- blog.avast.com EN - - [Transgender women found and created community in the 1980s internet](https://blog.avast.com/transgender-women-community-1980s-internet) -- Malwarebytes Labs - - [Hertzbleed exposes computers’ secret whispers](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/hertzbleed-exposes-computers-secret-whispers/) - - [Interpol’s First Light operation smashes crime on a global scale](https://blog.malwarebytes.com/scams/2022/06/interpols-first-light-operation-smashes-crime-on-a-global-scale/) - - [Photos of kids taken from spyware-ridden phones found exposed on the internet](https://blog.malwarebytes.com/stalkerware/2022/06/photos-of-kids-taken-from-spyware-ridden-phones-found-exposed-on-the-internet/) -- Hex Rays - - [What is QScripts?](https://hex-rays.com/blog/what-is-qscripts/) -- Application Security Blog - - [Critical aspects of securing your enterprise applications](https://www.synopsys.com/blogs/software-security/gartner-critical-capabilities-appsec-enterprise-apps/) -- Reverse Engineering - - [CVE-2022-23088: Exploiting a Heap Overflow in the FreeBSD Wi-Fi Stack -- includes root cause analysis and PoC code](https://www.reddit.com/r/ReverseEngineering/comments/vdq64d/cve202223088_exploiting_a_heap_overflow_in_the/) - - [Detect It Easy 3.05 Program for determining types of files for Windows, Linux and MacOS.](https://www.reddit.com/r/ReverseEngineering/comments/vdurf7/detect_it_easy_305_program_for_determining_types/) - - [I reversed engineered Google Colab to run continuously a Minecraft Server. Turned it into a script.](https://www.reddit.com/r/ReverseEngineering/comments/vdxdix/i_reversed_engineered_google_colab_to_run/) - - [foone reverse-engineering classic Windows Entertainment Pack game SkiFree -- Twitter thread](https://www.reddit.com/r/ReverseEngineering/comments/vd8tw8/foone_reverseengineering_classic_windows/) -- Sucuri Blog - - [WooCommerce Credit Card Skimmer Uses Telegram Bot to Exfiltrate Stolen Data](https://blog.sucuri.net/2022/06/woocommerce-credit-card-skimmer-uses-telegram-bot-to-exfiltrate-stolen-data.html) -- PortSwigger Blog - - [How to see the impact installing BApps might have on Burp Suite](https://portswigger.net/blog/how-to-see-the-impact-installing-bapps-might-have-on-burp-suite) -- daniel.haxx.se - - [curl user survey 2022 analysis](https://daniel.haxx.se/blog/2022/06/16/curl-user-survey-2022-analysis/) -- The Daily Swig | Cybersecurity news and views - - [Ransomware attack on Montrose Environmental Group disrupts lab testing services](https://portswigger.net/daily-swig/ransomware-attack-on-montrose-environmental-group-disrupts-lab-testing-services) - - [Business email platform Zimbra patches memcached injection flaw that imperils user credentials](https://portswigger.net/daily-swig/business-email-platform-zimbra-patches-memcached-injection-flaw-that-imperils-user-credentials) -- PortSwigger Blog - - [How to see the impact installing BApps might have on Burp Suite](https://portswigger.net/blog/how-to-see-the-impact-installing-bapps-might-have-on-burp-suite) -- Hacking Articles - - [Caldera: Red Team Emulation (Part 1)](https://www.hackingarticles.in/caldera-red-team-emulation-part-1/) -- KitPloit - PenTest & Hacking Tools - - [Frostbyte - FrostByte Is A POC Project That Combines Different Defense Evasion Techniques To Build Better Redteam Payloads](http://www.kitploit.com/2022/06/frostbyte-frostbyte-is-poc-project-that.html) - - [Admin-Panel_Finder - A Burp Suite Extension That Enumerates Infrastructure And Application Admin Interfaces (OTG-CONFIG-005)](http://www.kitploit.com/2022/06/admin-panelfinder-burp-suite-extension.html) -- Driver Tom's Blog - - [我的第一个真实环境二进制漏洞复现：CVE-2018-1160利用](https://drivertom.blogspot.com/2022/06/cve-2018-1160.html) -- 奇客Solidot–传递最新科技情报 - - [南亚面临气候变化的挑战和困境加剧](https://www.solidot.org/story?sid=71858) - - [地球内核旋转方向每 6 年变化一次](https://www.solidot.org/story?sid=71857) - - [VED（Vault Exploit Defense）开源实现](https://www.solidot.org/story?sid=71856) - - [微软退役 IE 浏览器](https://www.solidot.org/story?sid=71855) - - [古代 DNA 揭示黑死病的起源](https://www.solidot.org/story?sid=71853) - - [月球风暴洋样本可能有助于确定月球水的来源](https://www.solidot.org/story?sid=71852) - - [新加工技术让马铃薯更健康](https://www.solidot.org/story?sid=71851) - - [希格斯玻色子发现十年之后物理学家面临着别无所获的噩梦](https://www.solidot.org/story?sid=71850) - - [警示标志不足以让海滩游客躲开致命水流](https://www.solidot.org/story?sid=71849) - - [盖茨称加密货币和 NFT 是一场博傻骗局](https://www.solidot.org/story?sid=71848) - - [IPv6 比 IPv4 更快？](https://www.solidot.org/story?sid=71847) - - [WHO 警告猴痘对欧洲构成真实风险](https://www.solidot.org/story?sid=71845) - - [郑州部分停工楼盘业主被赋红码](https://www.solidot.org/story?sid=71844) -- Luca Mercatanti - - [Cyber Threat Intelligence sul Dark Web](https://luca-mercatanti.com/2022/06/16/cyber-threat-intelligence-sul-dark-web/?utm_source=rss&utm_medium=rss&utm_campaign=cyber-threat-intelligence-sul-dark-web) -- Forensic Focus - - [Enterprise Forensics: Traditions vs Reality in Modern DFIR](https://www.forensicfocus.com/webinars/enterprise-forensics-traditions-vs-reality-in-modern-dfir/) - - [University College Dublin Launches MSc in Cybersecurity](https://www.forensicfocus.com/news/university-college-dublin-launches-msc-in-cybersecurity/) -- bellingcat - - [The Brazilian Candidate: The Studious Cover Identity of an Alleged Russian Spy](https://www.bellingcat.com/news/americas/2022/06/16/the-brazilian-candidate-the-studious-cover-identity-of-an-alleged-russian-spy/) -- Posts By SpecterOps Team Members - Medium - - [Hang Fire: Challenging our Mental Model of Initial Access](https://posts.specterops.io/hang-fire-challenging-our-mental-model-of-initial-access-513c71878767?source=rss----f05f8696e3cc---4) -- 90Sec - 最新话题 - - [CS上线Linux--坑太多了](https://forum.90sec.com/t/topic/2135) -- SANS Internet Storm Center, InfoCON: green - - [Houdini is Back Delivered Through a JavaScript Dropper, (Thu, Jun 16th)](https://isc.sans.edu/diary/rss/28746) - - [ISC Stormcast For Thursday, June 16th, 2022 https://isc.sans.edu/podcastdetail.html?id=8052, (Thu, Jun 16th)](https://isc.sans.edu/diary/rss/28750) -- SecurityCurrent - - [Esteemed Board of CISO Judges to Host Ceremony Honoring the CISOs Top 100 CISO (C100) 2022 in North America](/esteemed-board-of-ciso-judges-to-host-ceremony-honoring-the-cisos-top-100-ciso-c100-2022-in-north-america/) -- Deeplinks - - [Facebook Says Apple is Too Powerful. They're Right.](https://www.eff.org/deeplinks/2022/06/facebook-says-apple-too-powerful-theyre-right) -- Graham Cluley - - [Interpol arrests thousands of scammers in operation “First Light 2022”](https://www.tripwire.com/state-of-security/latest-security-news/interpol-arrests-thousands-scammers-operation-first-light-2022/) - - [Want to block two billion known breached passwords from being used at your company? It’s easy with Specops Password Policy tools](https://grahamcluley.com/feed-sponsor-specops-2/) -- Security Affairs - - [BlackCat Ransomware affiliates target unpatched Microsoft Exchange servers](https://securityaffairs.co/wordpress/132343/hacking/blackcat-ransomware-targets-unpatched-microsoft-exchange.html) - - [ALPHV/BlackCat ransomware gang starts publishing victims’ data on the clear web](https://securityaffairs.co/wordpress/132339/malware/blackcat-ransomware-clear-web.html) - - [Researchers disclosed a remote code execution flaw in Fastjson Library](https://securityaffairs.co/wordpress/132333/security/fastjson-library-rce.html) - - [Cisco fixed a critical Bypass Authentication flaw in Cisco ESA and Secure Email and Web Manager](https://securityaffairs.co/wordpress/132327/hacking/cisco-esa-critical-flaw.html) - - [Malicious apps continue to spread through the Google Play Store](https://securityaffairs.co/wordpress/132305/malware/malware-google-play-store.html) -- Dark Reading - - [Internet Explorer Now Retired but Still an Attacker Target](https://www.darkreading.com/vulnerabilities-threats/internet-explorer-will-likely-remain-an-attacker-target-for-some-time) - - [BlastWave Announces Enhancements to Its Zero-Trust Security Software Solution, BlastShield](https://www.darkreading.com/cloud/blastwave-announces-enhancements-to-its-zero-trust-security-software-solution-blastshield) - - [Microsoft 365 Function Leaves SharePoint, OneDrive Files Open to Ransomware Attacks](https://www.darkreading.com/vulnerabilities-threats/office-365-files-stored-in-the-cloud-vulnerable-to-ransomware-encryption) - - [What We Mean When We Talk About Cyber Insurance](https://www.darkreading.com/edge-articles/what-we-mean-when-we-talk-about-cyber-insurance) - - [Android Spyware 'Hermit' Discovered in Targeted Attacks](https://www.darkreading.com/mobile/android-spyware-hermit-discovered-in-targeted-attacks) - - [Unlocking the Cybersecurity Benefits of Digital Twins](https://www.darkreading.com/dr-tech/unlocking-the-cybersecurity-benefits-of-digital-twins) - - [EU & US Unite to Fight Ransomware](https://www.darkreading.com/threat-intelligence/eu-us-enhance-cooperation-in-fighting-ransomware-attacks) - - [RSAC Startup Competition Focuses on Post-Cloud IT Infrastructure](https://www.darkreading.com/vulnerabilities-threats/rsac-startup-competition-focuses-on-post-cloud-it-infrastructure) - - [CISOs Gain False Confidence in the Calm After the Storm of the Pandemic](https://www.darkreading.com/attacks-breaches/cisos-gain-false-confidence-in-the-calm-after-the-storm-of-the-pandemic) - - [Are You Hiring Enough Entry-Level Security Pros?](https://www.darkreading.com/operations/are-you-hiring-enough-entry-level-security-pros-) - - [How Should I Think About Security When Considering Digital Transformation Projects?](https://www.darkreading.com/edge-ask-the-experts/how-should-i-think-about-security-when-considering-digital-transformation-projects-) -- KitPloit - PenTest Tools! - - [Frostbyte - FrostByte Is A POC Project That Combines Different Defense Evasion Techniques To Build Better Redteam Payloads](http://www.kitploit.com/2022/06/frostbyte-frostbyte-is-poc-project-that.html) - - [Admin-Panel_Finder - A Burp Suite Extension That Enumerates Infrastructure And Application Admin Interfaces (OTG-CONFIG-005)](http://www.kitploit.com/2022/06/admin-panelfinder-burp-suite-extension.html) -- 黑海洋 - WIKI - - [抖音影视剪辑搬运变现一体教程](https://blog.upx8.com/2799) -- Schneier on Security - - [Attacking the Performance of Machine Learning Systems](https://www.schneier.com/blog/archives/2022/06/attacking-the-performance-of-machine-learning-systems.html) -- Computer Forensics - - [Using write blocker to image a drive that is still in computer.](https://www.reddit.com/r/computerforensics/comments/vdwch7/using_write_blocker_to_image_a_drive_that_is/) - - [Was given a .dist for NICE Inform, need to convert it to useable audio](https://www.reddit.com/r/computerforensics/comments/vdt17a/was_given_a_dist_for_nice_inform_need_to_convert/) - - [Consolidate split .e01 image files into single file?](https://www.reddit.com/r/computerforensics/comments/vdx0j8/consolidate_split_e01_image_files_into_single_file/) -- 山石网科安全技术研究院 - - [HCON线上安全技术沙龙即将开始啦！](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493996&idx=1&sn=0595360487960f1c6b4389290db79ede&chksm=fa523cd2cd25b5c426b253126f279e3212a078e32b83e64b49d97a70eb7f4857e0dee7ced0f7&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Visualizing Elliptic Curves](https://www.reddit.com/r/netsecstudents/comments/vdnx0e/visualizing_elliptic_curves/) - - [Questionnaire preparation regarding Cyber Trust and Cyber Resilience](https://www.reddit.com/r/netsecstudents/comments/vdnzen/questionnaire_preparation_regarding_cyber_trust/) -- 火线Zone - - [存储桶上传策略和签名 URL的绕过及利用](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495579&idx=1&sn=e330155ba5540e5c7b66ba0de9e6a0b8&chksm=eaa967bbdddeeeadff8076db8d344932d92c6c5fe5f75eff8da4cd36d95be3fad5fe4b2af140&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [近期网络安全事件盘点](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247490845&idx=1&sn=f5a219b03abe38ea0a1b6d3d7e80cfca&chksm=feb59c0ec9c21518994fde3232b451012359b4a10a938c77bfdc9bb0999558a57ac00d43484c&scene=58&subscene=0#rd) - - [电话诈骗与验证码安全](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247490845&idx=2&sn=a25102a4d01e837dd808325283c4cbc0&chksm=feb59c0ec9c2151829181efbc9e21d6c46d213d84c9acbbf84e05346482cb6af32aa35b72876&scene=58&subscene=0#rd) -- Securityinfo.it - - [Password a rischio in Citrix ADM](https://www.securityinfo.it/2022/06/16/password-a-rischio-in-citrix-adm/?utm_source=rss&utm_medium=rss&utm_campaign=password-a-rischio-in-citrix-adm) - - [Vulnerabilità critica in Cisco Secure Email](https://www.securityinfo.it/2022/06/16/vulnerabilita-critica-in-cisco-secure-email/?utm_source=rss&utm_medium=rss&utm_campaign=vulnerabilita-critica-in-cisco-secure-email) -- NETRESEC Network Security Blog - - [CapLoader 1.9.4 Released](https://www.netresec.com/?page=Blog&month=2022-06&post=CapLoader-1-9-4-Released) -- Mozilla Hacks – the Web developer blog - - [Hacks Decoded: Bikes and Boomboxes with Samuel Aboagye](https://hacks.mozilla.org/2022/06/hacks-decoded-bikes-and-boomboxes-with-samuel-aboagye/) -- 星阑科技 - - [【技术干货】CVE-2022-26134 Confluence OGNL RCE 漏洞分析](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493712&idx=1&sn=0eb90bbd63cadffdd089fcd8ede0fbeb&chksm=c00745ccf770ccda84e24402f35e19e6349ba5c2d15e8362ab0e888041524876dda4eed7e884&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [洞见RSA2022 | 守护5G终端隐私](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492252&idx=1&sn=46b016ae62b0a5aae66124100b81669d&chksm=e84c4443df3bcd55b559901d0ee8bd523b2705922696da2323e1583dd1a22a16a748e1106414&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [pi-hole](https://www.reddit.com/r/HowToHack/comments/vdpelq/pihole/) - - [PNPT Live - 25 Weeks of Free Pentest Training](https://www.reddit.com/r/HowToHack/comments/vdda0n/pnpt_live_25_weeks_of_free_pentest_training/) - - [injecting a trojan on windows](https://www.reddit.com/r/HowToHack/comments/vdv719/injecting_a_trojan_on_windows/) - - [Failed to parse hashes using the 'pwdump' format. (MD4) - Hashcat Issue](https://www.reddit.com/r/HowToHack/comments/vdk96a/failed_to_parse_hashes_using_the_pwdump_format/) - - [How many VMs do you need??](https://www.reddit.com/r/HowToHack/comments/vddo21/how_many_vms_do_you_need/) -- 安全威胁情报 - - [说一个扎心真相：红队黑掉大部分企业其实并不难](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172695&idx=1&sn=e64affac193bd61f47d4a28a1651cf60&chksm=f44896abc33f1fbd5119c0f86d94cfd249f47cdbe40f59a1c796e44211c4e4313083152b2677&scene=58&subscene=0#rd) -- 看雪学院 - - [go语言模糊测试与oss-fuzz](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452682&idx=1&sn=0ee1dac8ca1d7a0a7a50f0467041a472&chksm=b18e324086f9bb56ace762253a71fe44b74984df6200420afc7cc4bb256a15b0baa2bc425de3&scene=58&subscene=0#rd) - - [2022年暗网黑市商品现状](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452682&idx=2&sn=d02fbc760fad7cc7f54cb98216fb6cbb&chksm=b18e324086f9bb56f17bbfd63324b39e05f642d802a17ee86f6d98160e97da93ffc8e89f36b7&scene=58&subscene=0#rd) - - [《VMProtect分析与还原》—— 附赠价值5000元xx_vm工具](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458452682&idx=3&sn=18a1c163df4607d87f87302d3ca90326&chksm=b18e324086f9bb562fa06fde48e748c60eb7cac3a077238765ef3d3e00770565a6050f80c3ec&scene=58&subscene=0#rd) -- Threatpost - - [State-Sponsored Phishing Attack Targeted Israeli Military Officials](https://threatpost.com/phishing-attack-israeli-officials/179987/) - - [Ransomware Risk in Healthcare Endangers Patients](https://threatpost.com/ransomware-risk-healthcare/179980/) - - [Facebook Messenger Scam Duped Millions](https://threatpost.com/acebook-messenger-scam/179977/) -- 奇安信CERT - - [【已复现】Windows SMB拒绝服务漏洞(CVE-2022-32230)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496326&idx=1&sn=841acaa2dd461bed677ec3decd01afc6&chksm=fe79d61ec90e5f0839d1ae3b2e91025c38ad9043e2a89c9f96eb5b9c50ce925cc3d663ca2843&scene=58&subscene=0#rd) - - [奇安信集团2022年06月补丁库更新通告第一次更新](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496326&idx=2&sn=657fe2edadaf7d48df41b797678d20ab&chksm=fe79d61ec90e5f08bf846c64eb414b06a726d1be8999851e21054810c7c44c8c2e9f52c4821a&scene=58&subscene=0#rd) -- The Register - Security - - [RSAC branded a 'super spreader event' as attendees share COVID-19 test results](https://go.theregister.com/feed/www.theregister.com/2022/06/16/rsa_covid_risk/) - - [Elasticsearch server with no password or encryption leaks a million records](https://go.theregister.com/feed/www.theregister.com/2022/06/16/storehub_data_leak/) -- 小米安全中心 - - [MiSRC 十周年活动荣誉榜单！](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247513501&idx=1&sn=100c62ea6bb4498d8acf2db3112c70c9&chksm=ea839308ddf41a1e66191b4e4e88a9e1e5007f36c949690c30de0897b2410fd6dadacf842704&scene=58&subscene=0#rd) -- /dev/random - - [[SANS ISC] Houdini is Back Delivered Through a JavaScript Dropper](https://blog.rootshell.be/2022/06/16/sans-isc-houdini-is-back-delivered-through-a-javascript-dropper/) -- 代码卫士 - - [美国国防承包商 L3Harris 拟收购以色列监控公司 NSO Group](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512362&idx=1&sn=06bd2eeaadd804ceab0abd0bc5096bd5&chksm=ea948040dde30956dbbb595f39ef95d8e5a254e3c441c891f7534b420ed6c7c297eab5090d81&scene=58&subscene=0#rd) - - [新型侧信道漏洞 Hertzbleed 影响所有AMD 和 Intel CPU](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512362&idx=2&sn=8b46a7d7acb584b00292304dfcc7fd67&chksm=ea948040dde30956d4770c1c90d9bf9b7ad1acc876eb83ac63c20987e9f83b6678f23e01c62e&scene=58&subscene=0#rd) - - [思科安全邮件设备现严重漏洞，认证机制可被绕过](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512362&idx=3&sn=70e454390ffa2bbcc942bc0ef7d5a286&chksm=ea948040dde309563ae79f6f57791819cbb113d3001d4dfc53dbf437979066bb00c594bb068d&scene=58&subscene=0#rd) -- 雷神众测 - - [Pivoting 内网穿透基础](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652497842&idx=1&sn=5af1160a02b08e288f1185ea0855ddaa&chksm=f2584401c52fcd173099c3805e871a01b1c5f491d6b118da2b98e0d1cff97509b9d618c56580&scene=58&subscene=0#rd) -- 默安科技 - - [云原生产业大会 | 默安科技邀您共话云原生安全之变](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247491814&idx=1&sn=575a2d4dcad7a589a42df9afc0e45e3d&chksm=e93b17c4de4c9ed2eba81de27861d842851a2309fe3197128b27530df4d85a067b0c267fbc8f&scene=58&subscene=0#rd) -- KCon黑客大会 - - [议题大众评选圆满结束，获奖名单新鲜出炉！](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651134704&idx=1&sn=df451562cfb8c4db6f134fe0b6636008&chksm=f2c11b90c5b692861246b2b4873c21a58eda134e92f1ce44905283d750ad3ee325a1d3f5cadf&scene=58&subscene=0#rd) -- 情报分析师 - - [中国公安首个免费开放的资金分析平台免费开放注册了！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506263&idx=1&sn=3656feb9355657e25eaa4565ad877ea7&chksm=8716aa5cb061234a78a9d693730ca2382867fac6d235d717cac90d0dc19d4e958eb177e44c2f&scene=58&subscene=0#rd) - - [【分析报告】乌克兰战争对粮食、能源和金融的全球影响](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506263&idx=2&sn=b0b42a15853b1a46671593a20017a63f&chksm=8716aa5cb061234a66423664a769d2cc77903e2baa9e2e835d3b8e64babd2226f6f7c4188aac&scene=58&subscene=0#rd) - - [【情报可视化】朝鲜新冠数据跟踪 （6月15日更新）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506263&idx=3&sn=9331d6798887b86bda8095feb33dc8aa&chksm=8716aa5cb061234a24a7debfab4b281ae9fb5604b6b513d426b4cb5a37efba8949def563ac8e&scene=58&subscene=0#rd) -- 安全客 - - [7月重磅来袭！ISC 2022打造全球首个数字安全盛宴](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772281&idx=1&sn=c2ef7a1ede6a4de9b88542a655c953f2&chksm=88936096bfe4e980b6a2875e69d41f7f9fdd0454b29df612659a27326cb43d8221e0df3caee0&scene=58&subscene=0#rd) - - [直击RSAC 2022：如何最大化体验托管检测与响应服务价值](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772281&idx=2&sn=f35ad7be9401d119a054c10f0cee3fbf&chksm=88936096bfe4e980de721831191babe99bde0ac4bf51fd5ed468952e9ec42f76221c469a4d2b&scene=58&subscene=0#rd) - - [【安全头条】勒索软件组织模仿HIBP建立数据泄露检测站](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772281&idx=3&sn=b7ccf848d86aa857d3e661faaeb4ea4d&chksm=88936096bfe4e98064aef75ad3f11237a70a6c8a50cb54fc053617cfada675ed0b744ccb88e5&scene=58&subscene=0#rd) - - [人才故事 | 360龚广：守护国家网络安全的“白帽黑客”](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772281&idx=4&sn=503c8e9db636c93847083fa16c06e75f&chksm=88936096bfe4e980b1401e64b027cb750b387af611ff273b4f803539053edc1c3fe12eca645f&scene=58&subscene=0#rd) - - [【技术分享】Linux kernel 4.20 BPF 整数溢出-堆溢出漏洞及其利用](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772281&idx=5&sn=dfd503418dcc9a760cff1640209fb41f&chksm=88936096bfe4e980640b9724848b81cc7852dc28623312192088babc13420edc9c1b372355a3&scene=58&subscene=0#rd) -- Social Engineering - - [How to deal with people who ghost you?](https://www.reddit.com/r/SocialEngineering/comments/vdt758/how_to_deal_with_people_who_ghost_you/) -- 字节跳动技术团队 - - [通过 Goyacc 构建 Elasticsearch Querystring 解析器 - 领域特定语言语法分析实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495061&idx=1&sn=d6c9da97f96633f1c6b0c1e9db894e78&chksm=e9d32677dea4af612548c996db664beba356628a3918f037c3ad9f39a147fdd78790834afbba&scene=58&subscene=0#rd) - - [免费报名中｜字节跳动工程师带你 6 天入门前端监控](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495061&idx=2&sn=99f6a9b0978aa317381e40d992c2bb9a&chksm=e9d32677dea4af61bd64086c924482971f3b390d8e3c926934edb4b8354d915e6672605740a1&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [CVE-2022-23088: Exploiting a Heap Overflow in the FreeBSD Wi-Fi Stack](https://www.reddit.com/r/netsec/comments/vdrtw5/cve202223088_exploiting_a_heap_overflow_in_the/) - - [The Android kernel mitigations obstacle race](https://www.reddit.com/r/netsec/comments/vdprqx/the_android_kernel_mitigations_obstacle_race/) - - [Quick Malware Analysis Using Free Tools: Malware infection from Brazil malspam pcap from 2022-04-19](https://www.reddit.com/r/netsec/comments/vdnou3/quick_malware_analysis_using_free_tools_malware/) - - [That Pipe is Still Leaking: Revisiting the RDP Named Pipe Vulnerability](https://www.reddit.com/r/netsec/comments/vdtgnm/that_pipe_is_still_leaking_revisiting_the_rdp/) - - [DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach](https://www.reddit.com/r/netsec/comments/vdd7v3/driftingcloud_zeroday_sophos_firewall/) - - [VED (Vault Exploit Defense): Open source implementation](https://www.reddit.com/r/netsec/comments/vdm134/ved_vault_exploit_defense_open_source/) - - [Shadow Credentials - Red Teaming Experiments](https://www.reddit.com/r/netsec/comments/vdj28x/shadow_credentials_red_teaming_experiments/) -- 深信服千里目安全实验室 - - [小心主机被开后门！深信服捕获到“faker”利用搜狗文件Patch定向攻击](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261793&idx=1&sn=62d1e42cd8a2032ff6c3f8604392fc76&chksm=f3e27355c495fa4370cf69605bf8069085b75942d0e5ca9a308a09a15b9bf9e65d65bbfbf9fb&scene=58&subscene=0#rd) - - [“狼来了”！某黑产团伙套壳“大灰狼远控”发起攻击](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261793&idx=2&sn=1babb56ecf3b4fcce142ee7b68ca6a9c&chksm=f3e27355c495fa439a696170c322aa4cc4dfdeeb8d5ea7201c0b68cf83c8111cecbf1bee24a7&scene=58&subscene=0#rd) -- Tor Project blog - - [The Tor Project 2020-2021 Annual Report](https://blog.torproject.org/2020-2021-annual-report/) -- TorrentFreak - - [Xtream-Codes IPTV Company Declared Lawful, Assets Seized in Raid Returned](https://torrentfreak.com/xtream-codes-iptv-company-declared-lawful-assets-seized-in-raid-returned-220616/) - - [‘Pirate’ Streaming Apps Beat Netflix and Disney in Brazil’s Play Store](https://torrentfreak.com/pirate-streaming-apps-beat-netflix-and-disney-in-brazils-play-store-220616/) -- - - [Fine-tuned Windows scenarios: debugger-assisted recording with WinDbg](https://blog.tetrane.com/2022/windows-full-system-recording-with-vmi-windbg.html) -- 腾讯玄武实验室 - - [每日安全动态推送(06-16)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958514&idx=1&sn=1a63b72cd52672b82b872d5e07a230f4&chksm=8baecc6dbcd9457b52d0d710d81d0081c0641af50e0e2597963cc3ae00213874b4a1f26eb1e8&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [国家能源局综合司关于公开征求《电力行业网络安全管理办法（修订征求意见稿）》《电力行业网络安全等级保护管理办法（修订征求意见稿）》](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527433&idx=1&sn=d79c614a2927d55c7c573fb7255cde48&chksm=c1e9e058f69e694e0dcd74e690b289b6aca3c7d0d6d1cc720a8844e933f420424c33ee11a278&scene=58&subscene=0#rd) - - [附件1：电力行业网络安全管理办法(修订征求意见稿)](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527433&idx=2&sn=fbc6596af5fc07a7c922d3eab711f3ea&chksm=c1e9e058f69e694eac2de5e782306c7228f059b9bebd2e5c7ccaa9bc70915c007e56f402c62f&scene=58&subscene=0#rd) - - [附件2：电力行业网络安全等级保护管理办法(修订征求意见稿)](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527433&idx=3&sn=2816bf79a165c7648ab4c0813633a99e&chksm=c1e9e058f69e694e8d30ff6f289b1671587e86626936123ed4e47935f9db564f74d145f32945&scene=58&subscene=0#rd) - - [跨国公司的跨境数据治理挑战与对策建议](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527433&idx=4&sn=30dffc3f11ef00aab4ad9e9679140a4c&chksm=c1e9e058f69e694ebd4e3abc0d70e85bbeb423c6808bfba8f16a2c69a4d61b35c0bae5494771&scene=58&subscene=0#rd) - - [乌克兰将国家重要数据迁移至北约邻国｜俄乌冲突](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527433&idx=5&sn=23cb19707ab1f4d07ad585d69ed79abd&chksm=c1e9e058f69e694e95fb9bbee67a043a6bc45c74fb36ab378a98c44c2ad9a1a6847ec8b6e2c0&scene=58&subscene=0#rd) - - [警惕华盛顿新套路-路透独家披露美国在俄乌战争中资助VPN服务商引导俄罗斯网民](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527433&idx=6&sn=34aa7d99ad5a49ecfcdc09833a4ebfb3&chksm=c1e9e058f69e694e7e662720064f101a72ac27e51d6b25cdf607e801a951f1b665dbe41c8946&scene=58&subscene=0#rd) -- NetSPI - - [Painting a Threat Detection Landscape](https://www.netspi.com/blog/technical/adversary-simulation/painting-a-threat-detection-landscape/) -- 陌陌安全 - - [我和你说设计，你和我谈进化(二)？](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487199&idx=1&sn=5dbfb79fbd62dfc086652d0ca89b9db0&chksm=eadc04bdddab8dabad360383a1cb9f119e5632179ce6eb877cdbff49f35ce6161b20b3add495&scene=58&subscene=0#rd) -- 三六零CERT - - [7月重磅来袭！ISC 2022打造全球首个数字安全盛宴](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491078&idx=1&sn=37cf16fd8decacfaf332726927128298&chksm=fe251b07c95292117e1961124163e58552638977ad7a31e181bd892ccc695c102921a62f0030&scene=58&subscene=0#rd) - - [安全日报（2022.06.16）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491078&idx=2&sn=9ef1b11daf5a829e789c2b70ca3924b4&chksm=fe251b07c95292111731d0c24d917061fb2d19fe9c4bbc04dd60d05570143bd084553c67d09e&scene=58&subscene=0#rd) -- 安全牛 - - [用多方共管思维，推动数据规模化安全流通](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114702&idx=1&sn=a1504f60e21ca8e9ded7fb0a33126f12&chksm=bd147c1d8a63f50bb8208bec35d5eca4da25cd4da1fb76aac68ee320b795fd745d3d8cedfa14&scene=58&subscene=0#rd) - - [好用不贵！11款开源自动化安全测试工具简介](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114702&idx=2&sn=1f7d3b1c3af8e698c8968f41c8410bfc&chksm=bd147c1d8a63f50b9e11f41ac5aa5a4640d6c2fbcd253ac6840b7ef1ec03f823174a92c43350&scene=58&subscene=0#rd) - - [移动互联网应用新规颁布，个人信息保护监管再加码](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114702&idx=3&sn=4c3f11464517d813dd2e90f4f23e87fd&chksm=bd147c1d8a63f50bffb5dd5498099ca6d038dfacae0a785958556c10682fcaa0111fe332f7ba&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [Security 101: Cloud-native Virtual Patching](https://www.trendmicro.com/en_us/devops/22/f/cloud-native-virtual-patching-101.html) diff --git a/archive/2022/2022-06-18.md b/archive/2022/2022-06-18.md deleted file mode 100644 index ba4ef4bc3b..0000000000 --- a/archive/2022/2022-06-18.md +++ /dev/null @@ -1,295 +0,0 @@ -# 每日安全资讯（2022-06-18） - -- HackerOne Hacker Activity - - [sql injection via https://setup.p2p.ihost.com/](https://hackerone.com/reports/1567516) - - [CSRF Bypassed on Logout Endpoint](https://hackerone.com/reports/1091403) - - [Race condition via project team member invitation system.](https://hackerone.com/reports/1108291) -- Security Boulevard - - [Resurgence of Voicemail-themed Phishing Attacks Targeting Key Industry Verticals in US](https://securityboulevard.com/2022/06/resurgence-of-voicemail-themed-phishing-attacks-targeting-key-industry-verticals-in-us/) - - [RiskLens Adds New APIs for Risk Registers and Other Reporting Tools](https://securityboulevard.com/2022/06/risklens-adds-new-apis-for-risk-registers-and-other-reporting-tools/) - - [BSides:Munich 2022 – BSides Outro, BSides Munich Orga](https://securityboulevard.com/2022/06/bsidesmunich-2022-bsides-outro-bsides-munich-orga/) - - [Crosspost: A Simple SOAR Adoption Maturity Model](https://securityboulevard.com/2022/06/crosspost-a-simple-soar-adoption-maturity-model/) - - [Joy Of Tech® ‘Currency Comisery’](https://securityboulevard.com/2022/06/joy-of-tech-currency-comisery/) - - [SBOMs Go Prime Time at RSAC 2022](https://securityboulevard.com/2022/06/sboms-go-prime-time-at-rsac-2022/) - - [Improve MSP Security Offerings with JumpCloud + RADIUS](https://securityboulevard.com/2022/06/improve-msp-security-offerings-with-jumpcloud-radius/) - - [Life is Too Short to Review Spaces](https://securityboulevard.com/2022/06/life-is-too-short-to-review-spaces/) - - [What Is a Software-Defined Perimeter (SDP)?](https://securityboulevard.com/2022/06/what-is-a-software-defined-perimeter-sdp/) -- Tenable Blog - - [CVE-2022-27511, CVE-2022-27512: Patches for Two Citrix Application Delivery Management Vulnerabilities](https://www.tenable.com/blog/cve-2022-27511-cve-2022-27512-patches-for-two-citrix-application-delivery-management) - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now) -- Sploitus.com Exploits RSS Feed - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=F06CBF2F-FED2-572B-B789-BDBB772E59E0&utm_source=rss&utm_medium=rss) -- Der Flounder - - [Slides from the “Leveling Up – Managing admin rights in the enterprise” session at MacDevOpsYVR 2022 conference](https://derflounder.wordpress.com/2022/06/17/slides-from-the-leveling-up-managing-admin-rights-in-the-enterprise-session-at-macdevopsyvr-2022-conference/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [SolarView Compact 6.00 pow Cross-Site Scripting (XSS)](https://cxsecurity.com/issue/WLB-2022060039) - - [Real Player v.20.0.8.310 G2 Control DoGoToURL() Remote Code Execution (RCE)](https://cxsecurity.com/issue/WLB-2022060038) - - [Navigate CMS 2.9.4 Server-Side Request Forgery (SSRF) (Authenticated)](https://cxsecurity.com/issue/WLB-2022060037) -- 跳跳糖 - 安全与分享社区 - - [深入注册表监控](https://tttang.com/archive/1588/) -- 安全客-有思想的安全新媒体 - - [完美落幕 | EISS-2022企业信息安全峰会之北京站（线上）06月10日成功举办](https://www.anquanke.com/post/id/274591) - - [00sec和Allsec双平台联合众测项目来袭，漏洞赏金赚不停！](https://www.anquanke.com/post/id/274561) - - [APISIX 安全评估](https://www.anquanke.com/post/id/274495) - - [信息收集思路&工具分享](https://www.anquanke.com/post/id/274493) - - [Windows将永久禁用IE](https://www.anquanke.com/post/id/274509) -- FreeBuf网络安全行业门户 - - [甲方群里疯传的2022攻防演练实践指南，我们终于拿到了！](https://www.freebuf.com/articles/336593.html) - - [MetaMask 浏览器扩展钱包 demonic 漏洞分析](https://www.freebuf.com/vuls/336572.html) - - [未打补丁的Microsoft Exchange服务器正受勒索软件BlackCat的攻击](https://www.freebuf.com/news/336571.html) - - [FreeBuf周报 | 乌克兰将重要数据迁移北约邻国；美举行2022年度网络盾牌演习](https://www.freebuf.com/articles/336464.html) - - [攻防演练中如何避免浏览器成为攻击方“入口” | FreeBuf甲方群话题讨论](https://www.freebuf.com/articles/neopoints/336530.html) - - [因盗取裸体照片，iCloud黑客被判9年监禁](https://www.freebuf.com/news/336521.html) - - [存储桶上传策略和签名 URL的绕过及利用](https://www.freebuf.com/articles/network/336507.html) - - [威胁行为者利用企业滥用微软Office 365某功能，对企业发起勒索攻击](https://www.freebuf.com/news/336489.html) -- 绿盟科技技术博客 - - [洞见RSA2022 | 数据中台赋能企业数字化转型，如何保障核心数据安全？](http://blog.nsfocus.net/rsa2022-data/) - - [洞见RSA2022 | 如何应对汽车行业转型下的网络安全？](http://blog.nsfocus.net/rsa2022-car/) - - [洞见RSA2022 | 使用Marblerun在Kubernetes上进行可扩展的机密计算](http://blog.nsfocus.net/rsa2022-marblerun-kubernetes/) - - [洞见RSA2022 | 密码学在零信任中的应用](http://blog.nsfocus.net/rsa2022-0/) -- paper - Last paper - - [CobaltStrike 流量分析与入侵检测](https://paper.seebug.org/1922/) -- NVISO Labs - - [Why a successful Cyber Security Awareness month starts … now!](https://blog.nviso.eu/2022/06/17/why-a-successful-cyber-security-awareness-month-starts-now/) -- SpiderLabs Blog from Trustwave - - [The Importance of White-Box Testing: A Dive into CVE-2022-21662](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-importance-of-white-box-testing-a-dive-into-cve-2022-21662/) -- Didier Stevens - - [Update: base64dump.py Version 0.0.22](https://blog.didierstevens.com/2022/06/17/update-base64dump-py-version-0-0-22/) -- Hex Rays - - [Igor’s tip of the week #94: Variable-sized structures](https://hex-rays.com/blog/igors-tip-of-the-week-94-variable-sized-structures/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 25](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-25-3/) -- blog.avast.com EN - - [Meta Bridges 2D And 3D With Crayta | Avast](https://blog.avast.com/meta-2d-3d-crayta) - - [eIDAS 2.0 Amendments | Avast](https://blog.avast.com/eidas-2.0-amendments-analysis) - - [Digital wellbeing: Do free countries have more of it?](https://blog.avast.com/digital-wellbeing-report) - - [Russian Disinformation Spreading Across the Globe | Avast](https://blog.avast.com/russia-ukraine-disinformation) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-06-17 - Matanbuchus with Cobalt Strike](https://www.malware-traffic-analysis.net/2022/06/17/index.html) - - [2022-06-16 - Files for an ISC diary (Matanbuchus with Cobalt Strike)](https://www.malware-traffic-analysis.net/2022/06/15/index.html) -- Malwarebytes Labs - - [ALPHV squeezes victim with dedicated leak site for employees and customers](https://blog.malwarebytes.com/ransomware/2022/06/alphv-aims-to-shock-victim-with-dedicated-leak-site-for-its-employees-and-customers/) -- The Daily Swig | Cybersecurity news and views - - [Russian botnet ‘RSOCKS’ dismantled after hacking millions of devices](https://portswigger.net/daily-swig/russian-botnet-rsocks-dismantled-after-hacking-millions-of-devices) - - [Reddit patches CSRF vulnerability that forced users to view NSFW content](https://portswigger.net/daily-swig/reddit-patches-csrf-vulnerability-that-forced-users-to-view-nsfw-content) - - [RubyGems trials 2FA-by-default in code repo’s latest security effort](https://portswigger.net/daily-swig/rubygems-trials-2fa-by-default-in-code-repos-latest-security-effort) -- 博客园 - 我是小三 - - [某老牌反作弊产品分析-(存在加密漏洞可被中间人攻击) - 我是小三](https://www.cnblogs.com/2014asm/p/16387590.html) -- daniel.haxx.se - - [curl is REUSE compliant](https://daniel.haxx.se/blog/2022/06/17/curl-is-reuse-compliant/) -- HAHWUL - - [NoSQL Injection](https://www.hahwul.com/cullinan/nosql-injection/) -- KitPloit - PenTest & Hacking Tools - - [OSIPs - Gathers All Valid IP Addresses From All Text Files From A Directory, And Checks Them Against Whois Database, TOR Relays And Location](http://www.kitploit.com/2022/06/osips-gathers-all-valid-ip-addresses.html) - - [LambdaGuard - AWS Serverless Security](http://www.kitploit.com/2022/06/lambdaguard-aws-serverless-security.html) -- 奇客Solidot–传递最新科技情报 - - [SpaceX 解雇至少五名批评 CEO 的员工](https://www.solidot.org/story?sid=71869) - - [网信办发布跟帖管理征求意见稿](https://www.solidot.org/story?sid=71868) - - [中文维基用户被发现大规模篡改古罗斯史](https://www.solidot.org/story?sid=71867) - - [币值暴跌矿工减产](https://www.solidot.org/story?sid=71866) - - [深度学习与创新者困境鲜为人知的关系](https://www.solidot.org/story?sid=71865) - - [法院裁定大象 Happy 不是人](https://www.solidot.org/story?sid=71864) - - [马斯克对 Twitter 员工表示，“优秀”员工可远程工作](https://www.solidot.org/story?sid=71863) - - [为什么难以摆脱钯？](https://www.solidot.org/story?sid=71862) - - [Nothing 公司透露首款手机 Phone (1)](https://www.solidot.org/story?sid=71861) - - [第三艘航母福建号下水](https://www.solidot.org/story?sid=71860) - - [特斯拉等先进驾驶系统汽车安全性引发担忧](https://www.solidot.org/story?sid=71859) -- Secureworks Blog - - [Real World Knowledge and Lessons from Cybersecurity Challenges](https://www.secureworks.com/blog/real-world-knowledge-and-lessons-from-cybersecurity-challenges) -- 黑海洋 - WIKI - - [NFC卡模拟 v8.1.3 专业版已付费（安卓）](https://blog.upx8.com/2801) - - [分身有术Pro v3.50.0 至尊Vip会员版自动抢红包、虚拟定位（安卓）](https://blog.upx8.com/2800) -- IntelTechniques Blog - - [The Privacy, Security, & OSINT Show – Episode 266](https://inteltechniques.com/blog/2022/06/17/the-privacy-security-osint-show-episode-266/) -- bellingcat - - [Meet the Irregular Troops Backing up Russia’s Army in the Kharkiv Region](https://www.bellingcat.com/news/2022/06/17/meet-the-irregular-troops-backing-up-russias-army-in-the-donbas/) -- Red XOR Blue - - [Automating Cobalt Strike with Python](http://blog.redxorblue.com/2022/06/automating-cobalt-strike-with-python.html) -- Il Disinformatico - - [La rete di ricarica Tesla (35.000 colonnine) si apre anche alle auto di altre marche](http://attivissimo.blogspot.com/2022/06/la-rete-di-ricarica-tesla-35000.html) - - [Podcast RSI - Il software è diventato senziente, secondo un ingegnere di Google](http://attivissimo.blogspot.com/2022/06/podcast-rsi-il-software-e-diventato.html) -- TS-WAY - - [Weekly Threats N. 24 2022](https://www.ts-way.com/it/weekly-threats/2022/06/17/weekly-threats-n-24-2022/) -- D3Lab - - [BidenCash another Credit Card Market publishes data for Free!](https://www.d3lab.net/bidencash-another-credit-card-market-publishes-data-for-free/) -- Securityinfo.it - - [Pegasus diventa americano?](https://www.securityinfo.it/2022/06/17/pegasus-diventa-americano/?utm_source=rss&utm_medium=rss&utm_campaign=pegasus-diventa-americano) - - [Dark Web Index: il prezzo dei prodotti illegali](https://www.securityinfo.it/2022/06/17/dark-web-index-il-prezzo-dei-prodotti-illegali/?utm_source=rss&utm_medium=rss&utm_campaign=dark-web-index-il-prezzo-dei-prodotti-illegali) -- text/plain - - [“Batteries-Included” vs “Bloated”](https://textslashplain.com/2022/06/16/batteries-included-vs-bloated/) -- Diritto dell'Informatica - - [Ransomware in azienda e PA: come difendersi?](https://www.dirittodellinformatica.it/ransomware-in-azienda-e-pa-come-difendersi/) -- SANS Internet Storm Center, InfoCON: green - - [Critical vulnerability in Splunk Enterprise?s deployment server functionality, (Fri, Jun 17th)](https://isc.sans.edu/diary/rss/28760) - - [Malspam pushes Matanbuchus malware, leads to Cobalt Strike, (Fri, Jun 17th)](https://isc.sans.edu/diary/rss/28752) - - [ISC Stormcast For Friday, June 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=8054, (Fri, Jun 17th)](https://isc.sans.edu/diary/rss/28754) -- NetSPI - - [NetSPI Named a Top Minnesota Workplace and Honored for its Cultural Excellence](https://www.netspi.com/news/press-release/top-200-minnesota-workplaces/) -- Trend Micro Research, News and Perspectives - - [Websites Hosting Fake Cracks Spread Updated CopperStealer Malware](https://www.trendmicro.com/en_us/research/22/f/websites-hosting-fake-cracks-spread-updated-copperstealer.html) -- Threatpost - - [China-linked APT Flew Under Radar for Decade](https://threatpost.com/apt-flew-under-radar-decade/179995/) -- Deeplinks - - [EFF Warns Another Court About the Dangers of Broad Site-Blocking Orders](https://www.eff.org/deeplinks/2022/06/eff-warns-another-court-about-dangers-broad-site-blocking-orders) - - [Copyright "Small Claims" Quasi-Court Opens. Here's Why Many Defendants Will Opt Out.](https://www.eff.org/deeplinks/2022/06/copyright-small-claims-quasi-court-opens-heres-why-many-defendants-will-opt-out) - - [Our Digital Lives Rest on a Robust, Flexible, and Stable Fair Use Regime](https://www.eff.org/deeplinks/2022/06/our-digital-lives-rest-robust-flexible-and-stable-fair-use-regime) -- Dark Reading - - [Ransomware and Phishing Remain IT's Biggest Concerns](https://www.darkreading.com/edge-threat-monitor/ransomware-and-phishing-remain-it-s-biggest-concerns) - - [WordPress Plug-in Ninja Forms Issues Update for Critical Bug](https://www.darkreading.com/threat-intelligence/ninja-forms-wordpress-plugin-issues-update-against-code-injection-vuln) - - [DeadBolt Ransomware Actively Targets QNAP NAS Devices — Again](https://www.darkreading.com/attacks-breaches/deadbolt-ransomware-actively-targets-qnap-nas-devices----again) - - [Atlassian Confluence Server Bug Under Active Attack to Distribute Ransomware](https://www.darkreading.com/attacks-breaches/atlassian-confluence-server-vulnerability-active-attack-ransomware) - - [Can We Make a Global Agreement to Halt Attacks on Our Energy Infrastructure?](https://www.darkreading.com/attacks-breaches/can-we-make-a-global-agreement-to-halt-attacks-on-our-energy-infrastructure-) - - [Tackling 5 Challenges Facing Critical National Infrastructure Today](https://www.darkreading.com/dr-tech/tackling-5-challenges-facing-critical-national-infrastructure-today) -- TorrentFreak - - [Music Publishers Launch Crackdown on Copyright Infringing Apps](https://torrentfreak.com/music-publishers-launch-crackdown-on-copyright-infringing-apps-220617/) - - [Big Tech Protests US Pirate Site Injunction “Power Grab” Against Cloudflare](https://torrentfreak.com/big-tech-protests-us-pirate-site-injunction-power-grab-against-cloudflare-220617/) -- Instapaper: Unread - - [Cops Will Be Able to Scan Your Fingerprints With a Phone](https://www.wired.co.uk/article/police-contactless-fingerprints-photos) - - [Power Up Memory Forensics with Memory Baseliner](https://www.sans.org/blog/power-up-memory-forensics-with-memory-baseliner/) - - [Enterprise Forensics Traditions vs Reality in Modern DFIR](https://www.forensicfocus.com/webinars/enterprise-forensics-traditions-vs-reality-in-modern-dfir/) - - [Cyber Threat Intelligence sul Dark Web](https://luca-mercatanti.com/2022/06/16/cyber-threat-intelligence-sul-dark-web/) - - [Cybersicurezza in Italia perché non si trovano candidati](https://www.guerredirete.it/cybersicurezza-italia-perche-non-si-trovano-candidati/) - - [This new Android malware bypasses multi-factor authentication to steal your passwords](https://www.zdnet.com/article/this-new-android-malware-bypasses-multi-factor-authentication-to-steal-your-passwords/) - - [2,000 arrests in crackdown on social engineering and business email scams](https://www.zdnet.com/article/2000-arrests-in-crackdown-on-social-engineering-and-business-email-scams/) -- Computer Forensics - - [How to forensics copy Google Drive?](https://www.reddit.com/r/computerforensics/comments/veb2hx/how_to_forensics_copy_google_drive/) - - [Dept just added a computer liaison program to our ranks. They are to assist with the Computer Crime Task Force. What trainings, certifications or programs can be recommended in taking outside of vendor specific training?](https://www.reddit.com/r/computerforensics/comments/ve2yk5/dept_just_added_a_computer_liaison_program_to_our/) -- Social Engineering - - [What would be a perfect algorithm for Variable Rewards to form a habit in someone?](https://www.reddit.com/r/SocialEngineering/comments/vedfxz/what_would_be_a_perfect_algorithm_for_variable/) - - [Any advice to control one's mood when saying a lie?](https://www.reddit.com/r/SocialEngineering/comments/venn2l/any_advice_to_control_ones_mood_when_saying_a_lie/) -- ICT Security Magazine - - [Fuzzing e sicurezza dei DNS: Synopsys e il caso BIND 9](https://www.ictsecuritymagazine.com/notizie/fuzzing-e-sicurezza-dei-dns-synopsys-e-il-caso-bind-9/) -- 青藤云安全 - - [Webshell检测引擎：青藤开放200个雷火SaaS版免费账号！](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650835341&idx=1&sn=c7186aecfda3f9b9cb33710b21401c9b&chksm=80dbea28b7ac633eee1abdcf187cd6a19fa6fd0acca60f037f21dee81df8a8b1ca647993908a&scene=58&subscene=0#rd) -- The Register - Security - - [Inverse Finance stung for $1.2 million via flash loan attack](https://go.theregister.com/feed/www.theregister.com/2022/06/17/inverse_finance_heist/) - - [US senators seek ban on sale of health location data](https://go.theregister.com/feed/www.theregister.com/2022/06/17/bill-location-data-ban-roe/) - - [International operation takes down Russian RSOCKS botnet](https://go.theregister.com/feed/www.theregister.com/2022/06/17/rsocks_russia_botnet/) - - [Microsoft Defender goes cross-platform for the masses](https://go.theregister.com/feed/www.theregister.com/2022/06/17/microsoft_defender/) - - [Cookie consent crumbles under fresh UK data law proposals](https://go.theregister.com/feed/www.theregister.com/2022/06/17/cookies_crumble_in_uk_data/) - - [Password recovery from beyond the grave](https://go.theregister.com/feed/www.theregister.com/2022/06/17/on_call/) - - [Interpol anti-fraud operation busts call centers behind business email scams](https://go.theregister.com/feed/www.theregister.com/2022/06/17/interpol_operation_first_light_fraud_scam/) -- 永安在线情报平台 - - [永安在线发现针对中国数字政务的攻击团伙，7省份的近4亿公民数据受威胁](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493504&idx=1&sn=29dbb091f01eaf71283a1493543a3db5&chksm=eb12c1bbdc6548ad7280cea9b62ecfd00aa6a5cd570eb626178998cbb4f0eb938fa260f363c3&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【漏洞通告】Windows SMB 拒绝服务漏洞CVE-2022-32230](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261913&idx=1&sn=f6744b2cbe1d4fff9e261e972fc31f42&chksm=f3e273edc495fafbb26b2b08b04d86cec26bab67b08a775b5eed8d0c71ba6aa3eec73345e675&scene=58&subscene=0#rd) - - [海莲花组织2022年6月份针对国内地区的攻击活动样本分析](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261913&idx=2&sn=d4e8a310a3bbac6ad46142b30e02a3c7&chksm=f3e273edc495fafb5c4a558af506f614fc046fea4a15369c36e16411beef0835188cecde5695&scene=58&subscene=0#rd) - - [【恶意文件通告】HelloXD恶意文件分析](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261913&idx=3&sn=07b8f2fa28d2d18c9e87747b66123c00&chksm=f3e273edc495fafb25b1400887e5f704f1511fd50199f14e97fd4b21c848da68a86749221906&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [【火绒安全周报】勒索软件与恶意软件联手/俄利用漏洞入侵乌机构](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247504723&idx=1&sn=ee6635e9205c54248d3c6eff47d02eed&chksm=eb700d6cdc07847ae68ac80c7d41e2aae12e61c5f9e1e8ae69e2c611a7648058a5a684b3d289&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jun. 17th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495571&idx=1&sn=c2dbb69fce048e6e3bab45b813c92745&chksm=ce96a2adf9e12bbb72e70928d31067e4930d30533cc3f97bff39bd7761c8af2c8dfd78fa1ab3&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [OSIPs - Gathers All Valid IP Addresses From All Text Files From A Directory, And Checks Them Against Whois Database, TOR Relays And Location](http://www.kitploit.com/2022/06/osips-gathers-all-valid-ip-addresses.html) - - [LambdaGuard - AWS Serverless Security](http://www.kitploit.com/2022/06/lambdaguard-aws-serverless-security.html) -- 安恒威胁情报中心 - - [安恒高级安全威胁情报周报（2022.6.11~6.17）](https://mp.weixin.qq.com/s?__biz=MzI1MDU5NjYwNg==&mid=2247495700&idx=1&sn=29427d43d0a6e40484d24772ea9f4f2d&chksm=e9fd6d85de8ae4932b2711d097d65f6d413aa1b77626ededad2061710d5d0852f8a753dff588&scene=58&subscene=0#rd) - - [警惕！针对聚合支付商户的定向网络盗刷](https://mp.weixin.qq.com/s?__biz=MzI1MDU5NjYwNg==&mid=2247495700&idx=2&sn=6d150e3d871e7d3ce8662b45587e57f4&chksm=e9fd6d85de8ae493f019fc3e06ba21b3a310e55883d6d9d39f9c270c179a724ca34742a6a00e&scene=58&subscene=0#rd) - - [安恒信息全球网络安全5月月报完整版下载](https://mp.weixin.qq.com/s?__biz=MzI1MDU5NjYwNg==&mid=2247495700&idx=3&sn=b462da0ff5073adda8738d71cfe7684a&chksm=e9fd6d85de8ae493352426fc5b96658d8846842042cc641e4e038b72a8b9de396a89d53688f8&scene=58&subscene=0#rd) -- 互联网安全内参 - - [非洲最大连锁超市遭勒索团伙敲诈：600GB数据失窃](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503550&idx=1&sn=a074107484b4957e5889c938495e915b&chksm=ebfa899edc8d0088f2efed23512b0ed87256e5407fd55375c122a06ae9f29593bcce16e8fc40&scene=58&subscene=0#rd) - - [数据安全级别可定价！《数据资产评估指导意见 (征求意见稿)》发布](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503550&idx=2&sn=3c293edd9c1aaa98c776d1a2d5fd9843&chksm=ebfa899edc8d0088c225fc7cd904425093efdf375f995804945bfc8b5a0fbe61e5a1ed0dd4b6&scene=58&subscene=0#rd) - - [Windows SMB拒绝服务漏洞 (CVE-2022-32230) 安全风险通告](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503550&idx=3&sn=143d95fc75127e6285ab1a65c5e3a09f&chksm=ebfa899edc8d008835323fd04aa90da6b09d494d1a3061696260bc97487ad49cfd295d1db0b5&scene=58&subscene=0#rd) - - [全球云计算大会·中国站即将启幕，见证科技下一个十年战场](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503550&idx=4&sn=0f29e12af1b9a3e4b237a797ca17e013&chksm=ebfa899edc8d00889df8c26f6a7a65686a18bd3d3e501c512b6b150e8060c827c3b3bfeb7eb4&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [A good course on API Tesing?](https://www.reddit.com/r/HowToHack/comments/vebebi/a_good_course_on_api_tesing/) - - [What do you recommend I try to learn next?](https://www.reddit.com/r/HowToHack/comments/vetihv/what_do_you_recommend_i_try_to_learn_next/) - - [alternatives for old tools](https://www.reddit.com/r/HowToHack/comments/veof1i/alternatives_for_old_tools/) - - [penetrating testing of an SSO web app](https://www.reddit.com/r/HowToHack/comments/ve91on/penetrating_testing_of_an_sso_web_app/) - - [Any way to hack and enable the local admin account? (Locked myself out of a Windows Server)](https://www.reddit.com/r/HowToHack/comments/vedb79/any_way_to_hack_and_enable_the_local_admin/) -- 绿盟科技研究通讯 - - [RSAC议题解读｜真实云安全事件复盘与思考](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492295&idx=1&sn=c944e98857bdf5ca0addaf25eaaa56a6&chksm=e84c4418df3bcd0ecad386172a6389b219ac863de585226b1c91652ddb1541e893f284d98b5e&scene=58&subscene=0#rd) -- 代码卫士 - - [热门Fastjson 中出现高危RCE漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512404&idx=1&sn=3f6c217dd2037970aa2fb88576e72223&chksm=ea94803edde30928208f75e8e32f8dad8b673a8bbbddd571da9dc4a14718f8cd9403b3dac39d&scene=58&subscene=0#rd) - - [Anker Eufy 智能设备系统易受严重的RCE漏洞影响](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512404&idx=2&sn=c658bb128dac22af8e2041f4d86d9c98&chksm=ea94803edde309286702f0b3b4638f0e87262ccd067fca6402a3f21d7cd880e36026452daa2e&scene=58&subscene=0#rd) - - [黑客利用已存在三年之久的 Telerik 漏洞部署 Cobalt Strike](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512404&idx=3&sn=0a2fc411015676c5b452cccf54ea5489&chksm=ea94803edde30928b210233c0861c0dbb30f257cb589c1889182de311e5db510fde7d392a632&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [Web协议层安全之websocket安全分析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247493997&idx=1&sn=9e6b5b6b1c1728a64980397ceb82aeb7&chksm=fa523cd3cd25b5c525c64462beb9757009668817140bc78ecaf38c15ff4957964e035160e201&scene=58&subscene=0#rd) -- Troy Hunt's Blog - - [Weekly Update 300](https://www.troyhunt.com/weekly-update-300/) -- Security Affairs - - [Chinese DriftingCloud APT exploited Sophos Firewall Zero-Day before it was fixed](https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html) - - [Experts link Hermit spyware to Italian surveillance firm RCS Lab and a front company](https://securityaffairs.co/wordpress/132363/malware/hermit-spyware-italian-surveillance-firm.html) - - [A Microsoft 365 feature can ransom files on SharePoint and OneDriveCould](https://securityaffairs.co/wordpress/132353/hacking/microsoft-365-feature-ransomware.html) -- 安全牛 - - [如何制定一个可落地的漏洞补丁管理策略？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114742&idx=1&sn=0f318edb922b5718bea97387d2721cbb&chksm=bd147c258a63f533e3f2d92ef3069238fd3762d6133942837a5fb6b01ca467130432812b893f&scene=58&subscene=0#rd) - - [简析入侵和攻击模拟（BAS）技术的关键能力与价值](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114742&idx=2&sn=0a85f986080e83e8f52e262387cf6cd7&chksm=bd147c258a63f5339366d479ad57bb535568e36df1343209c44136cccf9352b114c42cec1ba6&scene=58&subscene=0#rd) - - [以智能化增强端点安全能力](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114742&idx=3&sn=cc230913ae22e1b308fa8f947d1a2001&chksm=bd147c258a63f533f6c52ae6ed9b2862f16a2d7ef4434d5d71d50d089e0d5242a185741aba36&scene=58&subscene=0#rd) -- M01NTeam - - [每周蓝军技术推送（2022.6.11-6.17）](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247488376&idx=1&sn=be1b41db5e3c5e93758987531e5a0fb2&chksm=c187d369f6f05a7f9bcc52cc44c68858c30002db429c627d0d35c3fe13e708187a01ae5e9d84&scene=58&subscene=0#rd) -- Full Disclosure - - [SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series](https://seclists.org/fulldisclosure/2022/Jun/36) -- Blackhat Library: Hacking techniques and research - - [Is there a way for someone to view your private Instagram account that hasn't been patched?](https://www.reddit.com/r/blackhat/comments/vehz3l/is_there_a_way_for_someone_to_view_your_private/) -- 长亭科技 - - [实战积淀，长亭再获IDC WAF中国市场份额第四](https://mp.weixin.qq.com/s?__biz=MzIwNDA2NDk5OQ==&mid=2651381723&idx=1&sn=2205697907fc4f028034794b6d3d4050&chksm=8d39ae53ba4e2745dc1fd8f6d8e9b6b1737c1dc09aaccba32d48750c7f25f03b9ead4241c369&scene=58&subscene=0#rd) - - [共向未来 合作双赢|长亭2022年合作伙伴招募会深圳首站成功举办](https://mp.weixin.qq.com/s?__biz=MzIwNDA2NDk5OQ==&mid=2651381723&idx=2&sn=52e9cc87fd237fdd561e0a0524a07d75&chksm=8d39ae53ba4e2745743efa18fb2f24e1a9b2ec98313133d585bb4d3705bc0d4f306cf3366de6&scene=58&subscene=0#rd) -- Seebug漏洞平台 - - [404星链计划新项目发布，速来升级装备，一秒回血](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650961752&idx=1&sn=13c769c2073ed4f3897d561d77ef59ae&chksm=8079356ab70ebc7c02a0c1614ea6a2774faf9494020d344313f29dace24bb765a8607440fde2&scene=58&subscene=0#rd) -- GeekPwn - - [分享图片](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650344792&idx=1&sn=4c7c0388908bdf027f229ce143047a11&chksm=8740b69db0373f8baa24fe1fa9aee0afacf7da525eea31b58bf51edd290466e4b3513b66bf0b&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [互联网数据泄漏监测平台，保护企业关键数字资产和数据安全](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527473&idx=1&sn=771efbd5a91d6618053f94d4a0dcb69b&chksm=c1e9e060f69e6976e0596730eba43f931714dc93f0f8cdd8f8c7b35b1038eea07a907b16ca68&scene=58&subscene=0#rd) - - [黑客用机器学习发动攻击的九种方法](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527473&idx=2&sn=bba08c1a9d3d3b8d595acf3aa369053e&chksm=c1e9e060f69e69760502d48104ac67643ae8b0d1456bc614146d945df5bafbff51cb7470f8fa&scene=58&subscene=0#rd) - - [缺乏集中的可见性是OT网络安全的问题根源](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527473&idx=3&sn=d68426fc45a8440575d5cdbdfd648700&chksm=c1e9e060f69e6976fe9036e264af365b79d15e84594447387681d934ff19d54d109ff5b5966d&scene=58&subscene=0#rd) -- Yak Project - - [进无止境！Yak官网焕新升级。](https://mp.weixin.qq.com/s?__biz=MzAxOTAzOTU3Mw==&mid=2247488014&idx=1&sn=3dcfbf80a024fc11c5a8be192bf579b3&chksm=9bcc4634acbbcf2290a99683f6b59369aa377f77c328969eafc866ae953237810657edca8763&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.06.17）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491081&idx=1&sn=cc2dc742f3900e9f9f55daebf0e01bc5&chksm=fe251b08c952921e362fd27e88cc489c1a6340a00944348039ced95ab68eb193d84ca76c9764&scene=58&subscene=0#rd) -- Schneier on Security - - [Friday Squid Blogging: Signature Steamed Giant Squid with Thai Lime Sauce](https://www.schneier.com/blog/archives/2022/06/friday-squid-blogging-signature-steamed-giant-squid-with-thai-lime-sauce.html) - - [Tracking People via Bluetooth on Their Phones](https://www.schneier.com/blog/archives/2022/06/tracking-people-via-bluetooth-on-their-phones.html) -- 字节跳动技术团队 - - [2022 春节抖音视频红包系统设计与实现](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495155&idx=1&sn=f7faaf96452f092bba6fbcaa914d9084&chksm=e9d32611dea4af07f52d16773f810ba5952700b385d34ba1a050dd27939e1e00790246076d14&scene=58&subscene=0#rd) - - [A/B 测试助力游戏业务增长](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495155&idx=2&sn=dbc28aaf3b637de75e72d45c8b6e18ef&chksm=e9d32611dea4af07419a529c0adc4476edb559810f36f47a3e0d7bb2c8950b07887713f213e8&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [【警惕】6.18购物节将至，山寨网贷木马“BHY”进入新一轮爆发期](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247489872&idx=1&sn=332979d39b9dd47fcd43c3f9519ae197&chksm=ec6a6978db1de06ea58b52d6ec32bff0280df950063422b4dbca4e9c9971467a3221bbfaccae&scene=58&subscene=0#rd) -- 情报分析师 - - [【舆情分析报告】唐山烧烤打人案](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506416&idx=1&sn=ea640a23d64f5b6e1fd24be8e1a9e26a&chksm=8716aafbb06123ede02a180cecff3678ef367fca10fdd28c1fbd597974a760875ad33e5c32f1&scene=58&subscene=0#rd) - - [中国公安首个免费开放的资金分析平台免费开放注册了！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506416&idx=2&sn=f7a2f301bcaaeda0f399d18cc3ac5cc8&chksm=8716aafbb06123ed44c7091e10e4751a19601cb9c8586275f5158bed1dc537553afc2ceb4f87&scene=58&subscene=0#rd) - - [【智库报告】法国2022年印太战略分析](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506416&idx=3&sn=5dea584435bdbc984d57008d03a38255&chksm=8716aafbb06123edbe99249c7c198f3c4f02f0d0ac51a4c2b7f84cfe26e3f98fa905086dcd91&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [CSRF leads to account takeover in Yahoo!](https://www.reddit.com/r/netsec/comments/vetgu3/csrf_leads_to_account_takeover_in_yahoo/) - - [Securing OT Network Management Systems: Siemens SINEC NMS](https://www.reddit.com/r/netsec/comments/vef213/securing_ot_network_management_systems_siemens/) - - [Analyzing the latest version of Matanbuchus](https://www.reddit.com/r/netsec/comments/vem58k/analyzing_the_latest_version_of_matanbuchus/) - - [BRATA is evolving into an APT | Cleafy Labs](https://www.reddit.com/r/netsec/comments/ve8k27/brata_is_evolving_into_an_apt_cleafy_labs/) - - [AWS Lambda Command Injection](https://www.reddit.com/r/netsec/comments/veahwx/aws_lambda_command_injection/) -- OPPO安全应急响应中心 - - [【重要公告】OSRC季度奖励大升级！](https://mp.weixin.qq.com/s?__biz=MzUyNzc4Mzk3MQ==&mid=2247489653&idx=1&sn=838f24f5527fcf499058d340ca164b8c&chksm=fa7b1939cd0c902f9dc9a4d9630598574c1cb62317afd66f3a596bb03af6090213ee495021a3&scene=58&subscene=0#rd) - - [2022年5月奖励公告](https://mp.weixin.qq.com/s?__biz=MzUyNzc4Mzk3MQ==&mid=2247489653&idx=2&sn=c84fa9b75e41d9365e9e0807f58cf15e&chksm=fa7b1939cd0c902f23d4bce7354feec329590d50c3d7652a4ec041abebb7b2cd16f8e0613e70&scene=58&subscene=0#rd) -- NVISO Labs - - [Why a successful Cyber Security Awareness month starts … now!](https://blog.nviso.eu/2022/06/17/why-a-successful-cyber-security-awareness-month-starts-now/) -- 火线Zone - - [在AWS上使用MFA钓鱼用户](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495587&idx=1&sn=27090e2b93dda73b7639ae9b47588f44&chksm=eaa96783dddeee956fe74753ccd70ed9581c9c2c20fb0c936519ee89608b6c4d725c2d4de802&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】2020 “第五空间” 智能安全大赛 Web Writeup](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772352&idx=1&sn=12211374119beed6dd07f46434a0f8ce&chksm=8893612fbfe4e839481aad2ab1d86dd2e09eeb23eb7d7630417c27923c3c9cd44cfcfda3023f&scene=58&subscene=0#rd) - - [【安全头条】Windows将永久禁用IE](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772352&idx=2&sn=6e5fc37291d1ff29e4de66f343739039&chksm=8893612fbfe4e8393746e09058afd8db25127f36397c13a7f946427dbe7fa340e351b950324e&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-17)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958518&idx=1&sn=5338c61e637d49e4043f6cfceeb48579&chksm=8baecc69bcd9457fc25e7d43b9934707a17c149b73781fc0e994e9d52f3717bb4f83a2b8f7cd&scene=58&subscene=0#rd) -- 慢雾科技 - - [MetaMask 浏览器扩展钱包 demonic 漏洞分析](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495755&idx=1&sn=c53a9c7408feda41482f9d284f33d082&chksm=fdde8ecccaa907daaa563b27b528bb2f499be89b80dbf0ff9c87988b6a5db3565f2d0fb17f52&scene=58&subscene=0#rd) -- 看雪学院 - - [2022DASCTF MAY 出题人挑战赛](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453196&idx=1&sn=9b810ff4dad3b7961a22892a685e37e7&chksm=b18e344686f9bd5095a2f8afd873518cb7e56c7bb868ec9a20e88ec14f8843d37c12dc490789&scene=58&subscene=0#rd) - - [618知识蓄能大作战，商城上新超值抢购！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453196&idx=2&sn=2da1176b1cdf83b47df49d17d9cd9915&chksm=b18e344686f9bd509ab5786aa817d7d482d7bda47da06e359fdbfe6f86845b9395ac8708b664&scene=58&subscene=0#rd) - - [抓捕两千人！国际刑警组织打击电信和社会工程学诈骗](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453196&idx=3&sn=f92c29eb5f0a74bdbd100365b96e987e&chksm=b18e344686f9bd5094ac02cc70156bf8c5a92b9cbc94c2057d81fe041fa3a3cc81aa9325f9de&scene=58&subscene=0#rd) - - [职位又更新啦！高薪工作速来](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453196&idx=4&sn=f6d394b1a226ed6a936af89e411c785d&chksm=b18e344686f9bd501bdf9ef6887a61999942ad54d19cb4286916d3cd80d4f893b8eb52d56219&scene=58&subscene=0#rd) - - [反勒索软件开发实战篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453196&idx=5&sn=b8c7573c7746804343bf0eb3270d265e&chksm=b18e344686f9bd50fb4168700b6713a37338d03747d8d51329925cc3e533c2b07bb21a447928&scene=58&subscene=0#rd) -- 奇安信CERT - - [Cisco Small Business远程代码执行漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496333&idx=1&sn=78a16eca8dff8a7e3863a481103ec60c&chksm=fe79d615c90e5f0366e79776af5da445231a2559168b2be92c8b6841a60c80bd2a4d771eef28&scene=58&subscene=0#rd) -- 腾讯安全威胁情报中心 - - [腾讯安全威胁情报中心推出2022年5月必修安全漏洞清单](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500338&idx=1&sn=2fa717b3367276c07c87f3f2a4163431&chksm=ec9f1b41dbe8925763f9944ec19e2210152a563434ea2abf75df97b7698dc337151bb7f59c6e&scene=58&subscene=0#rd) -- 数世咨询 - - [第二届数字安全大会618重磅开启！](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493812&idx=1&sn=8947fa384c580fed5ba75d7d922e4ded&chksm=c1449a09f633131f92b2e47445491d6a941d74c841d020121f039402bf0422b551e63c7c64a3&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [钓鱼之王 — APT-Q-2（Kimsuky）近期以多个话题针对韩国的鱼叉攻击活动分析](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247501634&idx=1&sn=c796f548e62dfeac493c8b841f2bb52b&chksm=ea663035dd11b923cc0ebf1714664104e2824eb47aeec44a6a2aff77a940eb2d48fa364faaae&scene=58&subscene=0#rd) - - [每周高级威胁情报解读(2022.06.09~06.16)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247501634&idx=2&sn=875365efd8b5f31dd4f013833a6d55be&chksm=ea663035dd11b923057ac35f375593c4326d6dd5d6cb59d1d200c1156ac482cfe1678f0f1f33&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [which among the two options is the Best](https://www.reddit.com/r/netsecstudents/comments/vekcl9/which_among_the_two_options_is_the_best/) -- 360漏洞云 - - [实力入榜！360获中国信通院首批“软件供应链安全实验室成员单位代表”授牌](https://mp.weixin.qq.com/s?__biz=MzI4NTUzNTc0MQ==&mid=2247498559&idx=1&sn=5da6313c349568734c109ecb8b319c5a&chksm=ebe807addc9f8ebbb40c97087277933dd6df442d48efb5503e4c5b2dd55fb248d62df3005ab8&scene=58&subscene=0#rd) -- Graham Cluley - - [QNAP warns of new DeadBolt ransomware attack locking up NAS devices](https://www.bitdefender.com/blog/hotforsecurity/qnap-warns-of-new-deadbolt-ransomware-attack-locking-up-nas-devices/) - - [NinjaForms WordPress plugin, actively exploited in wild, receives forced security update](https://grahamcluley.com/ninjaforms-wordpress-plugin-actively-exploited-in-wild-receives-forced-security-update/) - - [Heineken giving away free beer for Father’s Day? It’s a WhatsApp scam](https://www.bitdefender.com/blog/hotforsecurity/heineken-giving-away-free-beer-for-fathers-day-its-a-whatsapp-scam/) -- Dark Space Blogspot - - [Quali Piattaforme Sono Coinvolte Con Three Arrows Capital?](http://darkwhite666.blogspot.com/2022/06/quale-piattaforme-sono-coinvolte-con.html) diff --git a/archive/2022/2022-06-19.md b/archive/2022/2022-06-19.md deleted file mode 100644 index 59499b2b4c..0000000000 --- a/archive/2022/2022-06-19.md +++ /dev/null @@ -1,92 +0,0 @@ -# 每日安全资讯（2022-06-19） - -- HackerOne Hacker Activity - - [Broken access control](https://hackerone.com/reports/1539426) -- Sec-News 安全文摘 - - [我自己博客的一个XSS的故事](https://wiki.ioin.in/url/MM0D) -- Security Boulevard - - [USENIX Enigma 2022 – Dr. Gillian “Gus” Andrews’ ‘Can The Fight Against Disinformation Really Scale?’](https://securityboulevard.com/2022/06/usenix-enigma-2022-dr-gillian-gus-andrews-can-the-fight-against-disinformation-really-scale/) - - [IRA Financial versus Gemini – security questions to ponder from a crypto IRA hack](https://securityboulevard.com/2022/06/ira-financial-versus-gemini-security-questions-to-ponder-from-a-crypto-ira-hack/) - - [CommitStrip ‘GIT-LFS’](https://securityboulevard.com/2022/06/commitstrip-git-lfs/) - - [USENIX Enigma 2022 – Justin Brookman’s ‘The Global Privacy Control: Exercising Legal Rights At Scale’](https://securityboulevard.com/2022/06/usenix-enigma-2022-justin-brookmans-the-global-privacy-control-exercising-legal-rights-at-scale/) - - [Hackers Also Have Financial Reporting And Quotas :)](https://securityboulevard.com/2022/06/hackers-also-have-financial-reporting-and-quotas/) -- 安全小飞侠的窝 - - [关于BIS的《信息安全控制：网络安全条目》的解读及影响分析](http://avfisher.win/archives/1340) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Another Massive Embedded Malware Attack](http://ddanchev.blogspot.com/2007/11/another-massive-embedded-malware-attack.html) - - [209.1 Host Locked](http://ddanchev.blogspot.com/2007/12/2091-host-locked.html) - - [Fake Codec Serving Domains from Digg.com's Comment Spam Attack](http://ddanchev.blogspot.com/2009/02/fake-codec-serving-domains-from-diggcom.html) - - [Inside a Botnet's Phishing Activities](http://ddanchev.blogspot.com/2008/02/inside-botnet-phishing-activities.html) - - [How to Take Down the Conti Ransomware Gang - A Practical And Relevant Case Study on Taking Down Cybercriminal Infrastructure - A Practical Example](http://ddanchev.blogspot.com/2022/06/how-to-take-down-conti-ransomware-gang.html) -- Didier Stevens - - [New Tool: sortcanon.py](https://blog.didierstevens.com/2022/06/18/new-tool-sortcanon-py/) -- HAHWUL - - [EL(Expression Language) Injection](https://www.hahwul.com/cullinan/el-injection/) - - [OGNL(Object-Graph Navigation Language) Injection](https://www.hahwul.com/cullinan/ognl-injection/) -- KitPloit - PenTest & Hacking Tools - - [Hunt-Sleeping-Beacons - Aims To Identify Sleeping Beacons](http://www.kitploit.com/2022/06/hunt-sleeping-beacons-aims-to-identify.html) - - [Nightingale - Docker Environment For Pentesting Which Having All The Required Tool For VAPT](http://www.kitploit.com/2022/06/nightingale-docker-environment-for.html) -- Shubham Shah - - [The ugly side of collaboration in bug bounties](http://shubs.io/the-ugly-side-of-collaboration-in-bug-bounties/) -- Shells.Systems - - [Protected: Oh my API, abusing TYK cloud API management to hide your malicious C2 traffic](https://shells.systems/oh-my-api-abusing-tyk-cloud-api-management-to-hide-your-malicious-c2-traffic/) -- bellingcat - - [Inside the Secretive World of Irish Limited Partnerships](https://www.bellingcat.com/news/2022/06/18/inside-the-secretive-world-of-irish-limited-partnerships/) -- SANS Internet Storm Center, InfoCON: green - - [Decoding Obfuscated BASE64 Statistically, (Sat, Jun 18th)](https://isc.sans.edu/diary/rss/28758) -- The Register - Security - - [DeadBolt ransomware takes another shot at QNAP storage](https://go.theregister.com/feed/www.theregister.com/2022/06/18/deadlbolt-ransomware-qnap-nas/) -- TorrentFreak - - [Anti-Piracy Jobs From £10/hr to ‘Let’s Talk ££’, There’s No Shortage in the UK](https://torrentfreak.com/anti-piracy-jobs-from-10-hr-to-lets-talk-theres-no-shortage-in-the-uk-220618/) -- 0xFFFF@blog:~$ - - [Protected: [PART 6] XSS Exploitation Series – Blind / out-of-band XSS scenarios](https://0x80dotblog.wordpress.com/2022/06/18/part-6-xss-exploitation-series-blind-out-of-band-xss-scenarios/) - - [Protected: [PART 5] XSS Exploitation Series – Advanced DOM XSS testing: Sources & Sinks](https://0x80dotblog.wordpress.com/2022/06/18/part-5-xss-exploitation-advanced-dom-xss-testing-sources-sinks/) - - [Protected: [PART 4] XSS Exploitation Series – Obfuscated/Stealth-based methods of testing for XSS](https://0x80dotblog.wordpress.com/2022/06/18/part-4-xss-exploitation-obfuscated-stealth-based-methods-of-testing-for-xss/) - - [Protected: [PART 3] XSS Exploitation Series – Building weaponized/advanced payloads](https://0x80dotblog.wordpress.com/2022/06/18/part-3-xss-exploitation-series-building-weaponized-advanced-payloads/) - - [Protected: [PART 2] XSS Exploitation Series – Filter Evasion](https://0x80dotblog.wordpress.com/2022/06/18/part-2-xss-exploitation-series-filter-evasion/) - - [Protected: [PART 1] XSS Exploitation Series – Introduction and Overview.](https://0x80dotblog.wordpress.com/2022/06/18/part-1-xss-exploitation-series-introduction-and-overview/) - - [Protected: An introduction to Quantum Computing](https://0x80dotblog.wordpress.com/2022/06/18/an-introduction-to-quantum-computing/) - - [Protected: (ab)using XSS protections to trigger XSS](https://0x80dotblog.wordpress.com/2022/06/18/abusing-xss-protections-to-trigger-xss/) - - [Protected: Technique of the week: HTTP/2 Smuggling + h2c Smuggling](https://0x80dotblog.wordpress.com/2022/06/18/technique-of-the-week-http-2-smuggling-h2c-smuggling/) - - [Protected: Exploring XS-Leaks and their exploitation potential](https://0x80dotblog.wordpress.com/2022/06/18/exploring-xs-leaks-and-their-exploitation-potential/) -- Security Affairs - - [US DoJ announced to have shut down the Russian RSOCKS Botnet](https://securityaffairs.co/wordpress/132403/cyber-crime/police-dismantled-rsocks-bitnet.html) - - [MaliBot Android Banking Trojan targets Spain and Italy](https://securityaffairs.co/wordpress/132387/hacking/malibot-android-malware.html) -- KitPloit - PenTest Tools! - - [Hunt-Sleeping-Beacons - Aims To Identify Sleeping Beacons](http://www.kitploit.com/2022/06/hunt-sleeping-beacons-aims-to-identify.html) - - [Nightingale - Docker Environment For Pentesting Which Having All The Required Tool For VAPT](http://www.kitploit.com/2022/06/nightingale-docker-environment-for.html) -- 奇客Solidot–传递最新科技情报 - - [中国天眼没有发现地外文明信号](https://www.solidot.org/story?sid=71873) - - [电子游戏助长大规模枪击的观点不再流行](https://www.solidot.org/story?sid=71872) - - [微软应用商店禁止第三方对免费的开源软件收费](https://www.solidot.org/story?sid=71871) - - [Scott Aaronson 将在 OpenAI 研究如何防止 AI 失控](https://www.solidot.org/story?sid=71870) -- Your Hacking Tutorial by Zempirians - - [Been playing with computers since I was 16](https://www.reddit.com/r/HowToHack/comments/vfckob/been_playing_with_computers_since_i_was_16/) - - [Access old ipad 2 that was donated to an orphanage](https://www.reddit.com/r/HowToHack/comments/vf04p6/access_old_ipad_2_that_was_donated_to_an_orphanage/) - - [IoT Wecurity and Hacking Resources](https://www.reddit.com/r/HowToHack/comments/vf78x7/iot_wecurity_and_hacking_resources/) - - [Hide powershell / cmd.exe call.](https://www.reddit.com/r/HowToHack/comments/vf2ero/hide_powershell_cmdexe_call/) - - [Does anonsurf still come with Tor bridging? It’s no longer listed in documentation.](https://www.reddit.com/r/HowToHack/comments/vfbgxs/does_anonsurf_still_come_with_tor_bridging_its_no/) - - [MENTOR needed desperately](https://www.reddit.com/r/HowToHack/comments/vfgdcc/mentor_needed_desperately/) - - [Is it possible to deauth a device without knowing the network MAC, and only the device MAC?](https://www.reddit.com/r/HowToHack/comments/vey5wv/is_it_possible_to_deauth_a_device_without_knowing/) -- Instapaper: Unread - - [Photos of kids taken from spyware-ridden phones found exposed on the internet](https://blog.malwarebytes.com/stalkerware/2022/06/photos-of-kids-taken-from-spyware-ridden-phones-found-exposed-on-the-internet/) - - [International operation takes down Russian RSOCKS botnet](https://www.theregister.com/2022/06/17/rsocks_russia_botnet/) - - [Interpol seizes $50 million, arrests 2000 social engineers](https://www.bleepingcomputer.com/news/security/interpol-seizes-50-million-arrests-2000-social-engineers/) - - [Experts link Hermit spyware to Italian surveillance firm RCS Lab and a front company](https://securityaffairs.co/wordpress/132363/malware/hermit-spyware-italian-surveillance-firm.html) -- 看雪学院 - - [Android Hook技术学习——常见的Hook技术方案总结](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453552&idx=1&sn=6cb756be4634cacb0dbbe2814dd81098&chksm=b18e36ba86f9bfacfadce515c3247395fe1a1cd56b4f1a3fb78f25bb8d0ca72e70a7cc0dc2c5&scene=58&subscene=0#rd) - - [视频资讯|美国国防承包商计划收购间谍软件公司NSO](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453552&idx=2&sn=e9dd37654c90af1204cbc41c46cea4fe&chksm=b18e36ba86f9bfac6c253eb2d08fca8a45e71d24286f46d0063ffb21456e0bc94b05df505c22&scene=58&subscene=0#rd) - - [如何利用高级查杀技术，通杀恶意程序？](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453552&idx=3&sn=857e57698c121b04b4988ccc3e4d82eb&chksm=b18e36ba86f9bfac1496fe34df41762be91dd0ee1d1bab5355fb601716042b37b210bc690bfc&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [I made a website can detect over 1000 extensions and shows you the percentage of users that share the same extensions.](https://www.reddit.com/r/netsec/comments/vffx2j/i_made_a_website_can_detect_over_1000_extensions/) - - [I have created a burp suite extension which allows pentester to keep track of each APIs, write test cases for individual APIs. Lastly the extension allows to map the vulnerable apis to the list of vulnerabilities using a custom checklist.](https://www.reddit.com/r/netsec/comments/vf365f/i_have_created_a_burp_suite_extension_which/) - - [Dangerous Repository of DoS, Red Teaming TTPs, and ICS Exploits](https://www.reddit.com/r/netsec/comments/vf7xsn/dangerous_repository_of_dos_red_teaming_ttps_and/) - - [Scheduled Scaling Up & Down Of EC2 Server](https://www.reddit.com/r/netsec/comments/vf47te/scheduled_scaling_up_down_of_ec2_server/) -- 数世咨询 - - [2021年中国数字安全百强报告](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493845&idx=1&sn=0581384588d52c6108da712c0116289b&chksm=c1449a68f633137e753403e898529de425b43ce7c030cc1fa13ce407f2756fdbfff0fc8bae88&scene=58&subscene=0#rd) - - [数字时代——基于行业最佳实践的安全保护框架](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493845&idx=2&sn=3507515eb0768c71ad8a6f4c677d31b1&chksm=c1449a68f633137e4c1c82e558b138500c8213354b5be42367dedffa28248f34b86ae4bb5d74&scene=58&subscene=0#rd) -- 安全客 - - [直击RSAC 2022：巧用ATT & CK框架应对具体威胁](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772409&idx=1&sn=52cdc4475583d46af72ddcc1ec45930b&chksm=88936116bfe4e8008daf12a158ea25d2b2723e1bd1b050ab7c915ff05f8e0df84c73b1efd22f&scene=58&subscene=0#rd) -- 情报分析师 - - [【反恐巨著1312页】恐怖主义预防和战备手册（预备防范篇）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506581&idx=1&sn=66300e22f7d75c53c3b9a86213effc9b&chksm=8716ab1eb061220895db6c15f9ad75d31a800fbe75236cfc8cf5207c179df8566a15e2ee3ae5&scene=58&subscene=0#rd) - - [大赛通知 | 第一届“智器云杯”数据情报分析大赛正式启动！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506581&idx=2&sn=24cf431569efac02dda92fdf8a175b96&chksm=8716ab1eb0612208d828395161e0d9f53f06727471b7b0a6a8f1dda968677c2109104b93b30e&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-06-20.md b/archive/2022/2022-06-20.md deleted file mode 100644 index 612cd33d6c..0000000000 --- a/archive/2022/2022-06-20.md +++ /dev/null @@ -1,91 +0,0 @@ -# 每日安全资讯（2022-06-20） - -- HackerOne Hacker Activity - - [Authentication token and CSRF token bypass](https://hackerone.com/reports/998457) - - [bypass forced password protection via circles app](https://hackerone.com/reports/1406926) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 前亚马逊工程师曾盗窃1亿人数据；八成互联网电视非法采集用户数据](https://www.freebuf.com/news/336608.html) -- No Headback - - [go-redis 和 redis server 版本错位导致的高延时问题一例](http://xargin.com/go-redis-v6-and-redis-server-6-are-not-compatible/) -- Sploitus.com Exploits RSS Feed - - [Zyxel Buffer Overflow / Format String / Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167464&utm_source=rss&utm_medium=rss) - - [Marval MSM 14.19.0.12476 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167471&utm_source=rss&utm_medium=rss) - - [ChurchCRM 4.4.5 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167483&utm_source=rss&utm_medium=rss) - - [Warehouse Management System 2022 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167479&utm_source=rss&utm_medium=rss) - - [JM-DATA ONU JF511-TV 1.0.67 / 1.0.62 / 1.0.55 XSS / CSRF / Open Redirect exploit](https://sploitus.com/exploit?id=PACKETSTORM:167487&utm_source=rss&utm_medium=rss) - - [Marval MSM 14.19.0.12476 Cross Site Request Forgery exploit](https://sploitus.com/exploit?id=PACKETSTORM:167476&utm_source=rss&utm_medium=rss) - - [Kitty 0.76.0.8 Stack Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:167475&utm_source=rss&utm_medium=rss) - - [Infiray IRAY-A8Z3 1.0.957 Code Execution / Overflow / Hardcoded Credentials exploit](https://sploitus.com/exploit?id=PACKETSTORM:167466&utm_source=rss&utm_medium=rss) - - [Virtua Software Cobranca 12S SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167480&utm_source=rss&utm_medium=rss) - - [Exploit for Uncontrolled Resource Consumption in Apple Ipados exploit](https://sploitus.com/exploit?id=0EABFFE9-94B8-564F-BD5C-4F354296C0EA&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=5255E938-0B92-5E2C-B1A4-21B2445C29AF&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [USENIX Enigma 2022 – Nicholas Carlini’s ‘When Machine Learning Isn’t Private’](https://securityboulevard.com/2022/06/usenix-enigma-2022-nicholas-carlinis-when-machine-learning-isnt-private/) - - [XKCD ‘Red Line Through HTTPS](https://securityboulevard.com/2022/06/xkcd-red-line-through-https/) - - [USENIX Enigma 2022 – Graham Bleaney’s ‘Teaching An Old Dog New Tricks: Reusing Security Solutions In Novel Domains’](https://securityboulevard.com/2022/06/usenix-enigma-2022-graham-bleaneys-teaching-an-old-dog-new-tricks-reusing-security-solutions-in-novel-domains/) - - [EU and U.S. Join Forces to Help Developing World Cybersecurity](https://securityboulevard.com/2022/06/eu-and-u-s-join-forces-to-help-developing-world-cybersecurity/) -- cloud world - - [OpenKruise 源码剖析之原地升级](https://cloudsjhan.github.io/2022/06/19/OpenKruise-%E6%BA%90%E7%A0%81%E8%A7%A3%E8%AF%BB%E4%B9%8B%E5%8E%9F%E5%9C%B0%E5%8D%87%E7%BA%A7/) -- Reverse Engineering - - [New Discovery for Minus World in Super Mario Bros! - Behind the Code [YouTube]](https://www.reddit.com/r/ReverseEngineering/comments/vfmsqr/new_discovery_for_minus_world_in_super_mario_bros/) -- HAHWUL - - [[Cullinan #38] Add Metasploit ☠️ and 3 Injections 💉](https://www.hahwul.com/2022/06/19/cullinan-38/) - - [Metasploit Framework](https://www.hahwul.com/cullinan/metasploit/) -- KitPloit - PenTest & Hacking Tools - - [VAmPI - Vulnerable REST API With OWASP Top 10 Vulnerabilities For Security Testing](http://www.kitploit.com/2022/06/vampi-vulnerable-rest-api-with-owasp.html) - - [Cervantes - Collaborative Platform For Pentesters Or Red Teams Who Want To Save Time To Manage Their Projects, Clients, Vulnerabilities And Reports In One Place](http://www.kitploit.com/2022/06/cervantes-collaborative-platform-for.html) -- 博客园 - 郑瀚Andrew.Hann - - [浙江农信 萧山农商银行 尽调 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16390459.html) -- 奇客Solidot–传递最新科技情报 - - [比特币价格暴跌让挖矿变得无利可图](https://www.solidot.org/story?sid=71876) - - [我们是否生来性本善？](https://www.solidot.org/story?sid=71875) - - [认为 AI 有生命的 Google 工程师自称是牧师](https://www.solidot.org/story?sid=71874) -- Il Disinformatico - - [Samantha Cristoforetti fa il cosplay di Sandra Bullock in “Gravity”. Nello spazio](http://attivissimo.blogspot.com/2022/06/samantha-cristoforetti-fa-il-cosplay.html) -- 黑海洋 - WIKI - - [XPlayer v2.3.0.2 解锁高级会员版](https://blog.upx8.com/2806) - - [安卓 WPS Office v16.3.2 解锁高级版](https://blog.upx8.com/2805) - - [CorelCAD 2023 v22.0.1.1151完整版](https://blog.upx8.com/2804) - - [扫描全能王 v6.18破解高级版（安卓）](https://blog.upx8.com/2803) - - [抖音无门槛无人直播视频课程](https://blog.upx8.com/2802) -- SANS Internet Storm Center, InfoCON: green - - [Video: Decoding Obfuscated BASE64 Statistically, (Sun, Jun 19th)](https://isc.sans.edu/diary/rss/28762) - - [Wireshark 3.6.6 Released, (Sun, Jun 19th)](https://isc.sans.edu/diary/rss/28756) -- ZeroSec - Adventures In Information Security - - [Azure Attack Paths: Common Findings and Fixes (Part 1)](https://blog.zsec.uk/azure-fundamentals-pt1/) -- TorrentFreak - - [Torrent Site Blockades Don’t Change Old Piracy Habits Right Away](https://torrentfreak.com/torrent-site-blockades-dont-change-old-piracy-habits-right-away-220619/) -- KitPloit - PenTest Tools! - - [VAmPI - Vulnerable REST API With OWASP Top 10 Vulnerabilities For Security Testing](http://www.kitploit.com/2022/06/vampi-vulnerable-rest-api-with-owasp.html) - - [Cervantes - Collaborative Platform For Pentesters Or Red Teams Who Want To Save Time To Manage Their Projects, Clients, Vulnerabilities And Reports In One Place](http://www.kitploit.com/2022/06/cervantes-collaborative-platform-for.html) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Should you write malware in C# or C++?](https://www.reddit.com/r/netsecstudents/comments/vfjugx/should_you_write_malware_in_c_or_c/) -- 情报分析师 - - [如何评估俄罗斯对加拿大领土的军事威胁？](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506595&idx=1&sn=13e00b1e356e9fb187a5395dbb2be82f&chksm=8716ab28b061223ed8c65c0c97d40430b731a136be45ae1766c9c3058e111e1ff0cbd1a2930a&scene=58&subscene=0#rd) - - [大赛通知 | 第一届“智器云杯”数据情报分析大赛正式启动！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506595&idx=2&sn=bb60f93094096fe78cb7709cec9544e4&chksm=8716ab28b061223e6ffcb1ec1ed336fa66d23a0329093e0b16aa09e7fefc8944be43058a373d&scene=58&subscene=0#rd) -- Security Affairs - - [Critical flaw in Ninja Forms WordPress Plugin actively exploited in the wild](https://securityaffairs.co/wordpress/132417/hacking/wordpress-ninja-forms-flaw.html) - - [Experts warn of a new eCh0raix ransomware campaign targeting QNAP NAS](https://securityaffairs.co/wordpress/132410/cyber-crime/ech0raix-ransomware-attacks.html) -- Computer Forensics - - [SANS FOR508 on Linux](https://www.reddit.com/r/computerforensics/comments/vfrncr/sans_for508_on_linux/) - - [On-demand / online introductory courses / certifications in IT-Forensics ~ $500 USD?](https://www.reddit.com/r/computerforensics/comments/vfyahs/ondemand_online_introductory_courses/) -- /r/netsec - Information Security News & Discussion - - [New blog - NMAP and CME 101 stuff](https://www.reddit.com/r/netsec/comments/vft533/new_blog_nmap_and_cme_101_stuff/) -- Your Hacking Tutorial by Zempirians - - [Hydra crack login on a Windows XP](https://www.reddit.com/r/HowToHack/comments/vg6c1h/hydra_crack_login_on_a_windows_xp/) - - [How does Windows password reset work](https://www.reddit.com/r/HowToHack/comments/vfsf4b/how_does_windows_password_reset_work/) - - [Kon-boot used on my computer and now forgot the password.](https://www.reddit.com/r/HowToHack/comments/vg5qbq/konboot_used_on_my_computer_and_now_forgot_the/) - - [I'm beginning my journey, what should I expect?](https://www.reddit.com/r/HowToHack/comments/vfo4s3/im_beginning_my_journey_what_should_i_expect/) - - [I am currently almost 19 - feel like i've achieved nothing yet in programming](https://www.reddit.com/r/HowToHack/comments/vg6flc/i_am_currently_almost_19_feel_like_ive_achieved/) - - [How To Add Local Admin User On Windows 10 Without Admin Privilege?](https://www.reddit.com/r/HowToHack/comments/vfof02/how_to_add_local_admin_user_on_windows_10_without/) - - [hi everyone 👋☺️ I have a Note 9 dual Sim and am wondering if anyone has some recommendations on hack or mods for it](https://www.reddit.com/r/HowToHack/comments/vfvh2y/hi_everyone_i_have_a_note_9_dual_sim_and_am/) - - [Is there a way to find the ip addresses of a particular software?](https://www.reddit.com/r/HowToHack/comments/vfkuq0/is_there_a_way_to_find_the_ip_addresses_of_a/) -- Social Engineering - - [How To Speak Up With Confidence: 17 Effective Strategies](https://www.reddit.com/r/SocialEngineering/comments/vg4l1m/how_to_speak_up_with_confidence_17_effective/) - - [Is English more effective or less effective for social engineering? Does language make any difference?](https://www.reddit.com/r/SocialEngineering/comments/vfuowz/is_english_more_effective_or_less_effective_for/) - - [Question on the use of language to influence people](https://www.reddit.com/r/SocialEngineering/comments/vfk4mj/question_on_the_use_of_language_to_influence/) - - [Social engineering advice here.... how can I make this work?](https://www.reddit.com/r/SocialEngineering/comments/vfnwjc/social_engineering_advice_here_how_can_i_make/) -- 数世咨询 - - [第二届数字安全大会线上启动会：三大重磅研究发布](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493876&idx=1&sn=7b8c9f97b8184b51703d7649579908d3&chksm=c1449a49f633135f6da0e3446cbc493b4c483d934afff6ade98b7570394d36ea919616d5c523&scene=58&subscene=0#rd) - - [解读IDaaS与IAM](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493853&idx=1&sn=4e2f0e049bf94aa7b4aafbbcc66b2bc5&chksm=c1449a60f633137611b7d353328ac22df140fb2d535a87d2f3c350274bbfe51c9c8c016857bf&scene=58&subscene=0#rd) - - [年损失18亿美元 去中心化金融遭网络犯罪重创](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493853&idx=2&sn=2361dc52d982b69617146d2c8d725106&chksm=c1449a60f633137636b1e2db9ed56c9686e0e2ae8822863f4e6404192729f23fbf36fc66d8d4&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-06-21.md b/archive/2022/2022-06-21.md deleted file mode 100644 index fdc6c31acf..0000000000 --- a/archive/2022/2022-06-21.md +++ /dev/null @@ -1,318 +0,0 @@ -# 每日安全资讯（2022-06-21） - -- Sec-News 安全文摘 - - [深入注册表监控](https://wiki.ioin.in/url/nYoy) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Zyxel Buffer Overflow / Format String / Command Injection](https://cxsecurity.com/issue/WLB-2022060063) - - [Infiray IRAY-A8Z3 1.0.957 Code Execution / Overflow / Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022060062) - - [Marval MSM 14.19.0.12476 Cross Site Request Forgery](https://cxsecurity.com/issue/WLB-2022060061) - - [Virtua Software Cobranca 12S SQL Injection](https://cxsecurity.com/issue/WLB-2022060060) - - [WSO2 Management Console XML Injection](https://cxsecurity.com/issue/WLB-2022060059) - - [JM-DATA ONU JF511-TV 1.0.67 / 1.0.62 / 1.0.55 XSS / CSRF / Open Redirect](https://cxsecurity.com/issue/WLB-2022060058) - - [ChurchCRM 4.4.5 SQL Injection](https://cxsecurity.com/issue/WLB-2022060057) - - [Warehouse Management System 2022 SQL Injection](https://cxsecurity.com/issue/WLB-2022060056) - - [Kitty 0.76.0.8 Stack Buffer Overflow](https://cxsecurity.com/issue/WLB-2022060055) - - [Marval MSM 14.19.0.12476 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022060054) - - [Lepin EP-KP001 KP001_V19 Authentication Bypass](https://cxsecurity.com/issue/WLB-2022060053) - - [Chrome CVE-2022-1096 Incomplete Fix](https://cxsecurity.com/issue/WLB-2022060052) - - [Mitel 6800/6900 Series SIP Phones Backdoor Access](https://cxsecurity.com/issue/WLB-2022060051) - - [SolarView Compact 6.00 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022060050) - - [Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor](https://cxsecurity.com/issue/WLB-2022060049) - - [phpIPAM 1.4.5 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022060048) - - [Old Age Home Management System 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022060047) - - [Verbatim Store N Go Secure Portable HDD GD25LK01-3637-C VER4.0 Behavior Violation](https://cxsecurity.com/issue/WLB-2022060046) - - [Pandora FMS 7.0NG.742 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022060045) - - [Verbatim Fingerprint Secure Portable Hard Drive Insufficient Verification](https://cxsecurity.com/issue/WLB-2022060044) - - [Verbatim Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 Missing Trust](https://cxsecurity.com/issue/WLB-2022060043) - - [SoftGuard SNMP Network Management Extension HTML Injection / File Download](https://cxsecurity.com/issue/WLB-2022060042) - - [WordPress Ninja Forms Code Injection](https://cxsecurity.com/issue/WLB-2022060041) - - [Gentics CMS 5.36.29 Cross Site Scripting / Deserialization](https://cxsecurity.com/issue/WLB-2022060040) -- Tenable Blog - - [Identifying XML External Entity: How Tenable.io Web Application Scanning Can Help](https://www.tenable.com/blog/identifying-xml-external-entity-how-tenable-io-web-application-scanning-can-help) -- Der Flounder - - [Videos from Penn State MacAdmins Campfire Sessions 2022](https://derflounder.wordpress.com/2022/06/20/videos-from-penn-state-macadmins-campfire-sessions-2022/) -- HackerOne Hacker Activity - - [Authentication CSRF resulting in unauthorized account access on Krisp app](https://hackerone.com/reports/1267476) - - [Add more seats by paying less via PUT /v2/seats request manipulation](https://hackerone.com/reports/1446090) - - [Admin Authentication Bypass Lead to Admin Account Takeover](https://hackerone.com/reports/1490470) -- Files ≈ Packet Storm - - [SIEMENS-SINEMA Remote Connect 3.0.1.0-01.01.00.02 Cross Site Scripting](https://packetstormsecurity.com/files/167554/SA-20220614-0.txt) - - [Ubuntu Security Notice USN-5486-1](https://packetstormsecurity.com/files/167553/USN-5486-1.txt) - - [Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor](https://packetstormsecurity.com/files/167552/SA-20220615-0.txt) - - [Kernel Live Patch Security Notice LSN-0087-1](https://packetstormsecurity.com/files/167551/LSN-0087-1.txt) - - [Lepin EP-KP001 KP001_V19 Authentication Bypass](https://packetstormsecurity.com/files/167550/SYSS-2022-024.txt) - - [Ubuntu Security Notice USN-5485-1](https://packetstormsecurity.com/files/167549/USN-5485-1.txt) - - [Red Hat Security Advisory 2022-4947-01](https://packetstormsecurity.com/files/167548/RHSA-2022-4947-01.txt) - - [Mitel 6800/6900 Series SIP Phones Backdoor Access](https://packetstormsecurity.com/files/167547/SYSS-2022-021.txt) - - [Verbatim Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 Insufficient Verification](https://packetstormsecurity.com/files/167546/SYSS-2022-013.txt) - - [Ubuntu Security Notice USN-5484-1](https://packetstormsecurity.com/files/167545/USN-5484-1.txt) - - [TOR Virtual Network Tunneling Tool 0.4.7.8](https://packetstormsecurity.com/files/167544/tor-0.4.7.8.tar.gz) - - [Ubuntu Security Notice USN-5482-1](https://packetstormsecurity.com/files/167543/USN-5482-1.txt) - - [SoftGuard SNMP Network Management Extension HTML Injection / File Download](https://packetstormsecurity.com/files/167542/SA-20220609-0.txt) - - [Ubuntu Security Notice USN-5476-1](https://packetstormsecurity.com/files/167541/USN-5476-1.txt) - - [Red Hat Security Advisory 2022-4951-01](https://packetstormsecurity.com/files/167540/RHSA-2022-4951-01.txt) - - [Verbatim Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 Missing Trust](https://packetstormsecurity.com/files/167539/SYSS-2022-011.txt) - - [WordPress Ninja Forms Code Injection](https://packetstormsecurity.com/files/167538/wpninjaforms-inject.txt) - - [Gentics CMS 5.36.29 Cross Site Scripting / Deserialization](https://packetstormsecurity.com/files/167537/SA-20220608-0.txt) - - [Verbatim Fingerprint Secure Portable Hard Drive #53650 Insufficient Verification](https://packetstormsecurity.com/files/167536/SYSS-2022-017.txt) - - [Verbatim Fingerprint Secure Portable Hard Drive #53650 Missing Trust](https://packetstormsecurity.com/files/167535/SYSS-2022-016.txt) - - [Red Hat Security Advisory 2022-5099-01](https://packetstormsecurity.com/files/167534/RHSA-2022-5099-01.txt) - - [Red Hat Security Advisory 2022-5100-01](https://packetstormsecurity.com/files/167533/RHSA-2022-5100-01.txt) - - [Verbatim Fingerprint Secure Portable Hard Drive #53650 Risky Crypto](https://packetstormsecurity.com/files/167531/SYSS-2022-014.txt) - - [SolarView Compact 6.00 Cross Site Scripting](https://packetstormsecurity.com/files/167530/solarviewcompact600-xss.txt) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 美当局称已捣毁僵尸网络RSOCKS；去中心化金融遭网络犯罪重创](https://www.freebuf.com/news/336713.html) - - [Google发布《SOC建设指南》，对未来SOC提出新思考](https://www.freebuf.com/articles/336674.html) - - [多年终端安全沉淀，源自支付宝的全链路安全防护建设 | 6月24日19点公开课](https://www.freebuf.com/articles/334892.html) - - [美国司法部成功打掉了 RSocks 僵尸网络](https://www.freebuf.com/news/336661.html) - - [使用西门子工控系统的注意了，已经暴露了15个安全漏洞](https://www.freebuf.com/news/336659.html) - - [DeadBolt 勒索软件再次发难，威联通正展开调查](https://www.freebuf.com/news/336646.html) -- Security Boulevard - - [Capital One Data Breach Update: Former Amazon Engineer Convicted](https://securityboulevard.com/2022/06/capital-one-data-breach-update-former-amazon-engineer-convicted/) - - [GUEST ESSAY: Threat hunters adapt personas, leverage AI to gather intel in the Dark Web](https://securityboulevard.com/2022/06/guest-essay-threat-hunters-adapt-personas-leverage-ai-to-gather-intel-in-the-dark-web/) - - [USENIX Enigma 2022 – Pritam Dash’ ‘Detection Is Not Enough: Attack Recovery For Safe And Robust Autonomous Robotic Vehicles’](https://securityboulevard.com/2022/06/usenix-enigma-2022-pritam-dash-detection-is-not-enough-attack-recovery-for-safe-and-robust-autonomous-robotic-vehicles/) - - [Rogue Certificates and Shadow IT: The Underbelly of Digital Certificate Growth](https://securityboulevard.com/2022/06/rogue-certificates-and-shadow-it-the-underbelly-of-digital-certificate-growth/) - - [Why Paper Receipts are Money at the Drive-Thru](https://securityboulevard.com/2022/06/why-paper-receipts-are-money-at-the-drive-thru/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 386’](https://securityboulevard.com/2022/06/robert-m-lees-jeff-haas-little-bobby-comic-week-386/) - - [How to get started with OT security](https://securityboulevard.com/2022/06/how-to-get-started-with-ot-security/) - - [USENIX Enigma 2022 – Dr. Sanchari Das’ ‘Leveraging Human Factors To Stop Dangerous IoT’](https://securityboulevard.com/2022/06/usenix-enigma-2022-dr-sanchari-das-leveraging-human-factors-to-stop-dangerous-iot/) -- Microsoft Security Blog - - [How one Microsoft software engineer works to improve access management](https://www.microsoft.com/security/blog/2022/06/20/how-one-microsoft-software-engineer-works-to-improve-access-management/) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（20220613-20220619）](http://blog.nsfocus.net/weekly-20220613/) - - [洞见RSA2022 | 基于ATT&CK的自动化渗透及合规性评估体系](http://blog.nsfocus.net/rsa2022-attck/) - - [洞见RSA2022 | 聚焦网络靶场建设，实战化网安人才培养探索实践](http://blog.nsfocus.net/rsa2022-peo/) - - [洞见RSA2022 | 从RSA看应用安全的热门领域与重要应用](http://blog.nsfocus.net/rsa-appli/) -- Sploitus.com Exploits RSS Feed - - [SolarView Compact 6.00 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167530&utm_source=rss&utm_medium=rss) - - [Multi Language Pharmacy Management System 1.0 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:167526&utm_source=rss&utm_medium=rss) - - [SoftGuard SNMP Network Management Extension HTML Injection / File Download exploit](https://sploitus.com/exploit?id=PACKETSTORM:167542&utm_source=rss&utm_medium=rss) - - [phpIPAM 1.4.5 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167518&utm_source=rss&utm_medium=rss) - - [HP LaserJet Professional M1210 MFP Series Receive Fax Service Unquoted Service Path exploit](https://sploitus.com/exploit?id=PACKETSTORM:167494&utm_source=rss&utm_medium=rss) - - [SIEMENS-SINEMA Remote Connect 3.0.1.0-01.01.00.02 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167554&utm_source=rss&utm_medium=rss) - - [Lepin EP-KP001 KP001_V19 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:167550&utm_source=rss&utm_medium=rss) - - [Old Age Home Management System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167511&utm_source=rss&utm_medium=rss) - - [Mitel 6800/6900 Series SIP Phones Backdoor Access exploit](https://sploitus.com/exploit?id=PACKETSTORM:167547&utm_source=rss&utm_medium=rss) - - [Chrome CVE-2022-1096 Incomplete Fix exploit](https://sploitus.com/exploit?id=PACKETSTORM:167516&utm_source=rss&utm_medium=rss) - - [Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor exploit](https://sploitus.com/exploit?id=PACKETSTORM:167552&utm_source=rss&utm_medium=rss) - - [Gentics CMS 5.36.29 Cross Site Scripting / Deserialization exploit](https://sploitus.com/exploit?id=PACKETSTORM:167537&utm_source=rss&utm_medium=rss) - - [Algo 8028 Control Panel Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167495&utm_source=rss&utm_medium=rss) - - [Sourcegraph Gitserver 3.36.3 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167506&utm_source=rss&utm_medium=rss) - - [Pandora FMS 7.0NG.742 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167503&utm_source=rss&utm_medium=rss) - - [TP-Link AX50 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167522&utm_source=rss&utm_medium=rss) - - [Exploit for Missing Authentication for Critical Function in F5 Big-Ip Access Policy Manager exploit](https://sploitus.com/exploit?id=136F5B52-10AC-57EC-AFD3-C56855D31685&utm_source=rss&utm_medium=rss) - - [Exploit for OS Command Injection in Telesquare Sdt-Cs3B1 Firmware exploit](https://sploitus.com/exploit?id=0C78A8E1-6F7B-50CE-AE03-3D51FA8955DC&utm_source=rss&utm_medium=rss) -- Cerbero Blog - - [Cerbero Journal Issue 1](https://blog.cerbero.io/?p=2431) -- 安全客-有思想的安全新媒体 - - [安全事件周报 (06.13-06.19)](https://www.anquanke.com/post/id/275093) - - [存储桶上传策略和签名 URL的绕过及利用](https://www.anquanke.com/post/id/275054) - - [黑客骇入iCloud窃取裸照被判九年监禁](https://www.anquanke.com/post/id/275056) -- ふるつき - - [ある種のEdDSAの実装に対するDouble-PubKey Oracle Attack](https://furutsuki.hatenablog.com/entry/2022/06/20/222434) -- Binary Ninja - - [Introducing Tantō: Slicing Functions for Faster Finds](https://binary.ninja/2022/06/20/introducing-tanto.html) -- Securelist - - [‘Unpacking’ technical attribution and challenges for ensuring stability in cyberspace](https://securelist.com/unpacking-technical-attribution/106791/) -- Didier Stevens - - [Another Exercise In Encoding Reversing](https://blog.didierstevens.com/2022/06/20/another-exercise-in-encoding-reversing/) -- blog.avast.com EN - - [Money20/20: Talking digital identity and the rise of embedded finance](https://blog.avast.com/digital-identity-embedded-finance) -- PortSwigger Blog - - [Finding client-side prototype pollution with DOM Invader](https://portswigger.net/blog/finding-client-side-prototype-pollution-with-dom-invader) -- Malwarebytes Labs - - [Client-side Magecart attacks still around, but more covert](https://blog.malwarebytes.com/threat-intelligence/2022/06/client-side-magecart-attacks-still-around-but-more-covert/) - - [Internet Safety Month: 7 tips for staying safe online while on vacation](https://blog.malwarebytes.com/awareness/2022/06/internet-safety-month-7-tips-for-staying-safe-online-while-on-vacation/) - - [DDoS-for-hire service provider jailed](https://blog.malwarebytes.com/cybercrime/2022/06/ddos-for-hire-service-provider-jailed/) - - [LinkedIn scams are a “significant threat”, warns FBI](https://blog.malwarebytes.com/scams/2022/06/linkedin-scams-are-a-significant-threat-warns-fbi/) - - [A week in security (June 13 – June 19)](https://blog.malwarebytes.com/a-week-in-security/2022/06/a-week-in-security-june-13-june-19/) - - [Securing the software supply chain, with Kim Lewandowski: Lock and Code S03E13](https://blog.malwarebytes.com/podcast/2022/06/securing-the-software-supply-chain-with-kim-lewandowski-lock-and-code-s03e13/) -- The Daily Swig | Cybersecurity news and views - - [Critical Citrix ADM vulnerability creates means to reset admin passwords](https://portswigger.net/daily-swig/critical-citrix-adm-vulnerability-creates-means-to-reset-admin-passwords) - - [Internet scans find 1.6 million secrets leaked by websites](https://portswigger.net/daily-swig/internet-scans-find-1-6-million-secrets-leaked-by-websites) - - [Attackers can use ‘Scroll to Text Fragment’ web browser feature to steal data – research](https://portswigger.net/daily-swig/attackers-can-use-scroll-to-text-fragment-web-browser-feature-to-steal-data-research) -- KitPloit - PenTest & Hacking Tools - - [SharpSniper - Find Specific Users In Active Directory Via Their Username And Logon IP Address](http://www.kitploit.com/2022/06/sharpsniper-find-specific-users-in.html) - - [Xss_Vulnerability_Challenges - This Repository Is A Docker Containing Some "XSS Vulnerability" Challenges And Bypass Examples](http://www.kitploit.com/2022/06/xssvulnerabilitychallenges-this.html) -- Hacking and security - - [Advanced Threat Hunting With Splunk](https://hackingandsecurity.blogspot.com/2022/06/advanced-threat-hunting-with-splunk.html) - - [Splunk Configuration - create index](https://hackingandsecurity.blogspot.com/2022/06/splunk-configuration-create-index.html) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/vgfaze/rreverseengineerings_weekly_questions_thread/) - - [OpenGOAL -- project reviving GOAL, custom Lisp programming language used for Jak and Daxter on PlayStation 2, and reverse-engineering/porting the games](https://www.reddit.com/r/ReverseEngineering/comments/vgx7e8/opengoal_project_reviving_goal_custom_lisp/) -- 谢乾坤 | Kingname - - [一日一技：使用Python翻译HTML中的文本字符串](https://www.kingname.info/2022/06/20/translate-html/) - - [一日一技：Bug分析，假删除导致文章发布成功却打不开的问题](https://www.kingname.info/2022/06/20/fake-delete/) - - [一日一技：让你的正则表达式可读性提高一百倍](https://www.kingname.info/2022/06/20/readable-re/) - - [一日一技：如何让自己的工具函数在Python全局可用？](https://www.kingname.info/2022/06/20/utility-anywhere/) -- rtl-sdr.com - - [Metal Case Upgrade for the SDRplay RSP1A Back in Stock!](https://www.rtl-sdr.com/metal-case-upgrade-for-the-sdrplay-rsp1a-back-in-stock-2/) - - [TechMinds: Testing the ISM Packet Decoder Plugin for SDR Sharp](https://www.rtl-sdr.com/techminds-testing-the-ism-packet-decoder-plugin-for-sdr-sharp/) - - [Probing a Cable Internet + TV Line with RTL-SDR USB](https://www.rtl-sdr.com/probing-a-cable-internet-tv-line-with-rtl-sdr-usb/) -- FireShell Security Team - - [SEETF 2022 - Username Generator](https://fireshellsecurity.team/seetf2022-username-generator/) - - [WeCTF 2022 - Google Wayback](https://fireshellsecurity.team/wectf2022-google-wayback/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 5/23/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-5-23-2022/) -- 奇客Solidot–传递最新科技情报 - - [哈勃观察到正在吞噬行星的死亡恒星](https://www.solidot.org/story?sid=71886) - - [香港政府有限度开放 Wi-Fi 6E](https://www.solidot.org/story?sid=71885) - - [Tor 项目发布 2020-2021 年度报告](https://www.solidot.org/story?sid=71884) - - [大自然的终极超级武器——磁星](https://www.solidot.org/story?sid=71883) - - [印度警方通过黑客活动陷害活动人士](https://www.solidot.org/story?sid=71882) - - [感染 Omicron 后疫苗接种者出现新冠长期症状的可能性比 Delta 低 20% 至 50%](https://www.solidot.org/story?sid=71881) - - [光疗法带来革命性的癌症新疗法](https://www.solidot.org/story?sid=71880) - - [城市居民在疫情中兴起露营热](https://www.solidot.org/story?sid=71879) - - [SpaceX 在 36 小时内完成三次发射](https://www.solidot.org/story?sid=71878) - - [TikTok 将美国用户数据转移到甲骨文服务器](https://www.solidot.org/story?sid=71877) -- PortSwigger Blog - - [Finding client-side prototype pollution with DOM Invader](https://portswigger.net/blog/finding-client-side-prototype-pollution-with-dom-invader) -- 黑海洋 - WIKI - - [随意修改网页内容安卓浏览器（支持审查元素修改）](https://blog.upx8.com/2807) -- 90Sec - 最新话题 - - [【由浅入深_打牢基础】HOST头攻击](https://forum.90sec.com/t/topic/2137) -- cavallette - - [Ed ecco per noi la Web Key Directory!](https://cavallette.noblogs.org/2022/06/9770) -- ICT Security Magazine - - [Cyber Deception Technology & Hybrid Warfare – Parte 1](https://www.ictsecuritymagazine.com/articoli/cyber-deception-technology-hybrid-warfare-parte-1/) -- Schneier on Security - - [Hartzbleed: A New Side-Channel Attack](https://www.schneier.com/blog/archives/2022/06/hartzbleed-a-new-side-channel-attack.html) -- Posts By SpecterOps Team Members - Medium - - [Establish security boundaries in your on-prem AD and Azure environment](https://posts.specterops.io/establish-security-boundaries-in-your-on-prem-ad-and-azure-environment-dcb44498cfc2?source=rss----f05f8696e3cc---4) -- Securelist - - [‘Unpacking’ technical attribution and challenges for ensuring stability in cyberspace](https://securelist.com/unpacking-technical-attribution/106791/) -- Securityinfo.it - - [Attacchi ransomware contro i NAS di QNAP](https://www.securityinfo.it/2022/06/20/attacchi-ransomware-contro-i-nas-di-qnap/?utm_source=rss&utm_medium=rss&utm_campaign=attacchi-ransomware-contro-i-nas-di-qnap) - - [Chrome salva dati sensibili in chiaro nella memoria](https://www.securityinfo.it/2022/06/20/chrome-salva-dati-sensibili-in-chiaro-nella-memoria/?utm_source=rss&utm_medium=rss&utm_campaign=chrome-salva-dati-sensibili-in-chiaro-nella-memoria) -- SANS Internet Storm Center, InfoCON: green - - [Odd TCP Fast Open Packets. Anybody understands why?, (Mon, Jun 20th)](https://isc.sans.edu/diary/rss/28766) - - [ISC Stormcast For Monday, June 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=8056, (Mon, Jun 20th)](https://isc.sans.edu/diary/rss/28764) -- Daniel Miessler - - [News & Analysis | NO. 336](https://danielmiessler.com/podcast/news-analysis-no-336/) -- TG Soft Software House - News - - [Vir.IT eXplorer PRO -AntiVirus, AntiSpyware, AntiMalware- certificato ICSA Labs nella categoria Anti-Malware.](http://www.tgsoft.it/italy/news_archivio.asp?id=1318) -- The Register - Security - - [Capital One: Convicted techie got in via 'misconfigured' AWS buckets](https://go.theregister.com/feed/www.theregister.com/2022/06/20/captial_one_wire_fraud/) - - [There are 24.6 billion pairs of credentials for sale on dark web](https://go.theregister.com/feed/www.theregister.com/2022/06/20/in_brief_security/) - - [You don’t need another hero … you need an automated incident response process](https://go.theregister.com/feed/www.theregister.com/2022/06/20/you_dont_need_another_heroyou/) - - [Indian government issues confidential infosec guidance to staff – who leak it](https://go.theregister.com/feed/www.theregister.com/2022/06/20/indian_government_infosec_guidance_leaks/) -- Graham Cluley - - [How to get Fortune 500 cybersecurity without the hefty price tag](https://grahamcluley.com/feed-sponsor-solcyber/) -- KitPloit - PenTest Tools! - - [SharpSniper - Find Specific Users In Active Directory Via Their Username And Logon IP Address](http://www.kitploit.com/2022/06/sharpsniper-find-specific-users-in.html) - - [Xss_Vulnerability_Challenges - This Repository Is A Docker Containing Some "XSS Vulnerability" Challenges And Bypass Examples](http://www.kitploit.com/2022/06/xssvulnerabilitychallenges-this.html) -- 山石网科安全技术研究院 - - [内存取证之volatility使用](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494016&idx=1&sn=ed9b2800f6b1b456e21b53bce22e56a1&chksm=fa523c3ecd25b528b657a92f8891c09cf711bf7aa71d9d52eff52d5f655050373d96dfd3b426&scene=58&subscene=0#rd) -- 星阑科技 - - [分享图片](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493749&idx=1&sn=411a322132e78b9a7c1028edb64744b1&chksm=c00745e9f770ccffc2b068231b1870047b64d7de328ed093a7227c78c525a227edcf510f855b&scene=58&subscene=0#rd) - - [API NEWS | 如何降低OWASP API安全威胁，微软建议......](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493746&idx=1&sn=0e910207727a7cb2f76b6428e41907b6&chksm=c00745eef770ccf80d81f732f6191b3b9c3042d734e2b60a03585e4f4f7bf38db1b016f0a089&scene=58&subscene=0#rd) -- 安全牛 - - [关键信息基础设施保护面临五道坎](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114811&idx=1&sn=065b67954f7109fdf0c5dd2c972226e9&chksm=bd147de88a63f4fedc1a685a5962faaca2a348a59ce3da8add8d5cae9a29e6c76fab6251f179&scene=58&subscene=0#rd) - - [云科安信完成数千万元A轮融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114811&idx=2&sn=ff41a2683aaefea9d9bd535ec0bfea75&chksm=bd147de88a63f4fe4402501b974fcaff2d7a72594c40a1ddef945e1026d2669e81472095b7aa&scene=58&subscene=0#rd) - - [安全头条 | CNNVD通报微软多个安全漏洞；工信部累计通报、下架违法违规APP近3000款](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114811&idx=3&sn=0a7ef41b0c1b19e911fbe8c976c6817f&chksm=bd147de88a63f4fef5dc787acbbdaf00f0df0de2adf2b8fcd9303f67d59f1f990d96ac904df6&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [CNVD漏洞周报2022年第24期](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496815&idx=1&sn=8d8b6aed4d0bda1b20c9a784729742e8&chksm=973ac70da04d4e1b7cc3ef78970a4c442208a3b9cd58cf42505e5fcc6a30c4dc71f487a226fd&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220613-20220619)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496815&idx=2&sn=bf57f161ca2b0de0e3a758a8801053b3&chksm=973ac70da04d4e1b7a4bd7e3eda8f60b037519d79310215b7817400f02b026089f2d5ea751ed&scene=58&subscene=0#rd) - - [每周移动恶意程序传播渠道安全监测报告（2022年06月13日—2022年06月19日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496815&idx=3&sn=b28689450a127753e48507f30f228b34&chksm=973ac70da04d4e1b2d4fb03b116348fa1c96579686ada6de68ae2c63c0a8ffb9984c885d5672&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [近期疑似海莲花组织攻击活动样本溯源分析](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650261970&idx=1&sn=7fd28b2fd231430e95da3c886224f9cc&chksm=f3e273a6c495fab092cafffa1bb13a81580fec2c5a63254eaded990f4fcc17b69cc9ae7eafa8&scene=58&subscene=0#rd) -- Security Affairs - - [Russian APT28 hacker accused of the NATO think tank hack in Germany](https://securityaffairs.co/wordpress/132452/hacking/apt28-hacked-nato-think-tank.html) - - [Google expert detailed a 5-Year-Old flaw in Apple Safari exploited in the wild](https://securityaffairs.co/wordpress/132446/hacking/apple-safari-zero-day-2016.html) - - [Security Affairs newsletter Round 370 by Pierluigi Paganini](https://securityaffairs.co/wordpress/132442/security/security-affairs-newsletter-round-370-by-pierluigi-paganini.html) - - [Cisco will not address critical RCE in end-of-life Small Business RV routers](https://securityaffairs.co/wordpress/132437/security/cisco-rce-small-business-rv-routers.html) - - [BRATA Android Malware evolves and targets the UK, Spain, and Italy](https://securityaffairs.co/wordpress/132425/malware/brata-android-malware-evolution.html) -- 互联网安全内参 - - [争夺第三世界影响力！美欧拟向发展中国家提供网络安全援助](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503598&idx=1&sn=6b82f502073c6b76b4f250e9197d3cad&chksm=ebfa89cedc8d00d8a56aaf4ffac7174749c64bcdde185a7cf36fd69e11e8847a0f6c005b530f&scene=58&subscene=0#rd) - - [年损失18亿美元！去中心化金融遭网络犯罪重创](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503598&idx=2&sn=253f3d45e04600471eb34be103ee64ab&chksm=ebfa89cedc8d00d8a212914e0ada8f1462f22c7f741247444873eff7cf86f81b88d9c7ad3f66&scene=58&subscene=0#rd) - - [美国联邦贸易委员会：现阶段AI无法对抗网络虚假信息](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503598&idx=3&sn=511ab23cc02d06b610986832bc1cfbe9&chksm=ebfa89cedc8d00d80613baa83d46b4b0d2c6146a78a36901690edb4b58d25b41d3ff196b5083&scene=58&subscene=0#rd) - - [首届软件供应链安全论坛 (3SCON) 召开，聚焦软件全生命周期安全](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503598&idx=4&sn=6f2d08cb2347985cebc05e19a07b7b28&chksm=ebfa89cedc8d00d8d55b47dbd0288da0f6f131f25afda175f68fb41f7883db7ea7d22917387d&scene=58&subscene=0#rd) -- 同程旅行安全应急响应中心 - - [双倍快乐｜单个漏洞最高奖励1.2万元！！](https://mp.weixin.qq.com/s?__biz=MzI4MzI4MDg1NA==&mid=2247484591&idx=1&sn=3c608f297f8150a40eeeb91c7a4c4ee4&chksm=eb8c5016dcfbd900e79d26d7683b4101251a9f333451401996ea01e10100addd23cb20fa25ff&scene=58&subscene=0#rd) -- Krebs on Security - - [Why Paper Receipts are Money at the Drive-Thru](https://krebsonsecurity.com/2022/06/why-paper-receipts-are-money-at-the-drive-thru/) -- 雷神众测 - - [雷神众测漏洞周报2022.06.13-2022.06.19-4](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652497909&idx=1&sn=f51e40a67a60966742b0ec4c03fc286d&chksm=f2584446c52fcd507b7e9b8dd269585483c09d17f6b4c4943cecb0aa5dc203a524040638621f&scene=58&subscene=0#rd) -- 代码卫士 - - [思科不打算修复VPN路由器 RCE 0day](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512438&idx=1&sn=563e5fbc7e61730cf40397cd09414e2b&chksm=ea94801cdde3090ad98fcb1524ccb001df9942040fddf238640160b7dab3a84c77eeef57ee7e&scene=58&subscene=0#rd) - - [研究员披露修复两次的 Windows RDP 漏洞详情](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512438&idx=2&sn=dc6db27797628706ae9f2892365b1f0b&chksm=ea94801cdde3090a9082e2396cd7a7f51816e70a1559981a18d63bfbe37b3f27b2a62f868d35&scene=58&subscene=0#rd) - - [RubyGems 在代码库安全更新中尝试默认2FA机制，保护供应链安全](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512438&idx=3&sn=b12b1f2846d9d93b0b8d24dc4f9286d8&chksm=ea94801cdde3090a64ac1dd5a0ff95c8920b3e2ba4479ef708c4e06d4ad1394cb2aefaddc479&scene=58&subscene=0#rd) - - [英国内政大臣：维基解密创始人朱丽安·阿桑奇可被引渡到美国](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512438&idx=4&sn=3a6c0ffc74aebe5a73beca00ebe05147&chksm=ea94801cdde3090ac1669988be61851d1d840e205c9abd5161d081267d1786aaab8a910e5676&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [深度揭秘：如何正确识别证书实际控制机构](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492334&idx=1&sn=b894216d323fb62acde466b59463b637&chksm=e84c4431df3bcd272bd996ad61a7c328bf1872aa00f09279e4ee09c5b8c652edc55e40dcdfed&scene=58&subscene=0#rd) -- M01NTeam - - [攻击技术研判 | 利用线程劫持的反调试新姿势](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247488405&idx=1&sn=e208b7f2adc02bd21b1318aed88ad4b9&chksm=c187d384f6f05a9270d9b02a007af6fb62bf4618db3dd78adaef504bf31455b9f92e566b2b7d&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [Hacking journey](https://www.reddit.com/r/HowToHack/comments/vgs8ke/hacking_journey/) - - [Make my own mag swipe card](https://www.reddit.com/r/HowToHack/comments/vgtpn8/make_my_own_mag_swipe_card/) - - [How to tell hashcat to apply no rules to wordlist?](https://www.reddit.com/r/HowToHack/comments/vgxllj/how_to_tell_hashcat_to_apply_no_rules_to_wordlist/) - - [Google Chrome Sync Passphrase Export](https://www.reddit.com/r/HowToHack/comments/vgwqrq/google_chrome_sync_passphrase_export/) - - [What is the meaning of Cross Site in XSS & CSRF?](https://www.reddit.com/r/HowToHack/comments/vgmd4l/what_is_the_meaning_of_cross_site_in_xss_csrf/) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第24期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491877&idx=1&sn=21bb58d07d6c7e6d80a2401dd4c00c77&chksm=fd74d1ecca0358faa1ee6787855b189ca7f196a5d9e75b04fb2e9e4289155f0c343e6515464d&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220613-20220619)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491877&idx=2&sn=211fe8b04ab0ec51efd24c093605a7b9&chksm=fd74d1ecca0358faed48517ece3efaf8b5dcbb92fc9bbec4c9dc1edc731e18ffd40e00d90bc0&scene=58&subscene=0#rd) -- Computer Forensics - - [Booting a image from OSFClone](https://www.reddit.com/r/computerforensics/comments/vgmfjm/booting_a_image_from_osfclone/) - - [Magnet axiom process error message](https://www.reddit.com/r/computerforensics/comments/vgmmsy/magnet_axiom_process_error_message/) -- 火线Zone - - [K8s提权之RBAC权限滥用](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495623&idx=1&sn=b8545551b2d5b030dbb55bc1ce0ea9a6&chksm=eaa967e7dddeeef1ad4027d071be742c75fc1d7f7fe9c48c7ab8ac3e7af176d39945d2393fa5&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jun. 20th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495573&idx=1&sn=011174bc88c20f604411e2ece7c990b3&chksm=ce96a2abf9e12bbd4cd42e89acc79e8258232a07f71b04e6b4fd3aa33568a166a5da1b9365b7&scene=58&subscene=0#rd) -- TorrentFreak - - [Judge Recommends $150k Piracy Judgment Against Torrent Site Operator](https://torrentfreak.com/judge-recommends-150k-piracy-judgment-against-torrent-site-operator-220620/) - - [Nitro IPTV Loses $100m Piracy Lawsuit Leaving Hollywood Studios Fuming](https://torrentfreak.com/nitro-iptv-loses-100m-piracy-lawsuit-leaving-hollywood-studios-fuming-220620/) -- 小米安全中心 - - [【内含福利】第五届小米IoT安全峰会邀请函](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247513694&idx=1&sn=f82bd0d2b59f2098845af3c7c920c23d&chksm=ea8390cbddf419dd51671dac025e2846179457088df110f3345cbb695e238bbae44689df57cd&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [西瓜视频 iOS 播放器技术重构](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495266&idx=1&sn=4a0cfe4464eca948eb7072ff4c404fb6&chksm=e9d32580dea4ac96e1c39b2450f4e2291ff62c7981f8ffbde8120a135a89d1a3a70d5ac9cb07&scene=58&subscene=0#rd) - - [分享远程办公经验，赢取社区大奖！](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495266&idx=2&sn=4cb4adef280f7476ec93abaaf91f6fc3&chksm=e9d32580dea4ac96f2f114b6ce1f0771cca5458afe55858b60f1766b4629cecac880fe052f5e&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-20)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958522&idx=1&sn=848ec75678ccaba5614a55968ad8ed28&chksm=8baecc65bcd945739b1ef43737fd0aa2ccd27cd438a296989e7fbcc6d930e3928bd0b5f87b4c&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】Lua程序逆向之Luajit字节码与反汇编](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772410&idx=1&sn=fa971a5f9bb2c31c09ef2cc7fa7f7821&chksm=88936115bfe4e8036d550a97625c8a15375e4cf2742bcb23511c6394ba48f2056dcd3ce929b4&scene=58&subscene=0#rd) - - [【安全头条】黑客骇入iCloud窃取裸照被判九年监禁](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772410&idx=2&sn=06d8f702d642a25ff038628f74acd518&chksm=88936115bfe4e803bc126850510067be24446487c410c6e7bda9ef2be91d634d0d7e059c1b93&scene=58&subscene=0#rd) -- 看雪学院 - - [『新课预售』基构网络构建与防护](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453618&idx=1&sn=fe9e14b00244c8e1305e77d5c11f127c&chksm=b18e36f886f9bfeef0e585d855151cf1225116b9bbe87f3b7bc868e519e698ceba33f2e72a19&scene=58&subscene=0#rd) - - [CVE-2016-0165提权漏洞学习笔记](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453618&idx=2&sn=dba42df66438701cda904d463e51e760&chksm=b18e36f886f9bfeefd2de981ac20b75516801e14ee248a182751e0b64855fe6df533fe2c4a41&scene=58&subscene=0#rd) - - [Claroty披露西门子工业网络管理系统15个漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453618&idx=3&sn=894833c98103a5d1549c7bd43509c3a0&chksm=b18e36f886f9bfeebb81a9dc3cb0232d1d37994cab8d0695e93d96bb0c73497fab11fcb92ae7&scene=58&subscene=0#rd) - - [（618限时9折）Intel CPU漏洞研究，为你深入详解三个史诗级的芯片漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453618&idx=4&sn=5a89909619e14747903efcdaf11aa2ba&chksm=b18e36f886f9bfeede1ea44ae22e97c8b39106820aca06b759c403ae4cf24cb285a83f61d3f6&scene=58&subscene=0#rd) -- 慢雾科技 - - [慢雾科技成为国家级数字文创规范治理生态矩阵首批协作发展伙伴](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495760&idx=1&sn=45891c851d20eb514c790a13ee022cdc&chksm=fdde8ed7caa907c1a5f9d7df3b9dca7f39a221acc6a07fe5936a8957c5e08660e75a7d5b8565&scene=58&subscene=0#rd) -- 情报分析师 - - [【智库报告】评估网络战与乌克兰战争](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506735&idx=1&sn=f2834ddfe0400090e4408eee7b2aba6f&chksm=8716aba4b06122b282079c6f66dd76dc09c141cc9a5c5064270ef4932916958428a7abc50b3e&scene=58&subscene=0#rd) - - [重点来了！《军事平衡2022》彩色全图中文完整版](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506735&idx=2&sn=f5b20757e90aaef72ad04c4ac5234479&chksm=8716aba4b06122b21e9e04bb3883766d7fac0f213e516b0468236943df1d2b06e63cc445c0e3&scene=58&subscene=0#rd) - - [开源网站—俄乌战争的监测图](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506735&idx=3&sn=a43097b54b342e0ec91fd54acba15f60&chksm=8716aba4b06122b2802d9d8501b3f57a1ba03cede24ca48b0a15bbf0298ad7de15bf5796bd0a&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [Hacking into the worldwide Jacuzzi SmartTub network](https://www.reddit.com/r/netsec/comments/vgsr81/hacking_into_the_worldwide_jacuzzi_smarttub/) - - [Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild](https://www.reddit.com/r/netsec/comments/vgaw7w/linux_threat_hunting_syslogk_a_kernel_rootkit/) - - [Zero Trust - A Layered Approach against threats](https://www.reddit.com/r/netsec/comments/vgi0ea/zero_trust_a_layered_approach_against_threats/) - - [semgrep rule pack by elttam - Java entry-points and security issues in Jackson, Spring Remoting, and Struts DMI](https://www.reddit.com/r/netsec/comments/vgepja/semgrep_rule_pack_by_elttam_java_entrypoints_and/) -- 安全学术圈 - - [NPM供应链的薄弱环节是什么？](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247487933&idx=1&sn=c388a7d1a3465a57a9bd32363e524752&chksm=fe2eee36c95967208ad6a45c8bd86ee545894ba2f7e4a8d1a2e23ac263e6c531a437c8a67f5e&scene=58&subscene=0#rd) -- 安全威胁情报 - - [你跟黑客孤军奋战，我在圈子里“对答案”](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172730&idx=1&sn=aea62ebf178f99f463ebc90066636a05&chksm=f4489686c33f1f90040b4b4e9bda2c7eb45ee4801c67800b5c5e4504a2c4eded739e0c81044d&scene=58&subscene=0#rd) -- 百度安全实验室 - - [百度安全亮相国际顶会SC2022 ：用fuzzing技术防范高性能计算风险](https://mp.weixin.qq.com/s?__biz=MzA3NTQ3ODI0NA==&mid=2247486792&idx=1&sn=b383826e1901b860ac42ac59c52de41c&chksm=9f6ea8c3a81921d5271368a87c7e6f58ff59c4fcd99556531ecf68311fedda25afe33c495a3f&scene=58&subscene=0#rd) -- Social Engineering - - [Burn Notice and Hustle (UK) are the best social engineering shows I’ve ever watched](https://www.reddit.com/r/SocialEngineering/comments/vgc8jh/burn_notice_and_hustle_uk_are_the_best_social/) -- 永安在线情报平台 - - [永安在线API数据安全方案助阵企业攻防演练](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493573&idx=1&sn=28c93dd256c49e4a60ca312d04bbd388&chksm=eb12c1fedc6548e851ebb3e40a392a96904484f71cbb581e0f9d8ce67b2f8cca461a66a52780&scene=58&subscene=0#rd) - - [永安在线成功入选2021年度“专精特新”企业名单](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493573&idx=2&sn=4e33b3db07f57345d80aa553b1cdcc3a&chksm=eb12c1fedc6548e81d76299c7c0aa2de68562573e8f6e56b957727f01e3d505f9556a7a32f19&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-06-20 ML-DOCTOR](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490436&idx=1&sn=6b2724ee474089265407d29cb8da569f&chksm=c060355df717bc4b1a5abd58af1dc92475e056a10898eeebc321d7a17575597f004f737dd8ac&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (06.13-06.19)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491085&idx=1&sn=cf91d665c41bdf165e91f2c89469a85b&chksm=fe251b0cc952921ae36aa6cce5cb0222b1ac9d3cb6614fb79fbbffb3bd9e299180d77833e7cd&scene=58&subscene=0#rd) - - [安全日报（2022.06.20）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491085&idx=2&sn=a9288ff33338ad866e5d77d4963a6cd9&chksm=fe251b0cc952921a6fc1643605c21e1da719e2cabdac08a234c9de41717d7c7a7cc56f6d282c&scene=58&subscene=0#rd) -- Dark Reading - - [Capital One Attacker Exploited Misconfigured AWS Databases](https://www.darkreading.com/attacks-breaches/capital-one-attacker-exploited-misconfigured-aws-databases) - - [Feds Take Down Russian 'RSOCKS' Botnet](https://www.darkreading.com/attacks-breaches/feds-take-down-russian-rsocks-botnet) - - [Name That Toon: Cuter Than a June Bug](https://www.darkreading.com/attacks-breaches/name-that-toon-cuter-than-a-june-bug) - - [DDoS Attacks Delay Putin Speech at Russian Economic Forum](https://www.darkreading.com/attacks-breaches/ddos-attacks-delay-putin-speech-russian-economic-forum) - - [Credential Sharing as a Service: The Hidden Risk of Low-Code/No-Code](https://www.darkreading.com/dr-tech/credential-sharing-as-a-service-hidden-risk-of-low-code-no-code) - - [Security Lessons From Protecting Live Events](https://www.darkreading.com/dr-tech/security-lessons-from-protecting-live-events) - - [The Cybersecurity Diversity Gap: Advice for Organizations Looking to Thrive](https://www.darkreading.com/careers-and-people/the-cybersecurity-diversity-gap-advice-for-organizations-looking-to-thrive) -- Hacking and security - - [Advanced Threat Hunting With Splunk](https://hackingandsecurity.blogspot.com/2022/06/advanced-threat-hunting-with-splunk.html) - - [Splunk Configuration - create index](https://hackingandsecurity.blogspot.com/2022/06/splunk-configuration-create-index.html) -- Dark Space Blogspot - - [Applicazioni Che Modificano I Software: Patch, Dropper, Loader, KMS](http://darkwhite666.blogspot.com/2018/12/tutti-i-tipi-di-crack-scopo-informativo.html) diff --git a/archive/2022/2022-06-22.md b/archive/2022/2022-06-22.md deleted file mode 100644 index 1fa49f6ada..0000000000 --- a/archive/2022/2022-06-22.md +++ /dev/null @@ -1,334 +0,0 @@ -# 每日安全资讯（2022-06-22） - -- Sec-News 安全文摘 - - [CVE-2022-1040 Sophos Firewall 服务架构与认证绕过漏洞分析之旅](https://wiki.ioin.in/url/P3xA) - - [CVE-2022-27925 Zimbra Collaboration 存在路径穿越漏洞最终导致RCE](https://wiki.ioin.in/url/1G7E) -- HackerOne Hacker Activity - - [Weak rate limit for SIGN.PLUS email verification](https://hackerone.com/reports/1584569) -- Microsoft Security Blog - - [Improving AI-based defenses to disrupt human-operated ransomware](https://www.microsoft.com/security/blog/2022/06/21/improving-ai-based-defenses-to-disrupt-human-operated-ransomware/) - - [Securing your IoT with Edge Secured-core devices](https://www.microsoft.com/security/blog/2022/06/20/securing-your-iot-devices-with-edge-secured-core-devices/) -- Sploitus.com Exploits RSS Feed - - [SAP FRUN 2.00 / 3.00 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167559&utm_source=rss&utm_medium=rss) - - [SAP FRUN Simple Diagnostics Agent 1.0 Directory Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:167563&utm_source=rss&utm_medium=rss) - - [SAP Fiori Launchpad Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167561&utm_source=rss&utm_medium=rss) - - [SAP FRUN Simple Diagnostics Agent 1.0 Missing Authentication exploit](https://sploitus.com/exploit?id=PACKETSTORM:167560&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=8A8AB8F5-563E-5796-B6A2-8D4033E3EB25&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-22980 exploit](https://sploitus.com/exploit?id=A264223F-9B71-527C-AA61-F7DF156E5B4A&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=1F9C946C-1533-5835-B5E8-641EF4FFC145&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [How Cybercriminals Misuse Code Signing Machine Identities](https://securityboulevard.com/2022/06/how-cybercriminals-misuse-code-signing-machine-identities/) - - [Security Awareness Course for Modern Work](https://securityboulevard.com/2022/06/security-awareness-course-for-modern-work/) - - [Unless Your ID Cloud Vendor Can Fulfill These 5 Requirements, Proceed With Caution](https://securityboulevard.com/2022/06/unless-your-id-cloud-vendor-can-fulfill-these-5-requirements-proceed-with-caution/) - - [Risk Assessments Aren’t Enough – Why You Need Threat Modeling](https://securityboulevard.com/2022/06/risk-assessments-arent-enough-why-you-need-threat-modeling/) - - [USENIX Enigma 2022 – Joy Forsythe’s ‘Healthcare Ecosystem: Security’s Role in Helping HealthTech Find Its Way’](https://securityboulevard.com/2022/06/usenix-enigma-2022-joy-forsythes-healthcare-ecosystem-securitys-role-in-helping-healthtech-find-its-way/) - - [Top 5 Application Security Takeaways from RSA Conference 2022](https://securityboulevard.com/2022/06/top-5-application-security-takeaways-from-rsa-conference-2022/) - - [Qakbot](https://securityboulevard.com/2022/06/qakbot/) - - [Passwordless MFA Goes Mainstream](https://securityboulevard.com/2022/06/passwordless-mfa-goes-mainstream/) - - [Tips for WP-Config & How to Avoid Sensitive Data Exposure](https://securityboulevard.com/2022/06/tips-for-wp-config-how-to-avoid-sensitive-data-exposure/) - - [Hacker Paige Thompson Could Face 45 Years in Prison — ‘Suicide by Law Enforcement’](https://securityboulevard.com/2022/06/hacker-paige-thompson-could-face-45-years-in-prison-suicide-by-law-enforcement/) -- Trustwave Blog - - [5 Reasons Why Managed Detection and Response (MDR) Must be on Every Company's Security Roadmap](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/5-reasons-why-managed-detection-and-response-mdr-must-be-on-every-companys-security-roadmap/) -- FreeBuf网络安全行业门户 - - [顺德农商银行2021年金融科技人才社会招聘全面启动](https://www.freebuf.com/jobs/336855.html) - - [FreeBuf早报 | 亚马逊前员工因数据泄露被定罪；谷歌浏览器扩展可用于在线跟踪用户](https://www.freebuf.com/articles/336794.html) - - [可怕！美国旗星银行150万客户数据遭泄露](https://www.freebuf.com/news/336805.html) - - [微软紧急发布更新，修复ARM设备上的Microsoft365登录问题](https://www.freebuf.com/news/336760.html) - - [APT 28组织成员被指控入侵北约智库](https://www.freebuf.com/news/336745.html) -- 绿盟科技技术博客 - - [洞见RSA2022 |“双碳”之下如何保护分布式新能源基础设施物联网安全](http://blog.nsfocus.net/rsa2022-cabon/) -- 安全客-有思想的安全新媒体 - - [360混合式教学已上](https://www.anquanke.com/post/id/275173) - - ["潮星"在线CTF平台上线啦](https://www.anquanke.com/post/id/275113) - - [CVE-2022-22972 VMware Workspace ONE Access 身份认证绕过漏洞分析](https://www.anquanke.com/post/id/275079) - - [RSocks僵尸网络风头正盛遭毁灭打击](https://www.anquanke.com/post/id/275094) -- paper - Last paper - - [CVE-2022-1040 Sophos Firewall 服务架构与认证绕过漏洞分析之旅](https://paper.seebug.org/1925/) - - [CVE-2022-27925 Zimbra Collaboration 存在路径穿越漏洞最终导致RCE](https://paper.seebug.org/1924/) - - [WebLogic CVE-2021-2294 反序列化 JDBC 漏洞分析](https://paper.seebug.org/1923/) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Defending Against Scheduled Task Attacks in Windows Environments](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5489-1](https://packetstormsecurity.com/files/167565/USN-5489-1.txt) - - [Ubuntu Security Notice USN-5488-1](https://packetstormsecurity.com/files/167564/USN-5488-1.txt) - - [SAP FRUN Simple Diagnostics Agent 1.0 Directory Traversal](https://packetstormsecurity.com/files/167563/ONAPSIS-2022-0007.txt) - - [SAP FRUN Simple Diagnostics Agent 1.0 Information Disclosure](https://packetstormsecurity.com/files/167562/ONAPSIS-2022-0006.txt) - - [SAP Fiori Launchpad Cross Site Scripting](https://packetstormsecurity.com/files/167561/ONAPSIS-2022-0005.txt) - - [SAP FRUN Simple Diagnostics Agent 1.0 Missing Authentication](https://packetstormsecurity.com/files/167560/ONAPSIS-2022-0004.txt) - - [SAP FRUN 2.00 / 3.00 Cross Site Scripting](https://packetstormsecurity.com/files/167559/ONAPSIS-2022-0003.txt) - - [OpenSSL Toolkit 1.1.1p](https://packetstormsecurity.com/files/167558/openssl-1.1.1p.tar.gz) - - [Ubuntu Security Notice USN-5487-1](https://packetstormsecurity.com/files/167556/USN-5487-1.txt) - - [Red Hat Security Advisory 2022-5132-01](https://packetstormsecurity.com/files/167555/RHSA-2022-5132-01.txt) -- Sucuri Blog - - [Tips for WP-Config & How to Avoid Sensitive Data Exposure](https://blog.sucuri.net/2022/06/tips-for-wp-config-how-to-avoid-sensitive-data-exposure.html) -- 跳跳糖 - 安全与分享社区 - - [Java安全笔记-JNI 详解](https://tttang.com/archive/1622/) -- ElcomSoft blog - - [checkm8 Extraction: the iPads, iPods, and TVs](https://blog.elcomsoft.com/2022/06/checkm8-extraction-the-ipads-ipods-and-tvs/) -- Google Online Security Blog - - [Game on! The 2022 Google CTF is here.](http://security.googleblog.com/2022/06/game-on-2022-google-ctf-is-here.html) -- Securelist - - [APT ToddyCat](https://securelist.com/toddycat/106799/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [A Compilation of Known Conti Ransomware Gang Personal Email Address Accounts - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/a-compilation-of-known-conti-ransomware_19.html) -- Sucuri Blog - - [Tips for WP-Config & How to Avoid Sensitive Data Exposure](https://blog.sucuri.net/2022/06/tips-for-wp-config-how-to-avoid-sensitive-data-exposure.html) -- CFC4N的博客 - - [eCapture的几个好消息，支持Android…](https://www.cnxct.com/ecapture-news-android/) -- Reverse Engineering - - [Reverse Engineering an old Mario & Luigi game for fun](https://www.reddit.com/r/ReverseEngineering/comments/vhes4l/reverse_engineering_an_old_mario_luigi_game_for/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Telangana, Andhra Pradesh, Karnataka, Himachal Pradesh & Kerala — All Government bus services were…](https://infosecwriteups.com/telangana-andhra-pradesh-karnataka-himachal-pradesh-kerala-all-government-bus-services-were-885b44c21a?source=rss----7b722bfd1b8d--bug_bounty) -- Malwarebytes Labs - - [DFSCoerce, a new NTLM relay attack, can take control over a Windows domain](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/dfscoerce-a-new-ntlm-relay-attack-can-take-control-over-a-windows-domain/) - - [Russia’s APT28 uses fear of nuclear war to spread Follina docs in Ukraine](https://blog.malwarebytes.com/threat-intelligence/2022/06/russias-apt28-uses-fear-of-nuclear-war-to-spread-follina-docs-in-ukraine/) - - [You can be tracked online using your Chrome browser extensions](https://blog.malwarebytes.com/privacy-2/2022/06/you-can-be-tracked-online-using-your-chrome-browser-extensions/) - - [Security vulnerabilities: 5 times that organizations got hacked](https://blog.malwarebytes.com/business-2/2022/06/security-vulnerabilities-5-times-that-organizations-got-hacked/) -- Trail of Bits Blog - - [Are blockchains decentralized?](https://blog.trailofbits.com/2022/06/21/are-blockchains-decentralized/) - - [Announcing the new Trail of Bits podcast](https://blog.trailofbits.com/2022/06/20/announcing-the-new-trail-of-bits-podcast/) -- The Daily Swig | Cybersecurity news and views - - [Single largest disclosure for vulnerabilities in industrial control security reveals 56 flaws](https://portswigger.net/daily-swig/single-largest-disclosure-for-vulnerabilities-in-industrial-control-security-reveals-56-flaws) - - [Jacuzzi customer details could be exposed by SmartTub web bugs, claims researcher](https://portswigger.net/daily-swig/jacuzzi-customer-details-could-be-exposed-by-smarttub-web-bugs-claims-researcher) -- GuidePoint Security - - [GRIT Ransomware Report Spotlight: Healthcare](https://www.guidepointsecurity.com/blog/grit-ransomware-report-spotlight-healthcare/) -- SentinelOne - - [Detecting Unconstrained Delegation Exposures in AD Environment](https://www.sentinelone.com/blog/detecting-unconstrained-delegation-exposures-in-ad-environment/) -- Light Blue Touchpaper - - [WEIS 2022 – Liveblog](https://www.lightbluetouchpaper.org/2022/06/21/weis-2022-liveblog/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 6/6/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-6-6-2022/) -- KitPloit - PenTest & Hacking Tools - - [Naabu - A Fast Port Scanner Written In Go With A Focus On Reliability And Simplicity](http://www.kitploit.com/2022/06/naabu-fast-port-scanner-written-in-go.html) - - [Msprobe - Finding All Things On-Prem Microsoft For Password Spraying And Enumeration](http://www.kitploit.com/2022/06/msprobe-finding-all-things-on-prem.html) -- rtl-sdr.com - - [Airspy 2022 Summer Sale + SDR# Noise Reduction Improvements](https://www.rtl-sdr.com/airspy-2022-summer-sale-sdr-noise-reduction-improvements/) - - [Low Cost Shielding Idea for Plastic RTL-SDRs](https://www.rtl-sdr.com/low-cost-shielding-idea-for-plastic-rtl-sdrs/) - - [The South Indian SDR User Group](https://www.rtl-sdr.com/the-south-indian-sdr-user-group/) -- 博客园 - 郑瀚Andrew.Hann - - [南京大学 静态软件分析（static program analyzes）-- Soundness and Soundiness 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16393680.html) - - [南京大学 静态软件分析（static program analyzes）-- Datalog-Based Program Analysis 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16378237.html) - - [南京大学 静态软件分析（static program analyzes）-- CFL-Reachability and IFDS 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16381920.html) - - [南京大学 静态软件分析（static program analyzes）-- Pointer Analysis Foundations 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16348789.html) - - [南京大学 静态软件分析（static program analyzes）-- Pointer Analysis Context Sensitive 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16360259.html) - - [南京大学 静态软件分析（static program analyzes）-- Static Analysis for Security 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16376137.html) - - [南京大学 静态软件分析（static program analyzes）-- Pointer Analysis 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16347463.html) - - [南京大学 静态软件分析（static program analyzes）-- Data Flow Analysis：Foundation 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16313553.html) - - [南京大学 静态软件分析（static program analyzes）-- Interprocedural Analysis 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16334657.html) - - [南京大学 静态软件分析（static program analyzes）-- Intermediate Representation 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16281285.html) - - [南京大学 静态软件分析（static program analyzes）-- Data Flow Analysis：Applications 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16284395.html) - - [南京大学 静态软件分析（static program analyzes）-- introduction 学习笔记 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16277016.html) -- Fuzzing Labs - - [Solidity/Ethereum Smart Contract Audit using Slither – Blockchain Security #4](https://fuzzinglabs.com/ethereum-smart-contract-audit-slither/) -- Qualys Security Blog - - [Defending Against Scheduled Task Attacks in Windows Environments](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Cobalt Strike Research and Development - - [Arsenal Kit Update: Thread Stack Spoofing](https://www.cobaltstrike.com/blog/arsenal-kit-update-thread-stack-spoofing/) -- Google Online Security Blog - - [Game on! The 2022 Google CTF is here.](http://security.googleblog.com/2022/06/game-on-2022-google-ctf-is-here.html) -- LuxSci - - [Increasing Resiliency with Data Backups](https://luxsci.com/blog/increasing-resiliency-with-data-backups.html) -- 奇客Solidot–传递最新科技情报 - - [网络配置错误导致 Cloudflare 大规模宕机](https://www.solidot.org/story?sid=71901) - - [逾半数美国人承认花在手机上的时间太多](https://www.solidot.org/story?sid=71900) - - [RISC-V 宣布新规格](https://www.solidot.org/story?sid=71899) - - [Space 上周日的发射包含了四颗秘密卫星](https://www.solidot.org/story?sid=71898) - - [Terra 币公司员工被禁止离境](https://www.solidot.org/story?sid=71897) - - [618 购物节销售增速放缓](https://www.solidot.org/story?sid=71896) - - [科学家开发出替代塑料的抗菌植物性食品包装](https://www.solidot.org/story?sid=71895) - - [希音如何高效率的运作](https://www.solidot.org/story?sid=71894) - - [Google 表示该让小企业长期用户付费了](https://www.solidot.org/story?sid=71893) - - [美国首个 CRISPR 试验三年后近 100% 有效](https://www.solidot.org/story?sid=71892) - - [NASA TESS 在附近星系发现超级地球](https://www.solidot.org/story?sid=71890) - - [绝大多数人对正在做的事情缺乏预见](https://www.solidot.org/story?sid=71888) - - [IE 的幽灵仍然会影响我们数年](https://www.solidot.org/story?sid=71887) -- IT Service Management News - - [Security Risk Assessment Tool del US HHS](http://blog.cesaregallotti.it/2022/06/security-risk-assessment-tool-del-us-hhs.html) -- Securityinfo.it - - [Gestire le vulnerabilità con l’intelligenza artificiale](https://www.securityinfo.it/2022/06/21/gestire-le-vulnerabilita-con-lintelligenza-artificiale/?utm_source=rss&utm_medium=rss&utm_campaign=gestire-le-vulnerabilita-con-lintelligenza-artificiale) - - [Trojan per Android BRATA diventa persistente](https://www.securityinfo.it/2022/06/21/il-trojan-per-android-brata-diventa-persistente/?utm_source=rss&utm_medium=rss&utm_campaign=il-trojan-per-android-brata-diventa-persistente) -- Schneier on Security - - [Hidden Anti-Cryptography Provisions in Internet Anti-Trust Bills](https://www.schneier.com/blog/archives/2022/06/hidden-anti-cryptography-provisions-in-internet-anti-trust-bills.html) -- HACKMAGEDDON - - [16-31 May 2022 Cyber Attacks Timeline](https://www.hackmageddon.com/2022/06/21/16-31-may-2022-cyber-attacks-timeline/) -- Chaos Computer Club - last 100 events feed - - [Der Fernsprecher (petitfoo)](https://cdn.media.ccc.de/contributors/essen/petitfoo/h264-hd/petitfoo-58-deu-Der_Fernsprecher_hd.mp4) -- Hakin9 – IT Security Magazine - - [VAmPI - Vulnerable REST API with OWASP top 10 vulnerabilities for security testing](https://hakin9.org/vampi-vulnerable-rest-api-with-owasp-top-10-vulnerabilities-for-security-testing/) - - [How to Scale Your OSINT Research with Data Enrichment by Gergo Varga](https://hakin9.org/how-to-scale-your-osint-research-with-data-enrichment/) -- Securelist - - [APT ToddyCat](https://securelist.com/toddycat/106799/) -- LockBoxx - - [Bootcamp Project: Home Network Visability](http://lockboxx.blogspot.com/2022/06/bootcamp-project-home-network-visability.html) -- NetSPI - - [NetSPI Expands Global Footprint with Strategic Leadership Appointments in EMEA](https://www.netspi.com/news/press-release/netspi-emea-expansion/) - - [A Strategic Approach to Automotive Security](https://www.netspi.com/blog/executive/penetration-testing/strategic-approach-to-automotive-security/) -- SANS Internet Storm Center, InfoCON: green - - [Experimental New Domain / Domain Age API, (Tue, Jun 21st)](https://isc.sans.edu/diary/rss/28770) - - [ISC Stormcast For Tuesday, June 21st, 2022 https://isc.sans.edu/podcastdetail.html?id=8058, (Tue, Jun 21st)](https://isc.sans.edu/diary/rss/28768) -- Threatpost - - [Modern IT Security Teams’ Inevitable Need for Advanced Vulnerability Management](https://threatpost.com/modern-it-security-teams-inevitable-need-for-advanced-vulnerability-management/180018/) - - [Kazakh Govt. Used Spyware Against Protesters](https://threatpost.com/kazakh-govt-used-spyware-against-protesters/180016/) - - [Office 365 Config Loophole Opens OneDrive, SharePoint Data to Ransomware Attack](https://threatpost.com/office-365-opens-ransomware-attacks-on-onedrive-sharepoint/180010/) - - [Voicemail Scam Steals Microsoft Credentials](https://threatpost.com/voicemail-phishing-scam-steals-microsoft-credentials/180005/) -- Graham Cluley - - [Voicemail-themed phishing attacks target organisations](https://grahamcluley.com/voicemail-themed-phishing-attacks-targets-organisations/) -- 补天平台 - - [补天平台邀请你来参加第五届小米IoT安全峰会啦！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247493745&idx=1&sn=83e6479f18c10ea9fc89cc1faa384531&chksm=eaf9a03ddd8e292bd60aa5849b260f86697cbaac3e829712390d1eed323c706d1e64da2879b5&scene=58&subscene=0#rd) - - [红蓝攻防：构建实战化网络安全防御体系](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247493745&idx=2&sn=90c41b6d6f24584fb8c88349faf93cab&chksm=eaf9a03ddd8e292bbe38adff32c5d2767d01752ac9227b0956ca3c05090083ef7d2787a7351f&scene=58&subscene=0#rd) - - [补天发布校园守护者计划，拟推出多期活动持续助力校园白帽成长！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247493745&idx=3&sn=be2d6a2e8007cf2aa88ba2707a782e78&chksm=eaf9a03ddd8e292bd1eae26412dcfd11227f3b7683f5f5322f708630eecb1c071197100a9048&scene=58&subscene=0#rd) -- Computer Forensics - - [Find out formated or marged partitions](https://www.reddit.com/r/computerforensics/comments/vhakue/find_out_formated_or_marged_partitions/) - - [$8k tower budget](https://www.reddit.com/r/computerforensics/comments/vh0vwy/8k_tower_budget/) - - [Convert Parallels image](https://www.reddit.com/r/computerforensics/comments/vh6rnn/convert_parallels_image/) -- Your Hacking Tutorial by Zempirians - - [How is the server avoiding my input to be used as HTML? Details in the comments](https://www.reddit.com/r/HowToHack/comments/vhetbi/how_is_the_server_avoiding_my_input_to_be_used_as/) - - [Book suggestions?](https://www.reddit.com/r/HowToHack/comments/vhj0fv/book_suggestions/) - - [Is it possible to make 'auto type'](https://www.reddit.com/r/HowToHack/comments/vhnm1x/is_it_possible_to_make_auto_type/) - - [String Search](https://www.reddit.com/r/HowToHack/comments/vh5vb9/string_search/) -- Social Engineering - - [Received this article some time ago. Any thoughts on it?](https://www.reddit.com/r/SocialEngineering/comments/vhfoj6/received_this_article_some_time_ago_any_thoughts/) - - [This post is exactly what this sub is about.](https://www.reddit.com/r/SocialEngineering/comments/vhb8g2/this_post_is_exactly_what_this_sub_is_about/) -- Instapaper: Unread - - [checkm8 Extraction the iPads, iPods, and TVs](https://blog.elcomsoft.com/2022/06/checkm8-extraction-the-ipads-ipods-and-tvs/) - - [Mobile Security Review 2022](https://www.av-comparatives.org/mobile-security-review-2022/) - - [Hartzbleed A New Side-Channel Attack](https://www.schneier.com/blog/archives/2022/06/hartzbleed-a-new-side-channel-attack.html) - - [Fofa Viewer simple FOFA (cyberspace search engine) client](https://securityonline.info/fofa-viewer-simple-fofa-cyberspace-search-engine-client/) - - [This new Windows 11 privacy feature shows when apps access your microphone, camera or location](https://www.zdnet.com/article/this-new-windows-11-privacy-feature-shows-when-apps-access-your-microphone-camera-or-location/) - - [US disrupts Russian botnet that 'hacked millions of devices'](https://www.zdnet.com/article/us-disrupts-russian-botnet-that-hacked-millions-of-devices/) -- 火线Zone - - [火线沙龙第26期-多云安全专场](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495632&idx=1&sn=13ed30c8d22f770d6ba6b5ecab030c0f&chksm=eaa967f0dddeeee6601cf0e88f2b9a596ee586b50fbb2090f876b46495f1132628f89870234e&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [DEF CON CTF Qualifier 2022 not-so-advanced writeup](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494102&idx=1&sn=e6664a174f68288bc0308943db440cb4&chksm=fa523c68cd25b57e8723b71170e0eb02707b1eb58db1cde6e5bd9bb1256c1099a4e06658d05f&scene=58&subscene=0#rd) -- TorrentFreak - - [Paris Hilton is One of the First Defendants at the ‘Small’ Copyright Claims Board](https://torrentfreak.com/paris-hilton-is-one-of-the-first-defendants-at-the-small-copyright-claims-board-220621/) - - [MANGA Plus Invites Users to Confess Piracy & Name Most-Used Pirate Sites](https://torrentfreak.com/manga-plus-invites-users-to-confess-piracy-name-most-used-pirate-sites-220621/) -- 安全牛 - - [云时代安全运营服务的变革与发展](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114902&idx=1&sn=b37e1e2abda24c6bb89a0a0fc214670c&chksm=bd147d458a63f453090a7df960cd5e9b65cb8d397ad17cd6be196245ae77086630cedc738053&scene=58&subscene=0#rd) - - [如何建立有弹性的网络安全团队](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114902&idx=2&sn=86a4bc8b9743450febc5272dd220fb2c&chksm=bd147d458a63f453efdff9948af67ed7d4ccee58c9443d0dbee9b48e40bd6a32c655cd76af97&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（27期）：互联网大厂如何应对数据跨境合规风险（一）](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114902&idx=3&sn=6c8c640a557671b043a5512687a7dbf9&chksm=bd147d458a63f4536361e732b2b2349bf1a233805369683c3513d81d159b839042de9ddb4287&scene=58&subscene=0#rd) -- Blackhat Library: Hacking techniques and research - - [Hypothesis of state sponsored implant with advanced ex-filtration technology](https://www.reddit.com/r/blackhat/comments/vh2i1n/hypothesis_of_state_sponsored_implant_with/) -- 深信服千里目安全实验室 - - [【漏洞通告】Spring Data MongoDB SpEL表达式注入漏洞 CVE-2022-22980](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262005&idx=1&sn=2eefdc73976a9751b35a9747723108dc&chksm=f3e27381c495fa97e6272be3ecb4e9a31c187cb166472035295b93d85c5f5761e114eaf15939&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [守护不止一“夏”](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247504779&idx=1&sn=93fb911c4e1e5797b72fa026497282e4&chksm=eb700db4dc0784a27db3ea0138405b17f3ad5cb925ea7566ec7079eb26be091055a4e53ef353&scene=58&subscene=0#rd) -- CENSUS - - [Introducing Janus: a hierarchical multi-blockchain access control system for policy based access to shared resources](https://census-labs.com/news/2022/06/21/janus-hmbac/) -- 默安科技 - - [默安科技@云原生产业大会：谈云原生安全体系五大能力](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492241&idx=1&sn=34c935c63eb69a39fac6b52e33faf289&chksm=e93b15b3de4c9ca5c7295e87758df3d82ca619d2afb063498ef96d8c2d99c366d003db81ff9e&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [【京麒沙龙-数据安全专场】蔚来汽车、字节、京东大咖分享数据安全最佳实践](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727834809&idx=1&sn=c264a8d5066b5618214add15e54b89f4&chksm=8050a331b7272a271bb36fba7479bfb7883f4f26b128a48eb559af8709ad1b05e56951400119&scene=58&subscene=0#rd) -- 白帽100安全攻防实验室 - - [ASMI学习-总结](https://mp.weixin.qq.com/s?__biz=MzIxMDYyNTk3Nw==&mid=2247489939&idx=1&sn=04659a947e9a50b63ece660b19475a0f&chksm=9760ed45a0176453b0419a9b6f49f19ef7ac898506ceb442ebd85c2692130e7f8c041521632f&scene=58&subscene=0#rd) - - [内网技巧-linuxPAM](https://mp.weixin.qq.com/s?__biz=MzIxMDYyNTk3Nw==&mid=2247489939&idx=2&sn=eb1740a350692865abdd148c13103d15&chksm=9760ed45a01764530d4b6133ef82bec1d38856a8529329d0172379f7655182f0caaefc16075e&scene=58&subscene=0#rd) -- 看雪学院 - - [EXP编写学习之绕过SafeSEH](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453650&idx=1&sn=80fd959ccaf32602fca0cc7462497228&chksm=b18e361886f9bf0e105675b2206100d43cebf617bf488de3bdedf767ed1a85768818145f8596&scene=58&subscene=0#rd) - - [热搜爆了！学习通数据库疑发生信息泄露，超1.7亿数据被非法售卖](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453650&idx=2&sn=2210c6ffd79a76eb6e3523ff11a81fd8&chksm=b18e361886f9bf0e42212dda09bf8dd0966232329e35c3b78a36ecf78cf46ae0485342c42cc8&scene=58&subscene=0#rd) - - [《安卓逆向入门》学懂学透](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458453650&idx=3&sn=8b8a4dcbb9508899adeb5ef6c64a5694&chksm=b18e361886f9bf0ee9f88a07447709dafcb8a4e8fef664f72af6b98bc22f8490ecaddcbb9be3&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [探索数字贸易视阈下跨境数据流动治理体系](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527554&idx=1&sn=c5923cb67ecc9e631cd851857ecf99cd&chksm=c1e9e0d3f69e69c5a7e641511eb046b5d1dba304d2958fc6bcb0b57a4749a0fcbc8bc59b2ba3&scene=58&subscene=0#rd) - - [网络犯罪集团为了躲避制裁而使用LockBit勒索软件](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527554&idx=2&sn=3dccd827231a176111befd3dfce130f4&chksm=c1e9e0d3f69e69c5047e71a3690c1a77fb36270cec71f6a25d4cb5f548cf309c5e943a711206&scene=58&subscene=0#rd) - - [疑伊朗黑客攻击以色列电子空袭警报系统致火箭警报响一小时](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527554&idx=3&sn=e5cafadf037a900467be6de762c07b01&chksm=c1e9e0d3f69e69c568b439e784add56674d0a40f45cdae22c78700479c9a1a9aa8c34326ef4a&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [Intercepting MS Teams Communication](https://www.reddit.com/r/netsec/comments/vhape1/intercepting_ms_teams_communication/) - - [Container escapes: Detecting abuses of Linux capabilities with Falco + Intro to CAP_SYS_ADMIN](https://www.reddit.com/r/netsec/comments/vhghx5/container_escapes_detecting_abuses_of_linux/) - - [A deep dive into Sigma rules and how to write your own threat detection rules](https://www.reddit.com/r/netsec/comments/vhf5o0/a_deep_dive_into_sigma_rules_and_how_to_write/) - - [Reverse Engineering an old Mario & Luigi game for fun](https://www.reddit.com/r/netsec/comments/vhea6a/reverse_engineering_an_old_mario_luigi_game_for/) - - [Improving AI-based defenses to disrupt human-operated ransomware](https://www.reddit.com/r/netsec/comments/vhgrse/improving_aibased_defenses_to_disrupt/) - - [Does Acrobat Reader Unload Injection of Security Products?](https://www.reddit.com/r/netsec/comments/vh8mic/does_acrobat_reader_unload_injection_of_security/) - - [When the CAS let you in - abusing misconfigured Actuator in Apereo CAS](https://www.reddit.com/r/netsec/comments/vh9j52/when_the_cas_let_you_in_abusing_misconfigured/) -- 奇安信CERT - - [Spring Data MongoDBSpEL表达式注入漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496347&idx=1&sn=41c698327015d265c511437802918bbf&chksm=fe79d603c90e5f153fdd7145f6ea5d6ba48b5362dc439aa23e5858e297606fbd788989567046&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [字节跳动开源 Go HTTP 框架 Hertz 设计实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495355&idx=1&sn=b21461ea295e81cfc5ce433b9f702e3f&chksm=e9d32559dea4ac4fb6c9bf425f3c3bf1f4f04d339ba988e96431f799cdab0789cd40a0b2f04b&scene=58&subscene=0#rd) - - [火山引擎云数据库 veDB 在字节内部的业务实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495355&idx=2&sn=8640e09cb5a4b7317a2f0112328f39c9&chksm=e9d32559dea4ac4ff2961201f3818bc4cd2dc54979aa4b0866418d430e4b8c257b5dd98f1515&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Detecting PetitPotam AD CS and other Domain Controller Account Takeovers](https://www.reddit.com/r/netsecstudents/comments/vhmraf/detecting_petitpotam_ad_cs_and_other_domain/) - - [Json injection question](https://www.reddit.com/r/netsecstudents/comments/vhjcn4/json_injection_question/) -- Deeplinks - - [Victory! Court Rules That DMCA Does Not Override First Amendment’s Anonymous Speech Protections](https://www.eff.org/deeplinks/2022/06/victory-court-rules-dmca-does-not-override-first-amendments-anonymous-speech) - - [When “Jawboning” Creates Private Liability](https://www.eff.org/deeplinks/2022/06/when-jawboning-creates-private-liability) - - [Pass the "My Body, My Data" Act](https://www.eff.org/deeplinks/2022/06/pass-my-body-my-data-act) - - [Daycare Apps Are Dangerously Insecure](https://www.eff.org/deeplinks/2022/06/daycare-apps-are-dangerously-insecure) -- 雷神众测 - - [基于Zabbix的漏洞复现](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652497976&idx=1&sn=1afbd05efa7327021334863176f19910&chksm=f2584b8bc52fc29dd0536646067319f0f9ce3f873846ce32334bf543cee9ea4abb8aed54624d&scene=58&subscene=0#rd) -- 黑海洋 - WIKI - - [MT管理器v2.11.0高级版（安卓反编译）](https://blog.upx8.com/2809) - - [Topaz Sharpen AI v4.1.0（图像清晰锐化）便携版](https://blog.upx8.com/2808) -- 长亭安全课堂 - - [xray三周年啦！还有重磅福利送上](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247489693&idx=1&sn=2f758d3c38ae9153694a2c78f2811173&chksm=96f407f0a1838ee6f8b30956c7ca1259bf4c3a9fa5320eef3838a68bb8d846d5d546d74caae4&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [网络安全如何保障，习近平这些话指明路径](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247490856&idx=1&sn=44117ed7af8c6c8947ed2b44318a56d2&chksm=feb59c3bc9c2152dd21c071947012dd5b7bc122c65d882684022ec5c26cbf51f3124235c7976&scene=58&subscene=0#rd) - - [法治网评：整体系统地认识网络安全与发展](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247490856&idx=2&sn=a1b5b76271ecc9a002fdab1009e2f7bf&chksm=feb59c3bc9c2152dbe2e5c7bdfb3842462c813ca8cdd324699a1f01f530b033fa4cea5caee4d&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.06.21）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491088&idx=1&sn=ab2a7b636f0629b56fd290af2b8032fa&chksm=fe251b11c9529207cc5b26a708ba30442c0f7d5bcfef8b3fa220685c6831863756f08c84a726&scene=58&subscene=0#rd) -- Forensic Focus - - [A Systematic Approach to Understanding MACB Timestamps on Unixlike Systems](https://www.forensicfocus.com/webinars/a-systematic-approach-to-understanding-macb-timestamps-on-unixlike-systems/) - - [Detego Global and Forensic Computers Inc. Team Up to Deliver Two Specialist Webinars](https://www.forensicfocus.com/news/detego-global-and-forensic-computers-inc-team-up-to-deliver-two-specialist-webinars/) -- Full Disclosure - - [Onapsis Security Advisory 2022-0007: Directory Traversal vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0)](https://seclists.org/fulldisclosure/2022/Jun/41) - - [Onapsis Security Advisory 2022-0006: Information Disclosure vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0)](https://seclists.org/fulldisclosure/2022/Jun/40) - - [Onapsis Security Advisory 2022-0005: Cross-Site Scripting (XSS) vulnerability in SAP Fiori launchpad](https://seclists.org/fulldisclosure/2022/Jun/39) - - [# Onapsis Security Advisory 2022-0004: Missing Authentication check in SAP Focused Run (Simple Diagnostics Agent 1.0)](https://seclists.org/fulldisclosure/2022/Jun/38) - - [Onapsis Security Advisory 2022-0003: Cross-Site Scripting (XSS) vulnerability in SAP Focused Run (Real User Monitoring)](https://seclists.org/fulldisclosure/2022/Jun/37) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于Spring Data MongoDB SPEL表达式注入漏洞风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495581&idx=1&sn=b1ef7863d3642b6b847b4b2fe89431b2&chksm=ce96a2a3f9e12bb52bfff2b9ea749ff29d8685355567511f11032ae31d0f14c1b77f4f6b00fa&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Jun. 21th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495581&idx=2&sn=a242255ffff1c2c5dd99dcbd0943d5ca&chksm=ce96a2a3f9e12bb546c9fa621a98eff15a3cbdd7b8cbb4e9ea743bbf03f224c846b45296420a&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [打造10亿产品线 | 绿盟科技魔力防火墙线上发布](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491760&idx=1&sn=95ece359dbed2342f8eda14bed8e9b31&chksm=eaac73f7dddbfae126ea695425c38420a4ccab99ef603aa85d10c84cb4d8a994f7b1c013ca03&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [打造10亿产品线 | 绿盟科技魔力防火墙线上发布](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492429&idx=1&sn=4f796a2f3d4869b383a7d84c1a211c07&chksm=e84c4592df3bcc846381585b6dc09423f53cc4be934be67d355a6ac7d0045b8eebc6463d6da8&scene=58&subscene=0#rd) -- 代码卫士 - - [谷歌研究员详述已存在5年、已遭利用、已修复的 Safari 0day](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512458&idx=1&sn=08b25be264dda4e141186f4948c38a61&chksm=ea9480e0dde309f63d8503831b6b7d929be097e6a6d155a43132e4f6cfafd14db0afa455cced&scene=58&subscene=0#rd) - - [西门子工业网络管理系统中存在15个漏洞，可导致RCE](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512458&idx=2&sn=f1263ecf9f5f3344014fbb23ed01ef9b&chksm=ea9480e0dde309f6895b3ca1824f5dbf05ec60a8059c2590a09de5d1f9ce9f6091a15eacabfa&scene=58&subscene=0#rd) - - [思杰ADM高危漏洞可导致管理员密码重置](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512458&idx=3&sn=b55867df7184e1bc35226d1d943cabe3&chksm=ea9480e0dde309f669afde9e26ac00dda9d4749a4a0a6235ff4f8d5e7d597e1dce83c40d010d&scene=58&subscene=0#rd) -- 青藤云安全 - - [攻防演练 | 基于ATT&CK的威胁狩猎实践案例](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650835587&idx=1&sn=f7e33ee4e3722c07361359d4ee93e367&chksm=80dbe926b7ac6030876dd5c5fedd4f5683dd2654c62890e0b5865eccbfc8d6eedd2e45beda35&scene=58&subscene=0#rd) -- Security Affairs - - [New ToddyCat APT targets high-profile entities in Europe and Asia](https://securityaffairs.co/wordpress/132482/apt/toddycat-apt.html) - - [New DFSCoerce NTLM relay attack allows taking control over Windows domains](https://securityaffairs.co/wordpress/132473/hacking/dfscoerce-attacks-windows-domains.html) - - [Cybercriminals Use Azure Front Door in Phishing Attacks](https://securityaffairs.co/wordpress/132458/cyber-crime/azure-front-door-phishing.html) -- 安全学术圈 - - [2022年河南省网络密码技术重点实验室开放基金](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247487939&idx=1&sn=59ddb20180ec7e790fd943d826564dd0&chksm=fe2eee48c959675e2b5115338371bbc266755e1ed95042585a310627aaa185b3fa0f26469c5f&scene=58&subscene=0#rd) -- 情报分析师 - - [研判报告：网络安全和央行数字货币的挑战](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506839&idx=1&sn=1c5876e03482a20f02d1eb3269683a01&chksm=8716a81cb061210a609c3d57901de122c90bd34638a958c82025915d203332a6f10293fd0f09&scene=58&subscene=0#rd) - - [开源情报工具汇总网站—TII](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650506839&idx=2&sn=515422a325f9092fc09808861e321c59&chksm=8716a81cb061210a4be0f5892a510bf4bffc99f4e173237c44c58ecec676ca8288e11bf7ba94&scene=58&subscene=0#rd) -- The Register - Security - - [Info on 1.5m people stolen from US bank in cyberattack](https://go.theregister.com/feed/www.theregister.com/2022/06/21/flagstar_bank_breached_ssn/) - - [Don’t react, prevent](https://go.theregister.com/feed/www.theregister.com/2022/06/21/dont_react_prevent/) - - [1Password's Insights tool to help admins monitor users' security practices](https://go.theregister.com/feed/www.theregister.com/2022/06/21/1password_trots_out_insights_tool/) - - [A great day for non-robots: iOS 16 will bypass CAPTCHAs](https://go.theregister.com/feed/www.theregister.com/2022/06/21/believe_it_or_not_apple/) - - [How refactoring code in Safari's WebKit resurrected 'zombie' security bug](https://go.theregister.com/feed/www.theregister.com/2022/06/21/apple-safari-zombie-exploit/) - - [CISA and friends raise alarm on critical flaws in industrial equipment, infrastructure](https://go.theregister.com/feed/www.theregister.com/2022/06/21/56_vulnerabilities_critical_industrial/) - - [Voicemail phishing emails steal Microsoft credentials](https://go.theregister.com/feed/www.theregister.com/2022/06/21/phishing-voicemail-microsoft-zscaler/) -- 腾讯玄武实验室 - - [每日安全动态推送(06-21)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958526&idx=1&sn=b3a017942a736cf374207ac23f43e474&chksm=8baecc61bcd945774e7e27594e93d57c559184c98de73be67e51f3cf0f5b1b13694de1de0f2f&scene=58&subscene=0#rd) -- 数世咨询 - - [[调研]入门级网络安全人员才是网络安全人才蓝海](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493884&idx=1&sn=46942a83109386356680ee2a4d3a8d73&chksm=c1449a41f63313574e47db713c53ab6e13ea57ce8de07a79c08283f583a37d865c933ebc33f1&scene=58&subscene=0#rd) - - [【直播预告】重磅发布：创宇安全智脑强势来袭](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493884&idx=2&sn=d2cbdb44fbf1ceb211d64b848068d119&chksm=c1449a41f63313570eb3ce1e0884ae5d036a2807c7d3d02b382dc8de020026467cb4e4f50306&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [Naabu - A Fast Port Scanner Written In Go With A Focus On Reliability And Simplicity](http://www.kitploit.com/2022/06/naabu-fast-port-scanner-written-in-go.html) - - [Msprobe - Finding All Things On-Prem Microsoft For Password Spraying And Enumeration](http://www.kitploit.com/2022/06/msprobe-finding-all-things-on-prem.html) -- 字节跳动安全中心 - - [1分钟带你了解字节、谷歌、奇安信是如何做安全运营的](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247488872&idx=1&sn=2b0d6254f8be419c38f18e4139439aa6&chksm=fa9eee3ecde96728742bc44092785e8893e73c939d1c4abf939d5989f96147b37d74e68daf40&scene=58&subscene=0#rd) -- Dark Reading - - [Linux Foundation Announces Open Programmable Infrastructure Project to Drive Open Standards for New Class of Cloud Native Infrastructure](https://www.darkreading.com/cloud/linux-foundation-announces-open-programmable-infrastructure-project-to-drive-open-standards-for-new-class-of-cloud-native-infrastructure) - - [7 Ways to Avoid Worst-Case Cyber Scenarios](https://www.darkreading.com/risk/7-ways-to-avoid-worst-case-cyber-scenarios) - - [VPNs Persist Despite Zero-Trust Fervor](https://www.darkreading.com/remote-workforce/vpns-persist-despite-zero-trust-fervor) - - [China-Linked ToddyCat APT Pioneers Novel Spyware](https://www.darkreading.com/attacks-breaches/china-linked-toddycat-apt-pioneers-novel-spyware) - - [RIG Exploit Kit Replaces Raccoon Stealer Trojan With Dridex](https://www.darkreading.com/attacks-breaches/rig-exploit-kit-replaces-raccoon-stealer-trojan-with-dridex) - - [Gartner: Regulation, Human Costs Will Create Stormy Cybersecurity Weather Ahead](https://www.darkreading.com/attacks-breaches/gartner-regulation-human-cost-stormy-cybersecurity-weather) - - [Why Financial Institutions Must Double Down on Open Source Investments](https://www.darkreading.com/application-security/why-financial-institutions-must-double-down-on-open-source-investments) - - [Evolving Beyond the Password: It's Time to Up the Ante](https://www.darkreading.com/edge-articles/evolving-beyond-the-password-it-s-time-to-up-the-ante) - - [BRATA Android Malware Evolves Into an APT](https://www.darkreading.com/threat-intelligence/brata-android-malware-evolves-into-an-apt) - - [Reducing Risk With Zero Trust](https://www.darkreading.com/dr-tech/reducing-risk-with-zero-trust) - - [56 Vulnerabilities Discovered in OT Products From 10 Different Vendors](https://www.darkreading.com/vulnerabilities-threats/study-finds-56-vulnerabilities-in-ot-products-from-10-vendors) - - [AI Is Not a Security Silver Bullet](https://www.darkreading.com/attacks-breaches/ai-is-not-a-security-silver-bullet) - - [Open Source Software Security Begins to Mature](https://www.darkreading.com/application-security/open-source-software-security-mature) -- 安全客 - - [【技术分享】从 CVE-2017-0263 漏洞分析到菜单管理组件（上）](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772458&idx=1&sn=494294c3f20c40f28df4b397616e079b&chksm=889361c5bfe4e8d343462ab6122b39674ce39bb51c3b6e78540d819caa0d80e9fc425373d8a4&scene=58&subscene=0#rd) - - [【安全头条】RSocks僵尸网络风头正盛遭毁灭打击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772458&idx=2&sn=52a8f9e1f7703d502b3854f63e6b9e87&chksm=889361c5bfe4e8d39c430d94f09d55e466fbd1f42604cb7baee7bbb0b99ea9f448a5fc0a4214&scene=58&subscene=0#rd) -- Dark Space Blogspot - - [Solana è Davvero Decentralizzata? Il Problema Solend](http://darkwhite666.blogspot.com/2022/06/solana-e-davvero-decentralizzata-il.html) - - [Bancor Network e La Protezione Da Impermanent Loss](http://darkwhite666.blogspot.com/2022/06/bancor-network-e-la-protezione-da.html) diff --git a/archive/2022/2022-06-23.md b/archive/2022/2022-06-23.md deleted file mode 100644 index 122603ad13..0000000000 --- a/archive/2022/2022-06-23.md +++ /dev/null @@ -1,283 +0,0 @@ -# 每日安全资讯（2022-06-23） - -- HackerOne Hacker Activity - - [Bypass for Domain-level redirects (Unvalidated Redirects and Forwar)](https://hackerone.com/reports/1582160) - - [Able to approve admin approval and change effective status without adding payment details .](https://hackerone.com/reports/1543159) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [SIEMENS-SINEMA Remote Connect 3.0.1.0-01.01.00.02 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022060072) - - [Verbatim Fingerprint Secure Portable Hard Drive Insufficient Verification](https://cxsecurity.com/issue/WLB-2022060071) - - [BLUEWATER MARIBAGO BEACH RESORT - SQL Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022060070) - - [SAP FRUN Simple Diagnostics Agent 1.0 Directory Traversal](https://cxsecurity.com/issue/WLB-2022060069) - - [SAP FRUN Simple Diagnostics Agent 1.0 Missing Authentication](https://cxsecurity.com/issue/WLB-2022060068) - - [SAP FRUN Simple Diagnostics Agent 1.0 Information Disclosure](https://cxsecurity.com/issue/WLB-2022060067) - - [SAP Fiori Launchpad Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022060066) - - [SAP FRUN 2.00 / 3.00 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022060065) - - [WordPress Download Manager 3.2.43 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022060064) -- Microsoft Security Blog - - [Microsoft Defender for Office 365 receives highest award in SE Labs Enterprise Email Security Services test](https://www.microsoft.com/security/blog/2022/06/22/microsoft-defender-for-office-365-receives-highest-award-in-se-labs-enterprise-email-security-services-test/) -- Security Boulevard - - [Is Continuous Discovery Needed to Detect Rogue APIs?](https://securityboulevard.com/2022/06/is-continuous-discovery-needed-to-detect-rogue-apis/) - - [Apple Passwordless Future Brings Passkeys Into Focus](https://securityboulevard.com/2022/06/apple-passwordless-future-brings-passkeys-into-focus/) - - [WhiteHat brings new dimension to DAST capabilities at Synopsys](https://securityboulevard.com/2022/06/whitehat-brings-new-dimension-to-dast-capabilities-at-synopsys-2/) - - [WordPress Security](https://securityboulevard.com/2022/06/wordpress-security/) - - [USENIX Enigma 2022 – Vaibhav Garg’s ‘Covenants Without The Sword: Market Incentives For Security Investment’](https://securityboulevard.com/2022/06/usenix-enigma-2022-vaibhav-gargs-covenants-without-the-sword-market-incentives-for-security-investment/) - - [5 Takeaways from RSA 2022](https://securityboulevard.com/2022/06/5-takeaways-from-rsa-2022/) - - [Whaling Phishing Attacks: A Complete Guide](https://securityboulevard.com/2022/06/whaling-phishing-attacks-a-complete-guide/) - - [Biden Signs State and Local Government Cybersecurity Act Into Law; Establishes Rotational Cyber Workforce](https://securityboulevard.com/2022/06/biden-signs-state-and-local-government-cybersecurity-act-into-law-establishes-rotational-cyber-workforce/) - - [Cloudflare’s Outage – Key Takeaway, Design for Failures](https://securityboulevard.com/2022/06/cloudflares-outage-key-takeaway-design-for-failures/) -- Sploitus.com Exploits RSS Feed - - [Zoo Management System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167572&utm_source=rss&utm_medium=rss) - - [WordPress Download Manager 3.2.43 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167573&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-22980 exploit](https://sploitus.com/exploit?id=30680DAA-8D25-51A3-8733-0EF37673CBAE&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Wso2 Api Manager exploit](https://sploitus.com/exploit?id=D6A3D7A1-BA12-5C2E-BFC3-83078CF2F89B&utm_source=rss&utm_medium=rss) -- 绿盟科技技术博客 - - [深度揭秘：如何正确识别证书实际控制机构](http://blog.nsfocus.net/ca-ind/) -- 跳跳糖 - 安全与分享社区 - - [Mimikatz详细使用总结](https://tttang.com/archive/1616/) -- NowSecure - - [Dueling Architectures: Web vs Mobile Applications](https://www.nowsecure.com/blog/2022/06/22/dueling-architectures-web-vs-mobile-applications/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 一个开源代码项目平均有49个漏洞；亚马逊启动AWS量子网络中心](https://www.freebuf.com/articles/336975.html) - - [工控安全遭严峻挑战，56个严重漏洞席卷OT 设备](https://www.freebuf.com/news/336969.html) - - [如何实现与FDA保持邮件通信安全加密？](https://www.freebuf.com/news/336935.html) - - [Cloudflare服务中断致数百个网站瘫痪](https://www.freebuf.com/news/336917.html) - - [新的DFSCoerce NTLM中继攻击允许攻击者控制Windows域](https://www.freebuf.com/news/336910.html) - - [警方捣毁造成数百万美元损失的网络钓鱼团伙](https://www.freebuf.com/news/336905.html) - - [CVE-2020-1472](https://www.freebuf.com/articles/system/336900.html) -- Tenable Blog - - [Understanding the Ransomware Ecosystem: From Screen Lockers to Multimillion-Dollar Criminal Enterprise](https://www.tenable.com/blog/understanding-the-ransomware-ecosystem-screen-lockers-to-multimillion-dollar-criminal-enterprise) -- xorl %eax, %eax - - [The forgotten SUAVEEYEFUL FreeBSD software implant of the EQUATION GROUP](https://xorl.wordpress.com/2022/06/22/the-forgotten-suaveeyeful-freebsd-software-implant-of-the-equation-group/) -- paper - Last paper - - [简单聊下最近2个有意思的漏洞](https://paper.seebug.org/1926/) -- Posts on malicious.link - - [Beautiful Basics: Lesson 4](https://malicious.link/post/2022/beautiful-basics-lesson-04/) -- Marco Ramilli Web Corner - - [Cyber Threats Tracker: Status Update](https://marcoramilli.com/2022/06/22/cyber-threats-tracker-status-update/) -- Files ≈ Packet Storm - - [WordPress Download Manager 3.2.43 Cross Site Scripting](https://packetstormsecurity.com/files/167573/wpdownloadmanager3243-xss.txt) - - [Zoo Management System 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/167572/zooms10-xss.txt) - - [Red Hat Security Advisory 2022-5162-01](https://packetstormsecurity.com/files/167571/RHSA-2022-5162-01.txt) - - [Red Hat Security Advisory 2022-5157-01](https://packetstormsecurity.com/files/167570/RHSA-2022-5157-01.txt) - - [Red Hat Security Advisory 2022-5163-01](https://packetstormsecurity.com/files/167569/RHSA-2022-5163-01.txt) - - [Red Hat Security Advisory 2022-5152-01](https://packetstormsecurity.com/files/167568/RHSA-2022-5152-01.txt) - - [Red Hat Security Advisory 2022-4999-01](https://packetstormsecurity.com/files/167567/RHSA-2022-4999-01.txt) - - [Are Blockchains Decentralized? Unintended Centralities In Distributed Ledgers](https://packetstormsecurity.com/files/167566/Are_Blockchains_Decentralized.pdf) -- hn security - - [Semgrep rules for PHP security assessment](https://security.humanativaspa.it/semgrep-rules-for-php-security-assessment/) -- 安全客-有思想的安全新媒体 - - [360政企安全集团抢占18.1%网络安全实训平台 跃居行业头部](https://www.anquanke.com/post/id/275211) - - [360 EDR荣获中国信通院“端点检测与响应（EDR）产品”检验证书](https://www.anquanke.com/post/id/275215) - - [直击RSAC 2022：巧用ATT & CK框架应对具体威胁](https://www.anquanke.com/post/id/275207) - - [7月重磅来袭！ISC 2022打造全球首个数字安全盛宴](https://www.anquanke.com/post/id/275202) - - [WEB3 安全系列 || 攻击类型和经验教训](https://www.anquanke.com/post/id/275120) - - [K8s提权之RBAC权限滥用](https://www.anquanke.com/post/id/275121) - - [Flagstar银行披露数据泄露事件影响百万用户](https://www.anquanke.com/post/id/275124) -- Forcepoint - - [The Next Generation of CDR Technology](https://www.forcepoint.com/blog/insights/next-generation-cdr-technology) -- Planet Classpath - - [Mark Wielaard: Sourceware – GNU Toolchain Infrastructure roadmap](https://gnu.wildebeest.org/blog/mjw/2022/06/22/sourceware-gnu-toolchain-infrastructure-roadmap/) -- Malwarebytes Labs - - [MEGA claims it can’t decrypt your files. But someone’s managed to…](https://blog.malwarebytes.com/reports/2022/06/mega-claims-it-cant-decrypt-your-files-but-someones-managed-to/) - - [7-Zip gets Mark of the Web feature, increases protection for users](https://blog.malwarebytes.com/privacy-2/2022/06/7-zip-gets-mark-of-the-web-feature-increases-protection-for-users/) - - [Watch out for the email that says “You have a new voicemail!”](https://blog.malwarebytes.com/social-engineering/2022/06/watch-out-for-the-email-that-says-you-have-a-new-voicemail/) -- Didier Stevens - - [Examples Of Encoding Reversing](https://blog.didierstevens.com/2022/06/22/examples-encoding-reversing/) -- SentinelOne - - [From the Front Lines | 3 New and Emerging Ransomware Threats Striking Businesses in 2022](https://www.sentinelone.com/blog/from-the-front-lines-3-new-and-emerging-ransomware-threats-striking-businesses-in-2022/) -- Application Security Blog - - [WhiteHat brings new dimension to DAST capabilities at Synopsys](https://www.synopsys.com/blogs/software-security/synopsys-acquires-whitehat-security/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [I'm on Cryptome.org!](http://ddanchev.blogspot.com/2022/06/im-on-cryptomeorg.html) -- Intigriti - - [Bug Bytes #175 – 60 RCEs in 60min, Free Google Play Store ebooks & How to easily parse Burp Project files](https://blog.intigriti.com/2022/06/22/bug-bytes-175-60-rces-in-60min-free-google-play-store-ebooks-how-to-easily-parse-burp-project-files/) -- PortSwigger Research - - [Widespread prototype pollution gadgets](https://portswigger.net/research/widespread-prototype-pollution-gadgets) -- r2c website - - [Announcing Semgrep's general availability support of PHP](https://r2c.dev/blog/2022/announcing-php-ga-support/) -- The Daily Swig | Cybersecurity news and views - - [One in every 13 incidents blamed on API insecurity – report](https://portswigger.net/daily-swig/one-in-every-13-incidents-blamed-on-api-insecurity-report) - - [Severe Parse Server bug impacts Apple Game Center](https://portswigger.net/daily-swig/severe-parse-server-bug-impacts-apple-game-center) -- Data Breach - - [Flagstar Bank discloses a data breach that impacted 1.5 Million individuals](https://securityaffairs.co/wordpress/132490/data-breach/flagstar-bank-data-breach.html) -- Black Hills Information Security - - [Talkin’ About Infosec News – 6/13/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-6-13-2022/) -- 谢乾坤 | Kingname - - [一日一技：二分偏左，二分搜索在分布式系统里面也有用？](https://www.kingname.info/2022/06/22/bisect-left/) -- KitPloit - PenTest & Hacking Tools - - [MalSCCM - Tool To Abuse Local Or Remote SCCM Servers To Deploy Malicious Applications](http://www.kitploit.com/2022/06/malsccm-tool-to-abuse-local-or-remote.html) - - [GooFuzz - Tool To Perform Fuzzing With An OSINT Approach, Managing To Enumerate Directories, Files, Subdomains Or Parameters Without Leaving Evidence On The Target's Server With Google Dorking](http://www.kitploit.com/2022/06/goofuzz-tool-to-perform-fuzzing-with.html) -- 博客园 - nice_0e3 - - [Windows自启动技术-快速启动目录 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16403825.html) -- Qualys Security Blog - - [Risk-based Remediation Powered by Patch Management in Qualys VMDR 2.0](https://blog.qualys.com/category/product-tech) -- DEF CON Announcements! - - [COVID Clarification for DEF CON 30](https://defcon.org/html/links/dc-news.html#dc30covid) -- 博客园 - 郑瀚Andrew.Hann - - [国金中国铁建高速REIT 尽调 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16396612.html) -- 黑海洋 - WIKI - - [坏坏猫小说APP免费小说（安卓）](https://blog.upx8.com/2813) - - [Via浏览器 v4.4.0 GooglePlay（安卓浏览器）](https://blog.upx8.com/2812) - - [高清无码壁纸网站Wallhaven新出APP，带秘钥模式](https://blog.upx8.com/2811) - - [biubiu播放器 999 纯净永久 全新接口](https://blog.upx8.com/2810) -- 奇客Solidot–传递最新科技情报 - - [7-zip 支持 Windows Mark-of-the-Web 安全功能](https://www.solidot.org/story?sid=71913) - - [中国芯片行业高速发展](https://www.solidot.org/story?sid=71912) - - [COVID 反弹现象](https://www.solidot.org/story?sid=71911) - - [微软、Facebook 等组建元宇宙开放标准小组](https://www.solidot.org/story?sid=71910) - - [物理学家制造出可“永远”运行的原子激光器](https://www.solidot.org/story?sid=71909) - - [科学家在木星发现被蚕食的小行星残骸](https://www.solidot.org/story?sid=71908) - - [韩国成功用自己的火箭发射小型卫星](https://www.solidot.org/story?sid=71907) - - [美国人对上帝的信仰下滑至 81%](https://www.solidot.org/story?sid=71906) - - [研究发现奥密克戎重症率低](https://www.solidot.org/story?sid=71905) - - [维基媒体首批商业客户为 Google 和互联网档案馆](https://www.solidot.org/story?sid=71904) - - [马斯克称完成 Twitter 交易需解决三个问题](https://www.solidot.org/story?sid=71903) - - [GitHub Copilot 开放付费使用](https://www.solidot.org/story?sid=71902) -- Daniel Miessler - - [Summary: Don’t Trust Your Gut](https://danielmiessler.com/projects/reading/summary-dont-trust-your-gut/) -- SANS Internet Storm Center, InfoCON: green - - [Malicious PowerShell Targeting Cryptocurrency Browser Extensions, (Wed, Jun 22nd)](https://isc.sans.edu/diary/rss/28772) - - [ISC Stormcast For Wednesday, June 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=8060, (Wed, Jun 22nd)](https://isc.sans.edu/diary/rss/28774) -- Schneier on Security - - [Symbiote Backdoor in Linux](https://www.schneier.com/blog/archives/2022/06/symbiote-backdoor-in-linux.html) -- Forensic Focus - - [Register for Webinar: GrayKey Passcode History File and Hashcat (Law Enforcement Only)](https://www.forensicfocus.com/news/register-for-webinar-graykey-passcode-history-file-and-hashcat-law-enforcement-only/) -- Securityinfo.it - - [Rischio ransomware in OneDrive e SharePoint](https://www.securityinfo.it/2022/06/22/rischio-ransomware-in-onedrive-e-sharepoint/?utm_source=rss&utm_medium=rss&utm_campaign=rischio-ransomware-in-onedrive-e-sharepoint) - - [DFSCoerce permette di prendere controllo dei domini Windows](https://www.securityinfo.it/2022/06/22/dfscoerce-permette-di-prendere-controllo-dei-domini-windows/?utm_source=rss&utm_medium=rss&utm_campaign=dfscoerce-permette-di-prendere-controllo-dei-domini-windows) -- LockBoxx - - [Bootcamp #24: Writing an Alert](http://lockboxx.blogspot.com/2022/06/bootcamp-24-writing-alert.html) -- Pentestmag - - [Title: Defence vs Control: Understanding the optimal approach to your cloud security](https://pentestmag.com/title-defence-vs-control-understanding-the-optimal-approach-to-your-cloud-security/?utm_source=rss&utm_medium=rss&utm_campaign=title-defence-vs-control-understanding-the-optimal-approach-to-your-cloud-security) -- 90Sec - 最新话题 - - [一个弱口令引起的内网渗透](https://forum.90sec.com/t/topic/2138) -- Il Disinformatico - - [Ci vediamo al Tesla Club Italy Revolution a Bologna il 17 settembre?](http://attivissimo.blogspot.com/2022/06/ci-vediamo-al-tesla-club-italy.html) -- Deeplinks - - [Westlaw Must Face Antitrust Claims in a Case That Could Boost Competitive Compatibility](https://www.eff.org/deeplinks/2022/06/westlaw-must-face-antitrust-claims-case-could-boost-competitive-compatibility) -- /dev/random - - [[SANS ISC] Malicious PowerShell Targeting Cryptocurrency Browser Extensions](https://blog.rootshell.be/2022/06/22/sans-isc-malicious-powershell-targeting-cryptocurrency-browser-extensions/) -- Security Affairs - - [Exclusive: Lithuania under cyber-attack after the ban on Russian railway goods](https://securityaffairs.co/wordpress/132518/hacktivism/lithuania-under-cyber-attack.html) - - [Magecart attacks are still around but are more difficult to detect](https://securityaffairs.co/wordpress/132512/cyber-crime/magecart-attacks-difficult-detect.html) - - [Thank you!!! SecurityAffairs awarded as Best European Personal Cybersecurity Blog 2022](https://securityaffairs.co/wordpress/132506/breaking-news/securityaffairs-best-european-cybersecurity-blog-2022.html) - - [Crooks are using RIG Exploit Kit to push Dridex instead of Raccoon stealer](https://securityaffairs.co/wordpress/132498/malware/rig-exploit-kit-dridex.html) - - [Flagstar Bank discloses a data breach that impacted 1.5 Million individuals](https://securityaffairs.co/wordpress/132490/data-breach/flagstar-bank-data-breach.html) -- Krebs on Security - - [Meet the Administrators of the RSOCKS Proxy Botnet](https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/) -- KitPloit - PenTest Tools! - - [MalSCCM - Tool To Abuse Local Or Remote SCCM Servers To Deploy Malicious Applications](http://www.kitploit.com/2022/06/malsccm-tool-to-abuse-local-or-remote.html) - - [GooFuzz - Tool To Perform Fuzzing With An OSINT Approach, Managing To Enumerate Directories, Files, Subdomains Or Parameters Without Leaving Evidence On The Target's Server With Google Dorking](http://www.kitploit.com/2022/06/goofuzz-tool-to-perform-fuzzing-with.html) -- 补天平台 - - [七月积分回馈活动，瓜分百万权益积分！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247493791&idx=1&sn=c30bb6f2d3d5b3d725fbb5e8d3ee8562&chksm=eaf9a0d3dd8e29c5e1329899aa55aa53f56fdd9a5f37ee505831699e756f2d3e2d3cef7e8dc5&scene=58&subscene=0#rd) - - [补天发布校园守护者计划，拟推出多期活动持续助力校园白帽成长！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247493791&idx=2&sn=9a956a7b656b3d99032658f3bcaf76d0&chksm=eaf9a0d3dd8e29c5d1a591c86eb1457216ae9c89a45de232e9821da1d55ad575d4ffa58c3808&scene=58&subscene=0#rd) -- The Register - Security - - [Mega's unbreakable encryption proves to be anything but](https://go.theregister.com/feed/www.theregister.com/2022/06/22/megas_encryption_broken/) - - [Cisco warns of security holes in its security appliances](https://go.theregister.com/feed/www.theregister.com/2022/06/22/cisco_bug_bundle/) - - [Israeli air raid sirens triggered in possible cyberattack](https://go.theregister.com/feed/www.theregister.com/2022/06/22/israeli_air_raid_sirens_iran/) - - [DARPA study challenges assumptions about distributed ledger (and Bitcoin) security](https://go.theregister.com/feed/www.theregister.com/2022/06/22/research_challenges_assumptions_about_distributed/) - - [Yodel becomes the latest victim of a cyber 'incident'](https://go.theregister.com/feed/www.theregister.com/2022/06/22/yodel/) - - [Okta says Lapsus$ incident was actually a brilliant zero trust demonstration](https://go.theregister.com/feed/www.theregister.com/2022/06/22/okta_lapsus_zero_trust_explanation/) -- Trend Micro Research, News and Perspectives - - [Azure vs. AWS Developer Tools](https://www.trendmicro.com/en_us/devops/22/f/azure-vs-aws-developer-tools.html) -- Dark Reading - - [Microsoft 365 Users in US Face Raging Spate of Attacks](https://www.darkreading.com/remote-workforce/microsoft-office-365-users-raging-spate-attacks) - - [Synopsys Completes Acquisition of WhiteHat Security](https://www.darkreading.com/application-security/synopsys-completes-acquisition-of-whitehat-security) - - [Aqua Security Collaborates With Center for Internet Security to Create Guide for Software Supply Chain Security](https://www.darkreading.com/vulnerabilities-threats/aqua-security-collaborates-with-center-for-internet-security-to-create-guide-for-software-supply-chain-security) - - [Neustar Security Services Launches Public UltraDNS Health Check Site](https://www.darkreading.com/risk/neustar-security-services-launches-public-ultradns-health-check-site) - - [Russia's APT28 Launches Nuke-Themed Follina Exploit Campaign](https://www.darkreading.com/attacks-breaches/russia-apt28-launches-nuke-themed-follina-exploit-campaign) - - [Fresh Magecart Skimmer Attack Infrastructure Flagged by Analysts](https://www.darkreading.com/attacks-breaches/magecart-skimmer-attack-infrastructure) - - [Getting a Better Handle on Identity Management in the Cloud](https://www.darkreading.com/cloud/managing-identities-in-the-cloud) - - [Tanium Partners With ScreenMeet to Enable Employees to Securely Connect to Their Remote Desktops](https://www.darkreading.com/remote-workforce/tanium-partners-with-screenmeet-to-enable-employees-to-securely-connect-to-their-remote-desktops) - - [Zscaler and AWS Expand Relationship](https://www.darkreading.com/cloud/zscaler-and-aws-expand-relationship) - - [Zscaler Launches Posture Control Solution](https://www.darkreading.com/cloud/zscaler-launches-posture-control-solution) - - [Zscaler Adds New AI/ML Capabilities for the Zscaler Zero Trust Exchange](https://www.darkreading.com/cloud/zscaler-adds-new-ai-ml-capabilities-for-the-zscaler-zero-trust-exchange) - - [Evolving Beyond the Password: Vanquishing the Password](https://www.darkreading.com/dr-tech/evolving-beyond-the-password-vanquishing-the-password) - - [The Risk of Multichannel Phishing Is on the Horizon](https://www.darkreading.com/endpoint/the-risk-of-multichannel-phishing-is-on-the-horizon) - - [GitHub's MFA Plans Should Spur Rest of Industry to Raise the Bar](https://www.darkreading.com/endpoint/github-s-mfa-plans-should-spur-rest-of-industry-to-raise-the-bar) - - [80% of Firms Suffered Identity-Related Breaches in Last 12 Months](https://www.darkreading.com/operations/identity-related-breaches-last-12-months) - - [Risk Disconnect in the Cloud](https://www.darkreading.com/cloud/risk-disconnect-in-the-cloud) -- 字节跳动技术团队 - - [抖音支付十万级 TPS 流量发券实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495407&idx=1&sn=fad4b146ad9b9579d6a15ed9c6be2cfd&chksm=e9d3250ddea4ac1bbb94fd2459f049ee1cf32218377e1de85b1382dd477d1e42765563365f5a&scene=58&subscene=0#rd) - - [免费报名赢好礼！字节跳动 Dev Better 技术沙龙 | 倒计时3天](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495407&idx=2&sn=a7d4b1cb4740b68b8ca0fee8be0f7c2b&chksm=e9d3250ddea4ac1b8d76c4fd8b16acb402a95b3bc2f1ded08cb0af3a378668a3b7bd2e919863&scene=58&subscene=0#rd) -- 默安科技 - - [CCF TF61: 数字化转型期下的开发安全体系建设和软件供应链治理](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492294&idx=1&sn=f74153a8fa74ad6b8f2db5cf5289e7c5&chksm=e93b15e4de4c9cf29e50a5be6e575413bd89268d6ff0948acdf8d6f526fe7d4c7c5e038b3b00&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [ShoMon V2: Shodan Monitoring Integration for TheHive written in Golang](https://www.reddit.com/r/netsec/comments/vhz19f/shomon_v2_shodan_monitoring_integration_for/) - - [Semgrep rules for PHP security assessment](https://www.reddit.com/r/netsec/comments/vi0ofq/semgrep_rules_for_php_security_assessment/) -- 情报分析师 - - [【智库报告】小型卫星对国家安全的影响](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507127&idx=1&sn=20f7c55ac2479e05f6b69b2403d9b976&chksm=8716a93cb061202aad8baf9fb705a044dc82eaaa274e355916ee35a3c6b90c68c50dbf48a59e&scene=58&subscene=0#rd) - - [【舆情分析报告】唐山烧烤打人案（后续更新）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507127&idx=2&sn=ee0da8a994af24d64c9f0539b3e4a2a8&chksm=8716a93cb061202a7846447e818860abb5367080b9638aec259c72223c1e3bc86b280c720385&scene=58&subscene=0#rd) - - [加拿大防务政策的未来](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507127&idx=3&sn=96e2b6985f8d1e0f67c1064b0015aee1&chksm=8716a93cb061202affd6904f5ce87e6d8a64d4f5acc99b234f2e53fa64fe40c66dc068e41b76&scene=58&subscene=0#rd) - - [在执法中使用社交媒体和社交网络分析](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507127&idx=4&sn=c9e44e224d746be3caa7c0726e515b1c&chksm=8716a93cb061202a6c0372f9d8ffd5e9615e498a4561f84aa2c55cb98fd34146458d26b6aaed&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [SC 2022议题解读：采用Fuzzing技术防护高性能计算静默数据损坏安全风险](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537280&idx=1&sn=ecaad60a99310f6fae5df65c1b3ce48e&chksm=8bcba5fcbcbc2cea94580eeebc6c3d3671e1a72eed7bf6dc81fc913db845eb1b8f2aeac2d393&scene=58&subscene=0#rd) -- Threatpost - - [Gamification of Ethical Hacking and Hacking Esports](https://threatpost.com/gamification-of-ethical-hacking-and-hacking-esports/180039/) - - [Discovery of 56 OT Device Flaws Blamed on Lackluster Security Culture](https://threatpost.com/discovery-of-56-ot-device-flaws-blamed-on-lackluster-security-culture/180035/) - - [Elusive ToddyCat APT Targets Microsoft Exchange Servers](https://threatpost.com/elusive-toddycat-apt-targets-microsoft-exchange-servers/180031/) -- Graham Cluley - - [Israeli military personnel spied on via Strava fitness-tracking app](https://www.bitdefender.com/blog/hotforsecurity/israeli-military-personnel-spied-on-via-strava-fitness-tracking-app/) -- 山石网科安全技术研究院 - - [记一次曲折的域环境渗透测试 III](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494211&idx=1&sn=40c26ce34a06bdf88f3ab4975f07b113&chksm=fa523ffdcd25b6eb06efa2e87557a07729da88816cee85c095768f058e7fac257eca5f9d7060&scene=58&subscene=0#rd) -- 安全牛 - - [防不胜防？网络钓鱼攻击常用手法盘点与防护建议](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114936&idx=1&sn=909bdb54e4d69bfa90689ed0ebf45eb1&chksm=bd147d6b8a63f47d04c0e9a7e62cd265418ca2e5ebc7b41ef87480d2e2dbdc65636e6c7ed71a&scene=58&subscene=0#rd) - - [ISACA发布《供应链安全差距：2022年全球研究报告》](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114936&idx=2&sn=0933d530d779609aa1270217e8a272c8&chksm=bd147d6b8a63f47d99aaecd6b9e54426483d918cd6341b61e831769c92f5ce30fa3479693709&scene=58&subscene=0#rd) - - [用虚拟碎片化沙箱构建数据管控新模式](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114936&idx=3&sn=636189c2771673d8b8f0e387f3b552e4&chksm=bd147d6b8a63f47d3b29bc08424b964c6389c36d71e34fcf35fbedff5a5aedfb0d585efdbd66&scene=58&subscene=0#rd) -- SecPulse安全脉搏 - - [【漏洞预警】Spring Data MongoDB SpEL表达式注入漏洞](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044521&idx=1&sn=43271807ce76c3977a936ce5315e85f8&chksm=803fa8f7b74821e137a8c8d0d0a15122eb06ab12a284d59722e1d9cecb84a4f10eedfba47d06&scene=58&subscene=0#rd) -- 云鼎实验室 - - [创新实力再获认可！腾讯安全MSS获2022年度云原生安全守护先锋](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494581&idx=1&sn=ef72a0e25d23e4243d8337b99f478827&chksm=fd791733ca0e9e25409cf0b262cad26f06ac9c37a60b54b730be215e90f22cd4344637d538cc&scene=58&subscene=0#rd) -- Social Engineering - - [how would I get someone's license plate via their name?](https://www.reddit.com/r/SocialEngineering/comments/vhwy35/how_would_i_get_someones_license_plate_via_their/) - - [starting an online meetup to try to organize a way to collectively practice social engineering](https://www.reddit.com/r/SocialEngineering/comments/vhritr/starting_an_online_meetup_to_try_to_organize_a/) -- 代码卫士 - - [研究员披露影响10家OT厂商工控设备的56个漏洞OT:ICEFALL](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512470&idx=1&sn=9ff886e36269deab3af95b513c60754e&chksm=ea9480fcdde309ea294148ae92264463a822f5a65d3243f576e255cf7f0be60c1126a2ae9b95&scene=58&subscene=0#rd) - - [国际快递公司Yodel 承认服务受网络攻击影响](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512470&idx=2&sn=5038ef6a7a5e33d29acda6a64171c66f&chksm=ea9480fcdde309eaac32f77679943db716796157c801ebef4ac54f2c342d879ef890614c9599&scene=58&subscene=0#rd) -- 虎符智库 - - [美国爱因斯坦计划跟踪与解读（2022v1版）](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247487717&idx=1&sn=672329a0de9640cba5f8f089bbcc5182&chksm=971e7de7a069f4f1b74c4f8ac20dbed0792244caacfcdfdf07ce33d7b729a6a07b43e9ce7ba1&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [RSA解读 | Kubernetes集群的攻与防](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492430&idx=1&sn=ece35e2cf3836b861b750cff6a2bb403&chksm=e84c4591df3bcc878f791e0ac507c14c6b15390e47eb7dca0e95adaeb0c9f7dd2a278cb458bb&scene=58&subscene=0#rd) -- Security Through Education - - [Myths About Human Lie Detection](https://www.social-engineer.org/social-engineering/myths-about-human-lie-detection/) -- 三六零CERT - - [安全日报（2022.06.22）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491091&idx=1&sn=9934c706e81ce7a8d7bb6c6a5d800413&chksm=fe251b12c95292043a602a521ec8471bd8c9a4ce6c14234a763cfbddc5811bc59b4e9ae1f1d5&scene=58&subscene=0#rd) -- 互联网安全内参 - - [神秘特工利用跑步APP监视以色列军人和绝密基地](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503648&idx=1&sn=c23ba5b88292de998f11afc4625560a6&chksm=ebfa8800dc8d0116ea3ad058615819057b4be970f7325f91be4e9389a9580b1e863f7a797bf3&scene=58&subscene=0#rd) - - [“国防七校”西北工业大学遭受境外网络攻击](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503648&idx=2&sn=70b7d5d4dd7cf14dddb50c887b3f7619&chksm=ebfa8800dc8d011646586987a2422d2ed6083a3abba2316175217c9083f6c277cd12f11cbeb7&scene=58&subscene=0#rd) - - [工控安全火山爆发：“冰瀑”报告披露56个重大OT漏洞](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503648&idx=3&sn=6e10c4492d57bf004ee7b88d1ad2b186&chksm=ebfa8800dc8d01168e023cf591d82e41d5a373244fdfc0177102d5153428a7f2b1b2e5211406&scene=58&subscene=0#rd) - - [美国顶级委员会发布《网络安全劳动力发展报告》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503648&idx=4&sn=c23a08d399f27102346f35c378edb351&chksm=ebfa8800dc8d0116d66a02d6913255a02e9df7a8f57b2b23a0ed52ab9755f84470c7410a8de7&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [I have a KeePassXC v4 file, and I forgot the password](https://www.reddit.com/r/HowToHack/comments/via5zv/i_have_a_keepassxc_v4_file_and_i_forgot_the/) - - [Reccomendations on resources regarding DNS zone transfers?](https://www.reddit.com/r/HowToHack/comments/vi60he/reccomendations_on_resources_regarding_dns_zone/) - - [Pls help! Ok so when im uploading a Shell and it executes This is whats popping up in my terminal listening on [any] 4444 ... (UNKNOWN) [10.0.2.15] 34652 UNKNOWN CONNECTION. And i cant type any commands.](https://www.reddit.com/r/HowToHack/comments/viiwm3/pls_help_ok_so_when_im_uploading_a_shell_and_it/) -- Seebug漏洞平台 - - [404星链计划 | BinAbsInspector：二进制文件自动化静态漏洞检测工具](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650961961&idx=1&sn=03653289ec8e2263cb248b5637ed7f34&chksm=80793a1bb70eb30d8a9dc4d7290f6f92e2e6bc0e6352fc5b7ec2d55741d00a27746d67e6735f&scene=58&subscene=0#rd) -- SecIN技术平台 - - [原创 | 记一次对VAuditDemo平台的代码审计（下）](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494299&idx=1&sn=4b87c97d0035b161158b09ab9a25eff7&chksm=eb84b7cfdcf33ed94b9204c1de938a2dbafb88b416690f972be4a206ff66c009870e87de1ce2&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [「安全范儿」技术沙龙开启，1分钟带你了解字节、谷歌、奇安信是如何做安全运营的](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727834815&idx=1&sn=32d241bfa0e54ad641f1d3c2196fe21d&chksm=8050a337b7272a211518b9c7e6ce3294d03a47cc115ebf745932182a50c311a78481b3d7f4b7&scene=58&subscene=0#rd) -- 火线Zone - - [Zadig + 洞态 IAST：让安全溶于持续交付](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495659&idx=1&sn=dedaba8507dbb683157bab9b5ab7a26c&chksm=eaa967cbdddeeeddfe20b03bcdeed471ea5da38960d32fe51c5b06aeaaba980ff1952ad3cd53&scene=58&subscene=0#rd) - - [沙龙预告丨孔松（信通院）-数字化时代云安全能力建设及趋势](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495659&idx=2&sn=33df40fe8cf3ed6fc1eeaf76e5fce3fc&chksm=eaa967cbdddeeedd1f1f300e4ff71a23320d6d8499d95a2d62f523fed495b6e8b211e3f8037d&scene=58&subscene=0#rd) -- TorrentFreak - - [Tarantino Asks Court to Dismiss Miramax’s ‘Pulp Fiction’ NFT Lawsuit](https://torrentfreak.com/tarantino-asks-court-to-dismiss-miramaxs-pulp-fiction-nft-lawsuit-220622/) - - [Megaupload Pair Plead Guilty, Kim Dotcom Turns Anger on Former Friends](https://torrentfreak.com/megaupload-pair-plead-guilty-kim-dotcom-turns-anger-on-former-friends-220622/) -- vivo千镜安全实验室 - - [浅谈AOP技术](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247488624&idx=1&sn=a50e8d58167cb0e2ba3fd74e431a4749&chksm=e9b9321cdecebb0a6a068f3ce1e3a1301ba867a6cab6eb4500c03c0242125e8569ee30f54000&scene=58&subscene=0#rd) -- 安全威胁情报 - - [攻防演练实战秘诀：让0day内存马从送命题秒变送分题](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172752&idx=1&sn=cab9dcbb993cb56adcdd585c77bb8b06&chksm=f44896ecc33f1ffa784933749ace038d3d66c1968838861ce284a5cbe87e96f7f723572e0c36&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-22)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958530&idx=1&sn=567d0c1c87f29f1e504807e91e6eade6&chksm=8baecd9dbcd9448beda5e2d913879cd8aebe4568a6d3060fee4ba825469a62fadb2307bca5fa&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Is there any difference between circuit vs application level gateway except that one operates in layer 3 and another at layer 7 of OSI model?](https://www.reddit.com/r/netsecstudents/comments/vi42xi/is_there_any_difference_between_circuit_vs/) -- 安全客 - - [直击RSAC 2022：看威胁情报如何反网络诈骗](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772527&idx=1&sn=988bee20536604fec52d1341cb7231e3&chksm=88936180bfe4e89692ea99e788171f8d4530a116759b2651c5252e072f512a492d400342a1d8&scene=58&subscene=0#rd) - - [【安全头条】Flagstar银行披露数据泄露事件影响百万用户](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772527&idx=2&sn=4750366891f9419bc0177503b1e2ef2a&chksm=88936180bfe4e896a272fdfc02acd43018f39892eaae815fa80e5716eb9c20adfd4dcc6a7e79&scene=58&subscene=0#rd) - - [【技术分享】关于Bludit远程任意代码执行漏洞的复现、利用及详细分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772527&idx=3&sn=6f8291a6d2c6b16a93ef423b917b5d75&chksm=88936180bfe4e896fbc92202ab50c00ef0a1b1540e7d9bc7db91a7a5525446653537646bd0e1&scene=58&subscene=0#rd) -- 百度安全实验室 - - [SC 2022议题解读：采用Fuzzing技术防护高性能计算静默数据损坏安全风险](https://mp.weixin.qq.com/s?__biz=MzA3NTQ3ODI0NA==&mid=2247486816&idx=1&sn=c293e6dbeed8642c0570b1dbd0a20066&chksm=9f6ea8eba81921fd2731f2facbc953b4f1b1721e1d40a92b5707043c8c18e504adbefc337c88&scene=58&subscene=0#rd) -- 360漏洞云 - - [360漏洞云服务号迁移公告](https://mp.weixin.qq.com/s?__biz=Mzg5MTc5Mzk2OA==&mid=2247496909&idx=1&sn=8b9774d3d050aa469356f4d08993a547&chksm=cfc55392f8b2da84c2ee6faf335bcb892d83d1ea7e2f227c5cb10f5eac7619d5b0113982294c&scene=58&subscene=0#rd) -- Paul's Security Weekly - - [ASW #198 - Matias Madou](http://podcast.securityweekly.com/asw-198-matias-madou) diff --git a/archive/2022/2022-06-24.md b/archive/2022/2022-06-24.md deleted file mode 100644 index b615e32eec..0000000000 --- a/archive/2022/2022-06-24.md +++ /dev/null @@ -1,305 +0,0 @@ -# 每日安全资讯（2022-06-24） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Verbatim Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 Risky Crypto](https://cxsecurity.com/issue/WLB-2022060074) - - [Verbatim Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 Insufficient Verification](https://cxsecurity.com/issue/WLB-2022060073) -- 安全客-有思想的安全新媒体 - - [6月26日 | HW蓝方技术实战公开课免费直播](https://www.anquanke.com/post/id/275256) - - [记一次实战攻防(打点-Edr-内网-横向-Vcenter)](https://www.anquanke.com/post/id/275181) - - [百万欧元规模钓鱼组织被欧洲刑警组织打击](https://www.anquanke.com/post/id/275187) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-5029-01](https://packetstormsecurity.com/files/167579/RHSA-2022-5029-01.txt) - - [Ubuntu Security Notice USN-5487-2](https://packetstormsecurity.com/files/167578/USN-5487-2.txt) - - [Red Hat Security Advisory 2022-5115-01](https://packetstormsecurity.com/files/167577/RHSA-2022-5115-01.txt) - - [Red Hat Security Advisory 2022-5116-01](https://packetstormsecurity.com/files/167576/RHSA-2022-5116-01.txt) - - [Red Hat Security Advisory 2022-5114-01](https://packetstormsecurity.com/files/167575/RHSA-2022-5114-01.txt) - - [Ubuntu Security Notice USN-5491-1](https://packetstormsecurity.com/files/167574/USN-5491-1.txt) -- Sec-News 安全文摘 - - [向Typora学习electron安全攻防](https://wiki.ioin.in/url/OjdA) - - [Spring Data MongoDB SpEL Expression Injection Vulnerability (CVE-2022-22980) POC](https://wiki.ioin.in/url/8nav) -- Chromium Blog - - [Chrome 104 Beta: New Media Query Syntax, Region Capture, and More](http://blog.chromium.org/2022/06/chrome-104-beta-new-media-query-syntax.html) -- 绿盟科技技术博客 - - [洞见RSA2022 | 大规模渗透测试的实践 (The Practicalities of Pentesting at Scale)](http://blog.nsfocus.net/rsa2022-scale/) - - [洞见RSA2022|网络犯罪为何盯上了工业控制系统](http://blog.nsfocus.net/rsa2022-cri/) -- ElcomSoft blog - - [Logical Acquisition: Not as Simple as It Sounds](https://blog.elcomsoft.com/2022/06/logical-acquisition-not-as-simple-as-it-sounds/) -- Security Boulevard - - [Does the World Need Cloud Detection and Response (CDR)?](https://securityboulevard.com/2022/06/does-the-world-need-cloud-detection-and-response-cdr/) - - [How to Detect DFSCoerce](https://securityboulevard.com/2022/06/how-to-detect-dfscoerce/) - - [Unprecedented Accuracy on Data Breach Costs from RiskLens Data Science](https://securityboulevard.com/2022/06/unprecedented-accuracy-on-data-breach-costs-from-risklens-data-science/) - - [USENIX Enigma 2022 – Patrick Gage Kelley’s ‘Around The World In 500 Days Of Pandemic Misinformation’](https://securityboulevard.com/2022/06/usenix-enigma-2022-patrick-gage-kelleys-around-the-world-in-500-days-of-pandemic-misinformation/) - - [The Top 8 Data Security Best Practices](https://securityboulevard.com/2022/06/the-top-8-data-security-best-practices/) - - [SOC 2 Compliance: Experts Refute 5 Common Misperceptions](https://securityboulevard.com/2022/06/soc-2-compliance-experts-refute-5-common-misperceptions/) - - [How to build a cyber capable board](https://securityboulevard.com/2022/06/how-to-build-a-cyber-capable-board/) - - [RSA Spotlights Supply Chain, Critical Infrastructure Cyber Risk](https://securityboulevard.com/2022/06/rsa-spotlights-supply-chain-critical-infrastructure-cyber-risk/) - - [How to Respond to Threats Faster with Active Sensing Fabric](https://securityboulevard.com/2022/06/how-to-respond-to-threats-faster-with-active-sensing-fabric/) - - [XKCD ‘What If? 2 Countdown’](https://securityboulevard.com/2022/06/xkcd-what-if-2-countdown/) -- Sucuri Blog - - [2021 Threat Report Webinar](https://blog.sucuri.net/2022/06/2021-threat-report-webinar.html) -- Tenable Blog - - [OT:ICEFALL Research from Forescout Explores Insecure-by-Design State of Operational Technology](https://www.tenable.com/blog/oticefall-research-from-forescout-explores-insecure-by-design-state-of-operational-technology) -- 跳跳糖 - 安全与分享社区 - - [CVE-2022-23222漏洞及利用分析](https://tttang.com/archive/1628/) -- Microsoft Security Blog - - [Detecting malicious key extractions by compromised identities for Azure Cosmos DB](https://www.microsoft.com/security/blog/2022/06/23/detecting-malicious-key-extractions-by-compromised-identities-for-azure-cosmos-db/) -- MWR Publications - - [Top](https://labs.withsecure.com/publications/#top%22%20class=%22btn-gototop) - - [Printing Shellz](https://labs.withsecure.com/publications/printing-shellz/) - - [Threat Intelligence Report: Lazarus Group Campaign Targeting the Cryptocurrency Vertical](https://labs.withsecure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical/) - - [The Fake Cisco](https://labs.withsecure.com/publications/the-fake-cisco/) - - [Scheduled Task Tampering](https://labs.withsecure.com/blog/scheduled-task-tampering/) - - [Faking Another Positive COVID Test](https://labs.withsecure.com/blog/faking-another-positive-covid-test/) - - [Detecting Attacks against Azure DevOps](https://labs.withsecure.com/blog/detecting-attacks-against-azure-devops/) -- Exodus Intelligence - - [TP-Link WA850RE Unauthenticated Configuration Disclosure Vulnerability](https://blog.exodusintel.com/2022/06/23/tp-link-wa850re-unauthenticated-configuration-disclosure-vulnerability/?utm_source=rss&utm_medium=rss&utm_campaign=tp-link-wa850re-unauthenticated-configuration-disclosure-vulnerability) - - [TP-Link WA850RE Remote Command Injection Vulnerability](https://blog.exodusintel.com/2022/06/23/tp-link-wa850re-remote-command-injection-vulnerability/?utm_source=rss&utm_medium=rss&utm_campaign=tp-link-wa850re-remote-command-injection-vulnerability) - - [TP-Link WR940N/WR941ND Uninitialized Pointer Vulnerability](https://blog.exodusintel.com/2022/06/23/tp-link-wr940n-wr941nd-uninitialized-pointer-vulnerability/?utm_source=rss&utm_medium=rss&utm_campaign=tp-link-wr940n-wr941nd-uninitialized-pointer-vulnerability) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 西北工业大学遭境外网络攻击；Conti勒索软件一个月内攻击40多个组织](https://www.freebuf.com/news/337118.html) - - [立陶宛对俄罗斯“禁运”后遭网络攻击](https://www.freebuf.com/articles/337042.html) - - [MEGA修复了允许解密用户数据的关键漏洞](https://www.freebuf.com/news/337040.html) - - [《关于构建数据基础制度更好发挥数据要素作用的意见》审议通过](https://www.freebuf.com/news/337038.html) - - [基于ObRegisterCallbacks实现的进程保护功能](https://www.freebuf.com/articles/system/337027.html) - - [微软：俄罗斯将加强对乌克兰盟友的网络攻击](https://www.freebuf.com/news/337022.html) - - [游戏安全丨喊话CALL分析-分析参数](https://www.freebuf.com/vuls/337007.html) - - [网安新势力创始人们，投资人和行业评委Pick谁？](https://www.freebuf.com/articles/337002.html) - - [假如三国有网络安全攻防演练](https://www.freebuf.com/articles/network/336988.html) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [I'm on Cryptome.org! - Part Two](http://ddanchev.blogspot.com/2022/06/im-on-cryptomeorg-part-two.html) - - [Discussing the Ransomware FUD Wars - An Analysis](http://ddanchev.blogspot.com/2022/06/discussing-ransomware-fud-wars-analysis.html) -- Securelist - - [The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs](https://securelist.com/modern-ransomware-groups-ttps/106824/) -- SentinelOne - - [On the Board of Directors? Beware of These Six Common Cyber Security Myths](https://www.sentinelone.com/blog/on-the-board-of-directors-beware-of-these-six-common-cyber-security-myths/) -- blog.avast.com EN - - [Vishing scams on the rise: How to protect yourself](https://blog.avast.com/vishing-scams) - - [The secret gay history of the modern internet](https://blog.avast.com/gay-history-modern-internet) -- NVISO Labs - - [Cortex XSOAR Tips & Tricks – Creating indicator relationships in automations](https://blog.nviso.eu/2022/06/23/cortex-xsoar-tips-tricks-creating-indicator-relationships-in-automations/) -- Sucuri Blog - - [2021 Threat Report Webinar](https://blog.sucuri.net/2022/06/2021-threat-report-webinar.html) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-06-21 - aa distribution Qakbot with DarkVNC and Cobalt Strike](https://www.malware-traffic-analysis.net/2022/06/21/index.html) -- Application Security Blog - - [M&A, trust in software, and a good night’s sleep](https://www.synopsys.com/blogs/software-security/building-trust-mergers-and-acquisitions/) - - [WhiteHat brings new dimension to DAST capabilities at Synopsys](https://www.synopsys.com/blogs/software-security/synopsys-acquires-whitehat-security/) -- Geek Freak - - [AWS Misconfigurations](https://dhiyaneshgeek.github.io/cloud/security/2022/06/23/aws-misconfigurations/) -- Malwarebytes Labs - - [Conti ransomware group’s pulse stops, but did it fake its own death?](https://blog.malwarebytes.com/ransomware/2022/06/conti-ransomware-disappears-did-it-fake-its-own-death/) - - [Dial 311 for… cybersecurity emergencies?](https://blog.malwarebytes.com/awareness/2022/06/dial-311-for-cybersecurity-emergencies/) - - [Rogue cryptocurrency billboards go phishing for wallets](https://blog.malwarebytes.com/scams/2022/06/rogue-cryptocurrency-billboards-go-phishing-for-wallets/) - - [Police seize and dismantle massive phishing operation](https://blog.malwarebytes.com/social-engineering/2022/06/police-seize-and-dismantle-massive-phishing-operation/) -- GuidePoint Security - - [GRIT Ransomware Report Spotlight: Government](https://www.guidepointsecurity.com/blog/grit-ransomware-report-spotlight-government/) -- The Daily Swig | Cybersecurity news and views - - [Statutory defense for ethical hacking under UK Computer Misuse Act tabled](https://portswigger.net/daily-swig/statutory-defense-for-ethical-hacking-under-uk-computer-misuse-act-tabled) - - [Splunk patches critical vulnerability while users push for legacy updates](https://portswigger.net/daily-swig/splunk-patches-critical-vulnerability-while-users-push-for-legacy-updates) -- Project Zero - - [](https://googleprojectzero.blogspot.com/2022/06/curious-case-carrier-app.html) -- Hex Rays - - [2022 September IDA training session: Registrations are now open!](https://hex-rays.com/blog/2022-september-ida-training-session-registrations-are-now-open/) -- Wallarm - - [Update on Spring Data MongoDB SpEL Expression Injection Vulnerability (CVE-2022-22980)](https://lab.wallarm.com/update-on-spring-data-mongodb-spel-expression-injection-vulnerability-cve-2022-22980/) -- 阿小信的博客 - - [Golang基于GNU gettext方式的i18n国际化多语言集成方式总结](http://axiaoxin.com/article/263) -- rtl-sdr.com - - [RTL-SDR Blog V3 Dongle and SDR# Spotted on The Secret of Skinwalker Ranch TV Show](https://www.rtl-sdr.com/rtl-sdr-blog-v3-dongle-and-sdr-spotted-on-the-secret-of-skinwalker-ranch-tv-show/) -- 博客园 - nice_0e3 - - [Windows自启动技术-注册表 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16406768.html) -- KitPloit - PenTest & Hacking Tools - - [TrelloC2 - Simple C2 Over The Trello API](http://www.kitploit.com/2022/06/trelloc2-simple-c2-over-trello-api.html) - - [WEF - Wi-Fi Exploitation Framework](http://www.kitploit.com/2022/06/wef-wi-fi-exploitation-framework.html) -- 黑海洋 - WIKI - - [安卓长图拼接大师v1.8.0高级版](https://blog.upx8.com/2819) - - [一键网络重装系统,一键DD– 魔改版（适用于Linux / Windows）](https://blog.upx8.com/2818) - - [爱趣漫画 v2.1.2 纯净无广告版（安卓）](https://blog.upx8.com/2816) - - [永遇乐+几枝+西窗烛：中国传统古诗词欣赏](https://blog.upx8.com/2815) - - [扫描君（全能扫描王） v4.11.3 免登陆VIP版（安卓）](https://blog.upx8.com/2814) -- 博客园 - 郑瀚Andrew.Hann - - [基础设施公募REITs介绍 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16399560.html) -- Mozilla Hacks – the Web developer blog - - [Fuzzing rust-minidump for Embarrassment and Crashes – Part 2](https://hacks.mozilla.org/2022/06/fuzzing-rust-minidump-for-embarrassment-and-crashes/) -- Forensic Focus - - [Quantifying Data Volatility for IoT Forensics With Examples From Contiki OS](https://www.forensicfocus.com/webinars/quantifying-data-volatility-for-iot-forensics-with-examples-from-contiki-os/) -- 奇客Solidot–传递最新科技情报 - - [南方地区遭遇洪灾](https://www.solidot.org/story?sid=71925) - - [马斯克称特斯拉新工厂损失了数十亿美元](https://www.solidot.org/story?sid=71924) - - [Brave Search Goggles：用规则和过滤器改变搜索排名](https://www.solidot.org/story?sid=71923) - - [用推文和喷鼻剂对抗新冠的免疫学家](https://www.solidot.org/story?sid=71921) - - [半数英国人支持用基因组编辑预防严重疾病](https://www.solidot.org/story?sid=71920) - - [50 年后 NASA 开始关闭航海者号](https://www.solidot.org/story?sid=71919) - - [中国今年 IPO 筹资额居全球之首](https://www.solidot.org/story?sid=71918) - - [研究发现 Mega 的文件加密容易破解](https://www.solidot.org/story?sid=71917) - - [广电总局发布《网络主播行为规范》](https://www.solidot.org/story?sid=71916) - - [阿里巴巴性侵案客户被判 18 个月](https://www.solidot.org/story?sid=71915) - - [TikTok 广告收入激增](https://www.solidot.org/story?sid=71914) -- Arturo Di Corinto - - [Il dark web per pochi ma non per tutti](https://dicorinto.it/testate/il-manifesto/il-dark-web-per-pochi-ma-non-per-tutti/) -- Securityinfo.it - - [Allarme missilistico in Israele per un cyber attacco](https://www.securityinfo.it/2022/06/23/allarme-missilistico-in-israele-per-un-cyber-attacco/?utm_source=rss&utm_medium=rss&utm_campaign=allarme-missilistico-in-israele-per-un-cyber-attacco) - - [Nuove vulnerabilità nei prodotti Cisco](https://www.securityinfo.it/2022/06/23/nuove-vulnerabilita-nei-prodotti-cisco/?utm_source=rss&utm_medium=rss&utm_campaign=nuove-vulnerabilita-nei-prodotti-cisco) -- Tails - News - - [Tails 5.1.1 is out](https://tails.boum.org/news/version_5.1.1/index.en.html) -- HACKMAGEDDON - - [May 2022 Cyber Attack Statistics](https://www.hackmageddon.com/2022/06/23/may-2022-cyber-attack-statistics/) -- Securelist - - [The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs](https://securelist.com/modern-ransomware-groups-ttps/106824/) -- LuxSci - - [New Feature: Secure Email Tagline](https://luxsci.com/blog/secure-email-tagline.html) -- Appsecco - Medium - - [Top 10 Docker Hardening Best Practices](https://blog.appsecco.com/top-10-docker-hardening-best-practices-f16c090e4d59?source=rss----e2adb3957733---4) -- Schneier on Security - - [On the Subversion of NIST by the NSA](https://www.schneier.com/blog/archives/2022/06/on-the-subversion-of-nist-by-the-nsa.html) -- Hakin9 – IT Security Magazine - - [AWS Lambda for Go](https://hakin9.org/aws-lambda-for-go/) - - [Adalanche: Active Directory ACL Visualizer and Explorer](https://hakin9.org/adalanche-active-directory-acl-visualizer-and-explorer/) -- SANS Internet Storm Center, InfoCON: green - - [FLOSS 2.0 Has Been Released, (Thu, Jun 23rd)](https://isc.sans.edu/diary/rss/28776) - - [ISC Stormcast For Thursday, June 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=8062, (Thu, Jun 23rd)](https://isc.sans.edu/diary/rss/28778) -- Instapaper: Unread - - [Europol arrests nine suspected of stealing 'several million' euros via phishing](https://www.theregister.com/2022/06/23/dutch_europol_arrest_phishing/) - - [Logical Acquisition Not as Simple as It Sounds](https://blog.elcomsoft.com/2022/06/logical-acquisition-not-as-simple-as-it-sounds/) - - [Quantifying Data Volatility for IoT Forensics With Examples From Contiki OS](https://www.forensicfocus.com/webinars/quantifying-data-volatility-for-iot-forensics-with-examples-from-contiki-os/) - - [NSO Confirms Pegasus Spyware Used by at least 5 European Countries](https://thehackernews.com/2022/06/nso-confirms-pegasus-spyware-used-by-at.html) - - [Interpol, duemila arresti per truffe informatiche, 50 milioni di dollari recuperati](https://attivissimo.blogspot.com/2022/06/interpol-duemila-arresti-per-truffe.html) - - [Vasche da bagno a rischio attacco informatico](https://attivissimo.blogspot.com/2022/06/vasche-da-bagno-rischio-attacco.html) - - [Magnet User Summit 2022 CTF - iPhone](https://www.stark4n6.com/2022/06/magnet-user-summit-2022-ctf-iphone.html) - - [Detecting Linux Anti-Forensics Log Tampering](https://www.inversecos.com/2022/06/detecting-linux-anti-forensics-log.html) -- Threatpost - - [Fancy Bear Uses Nuke Threat Lure to Exploit 1-Click Bug](https://threatpost.com/fancy-bear-nuke-threat-lure/180056/) -- Trend Micro Research, News and Perspectives - - [Trend Micro CEO Discusses Need for a Unified Cybersecurity Platform](https://www.trendmicro.com/en_us/ciso/22/f/why-unified-cybersecurity-platform.html) -- Dark Reading - - [Chinese APT Group Likely Using Ransomware Attacks as Cover for IP Theft](https://www.darkreading.com/attacks-breaches/chinese-apt-ransomware-attacks-cover-ip-theft) - - [Johnson Controls Acquires Tempered Networks to Bring Zero Trust Cybersecurity to Connected Buildings](https://www.darkreading.com/operations/johnson-controls-acquires-tempered-networks-to-bring-zero-trust-cybersecurity-to-connected-buildings) - - [ShiftLeft: Focus On 'Attackability' To Better Prioritize Vulnerabilities](https://www.darkreading.com/attacks-breaches/shiftleft-focus-on-attackability-to-better-prioritize-vulnerabilities) - - [Pair of Brand-New Cybersecurity Bills Become Law](https://www.darkreading.com/careers-and-people/cybersecurity-bills-become-law) - - [The Rise, Fall, and Rebirth of the Presumption of Compromise](https://www.darkreading.com/vulnerabilities-threats/the-rise-fall-and-rebirth-of-the-presumption-of-compromise) - - [Reinventing How Farming Equipment Is Remotely Controlled and Tracked](https://www.darkreading.com/the-cyber-future/reinventing-how-farming-equipment-is-remotely-controlled-and-tracked) - - [Cyberattackers Abuse QuickBooks Cloud Service in 'Double-Spear' Campaign](https://www.darkreading.com/remote-workforce/cyberattackers-abuse-quickbooks-cloud-service-ouble-spear-campaign) - - [Palo Alto Networks Bolsters Its Cloud Native Security Offerings With Out-of-Band WAAS](https://www.darkreading.com/cloud/palo-alto-networks-bolsters-its-cloud-native-security-offerings-with-out-of-band-waas) - - [How APTs Are Achieving Persistence Through IoT, OT, and Network Devices](https://www.darkreading.com/attacks-breaches/how-apts-are-achieving-persistence-through-iot-ot-and-network-devices) - - [80% of Legacy MSSP Users Planning MDR Upgrade](https://www.darkreading.com/risk/legacy-mssp-users-planning-mdr-upgrade) - - [MetaMask Crypto-Wallet Theft Skates Past Microsoft 365 Security](https://www.darkreading.com/attacks-breaches/metamask-crypto-wallet-theft-skates-past-microsoft-365-security) - - [Organizations Battling Phishing Malware, Viruses the Most](https://www.darkreading.com/edge-threat-monitor/organizations-battling-phishing-malware-viruses-the-most) -- Graham Cluley - - [Amazon thinks it’s really cool that Alexa can mimic your dead grandma’s voice](https://grahamcluley.com/amazon-alexa-dead-grandma/) - - [NHS warns of scam COVID-19 text messages](https://www.tripwire.com/state-of-security/featured/nhs-warns-scam-covid-19-text-messages/) - - [Smashing Security podcast #280: Hot tub hijinx, and a sentient AI](https://grahamcluley.com/smashing-security-podcast-280-hot-tub-hijinx-and-a-sentient-ai/) -- 补天平台 - - [有奖调研|补天启动2022中国白帽子能力调研](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247493907&idx=1&sn=30911b360b75e3eac2d0a9f2104bec95&chksm=eaf9a15fdd8e284985bd1b468f9d39abebcaff227fff35442a582fdbed6cf29c2769801430cf&scene=58&subscene=0#rd) -- NVISO Labs - - [Cortex XSOAR Tips & Tricks – Creating indicator relationships in automations](https://blog.nviso.eu/2022/06/23/cortex-xsoar-tips-tricks-creating-indicator-relationships-in-automations/) -- 情报分析师 - - [【研判报告】西方对俄罗斯经济制裁的全面分析（49页附下载）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507215&idx=1&sn=e49cd3ede32936a0e3433f70c89198e5&chksm=8716a984b0612092bbcdceda81c17f502f2fb7213dd439026d7ff6ebd35061da55c48a5d1d73&scene=58&subscene=0#rd) - - [【塔利班的能力分析】阿塔、巴塔的新威胁和ISIS-K](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507215&idx=2&sn=90a92af0bdae05b2d3d9490ad19a96e0&chksm=8716a984b061209282cb8b1cc14826c5a4f8eeb616c8d4b9a21715c3fb54a35618327d2b03d8&scene=58&subscene=0#rd) - - [开源情报工具——geOps](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507215&idx=3&sn=5bd7c3c17bf804606a30b02d6ccfaab4&chksm=8716a984b0612092fbebb76db14c128f70baf1036eff69cfd63fa0230f1b83961123d280afc8&scene=58&subscene=0#rd) -- KCon黑客大会 - - [KCon 2022 举办时间正式公布！官方网站重磅升级上线！](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651134746&idx=1&sn=9530b19f53e52815dd174c14e51c436c&chksm=f2c11a7ac5b6936c36a61d1dd61f183e8dbf4cc83e7a681845b1910068a9b3b3a13f2e7469cc&scene=58&subscene=0#rd) -- 阿里安全响应中心 - - [ASRC五月英雄榜发布！](https://mp.weixin.qq.com/s?__biz=MzIxMjEwNTc4NA==&mid=2652992709&idx=1&sn=9d6a7ad8e3077e0bc9b86b95964d20d9&chksm=8c9efb92bbe97284ce8c5f56494a3eb7b91b1a4daa3192dd7a9af6049053a3f71b904f1127c1&scene=58&subscene=0#rd) -- TorrentFreak - - [Brazil’s Targets ‘Metaverse’ Piracy in Latest “Operation 404” Crackdown](https://torrentfreak.com/brazils-targets-metaverse-piracy-in-latest-operation-404-crackdown-220623/) - - [DMCA Subpoena to Unmask Twitter User Hits Fair Use & Constitutional Roadblock](https://torrentfreak.com/dmca-subpoena-to-unmask-twitter-user-hits-fair-use-constitutional-roadblock-220623/) -- The Register - Security - - [$6b mega contract electronics vendor Sanmina jumps into zero trust](https://go.theregister.com/feed/www.theregister.com/2022/06/23/sanmina-zero-trust-zscaler/) - - [Halfords suffers a puncture in the customer details department](https://go.theregister.com/feed/www.theregister.com/2022/06/23/halfords_data_leak_vulnerability/) - - [Don't ditch PowerShell to improve security, say infosec agencies from UK, US, and NZ](https://go.theregister.com/feed/www.theregister.com/2022/06/23/keep_poewrshell_security_advice/) - - [Europol arrests nine suspected of stealing 'several million' euros via phishing](https://go.theregister.com/feed/www.theregister.com/2022/06/23/dutch_europol_arrest_phishing/) -- 火绒安全实验室 - - [火绒安全与英特尔vPro平台合作，共筑软硬件协同安全新格局](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247504885&idx=1&sn=4e45e4c91e9bce9a7a252b8ec2c5f291&chksm=eb700dcadc0784dc2a165c116171c5722e29b7d0ff75959d7d98b796f09bfa9f400ddd5c6e6c&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [透过数据安全法看API安全该如何防护](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493645&idx=1&sn=2541c4c057010031cd8a9b3ddc39682a&chksm=eb12ce36dc65472057fb04826875118d87036f0e857761c1f7f1586eaccf0e3617f267a21f29&scene=58&subscene=0#rd) -- Computer Forensics - - [Any DFIR-Orc user who could help with KAPE embedding?](https://www.reddit.com/r/computerforensics/comments/vj1wvl/any_dfirorc_user_who_could_help_with_kape/) -- 字节跳动安全中心 - - [请查收来自安全范儿沙龙的直播邀请](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247488890&idx=1&sn=370a5de4ef056b5e1ea09bcf86a50c17&chksm=fa9eee2ccde9673ab5af6a5bbba8bc70fdd595cd4da370458f86c73451be84cc5cf879c8231b&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [This repo contains information about EDRs that can be useful during red team exercise.](https://www.reddit.com/r/netsec/comments/vj0gwa/this_repo_contains_information_about_edrs_that/) - - [Miracle - One Vulnerability To Rule Them All](https://www.reddit.com/r/netsec/comments/viuhpy/miracle_one_vulnerability_to_rule_them_all/) - - [Understanding the Compound File Binary Format and OLE Structures to Mess with CVE-2022-30190](https://www.reddit.com/r/netsec/comments/vispu6/understanding_the_compound_file_binary_format_and/) - - [fuzzuli is a fuzzing tool that aims to find critical backup files by creating a dynamic wordlist based on the domain.](https://www.reddit.com/r/netsec/comments/viteij/fuzzuli_is_a_fuzzing_tool_that_aims_to_find/) -- Deeplinks - - [The Bipartisan Digital Advertising Act Would Break Up Big Trackers](https://www.eff.org/deeplinks/2022/06/bipartisan-digital-advertising-act-would-break-big-trackers) - - [Security and Privacy Tips for People Seeking An Abortion](https://www.eff.org/deeplinks/2022/06/security-and-privacy-tips-people-seeking-abortion) -- 代码卫士 - - [开源项目 Parse Server 出现严重漏洞，影响苹果 Game Center](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512551&idx=1&sn=a3dc5a12724c0b9b230eedf1455dbf23&chksm=ea94808ddde3099bc99f14a224f4836cc7d9419f056f982dd29238ebf945806f58f2989225bc&scene=58&subscene=0#rd) - - [严重的PHP缺陷可导致QNAP NAS 设备遭RCE攻击](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512551&idx=2&sn=62ca391c055ea2839fe4178afcd48f4b&chksm=ea94808ddde3099be6ec5044d096c7921e4abb430485bfbd3eb207e3fa39af16c7a0ca6a766b&scene=58&subscene=0#rd) - - [Spring Data MongoDB SpEL表达式注入漏洞安全风险通告第二次更新](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512551&idx=3&sn=1d82552fab1461f66ca02457161cf83b&chksm=ea94808ddde3099bca51c4d30afed76e7f9f6f4d553a89f6a7585832af3f8743faabd0c122ac&scene=58&subscene=0#rd) -- Social Engineering - - [Labeling and mirroring sometimes makes the conversation stalls .. [LABEL] response: YEah](https://www.reddit.com/r/SocialEngineering/comments/vj2wsb/labeling_and_mirroring_sometimes_makes_the/) -- 绿盟科技金融事业部 - - [绿盟科技战略解决方案系列介绍--安全运营平台](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491781&idx=1&sn=9859df739e059968b769a1ff0aa40bc1&chksm=eaac7382dddbfa94ce4a07e5d557b11370812ce54481b2444c8be4ff670b8a2880053908aa5e&scene=58&subscene=0#rd) -- 星阑科技 - - [国内篇｜网安行业相关政策法规、标准、研究报告、白皮书汇总（附下载）](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493794&idx=1&sn=eeb9027e18ed53e6ed0615046fd936d7&chksm=c007453ef770cc28b654bfe4c7f32be2fcc21ae1d29bb2708f268dda1bdfc3c3aeb164211673&scene=58&subscene=0#rd) -- 青藤云安全 - - [青藤入选工信部网安中心“2021年数字技术融合创新应用典型解决方案”](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650835676&idx=1&sn=43b47fb298a69c2d302fbf6f3c8df309&chksm=80dbe979b7ac606fbdc503662247851ac7123028ded8315b84e55fab1f371399e16bb47201fa&scene=58&subscene=0#rd) - - [又一起境外网络攻击！“国防七校”西北工业大学冲上热搜](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650835676&idx=2&sn=b9898de61a06bdf943072bdc83f20b91&chksm=80dbe979b7ac606f27a1e568584bb90a34e2964feb21299c58186c336728fd1e4a1db326b975&scene=58&subscene=0#rd) -- Yak Project - - [高考志愿选择|网络安全行业专业解(上）](https://mp.weixin.qq.com/s?__biz=MzAxOTAzOTU3Mw==&mid=2247488446&idx=1&sn=1f0a30142d2bb3e530326213929aa2e5&chksm=9bcc4784acbbce9245ffa0e4e17bec80961302417661390987fe945b0c496596c1321c1bef71&scene=58&subscene=0#rd) -- 数世咨询 - - [第二届数字安全大会举办时间已确定，评选活动正在火热进行中！](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493929&idx=1&sn=5493c979bcd412ab36cc497a2fbf1914&chksm=c1449b94f6331282ffbcc1a1cc81a7a0eda9cc21efd9590d57b4cd3e2cb226efa38246e8e03c&scene=58&subscene=0#rd) - - [[调研]开源软件安全开始成熟](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493929&idx=2&sn=4b7183d66109ce0425b020e2f3643c3d&chksm=c1449b94f6331282a835d2587d9e06118653c822b87e8b806c42ea9a6241a2b7f06dc90cd2a2&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [习近平主持召开中央全面深化改革委员会第二十六次会议](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527682&idx=1&sn=12cd392cf1928a09d7b1cd10f49c8a5e&chksm=c1e9e153f69e68451143509c66ebd82e31052016437ef0f1743e7d81d026c0f3c9e17f381948&scene=58&subscene=0#rd) - - [工控安全火山爆发：“冰瀑”报告披露56个重大OT漏洞](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527682&idx=2&sn=bad34031570e2c46a35b968dc174bf5c&chksm=c1e9e153f69e68456dd4d584b9629791702147ecfeff7f133e350c3ef3f962d48cd932e60141&scene=58&subscene=0#rd) - - [可信计算在信息环境中的安全作用分析](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527682&idx=3&sn=0c5d782b0a25fc13c1b5d48c1be19eab&chksm=c1e9e153f69e68457e1866b4022f9acac96c9b65f5360291b7dd472b90382c74dd5f838e99a7&scene=58&subscene=0#rd) - - [神秘特工利用跑步APP监视以色列军人和绝密基地](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527682&idx=4&sn=517be164299a60a66987b9498c7ba243&chksm=c1e9e153f69e6845a7eef65b2cf656285b5716f2ae69fce79174f9aca4c76b177fff6436060e&scene=58&subscene=0#rd) - - [网络安全行业热议“OT:Icefall”漏洞：世界末日or见怪不怪？](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527682&idx=5&sn=50c209d72bde4e92a99b774d3573e20e&chksm=c1e9e153f69e684552ae8721913f4a5f723a82f15a29bd63467ef73d6fd7e2838e4d5c03adee&scene=58&subscene=0#rd) -- 互联网安全内参 - - [大力回应行业关切！美国今年已有5部网络安全法案施行](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503676&idx=1&sn=cb821ab4035f90ca8204610396fb14b2&chksm=ebfa881cdc8d010a56c4999da9b5c8374c438d5dd6c873f89eb075d7a686abd8b0de416f0403&scene=58&subscene=0#rd) - - [西北工业大学遭受境外网络攻击，西安警方已立案侦查](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503676&idx=2&sn=c16181ec543a43177630f6ebd8c7fa1b&chksm=ebfa881cdc8d010aa8e51c44305608cf1755aa546e444bd6e07e17f1c9715937ae0025276b35&scene=58&subscene=0#rd) - - [《网络数据安全管理条例》疑难问题研讨会现场综述](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503676&idx=3&sn=c73093c51b560cb341e7032a0e4172b4&chksm=ebfa881cdc8d010a658ccfbbf3ea3f0c14efe4a91fd8dc64f57896d33d148e9fec1654026422&scene=58&subscene=0#rd) - - [2022年可信云大会将发布《云安全全景图2.0》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503676&idx=4&sn=dd00735e2346e0f36cf2040afb7f3f9b&chksm=ebfa881cdc8d010a957c79c7015292654c1feb08d4f9ee1498d079edf7ad6332d3fe852a543a&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [QEMU虚拟化安全的攻击面探索与思考](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494230&idx=1&sn=a0a0fb22beb653ea98cfa9f510a5e4f9&chksm=fa523fe8cd25b6fee5d128768d0877d2f3ad2dcde31cb5d80ec9b96259e77606e3c4396acef3&scene=58&subscene=0#rd) -- Security Affairs - - [Chinese Tropic Trooper APT spreads a hacking tool laced with a backdoor](https://securityaffairs.co/wordpress/132545/hacking/tropic-trooper-apt-new-campaign.html) - - [NSO Group told lawmakers that Pegasus spyware was used by at least 5 European countries](https://securityaffairs.co/wordpress/132536/malware/nso-group-pegasus-5-eu-countries.html) - - [QNAP warns of a critical PHP flaw that could lead to remote code execution](https://securityaffairs.co/wordpress/132531/hacking/qnap-critical-php-vulnerability.html) - - [Researchers found flaws in MEGA that allowed to decrypt of user data](https://securityaffairs.co/wordpress/132523/hacking/mega-flaws-attacks.html) -- 信息安全国家工程研究中心 - - [关于密码你需要知道这些….](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247490940&idx=1&sn=257c15b5df23ba34e9188aaa053fafe1&chksm=feb59c6fc9c215791dbfab5544ca4b897663ecdf442e046a0d51a315353eb429cd9155c79b35&scene=58&subscene=0#rd) - - [新版测评标准对医疗行业网络安全等级保护提出了更高要求](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247490940&idx=2&sn=3c88fd673aa387e04d7b0d82aa6e2016&chksm=feb59c6fc9c2157940748ce080a1308e1cb1f466e8a53a15357e417e4c03c638bbfd7ad774bf&scene=58&subscene=0#rd) -- 威努特工控安全 - - [2022年新型勒索软件发展三大趋势](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651085224&idx=1&sn=60470afcaee8343099e0d155d6e11909&chksm=80e64318b791ca0ed08dea482c4ed0943751e4929c9b662e70332370656a6d422b4ad76037ab&scene=58&subscene=0#rd) - - [以色列疑遭网络攻击触发导弹袭击警报](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651085224&idx=2&sn=5cca32760444a5af143b0dde185c5ba3&chksm=80e64318b791ca0e8c46c336eaac1cf5b2646642deb99139be638221959a68bdc643e5b36c4c&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [TrelloC2 - Simple C2 Over The Trello API](http://www.kitploit.com/2022/06/trelloc2-simple-c2-over-trello-api.html) - - [WEF - Wi-Fi Exploitation Framework](http://www.kitploit.com/2022/06/wef-wi-fi-exploitation-framework.html) -- 看雪学院 - - [向Typora学习electron安全攻防](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454336&idx=1&sn=e35986593ff8bf4d3778ff8d2bf2f7c8&chksm=b18e39ca86f9b0dc6d365d664f0092648c3b38ead690be61f1711daf443da18d570623219618&scene=58&subscene=0#rd) - - [Lookout发现在哈萨克斯坦使用的Android间谍软件](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454336&idx=2&sn=c0495714be01d0b4e12ae41d5429ec0f&chksm=b18e39ca86f9b0dc355bf35cb16a3f579abfedb2db831c498e387a819d33defc49c99b91df82&scene=58&subscene=0#rd) - - [《VMProtect分析与还原》—— 附赠价值5000元xx_vm工具](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454336&idx=3&sn=8de186acf598cc0df87d628ca1a82b6c&chksm=b18e39ca86f9b0dc8307972454fb920b7dadd3821aebdf82e2703f02172fc069a1aae56ba0cd&scene=58&subscene=0#rd) -- 360Quake空间测绘 - - [解锁红蓝对抗中QUAKE“神”助攻（99元会员限时活动见文末）](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247485806&idx=1&sn=ec4a8facc8e6555c061c4c9791141714&chksm=c37b8e85f40c0793ddd23c1b329c8dedab619622208424cba318ed6e6a2f95b0433bf5aa38a0&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.06.23）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491094&idx=1&sn=10d78984bebc1d61e8006cf8b68e920c&chksm=fe251b17c952920175078d2553dc360e2394f780e3602c21da6c6e82ae8b173f2e715809b9fc&scene=58&subscene=0#rd) -- 锦行信息安全 - - [【燃烧吧！天才程序员】锦行科技独家技术支撑——打造实战网络攻防空间](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489884&idx=1&sn=1dc3f1464ab4526fd2c81d884202406e&chksm=9799e2f9a0ee6befb4c2f3dd210f7a68a37b4cc0e5849d6b26a78b07ec6997e2eb7dbaa80f20&scene=58&subscene=0#rd) -- OPPO安全应急响应中心 - - [OPPO安全-安天移动安全联合实验室应用热更新技术趋势及风险问题研究](https://mp.weixin.qq.com/s?__biz=MzUyNzc4Mzk3MQ==&mid=2247489809&idx=1&sn=09ac47886cd284e22256bd52080f44b3&chksm=fa7b185dcd0c914b8f892350fb36da04076bce05e88ba2cb73fe18411414603bc97fe896e2f7&scene=58&subscene=0#rd) -- 火线Zone - - [CVE-2022-25165：AWS VPN 客户端中的 SYSTEM 权限提升](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495672&idx=1&sn=5a43a5482769a476a870f49962c6d581&chksm=eaa967d8dddeeece563deeed31b727674e425c7fa244eadd99e525952e98140d5bf496f169fd&scene=58&subscene=0#rd) - - [陈宇（Aqua）-安全->云安全->多云安全](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495672&idx=2&sn=aa36725335a5ba6776ed6692579deb46&chksm=eaa967d8dddeeece1804a2f380dfc907da20012a945def429d7b4c041d5bed0ecaa2b0c9a12d&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】浅析Python SSTI/沙盒逃逸](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772602&idx=1&sn=8b27ff8032dd349799ef5ab326175ff8&chksm=88936255bfe4eb43e4bd37a726f08429251b038d3b6ec1c7dfc2ac99d028e4b4259467d2133b&scene=58&subscene=0#rd) - - [【安全头条】百万欧元规模钓鱼组织被欧洲刑警组织打击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772602&idx=2&sn=7076f858bee72273d51a0ab8a880f9d9&chksm=88936255bfe4eb4331aca24ab4db213496f169a949b139b7539fb0ffb3ba49bccef8c8458e7a&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jun. 23th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495585&idx=1&sn=ab7a9784f80a204e27393e7fae2fb072&chksm=ce96a29ff9e12b89a11aca642ff1063b482e2190ed9ce1d8929a974e44e3f9af3c73a0a504f2&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [Best way to use hashcat on an M1 Macbook Air?](https://www.reddit.com/r/HowToHack/comments/vj9yof/best_way_to_use_hashcat_on_an_m1_macbook_air/) - - [Just a question on schooling/certs](https://www.reddit.com/r/HowToHack/comments/vimv09/just_a_question_on_schoolingcerts/) -- 安全牛 - - [从PIA与DPIA对比看我国和欧盟个人信息保护的差异](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114988&idx=1&sn=61814bc0c2f9d933e5d7ed19a3f1165c&chksm=bd147d3f8a63f429b71354b1abeb1ce358a334549a546825038289ce05d4dac480039ce1d12c&scene=58&subscene=0#rd) - - [如何避免严重网络安全事故的发生？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114988&idx=2&sn=0ce21e0d27fd7e3f25d340bfd204c44d&chksm=bd147d3f8a63f429a8e0f56c21c779d43a18718c4bea6768ff3e0b31742223d2a1fc9d035e67&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（28期）：关键信息基础设施安全协同防御体系设计与实践](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651114988&idx=3&sn=ea6e828ce2ac07e74998aaa7a7c3baaa&chksm=bd147d3f8a63f429b91745449e56fca8b6633dc7e82cdaa488f25ca67ef78b946823967e2906&scene=58&subscene=0#rd) -- Il Disinformatico - - [Vasche da bagno a rischio attacco informatico](http://attivissimo.blogspot.com/2022/06/vasche-da-bagno-rischio-attacco.html) - - [Interpol, duemila arresti per truffe informatiche, 50 milioni di dollari recuperati](http://attivissimo.blogspot.com/2022/06/interpol-duemila-arresti-per-truffe.html) - - [Mettete al sicuro i vostri dati su un disco condiviso QNAP? Aggiornatelo per evitare ricatti](http://attivissimo.blogspot.com/2022/06/mettete-al-sicuro-i-vostri-dati-su-un.html) - - [Software “senziente”: come sapere se NON lo è](http://attivissimo.blogspot.com/2022/06/software-senziente-come-sapere-se-non.html) -- 深信服千里目安全实验室 - - [【二次通告】Spring Data MongoDB SpEL表达式注入漏洞CVE-2022-22980](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262026&idx=1&sn=5eb6199abfff8df8de7e17e5054d8dbc&chksm=f3e2707ec495f9686beb415d1d2bfe67abe3207bc007bf31773eabb055298d3a144b6bd4f35f&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-06-25.md b/archive/2022/2022-06-25.md deleted file mode 100644 index 0498bae432..0000000000 --- a/archive/2022/2022-06-25.md +++ /dev/null @@ -1,232 +0,0 @@ -# 每日安全资讯（2022-06-25） - -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5492-1](https://packetstormsecurity.com/files/167585/USN-5492-1.txt) - - [Ubuntu Security Notice USN-5487-3](https://packetstormsecurity.com/files/167584/USN-5487-3.txt) - - [Backdoor.Win32.InfecDoor.17.c MVID-2022-0614 Insecure Permissions](https://packetstormsecurity.com/files/167583/MVID-2022-0614.txt) - - [Trojan-Mailfinder.Win32.VB.p MVID-2022-0616 Insecure Permissions](https://packetstormsecurity.com/files/167582/MVID-2022-0616.txt) - - [Backdoor.Win32.Shark.btu MVID-2022-0615 Insecure Permissions](https://packetstormsecurity.com/files/167581/MVID-2022-0615.txt) - - [Yashma Ransomware Builder 1.2 MVID-2022-0613 Insecure Permissions](https://packetstormsecurity.com/files/167580/MVID-2022-0613.txt) -- FreeBuf网络安全行业门户 - - [Cunning Kitten–针对中东相关人士的威胁组织](https://www.freebuf.com/news/337241.html) - - [QNAP发出警告，关键PHP漏洞可导致远程代码执行](https://www.freebuf.com/articles/337218.html) - - [NSO终于承认！至少5个欧洲国家正使用飞马间谍软件](https://www.freebuf.com/news/337201.html) - - [CISA：威胁行为者利用Log4Shell漏洞入侵VMware服务器](https://www.freebuf.com/news/337187.html) - - [FreeBuf周报 | 美当局称已捣毁僵尸网络RSOCKS；Facebook面临集体诉讼](https://www.freebuf.com/articles/337183.html) - - [史上最能卷的勒索组织之一，每天工作时间超14小时](https://www.freebuf.com/news/337170.html) -- Sploitus.com Exploits RSS Feed - - [Backdoor.Win32.InfecDoor.17.c MVID-2022-0614 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:167583&utm_source=rss&utm_medium=rss) - - [Yashma Ransomware Builder 1.2 MVID-2022-0613 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:167580&utm_source=rss&utm_medium=rss) - - [Trojan-Mailfinder.Win32.VB.p MVID-2022-0616 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:167582&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Shark.btu MVID-2022-0615 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:167581&utm_source=rss&utm_medium=rss) - - [Exploit for Missing Authentication for Critical Function in F5 Big-Ip Access Policy Manager exploit](https://sploitus.com/exploit?id=A085342C-7F7C-5CBA-A424-89E5B1046F48&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=20BFC1D4-CB1E-51CF-82D8-E4258142BB69&utm_source=rss&utm_medium=rss) - - [Exploit for Off-by-one Error in Sudo Project Sudo exploit](https://sploitus.com/exploit?id=4C45914B-E23C-51F5-AC39-A11AF3084185&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=4FD3A97A-9BE6-5A1E-AE21-241CC188CDE7&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [A “whole-of-state” approach to cybersecurity](https://securityboulevard.com/2022/06/a-whole-of-state-approach-to-cybersecurity/) - - [Hackers Are Still Exploiting Log4Shell Vulnerability, Warns CISA](https://securityboulevard.com/2022/06/hackers-are-still-exploiting-log4shell-vulnerability-warns-cisa/) - - [USENIX Enigma 2022 – Mallory Knodel’s ‘You Can’t Always Get What You Want / But You Get What You Need: Moderating E2EE’](https://securityboulevard.com/2022/06/usenix-enigma-2022-mallory-knodels-you-cant-always-get-what-you-want-but-you-get-what-you-need-moderating-e2ee/) - - [Peer Groups](https://securityboulevard.com/2022/06/peer-groups/) - - [Privacy Access Token](https://securityboulevard.com/2022/06/privacy-access-token/) - - [Joy Of Tech® ‘#2909’](https://securityboulevard.com/2022/06/joy-of-tech-2909/) - - [NSA Wants To Help you Lock Down MS Windows in PowerShell](https://securityboulevard.com/2022/06/nsa-wants-to-help-you-lock-down-ms-windows-in-powershell/) - - [Reputational Cost of a Data Breach](https://securityboulevard.com/2022/06/reputational-cost-of-a-data-breach/) - - [Introducing LogRhythm Version 7.9: Simplify Your Job with Greater Efficiency and Enhanced Security](https://securityboulevard.com/2022/06/introducing-logrhythm-version-7-9-simplify-your-job-with-greater-efficiency-and-enhanced-security/) - - [USENIX Enigma 2022 – Cillian Kieran’s ‘An Open-Source Taxonomy For Ex-ante Privacy’](https://securityboulevard.com/2022/06/usenix-enigma-2022-cillian-kierans-an-open-source-taxonomy-for-ex-ante-privacy/) -- ElcomSoft blog - - [GPU Acceleration: Attacking Passwords with NVIDIA RTX Series Boards](https://blog.elcomsoft.com/2022/06/gpu-acceleration-attacking-passwords-with-nvidia-rtx-series/) -- codeblog - - [finding binary differences](https://outflux.net/blog/archives/2022/06/24/finding-binary-differences/) -- Blog on STAR Labs - - [io_uring - new code, new bugs, and a new exploit technique](https://starlabs.sg/blog/2022/06/io_uring-new-code-new-bugs-and-a-new-exploit-technique/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Dancho Danchev's Disappearance - 2010 - Official Complaint Against Republic of Bulgaria Regarding Dancho Danchev's Illegal Law Enforcement Arrest Home Molestation and Kidnapping Attempt - A Compilation](http://ddanchev.blogspot.com/2022/06/dancho-danchevs-disappearance-2010.html) -- Trail of Bits Blog - - [Managing risk in blockchain deployments](https://blog.trailofbits.com/2022/06/24/managing-risk-in-blockchain-deployments/) -- blog.avast.com EN - - [ToddyCat claws at Asian governments](https://blog.avast.com/toddycat-apt-targets-government) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 26](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-26-3/) -- Malwarebytes Labs - - [Cybersecurity agencies: You don’t have to delete PowerShell to secure it](https://blog.malwarebytes.com/security-world/2022/06/cybersecurity-agencies-you-dont-have-to-delete-powershell-to-secure-it/) -- Hacking and security - - [Infosec Income Questionnaire (Responses) and Ideal Candidates for Info Sec](https://hackingandsecurity.blogspot.com/2022/06/infosec-income-questionnaire-responses.html) - - [Weather Forecast Python program](https://hackingandsecurity.blogspot.com/2022/06/weather-forecast-python-program.html) - - [Using Medusa](https://hackingandsecurity.blogspot.com/2022/06/using-medusa.html) - - [Pulling LSASS off a hacked box](https://hackingandsecurity.blogspot.com/2022/06/pulling-lsass-off-hacked-box.html) -- Hex Rays - - [Igor’s tip of the week #95: Offsets](https://hex-rays.com/blog/igors-tip-of-the-week-95-offsets/) -- The Daily Swig | Cybersecurity news and views - - [BSides Cleveland organizer steps down after controversial guest added as ‘surprise’ speaker](https://portswigger.net/daily-swig/bsides-cleveland-organizer-steps-down-after-controversial-guest-added-as-surprise-speaker) -- Black Hills Information Security - - [Talkin’ About Infosec News – 6/20/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-6-20-2022/) -- HAHWUL - - [ZAP Forced User Mode!!](https://www.hahwul.com/2022/06/25/zap-forced-user-mode/) - - [File Inclusion (LFI/RFI)](https://www.hahwul.com/cullinan/file-inclusion/) - - [SRI (Subresource Integrity)](https://www.hahwul.com/cullinan/sri/) -- KitPloit - PenTest & Hacking Tools - - [Authcov - Web App Authorisation Coverage Scanning](http://www.kitploit.com/2022/06/authcov-web-app-authorisation-coverage.html) - - [Norimaci - Simple And Lightweight Malware Analysis Sandbox For macOS](http://www.kitploit.com/2022/06/norimaci-simple-and-lightweight-malware.html) -- 奇客Solidot–传递最新科技情报 - - [蔚来测试车发生事故致两人死亡](https://www.solidot.org/story?sid=71934) - - [AI 学会了新技能：化学](https://www.solidot.org/story?sid=71933) - - [法院裁定DMCA不能凌驾于第一修正案对匿名言论保护之上](https://www.solidot.org/story?sid=71932) - - [仿生机器鱼清除海洋中的微塑料](https://www.solidot.org/story?sid=71931) - - [科学家发现一厘米长细胞的细菌](https://www.solidot.org/story?sid=71930) - - [新冠疫苗全球减少 2000 万人死亡](https://www.solidot.org/story?sid=71929) - - [FDA 下令停售 Juul 电子烟](https://www.solidot.org/story?sid=71928) - - [Linus Torvalds 称 Rust 最快将在 Linux 5.20 中合并到内核](https://www.solidot.org/story?sid=71927) - - [谁获得科学荣誉？通常不是女性](https://www.solidot.org/story?sid=71926) -- text/plain - - [Captive Portals](https://textslashplain.com/2022/06/24/captive-portals/) - - [Extending Fiddler’s ImageView](https://textslashplain.com/2022/06/23/extending-fiddlers-imageview/) -- bellingcat - - [How Russia’s Offensive Damaged Critical Donbas Water Infrastructure](https://www.bellingcat.com/news/2022/06/24/how-russias-offensive-damaged-critical-donbas-water-infrastructure/) -- IntelTechniques Blog - - [The Privacy, Security, & OSINT Show – Episode 267](https://inteltechniques.com/blog/2022/06/24/the-privacy-security-osint-show-episode-267/) -- Il Disinformatico - - [Podcast RSI - Trucchi delle intelligenze artificiali; arresti Interpol rivelano tecniche dei criminali online; attacchi informatici ai dispositivi QNAP... e alle vasche idromassaggio](http://attivissimo.blogspot.com/2022/06/podcast-rsi-trucchi-delle-intelligenze.html) -- TS-WAY - - [Weekly Threats N. 25 2022](https://www.ts-way.com/it/weekly-threats/2022/06/24/weekly-threats-n-25-2022/) -- Forensic Focus - - [Digital Forensics Research Update: May 2022](https://www.forensicfocus.com/articles/digital-forensics-research-update-may-2022/) - - [Magnet REVIEW 4.0: Helping You Bring Investigators and Their Evidence Together](https://www.forensicfocus.com/news/magnet-review-4-0-helping-you-bring-investigators-and-their-evidence-together/) -- SANS Internet Storm Center, InfoCON: green - - [Python (ab)using The Windows GUI, (Fri, Jun 24th)](https://isc.sans.edu/diary/rss/28780) -- Securityinfo.it - - [Quanto costa accedere a una rete aziendale](https://www.securityinfo.it/2022/06/24/quanto-costa-accedere-a-una-rete-aziendale/?utm_source=rss&utm_medium=rss&utm_campaign=quanto-costa-accedere-a-una-rete-aziendale) - - [Ricercatori violano la criptazione di MEGA](https://www.securityinfo.it/2022/06/24/ricercatori-violano-la-criptazione-di-mega/?utm_source=rss&utm_medium=rss&utm_campaign=ricercatori-violano-la-criptazione-di-mega) -- Schneier on Security - - [Friday Squid Blogging: Squid Cubes](https://www.schneier.com/blog/archives/2022/06/friday-squid-blogging-squid-cubes.html) - - [On the Dangers of Cryptocurrencies and the Uselessness of Blockchain](https://www.schneier.com/blog/archives/2022/06/on-the-dangers-of-cryptocurrencies-and-the-uselessness-of-blockchain.html) -- Tor Project blog - - [Arti 0.5.0 is released: Robustness and API improvements](https://blog.torproject.org/arti_050_released/) -- Arturo Di Corinto - - [Per Google un’azienda italiana distribuisce software spia su dispositivi iOS e Android](https://dicorinto.it/testate/repubblica-it/per-google-unazienda-italiana-distribuisce-software-spia-su-dispositivi-ios-e-android/) -- Palo Alto Networks Blog - - [Presidio and Palo Alto Networks Secure Hybrid Workforces with ZTNA 2.0](https://www.paloaltonetworks.com/blog/2022/06/presidio-and-palo-alto-networks-secure-hybrid-workforces-with-ztna-2-0/) -- Dark Reading - - [Threat Intelligence Services Are Universally Valued by IT Staff](https://www.darkreading.com/tech-trends/threat-intelligence-services-are-universally-valued-by-it-staff) - - [Why We're Getting Vulnerability Management Wrong](https://www.darkreading.com/vulnerabilities-threats/why-we-re-getting-vulnerability-management-wrong) - - [APT Groups Swarming on VMware Servers with Log4Shell](https://www.darkreading.com/threat-intelligence/apt-groups-swarming-vmware-servers-log4shell) - - [Only 3% of Open Source Software Bugs Are Actually Attackable, Researchers Say](https://www.darkreading.com/application-security/open-source-software-bugs--attackability) - - [7 Steps to Stronger SaaS Security](https://www.darkreading.com/cloud/7-steps-to-stronger-saas-security) - - [The Cybersecurity Talent Shortage Is a Myth](https://www.darkreading.com/edge-articles/the-cybersecurity-talent-shortage-is-a-myth) - - [Without Conti on the Scene, LockBit 2.0 Leads Ransomware Attacks](https://www.darkreading.com/threat-intelligence/without-conti-on-the-scene-ransomware-attacks-fell-in-may) -- Computer Forensics - - [Looking for recommendations to include in a presentation for people starting out in DFIR](https://www.reddit.com/r/computerforensics/comments/vjum02/looking_for_recommendations_to_include_in_a/) - - [Cellebrite vs. Oxygen](https://www.reddit.com/r/computerforensics/comments/vjj5x5/cellebrite_vs_oxygen/) - - [add NSRL hashset to EnCase Forensics V8.05](https://www.reddit.com/r/computerforensics/comments/vjgd6l/add_nsrl_hashset_to_encase_forensics_v805/) -- Social Engineering - - [How do you market social engeering?](https://www.reddit.com/r/SocialEngineering/comments/vjxqkt/how_do_you_market_social_engeering/) - - [Challenge- Get into a Milan Fashion Week show as an average Joe tourist.](https://www.reddit.com/r/SocialEngineering/comments/vjk6to/challenge_get_into_a_milan_fashion_week_show_as/) - - [OSINT Analysis](https://www.reddit.com/r/SocialEngineering/comments/vjq5jw/osint_analysis/) - - [How effective is this competition at teaching social engineering?](https://www.reddit.com/r/SocialEngineering/comments/vjd2f1/how_effective_is_this_competition_at_teaching/) -- Deeplinks - - [EFF's Statement on Dobb's Abortion Ruling](https://www.eff.org/deeplinks/2022/06/effs-statement-dobbs-abortion-ruling) -- The Register - Security - - [More than $100m in cryptocurrency stolen from blockchain biz](https://go.theregister.com/feed/www.theregister.com/2022/06/24/harmony_100m_cryptocurrency_theft/) - - [Google: How we tackled this iPhone, Android spyware](https://go.theregister.com/feed/www.theregister.com/2022/06/24/spyware_iphones_android_isp/) - - [Beijing-backed attackers use ransomware as a decoy while they conduct espionage](https://go.theregister.com/feed/www.theregister.com/2022/06/24/ransomware_as_espionage_distraction/) - - [NSO claims 'more than 5' EU states use Pegasus spyware](https://go.theregister.com/feed/www.theregister.com/2022/06/24/nso_customers_eu_pegasus/) -- 深信服千里目安全实验室 - - [电子邮件内有毒蛇：揭秘Snake Keylogger窃密木马](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262069&idx=1&sn=7602d3a92c74318e24382c02687d9cc8&chksm=f3e27041c495f9572ad9631526c46e58db04a395fe43893eb72fabdd1763405dabbff246d845&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [字节跳动 Byte Camp 夏令营报名启动！四大赛道15个技术方向，等你来战！](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495585&idx=2&sn=23e84a5cd8989d002e65c9ea03d6b528&chksm=e9d32443dea4ad556b88a9d6494aeb6e3658ee6786f1d3c3bea09ba5ee27fb335a9c4f186822&scene=58&subscene=0#rd) -- Security Current - - [Congratulations to the 2022 C100 Winners](/congratulations-to-the-2022-c100-winners/) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jun. 24th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495587&idx=1&sn=16428fd9d3e37bfb4a61cca3b040f707&chksm=ce96a29df9e12b8bfb395ac6d8fba7efe3108c5c85daa848ce894953142a33d802b46cdf782f&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [Playing Docker? Bad Containers and What They Teach Us](https://www.reddit.com/r/netsec/comments/vjlwwj/playing_docker_bad_containers_and_what_they_teach/) - - [Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks](https://www.reddit.com/r/netsec/comments/vjoh6s/hagana_a_novel_approach_to_runtime_protection_for/) - - [Netsec Goggle for Brave Search](https://www.reddit.com/r/netsec/comments/vjuphf/netsec_goggle_for_brave_search/) - - [The curious tale of a fake Carrier.app](https://www.reddit.com/r/netsec/comments/vjkh9o/the_curious_tale_of_a_fake_carrierapp/) - - [CookieMonsteRCE: Stored XSS to RCE in Zena](https://www.reddit.com/r/netsec/comments/vjfnph/cookiemonsterce_stored_xss_to_rce_in_zena/) - - [The Far Point of a Static Encounter](https://www.reddit.com/r/netsec/comments/vjflm8/the_far_point_of_a_static_encounter/) -- Your Hacking Tutorial by Zempirians - - [Can someone please tell me if there is a way i can convert this into readable text?](https://www.reddit.com/r/HowToHack/comments/vjjx47/can_someone_please_tell_me_if_there_is_a_way_i/) - - [Which operating system is best?](https://www.reddit.com/r/HowToHack/comments/vk1gj0/which_operating_system_is_best/) - - [how to find my first bug ? (bug-bounty question)](https://www.reddit.com/r/HowToHack/comments/vjtfan/how_to_find_my_first_bug_bugbounty_question/) - - [Any advice on preparing for a CPTC Team tryout?](https://www.reddit.com/r/HowToHack/comments/vjzbqj/any_advice_on_preparing_for_a_cptc_team_tryout/) - - [Help!, so if u Scan a webserver with nmap -sV (ip) and u don’t get any versions just ports is that because of a firewall? And if so how do i bypass it.](https://www.reddit.com/r/HowToHack/comments/vjdeog/help_so_if_u_scan_a_webserver_with_nmap_sv_ip_and/) - - [Finding unknown items](https://www.reddit.com/r/HowToHack/comments/vjwfhx/finding_unknown_items/) - - [Phison 2303 hunting in 2022](https://www.reddit.com/r/HowToHack/comments/vjpwb7/phison_2303_hunting_in_2022/) - - [Opinions on Coursera?](https://www.reddit.com/r/HowToHack/comments/vjdhsu/opinions_on_coursera/) - - [com port listener](https://www.reddit.com/r/HowToHack/comments/vjnect/com_port_listener/) - - [How to approach a former black hacker?](https://www.reddit.com/r/HowToHack/comments/vjeemu/how_to_approach_a_former_black_hacker/) -- 互联网安全内参 - - [《2022年中国网络安全市场与企业竞争力分析》报告发布](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503728&idx=1&sn=b2432e075e54d2f61ddee444628ccc91&chksm=ebfa8850dc8d0146b3df93e7ae3e9e9c63e8cd77cd245d4700e8aec53f06944745942fa2f2e2&scene=58&subscene=0#rd) - - [网络安全审查办公室对知网启动网络安全审查](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503728&idx=2&sn=9f6909638c25ff03c34432e24dccdd26&chksm=ebfa8850dc8d0146e972eb6d73dfa760be3d28b4423f64f00cb661b4dac79d002c9238c6518c&scene=58&subscene=0#rd) - - [美国国家情报总监办公室里的网络安全旋转门](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503728&idx=3&sn=33f712153fcee18c8e10a56b913519ea&chksm=ebfa8850dc8d014634c5ba41909ccdd45d8a9712a32ef0016b6dc1ee6a0c6a9e54f2772b0b07&scene=58&subscene=0#rd) - - [三部门要求：推行隐私面单、虚拟号码等技术，保障快递用户隐私](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503728&idx=4&sn=ade3d6fcf7eaad1cebd18c76f238f19c&chksm=ebfa8850dc8d01462db3db065d7fd55d61d73e47ed42e73a9b2d649299286bf1ca63c5448501&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [Authcov - Web App Authorisation Coverage Scanning](http://www.kitploit.com/2022/06/authcov-web-app-authorisation-coverage.html) - - [Norimaci - Simple And Lightweight Malware Analysis Sandbox For macOS](http://www.kitploit.com/2022/06/norimaci-simple-and-lightweight-malware.html) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Do you all get hated in your organisation for being the nosey security guy?](https://www.reddit.com/r/netsecstudents/comments/vjsi34/do_you_all_get_hated_in_your_organisation_for/) -- Instapaper: Unread - - [Spyware vendor targets users in Italy and Kazakhstan](https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/) - - [Google Seven zero-days in 2021 developed commercially and sold to governments](https://www-therecord.recfut.com/google-seven-zero-days-in-2021-developed-commercially-and-sold-to-governments/) -- 奇安信威胁情报中心 - - [每周高级威胁情报解读(2022.06.16~06.23)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247501793&idx=2&sn=0dddd7c03b23de502a1b721a862c3357&chksm=ea663096dd11b9809c2d35f926e2609218f5027294f019bd68dccd08c7382d1c275bbdc2e873&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [Private Network 5G Security Risks & Vulnerabilities](https://www.trendmicro.com/en_us/research/22/f/5g-security-risks-vulnerabilities.html) -- 安全牛 - - [2022年云计算应用关键威胁调查](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115262&idx=1&sn=ebe7834b771b3795d8b8e803784b779d&chksm=bd147e2d8a63f73bbf666572386244d4d365f5dfb0af5a68105adfe181a9da0296aaf09d8ffd&scene=58&subscene=0#rd) - - [“金融科技安全”高级研修班将于7月上旬在京举办（附报名链接）](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115262&idx=2&sn=417ee3427afe159241693c5b733b3774&chksm=bd147e2d8a63f73bb36643b08f761aa54d3ff279a39c9e93dd32d14918b60946652bc1783edb&scene=58&subscene=0#rd) - - [2022安全创客汇复赛重庆站圆满落幕 20强企业晋级半决赛](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115262&idx=3&sn=0b60438eedb2798493d0f923c717fec4&chksm=bd147e2d8a63f73b5f0e75807c412af51c8faa34402dafc62245c1ab0ee9bfd9cd318c094ca6&scene=58&subscene=0#rd) -- Hacking and security - - [Infosec Income Questionnaire (Responses) and Ideal Candidates for Info Sec](https://hackingandsecurity.blogspot.com/2022/06/infosec-income-questionnaire-responses.html) - - [Weather Forecast Python program](https://hackingandsecurity.blogspot.com/2022/06/weather-forecast-python-program.html) - - [Using Medusa](https://hackingandsecurity.blogspot.com/2022/06/using-medusa.html) - - [Pulling LSASS off a hacked box](https://hackingandsecurity.blogspot.com/2022/06/pulling-lsass-off-hacked-box.html) -- 看雪学院 - - [倒计时1天！多轮抽奖！平安SRC线上沙龙第二期：新视角下的安全攻防对抗](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454436&idx=1&sn=95acc9022f85c6f2cc7de740cf27397e&chksm=b18e392e86f9b0381543fe31d1a81343d2b26af90daef6489bc2c3279ec34d3d97b807293790&scene=58&subscene=0#rd) - - [从2021年西湖论剑一道题看高版本libc解题思路](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454436&idx=2&sn=7d347ab070f6e5b638b60a7c2c687a4f&chksm=b18e392e86f9b038fdd2929854f83aa40ebed88fea4e8358d971e8600ac34c6849909b38eead&scene=58&subscene=0#rd) - - [严重PHP漏洞使威联通设备面临远程代码执行风险](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454436&idx=3&sn=d8018013e051a19f37930afa7dc64b94&chksm=b18e392e86f9b038869ce00368b565364dd5133ebb4ad9c8de1bb25450ab5d5c687fd9fcb0c7&scene=58&subscene=0#rd) - - [职位又更新啦！高薪工作速来](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454436&idx=4&sn=5e50d8a404a06bf3496e13a66a4a47e0&chksm=b18e392e86f9b0381c2287a21b2965a1f57c57cee891adcb0f33d55e7f02c098be219a4b1fb6&scene=58&subscene=0#rd) - - [《IDA插件开发入门》为你的逆向工作添砖加瓦](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454436&idx=5&sn=a5ad1c6e40167f388578afa8c1b33d43&chksm=b18e392e86f9b0380fd1d82f3aa642159ae2258af5432825adc30deec310b6d2e11ca31de226&scene=58&subscene=0#rd) -- 火线Zone - - [在AWS中，将支持MFA的IAM用户与IAM角色链接起来，以实现潜在的权限升级](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495686&idx=1&sn=e7ace88d072b2d06f56b34e14c2d2889&chksm=eaa97826dddef130a99e83a10336cf9aa48712f8590b5f1b0d20ea279a35433052578f3a2ab7&scene=58&subscene=0#rd) - - [刘对（火线安全）-多云环境的风险发现](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495686&idx=2&sn=ffeb208ac26a7a35758c1c8be12b4897&chksm=eaa97826dddef1308a58d086620ead42fa3004a971d9e0becbebbcb78a1dad3ee9397968371a&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [智能合约安全之solidity整数溢出的原理](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494277&idx=1&sn=1d2f88026c862d180d8de3271b7d816d&chksm=fa523f3bcd25b62daae6c5d1d4d494e70957790733611293f52cc7d792529326f96f9c50a0aa&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-24)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958538&idx=1&sn=a5026540c824e97fa4d7b07d0c537b27&chksm=8baecd95bcd944831d19cd6ec7515458105f5d52212d8673a2bbde3bad2cd7315910524302fb&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】使用Pineapple NANO、OS X和BetterCap进行无线网络渗透测试](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772687&idx=1&sn=a237b5f8086ac2a2ee487c15dfba176d&chksm=889362e0bfe4ebf606dfbafdae5f3f9912ddd77941a30d419fc7f8d69991f972581d9f4aefbf&scene=58&subscene=0#rd) - - [【安全头条】MEGA修复导致数据泄露的高危漏洞](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649772687&idx=2&sn=5803cbd7d749677a192a0a4f70eda8ad&chksm=889362e0bfe4ebf6284ecc85b6f11d8979e65c17c2ebe7ed2d29469ee9ffc3defdd69b0a592c&scene=58&subscene=0#rd) -- 情报分析师 - - [朝鲜：2022年情报评估](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507360&idx=1&sn=c85beac44ef9dc744e06cb33c93356d1&chksm=8716a62bb0612f3daeaca88a8086556cd48883f3c123fca7949ed2deda4ae0981d950aa81275&scene=58&subscene=0#rd) - - [情报分析师是干什么的，应具备什么条件？](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507360&idx=2&sn=830dbdd5c520f73a97b465b9480cabbf&chksm=8716a62bb0612f3d14be3f28d067ff4193f65c3ed50a9a67b54faa149fc1808312cc2439c4ca&scene=58&subscene=0#rd) - - [国际武器贸易|调查资源](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507360&idx=3&sn=912c6b471603c67bd8d95dd16a57f082&chksm=8716a62bb0612f3de50372146ddb6700ff178c9cabcd1857a4da60cd18db37152a3495321db2&scene=58&subscene=0#rd) -- 代码卫士 - - [NSO 集团称至少五个欧盟成员国使用了监控软件 Pegasus](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512563&idx=1&sn=7dac7a9cc99679e4449f45af97ebab3c&chksm=ea948099dde3098fd2f706947ca584334bf58946582c2d223e49fea86cd9dbfecb10df525173&scene=58&subscene=0#rd) - - [监控软件厂商勾结互联网服务提供商感染iOS和安卓用户](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512563&idx=2&sn=6582e83c3243a6d3bf6629a491add967&chksm=ea948099dde3098ff28bbb7d7f6e5634d3d0f29556ffb7aa7ec4f4088d596796e590016efe43&scene=58&subscene=0#rd) -- Threatpost - - [Google Warns Spyware Being Deployed Against Android, iOS Users](https://threatpost.com/google-hermit-spyware-android-ios/180062/) -- Security Affairs - - [Threat actors continue to exploit Log4Shell in VMware Horizon Systems](https://securityaffairs.co/wordpress/132569/security/log4shell-ongoing-exploitation.html) - - [Vulnerabilities in the Jacuzzi SmartTub app could allow to access users’ data](https://securityaffairs.co/wordpress/132559/hacking/jacuzzi-smarttub-app-flaws.html) - - [Google TAG argues surveillance firm RCS Labs was helped by ISPs to infect mobile users](https://securityaffairs.co/wordpress/132553/malware/rcs-labs-spyware-spreads.html) -- 三六零CERT - - [CVE-2022-21445:Oracle JDeveloper ADF Faces 远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491101&idx=1&sn=fe143c42f81f8e70e6d17d15037c09ac&chksm=fe251b1cc952920aa8002863ce27e244c999f945539698884fe50d697945a8b7a380b20baee8&scene=58&subscene=0#rd) - - [警惕！PBot挖矿僵尸网络正利用新漏洞发起攻击](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491101&idx=2&sn=7d8a506a104539a48a85ccdfc469ca72&chksm=fe251b1cc952920a5c68c82e547fa26beca531a1d57540582828999ffa00e4785bba44d8dd8e&scene=58&subscene=0#rd) - - [安全日报（2022.06.24）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491101&idx=3&sn=fc1ca5eeaecd2852cef57d02d1c701ca&chksm=fe251b1cc952920a92a3bf9354b1383e95941cfda12a3814b1b649425dfc47f190233b5ed87a&scene=58&subscene=0#rd) -- 锦行信息安全 - - [连获“双奖”，实力出圈！锦行科技入选“2022年中国数字安全百强”及获“2022年中国网安产业成长之星”称号](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489920&idx=1&sn=81b3e9bee54059353755745da26bfeb3&chksm=9799e225a0ee6b330e6c2c5d306728581899c31c508448dc07660c4a28e01fa0540edae0c47c&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [Cunning Kitten–针对中东相关人士的威胁组织](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247488652&idx=1&sn=4f481d386283932dbd232f97c5ab2ef8&chksm=f9ee7833ce99f125313710628e9038dda3580893c3925c568440f380e5e02dc01c2bf61df38c&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [主动破局｜绿盟数据安全运营平台（ISOP DS）助力多业务场景下的数据安全建设](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491800&idx=1&sn=48bbe7b0b91fbe231cca69a75d8b4962&chksm=eaac739fdddbfa89e82dbf12320e1fe2d990d273aaa90206bf83d2a9b6973bdff766c76f9953&scene=58&subscene=0#rd) -- TorrentFreak - - [Takedown Notice Wipes Game Boy Advance Emulator From GitHub](https://torrentfreak.com/takedown-notice-wipes-game-boy-advance-emulator-from-github-220624/) - - [Digital Trails: How Bungie Identified a Mass Sender of Fake DMCA Notices](https://torrentfreak.com/digital-trails-how-bungie-identified-a-mass-sender-of-fake-dmca-notices-220624/) -- 雷神众测 - - [基于Nginx反向代理水坑攻击](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498052&idx=1&sn=b3b541a0137e828e8d90e3e3a1d9cabe&chksm=f2584b37c52fc221bc26a1729cc81ac23062a91f94e88af5edce6933fcf4b93ad343a23a4e24&scene=58&subscene=0#rd) -- 复旦白泽战队 - - [我实验室廉轲轲博士在“移动互联网安全”（二）论坛上做的研究工作报告——《安卓系统数据存储机制安全分析》](https://mp.weixin.qq.com/s?__biz=MzU4NzUxOTI0OQ==&mid=2247485640&idx=1&sn=e1b4ae99215e8ce5f263a6240c0fedea&chksm=fdeb8cb6ca9c05a019a6053ed0c2c67a50c08ff7449339aca9a3c909c46593973c390a90f42b&scene=58&subscene=0#rd) -- Dark Space Blogspot - - [Solana Lancia Il Suo Smartphone: The Saga Begins](http://darkwhite666.blogspot.com/2022/06/solana-lancia-il-suo-smartphone-saga.html) diff --git a/archive/2022/2022-06-26.md b/archive/2022/2022-06-26.md deleted file mode 100644 index 7532034256..0000000000 --- a/archive/2022/2022-06-26.md +++ /dev/null @@ -1,72 +0,0 @@ -# 每日安全资讯（2022-06-26） - -- Security Boulevard - - [USENIX Enigma 2022 – Ram Shankar Siva Kumar’s ‘Why Has Your Toaster Been Through More Security Testing Than The AI System’](https://securityboulevard.com/2022/06/usenix-enigma-2022-ram-shankar-siva-kumars-why-has-your-toaster-been-through-more-security-testing-than-the-ai-system/) - - [XKCD ‘Roman Numerals’](https://securityboulevard.com/2022/06/xkcd-roman-numerals/) - - [USENIX Enigma 2022 – Chris Krebs’ ‘#Protect2020: An After Action Report’](https://securityboulevard.com/2022/06/usenix-enigma-2022-chris-krebs-protect2020-an-after-action-report/) -- No Headback - - [怎样降低沟通成本(1)](http://xargin.com/zen-yang-jiang-di-gou-tong-cheng-ben-1/) -- Sploitus.com Exploits RSS Feed - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=37F78533-E96A-5433-B558-90DB82C0BB27&utm_source=rss&utm_medium=rss) - - [Exploit for Incorrect Authorization in Dell Dbutil 2 3.Sys exploit](https://sploitus.com/exploit?id=E25C0F33-3564-5568-A04D-46877E5964AF&utm_source=rss&utm_medium=rss) -- Hacking and security - - [More hax.tor.hu solutions - old russian website](https://hackingandsecurity.blogspot.com/2022/06/more-haxtorhu-solutions-old-russian.html) - - [Hax.tor.hu solutions - old answers](https://hackingandsecurity.blogspot.com/2022/06/haxtorhu-solutions-old-answers.html) -- Microsoft Security Response Center - - [A Man of Action: Meet Callum Carney](https://msrc-blog.microsoft.com/2022/06/24/a-man-of-action-meet-callum-carney/) -- Malwarebytes Labs - - [5 ways to avoid being catfished](https://blog.malwarebytes.com/personal/2022/06/5-ways-to-avoid-being-catfished/) -- KitPloit - PenTest & Hacking Tools - - [DFSCoerce - PoC For MS-DFSNM Coerce Authentication Using NetrDfsRemoveStdRoot Method](http://www.kitploit.com/2022/06/dfscoerce-poc-for-ms-dfsnm-coerce.html) - - [Nim-Loader - WIP Shellcode Loader In Nim With EDR Evasion Techniques](http://www.kitploit.com/2022/06/nim-loader-wip-shellcode-loader-in-nim.html) -- 黑海洋 - WIKI - - [电报桌面版_Telegram_for_Windows_v4.0.2](https://blog.upx8.com/2820) -- 奇客Solidot–传递最新科技情报 - - [网信办对知网启动络安全审查](https://www.solidot.org/story?sid=71941) - - [ESA 准备升级火星快车上的软件](https://www.solidot.org/story?sid=71940) - - [NASA 探测器发现了坠毁在月球上的火箭位置](https://www.solidot.org/story?sid=71939) - - [中国网络分水岭](https://www.solidot.org/story?sid=71938) -- 90Sec - 最新话题 - - [实战未公开细节的漏洞 T00ls-2022-00159](https://forum.90sec.com/t/topic/2140) -- IT Service Management News - - [Rete indisponibile per Clouflare](http://blog.cesaregallotti.it/2022/06/rete-indisponibile-per-clouflare.html) -- SANS Internet Storm Center, InfoCON: green - - [Malicious Code Passed to PowerShell via the Clipboard, (Sat, Jun 25th)](https://isc.sans.edu/diary/rss/28784) -- Troy Hunt's Blog - - [Weekly Update 301](https://www.troyhunt.com/weekly-update-301/) -- Computer Forensics - - [What do you think about this workstation I built.](https://www.reddit.com/r/computerforensics/comments/vkhgtn/what_do_you_think_about_this_workstation_i_built/) - - [Jump starting an investigation ( school assignment)](https://www.reddit.com/r/computerforensics/comments/vko6x7/jump_starting_an_investigation_school_assignment/) -- The Register - Security - - [We're now truly in the era of ransomware as pure extortion without the encryption](https://go.theregister.com/feed/www.theregister.com/2022/06/25/ransomware_gangs_extortion_feature/) -- TorrentFreak - - [Movie & TV Pirates Increase in Italy But They Are Pirating Less Than Ever](https://torrentfreak.com/movie-tv-pirates-increase-in-italy-but-they-are-pirating-less-than-ever-220625/) -- 看雪学院 - - [[Rev赛题复现]DASCTF Apr X FATE 2022](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454448&idx=1&sn=3555e70fdfeb7a4107c476199caa8d7c&chksm=b18e393a86f9b02c71f02972dd13db2c3c8623b6db04e13785ffee36db716f73c948e78678b9&scene=58&subscene=0#rd) - - [视频资讯|德国指控俄罗斯黑客对北约智库进行网络间谍攻击](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454448&idx=2&sn=e917f02ba07e602d75ff9e9a1e113fed&chksm=b18e393a86f9b02c47791221cbf49cd8c585ad53e247e2137160db7aaa93f32014ee0fb7ea41&scene=58&subscene=0#rd) - - [『就业班预售9折』零基础红蓝对抗攻防研修班](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454448&idx=3&sn=5613fd31999ffd531dc4ace7ed22ba79&chksm=b18e393a86f9b02cee9109a5f6b2324eb382e6b107889942a218ed3b0c67ed9fe57acee031c2&scene=58&subscene=0#rd) -- 安全牛 - - [牛聘|2021年度岗位招聘第16期](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115291&idx=1&sn=46c7e838a69e834d6abb7e54a72bde99&chksm=bd147fc88a63f6de2a065e82b2188f6173287768719b669f9a8f428dc4a2a75586026d6ef655&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [How to track someone’s location from just a phone call?](https://www.reddit.com/r/HowToHack/comments/vkp3pn/how_to_track_someones_location_from_just_a_phone/) - - [DNS Vulnerabilities](https://www.reddit.com/r/HowToHack/comments/vka6vd/dns_vulnerabilities/) - - [Tools recommendations for android apps reverse engineering](https://www.reddit.com/r/HowToHack/comments/vkq3fw/tools_recommendations_for_android_apps_reverse/) - - [How the hacker did it?](https://www.reddit.com/r/HowToHack/comments/vkmgrx/how_the_hacker_did_it/) - - [Can someone point me in the right direction on AV evasion](https://www.reddit.com/r/HowToHack/comments/vkdp5l/can_someone_point_me_in_the_right_direction_on_av/) -- KitPloit - PenTest Tools! - - [DFSCoerce - PoC For MS-DFSNM Coerce Authentication Using NetrDfsRemoveStdRoot Method](http://www.kitploit.com/2022/06/dfscoerce-poc-for-ms-dfsnm-coerce.html) - - [Nim-Loader - WIP Shellcode Loader In Nim With EDR Evasion Techniques](http://www.kitploit.com/2022/06/nim-loader-wip-shellcode-loader-in-nim.html) -- Blackhat Library: Hacking techniques and research - - [Explaining Enumeration and Its Types](https://www.reddit.com/r/blackhat/comments/vk9f1i/explaining_enumeration_and_its_types/) -- Security Affairs - - [Oracle spent 6 months to fix ‘Mega’ flaws in the Fusion Middleware](https://securityaffairs.co/wordpress/132603/breaking-news/oracle-mega-flaw-cve-202221445.html) - - [Multiple malicious packages in PyPI repository found stealing AWS secrets](https://securityaffairs.co/wordpress/132598/hacking/pypi-malicious-packages-2.html) - - [Attackers exploited a zero-day in Mitel VOIP devices to compromise a network](https://securityaffairs.co/wordpress/132588/hacking/mitel-voip-ransomware-attack.html) -- /r/netsec - Information Security News & Discussion - - [Basic WebAssembly buffer overflow exploitation](https://www.reddit.com/r/netsec/comments/vkn5mn/basic_webassembly_buffer_overflow_exploitation/) -- Social Engineering - - [In social gatherings or parties, how do you get "clout" the right way so that it doesn't look like you're a smoocher?](https://www.reddit.com/r/SocialEngineering/comments/vkjtus/in_social_gatherings_or_parties_how_do_you_get/) - - [DEF CON Groups VR Event](https://www.reddit.com/r/SocialEngineering/comments/vk58pp/def_con_groups_vr_event/) -- Hacking and security - - [More hax.tor.hu solutions - old russian website](https://hackingandsecurity.blogspot.com/2022/06/more-haxtorhu-solutions-old-russian.html) - - [Hax.tor.hu solutions - old answers](https://hackingandsecurity.blogspot.com/2022/06/haxtorhu-solutions-old-answers.html) diff --git a/archive/2022/2022-06-27.md b/archive/2022/2022-06-27.md deleted file mode 100644 index 9d4a1341bf..0000000000 --- a/archive/2022/2022-06-27.md +++ /dev/null @@ -1,82 +0,0 @@ -# 每日安全资讯（2022-06-27） - -- Sploitus.com Exploits RSS Feed - - [Microsoft Office Project Universal Silent Builder Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37808&utm_source=rss&utm_medium=rss) - - [Microsoft Office Visio VSD Silent Builder Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37809&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Wptaskforce Wpcargo Track \& Trace exploit](https://sploitus.com/exploit?id=27C49ADA-861E-5C6E-BBA0-BAE901E52D41&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2021-38314 exploit](https://sploitus.com/exploit?id=6E3BF23B-CAA2-5948-8B61-A66A2ED3B787&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=9D782BF3-104F-5613-8414-64751732B707&utm_source=rss&utm_medium=rss) -- HackerOne Hacker Activity - - [User can link non-public file attachments, leading to file disclose on edit by higher-privileged user](https://hackerone.com/reports/763177) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Yashma Ransomware Builder v1.2 / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022060080) - - [Backdoor.Win32.Shark.btu / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022060077) - - [Backdoor.Win32.InfecDoor.17.c / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022060078) - - [Trojan-Mailfinder.Win32.VB.p / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022060076) - - [Yashma Ransomware Builder 1.2 MVID-2022-0613 Insecure Permissions](https://cxsecurity.com/issue/WLB-2022060075) -- Security Boulevard - - [How to Protect Your Remote Workforce from a Cyberattack](https://securityboulevard.com/2022/06/how-to-protect-your-remote-workforce-from-a-cyberattack/) - - [Considering RiskLens? We Offer Customized Pilots as Proof of Value (PoV) Engagements](https://securityboulevard.com/2022/06/considering-risklens-we-offer-customized-pilots-as-proof-of-value-pov-engagements/) - - [USENIX Enigma 2022 – Riana Pfefferkorn’s ‘Content-Oblivious Trust And Safety Techniques: Results From A Survey Of Online Service Providers’](https://securityboulevard.com/2022/06/usenix-enigma-2022-riana-pfefferkorns-content-oblivious-trust-and-safety-techniques-results-from-a-survey-of-online-service-providers/) - - [CommitStrip ‘The Right Tool For The Right Job At The Right Time?’](https://securityboulevard.com/2022/06/commitstrip-the-right-tool-for-the-right-job-at-the-right-time/) - - [USENIX Enigma 2022 – Chloé Messdaghi’s ‘Burnout And PCSD: Placing Team At Risk’](https://securityboulevard.com/2022/06/usenix-enigma-2022-chloe-messdaghis-burnout-and-pcsd-placing-team-at-risk/) - - [Elevating Privileges with Authentication Coercion Using DFSCoerce](https://securityboulevard.com/2022/06/elevating-privileges-with-authentication-coercion-using-dfscoerce/) -- Envato Tuts+ Code - Mobile Development - - [Build Native iOS and Android Apps With AppMySite](https://code.tutsplus.com/tutorials/build-native-ios-and-android-apps-with-appmysite--cms-41818) -- Tyranid's Lair - - [Finding Running RPC Server Information with NtObjectManager](https://www.tiraniddo.dev/2022/06/finding-running-rpc-server-information.html) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Here Come the Downloads!](http://ddanchev.blogspot.com/2022/06/here-come-downloads.html) -- HAHWUL - - [[Cullinan #39] SRI and File Inclusion](https://www.hahwul.com/2022/06/26/cullinan-39/) -- 奇客Solidot–传递最新科技情报 - - [龟等爬行动物几乎没有衰老痕迹](https://www.solidot.org/story?sid=71944) - - [Stack Overflow 年度调查显示开发者喜欢 Rust 和远程办公](https://www.solidot.org/story?sid=71943) - - [美国参议员在 GitHub 上公布加密货币监管法案](https://www.solidot.org/story?sid=71942) -- 黑海洋 - WIKI - - [开这个破博客的初衷](https://blog.upx8.com/2824) - - [贝利自动点击器 v2.6.7a 去广告解锁VIP会员版](https://blog.upx8.com/2823) - - [TVbox 电视TV盒子APK猫影视的替身（猫影视接口通用）](https://blog.upx8.com/2822) - - [搜书大师 v23.5 无广告VIP版](https://blog.upx8.com/2821) -- KitPloit - PenTest & Hacking Tools - - [Sealighter - Easy ETW Tracing for Security Research](http://www.kitploit.com/2022/06/sealighter-easy-etw-tracing-for.html) - - [Scout - Lightweight URL Fuzzer And Spider: Discover A Web Server'S Undisclosed Files, Directories And VHOSTs](http://www.kitploit.com/2022/06/scout-lightweight-url-fuzzer-and-spider.html) -- SANS Internet Storm Center, InfoCON: green - - [My Paste Command, (Sun, Jun 26th)](https://isc.sans.edu/diary/rss/28786) - - [More Decoding Analysis, (Sun, Jun 26th)](https://isc.sans.edu/diary/rss/28788) -- KitPloit - PenTest Tools! - - [Sealighter - Easy ETW Tracing for Security Research](http://www.kitploit.com/2022/06/sealighter-easy-etw-tracing-for.html) - - [Scout - Lightweight URL Fuzzer And Spider: Discover A Web Server'S Undisclosed Files, Directories And VHOSTs](http://www.kitploit.com/2022/06/scout-lightweight-url-fuzzer-and-spider.html) -- Your Hacking Tutorial by Zempirians - - [what information can I get from a email?](https://www.reddit.com/r/HowToHack/comments/vl6jx8/what_information_can_i_get_from_a_email/) -- Social Engineering - - [Conversation moves](https://www.reddit.com/r/SocialEngineering/comments/vl3y23/conversation_moves/) -- Computer Forensics - - [Detecting Linux Anti-Forensics Log Tampering](https://www.reddit.com/r/computerforensics/comments/vlfqz5/detecting_linux_antiforensics_log_tampering/) - - [What is the modern, unofficial digital forensics process model that sees the most real-world application to investigations?](https://www.reddit.com/r/computerforensics/comments/vl2yta/what_is_the_modern_unofficial_digital_forensics/) -- 数世咨询 - - [天基太空资产难逃网络攻击](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493970&idx=1&sn=e60363d7027ff412904a8e0e1c22ade7&chksm=c1449beff63312f94365eb454080db528461b585372eff5adaf8736abb3dd570f499f16d7096&scene=58&subscene=0#rd) - - [[调研]2021年80%的公司遭遇身份相关数据泄露](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247493970&idx=2&sn=9ffc17b0a784d96ec0821b76030f0a8e&chksm=c1449beff63312f94744a12946e09b275bd6474e693fd1c5d91fe4095a3318d8e42f183485dc&scene=58&subscene=0#rd) -- Blackhat Library: Hacking techniques and research - - [Making a Link Extractor In Python](https://www.reddit.com/r/blackhat/comments/vktkkw/making_a_link_extractor_in_python/) -- 看雪学院 - - [CVE-2016-3309提权漏洞学习笔记](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454449&idx=1&sn=0e7fcab06f6208c134b8388ea61af637&chksm=b18e393b86f9b02df2779e9bd4d55058cc7666c0c83945978924a0690e47ee0f449087a1ef70&scene=58&subscene=0#rd) - - [招生！《安卓高级研修班》2022年夏季班](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458454449&idx=2&sn=c0122501b606c1ccb334113ddc47bf4a&chksm=b18e393b86f9b02d30b9f0be78fa5d2ea77eec354428754723c0065615643a66dd2bcfc6b04d&scene=58&subscene=0#rd) -- 云鼎实验室 - - [每周云安全资讯-2022年第26周](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494583&idx=1&sn=142ea702017ca3c78726b8b11e8d7e85&chksm=fd791731ca0e9e27aaedb1e0aeb1dc59a023108a8b56430cab676d1d59db95437c2500c9bee1&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报教程】信息事件框架](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507398&idx=1&sn=706a1ec03b0ac329a52db600e3c8fd47&chksm=8716a6cdb0612fdb6f6a1ee1e8673397cd2c8a25f199c90030c64e261689b0e29a7ca426d1e8&scene=58&subscene=0#rd) - - [朝鲜半岛军备竞赛的必然性](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507398&idx=2&sn=3f7b2b3b0134893e5badb133ee0c53ea&chksm=8716a6cdb0612fdb7a7f4e7217909590f87742706d3351aad9d38489f3bd1b0b4b244216f191&scene=58&subscene=0#rd) -- Security Affairs - - [Threat actors sell access to tens of vulnerable networks compromised by exploiting Atlassian 0day](https://securityaffairs.co/wordpress/132637/cyber-crime/access-vulnerable-networks-atlassian-0day.html) - - [Security Affairs newsletter Round 371 by Pierluigi Paganini](https://securityaffairs.co/wordpress/132633/breaking-news/security-affairs-newsletter-round-371-by-pierluigi-paganini.html) - - [China-linked APT Bronze Starlight deploys ransomware as a smokescreen](https://securityaffairs.co/wordpress/132624/apt/bronze-starlight-deploy-ransomware.html) - - [Russia-linked actors may be behind an explosion at a liquefied natural gas plant in Texas](https://securityaffairs.co/wordpress/132608/security/liquefied-natural-gas-plant-texas-explosion.html) -- TorrentFreak - - [Harvard Lawyers Don’t Think That Piracy is Theft, Research Finds](https://torrentfreak.com/harvard-lawyers-dont-think-that-piracy-is-theft-research-finds-220626/) -- /r/netsec - Information Security News & Discussion - - [linx - Reveals invisible links within JavaScript files](https://www.reddit.com/r/netsec/comments/vlgei9/linx_reveals_invisible_links_within_javascript/) -- 微步在线研究响应中心 - - [安全威胁情报周报（6.20~6.26）](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247493742&idx=1&sn=7a16befa5124e2f8162583501bf94545&chksm=cfca8b7af8bd026c20cacf36a1e995f296007143dd0e72c84284083e4a7406e742f0d01c3047&scene=58&subscene=0#rd) -- Dark Space Blogspot - - [Come Configurare IBC Transfers Su Keplr (IBC Relayers e Channel)](http://darkwhite666.blogspot.com/2022/06/come-configurare-ibc-transfers-su-keplr.html) diff --git a/archive/2022/2022-06-28.md b/archive/2022/2022-06-28.md deleted file mode 100644 index 5ddb0d9f6e..0000000000 --- a/archive/2022/2022-06-28.md +++ /dev/null @@ -1,269 +0,0 @@ -# 每日安全资讯（2022-06-28） - -- Sploitus.com Exploits RSS Feed - - [Library Management System With QR Code 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167589&utm_source=rss&utm_medium=rss) - - [WSO2 Management Console Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167587&utm_source=rss&utm_medium=rss) - - [WordPress Plugin Weblizar 8.9 - Backdoor exploit](https://sploitus.com/exploit?id=EDB-ID:50969&utm_source=rss&utm_medium=rss) - - [WordPress W-DALIL 2.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37814&utm_source=rss&utm_medium=rss) - - [WordPress Weblizar 8.9 Plugin - Backdoor Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37810&utm_source=rss&utm_medium=rss) - - [Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50971&utm_source=rss&utm_medium=rss) - - [WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50970&utm_source=rss&utm_medium=rss) - - [Mailhog 1.0.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167596&utm_source=rss&utm_medium=rss) - - [WordPress Simple Page Transition 1.4.1 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37813&utm_source=rss&utm_medium=rss) - - [Library Management System With QR Code 1.0 Shell Upload Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37818&utm_source=rss&utm_medium=rss) - - [Library Management System With QR Code 1.0 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:167588&utm_source=rss&utm_medium=rss) - - [Coffee Shop Cashiering System 1.0 SQL Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37815&utm_source=rss&utm_medium=rss) - - [Coffee Shop Cashiering System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167592&utm_source=rss&utm_medium=rss) - - [WSO2 Management Console (Multiple Products) - Unauthenticated Reflected XSS Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37811&utm_source=rss&utm_medium=rss) - - [Library Management System With QR Code 1.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37817&utm_source=rss&utm_medium=rss) - - [Library Management System With QR Code 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37816&utm_source=rss&utm_medium=rss) - - [Library Management System With QR Code 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167590&utm_source=rss&utm_medium=rss) - - [Mailhog 1.0.1 - Stored Cross-Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37812&utm_source=rss&utm_medium=rss) - - [WordPress Weblizar 8.9 Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167593&utm_source=rss&utm_medium=rss) - - [WordPress Simple Page Transition 1.4.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167597&utm_source=rss&utm_medium=rss) - - [WordPress W-DALIL 2.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167595&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5494-1](https://packetstormsecurity.com/files/167600/USN-5494-1.txt) - - [Red Hat Security Advisory 2022-5189-01](https://packetstormsecurity.com/files/167599/RHSA-2022-5189-01.txt) - - [Ubuntu Security Notice USN-5493-1](https://packetstormsecurity.com/files/167598/USN-5493-1.txt) - - [WordPress Simple Page Transition 1.4.1 Cross Site Scripting](https://packetstormsecurity.com/files/167597/wpspt141-xss.txt) - - [Mailhog 1.0.1 Cross Site Scripting](https://packetstormsecurity.com/files/167596/mailhog101-xss.txt) - - [WordPress W-DALIL 2.0 Cross Site Scripting](https://packetstormsecurity.com/files/167595/wpwdalil20-xss.txt) - - [Red Hat Security Advisory 2022-5187-01](https://packetstormsecurity.com/files/167594/RHSA-2022-5187-01.txt) - - [WordPress Weblizar 8.9 Code Execution](https://packetstormsecurity.com/files/167593/wpweblizar89-exec.txt) - - [Coffee Shop Cashiering System 1.0 SQL Injection](https://packetstormsecurity.com/files/167592/cscs10-sql.txt) - - [Red Hat Security Advisory 2022-5188-01](https://packetstormsecurity.com/files/167591/RHSA-2022-5188-01.txt) - - [Library Management System With QR Code 1.0 SQL Injection](https://packetstormsecurity.com/files/167590/lmsqr10-sql.txt) - - [Library Management System With QR Code 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/167589/lmsqr10-xss.txt) - - [Library Management System With QR Code 1.0 Shell Upload](https://packetstormsecurity.com/files/167588/lmsqr10-shell.txt) - - [WSO2 Management Console Cross Site Scripting](https://packetstormsecurity.com/files/167587/ws02mc-xss.txt) - - [Red Hat Security Advisory 2022-5192-01](https://packetstormsecurity.com/files/167586/RHSA-2022-5192-01.txt) -- Microsoft Security Blog - - [4 breakthrough ideas for compliance and data security](https://www.microsoft.com/security/blog/2022/06/27/4-breakthrough-ideas-for-compliance-and-data-security/) -- HackerOne Hacker Activity - - [CVE-2022-32208: FTP-KRB bad message verification](https://hackerone.com/reports/1590071) - - [CVE-2022-32206: HTTP compression denial of service](https://hackerone.com/reports/1570651) - - [CVE-2022-32205: Set-Cookie denial of service](https://hackerone.com/reports/1569946) - - [CVE-2022-32207: Unpreserved file permissions](https://hackerone.com/reports/1573634) - - [Unauthorized Access to Internal Server Panel without Authentication](https://hackerone.com/reports/1548067) - - [Reflected XSS via `████████` parameter](https://hackerone.com/reports/1536215) - - [HTTP request smuggling with Origin Rules using newlines in the host_header action parameter](https://hackerone.com/reports/1575912) - - [Bypassing Cache Deception Armor using .avif extension file](https://hackerone.com/reports/1391635) - - [Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts](https://hackerone.com/reports/1593413) - - [Sign in with Apple works on existing accounts, bypasses 2FA](https://hackerone.com/reports/1593404) - - [API docs expose an active token for the sample domain theburritobot.com](https://hackerone.com/reports/1507412) - - [Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag](https://hackerone.com/reports/1599573) - - [Credential leak when use two url](https://hackerone.com/reports/1569926) -- 跳跳糖 - 安全与分享社区 - - [CobaltStrike Beacon生成原理分析](https://tttang.com/archive/1631/) -- 安全客-有思想的安全新媒体 - - [云主机AK/SK泄露利用](https://www.anquanke.com/post/id/275261) - - [CVE-2022-21445:Oracle JDeveloper ADF Faces 远程代码执行漏洞](https://www.anquanke.com/post/id/275295) - - [蜻蜓低代码安全工具平台开发之路](https://www.anquanke.com/post/id/275235) - - [MetaMask要求“帮帮我们”实则帮帮黑客](https://www.anquanke.com/post/id/275268) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（20220620-20220626）](http://blog.nsfocus.net/weekly-20220620/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 腾讯 QQ 回应大批账号被盗；黑客仍在利用Log4Shell漏洞](https://www.freebuf.com/news/337418.html) - - [《个人信息跨境处理活动安全认证规范》发布，规范个人信息跨境活动](https://www.freebuf.com/news/337414.html) - - [《中华人民共和国反电信网络诈骗法（草案二次审议稿）》发布](https://www.freebuf.com/news/337401.html) - - [俄罗斯对谷歌传播诋毁其军队的 “不可靠”信息进行罚款](https://www.freebuf.com/news/337370.html) - - [QQ大规模盗号，给好友群发不雅照，腾讯回应来了](https://www.freebuf.com/news/337366.html) - - [德克萨斯州天然气厂爆炸，俄威胁行为者或将是幕后黑手](https://www.freebuf.com/news/337361.html) -- Envato Tuts+ Code - Mobile Development - - [Get Started With React Native Layouts](https://code.tutsplus.com/tutorials/get-started-with-layouts-in-react-native--cms-27418) -- ふるつき - - [ACTF 2022 writeup](https://furutsuki.hatenablog.com/entry/2022/06/28/001931) -- Security Boulevard - - [Zero Trust Network Access (ZTNA) vs. Zero Trust Application Access (ZTAA): Which Is Better?](https://securityboulevard.com/2022/06/zero-trust-network-access-ztna-vs-zero-trust-application-access-ztaa-which-is-better/) - - [Detecting Inclusive Language in My Codebase with Sonatype Lift](https://securityboulevard.com/2022/06/detecting-inclusive-language-in-my-codebase-with-sonatype-lift/) - - [USENIX Enigma 2022 – Nidhi Rastogi’s ‘Contextual Security: A Critical Shift In Performing Threat Intelligence’](https://securityboulevard.com/2022/06/usenix-enigma-2022-nidhi-rastogis-contextual-security-a-critical-shift-in-performing-threat-intelligence/) - - [ADPPA US Privacy Law: Coming Soon in Wake of Roe v. Wade Redo](https://securityboulevard.com/2022/06/adppa-us-privacy-law-coming-soon-in-wake-of-roe-v-wade-redo/) - - [Ask the CEO: Dynamically Speaking live Q&A highlights – Part 1](https://securityboulevard.com/2022/06/ask-the-ceo-dynamically-speaking-live-qa-highlights-part-1/) - - [Celebrating one year of Rapid Scan Static](https://securityboulevard.com/2022/06/celebrating-one-year-of-rapid-scan-static/) - - [Killnet, Kaliningrad, and Lithuania’s Transport Standoff With Russia](https://securityboulevard.com/2022/06/killnet-kaliningrad-and-lithuanias-transport-standoff-with-russia/) - - [Zero Trust takes center stage at EIC 2022](https://securityboulevard.com/2022/06/zero-trust-takes-center-stage-at-eic-2022/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 387’](https://securityboulevard.com/2022/06/robert-m-lees-jeff-haas-little-bobby-comic-week-387/) - - [Comparing Popular Types of Biometrics](https://securityboulevard.com/2022/06/comparing-popular-types-of-biometrics/) -- Guido Vranken - - [Notes on OpenSSL remote memory corruption](https://guidovranken.com/2022/06/27/notes-on-openssl-remote-memory-corruption/) -- Didier Stevens - - [Quickpost: Cracking PDF Owner Passwords](https://blog.didierstevens.com/2022/06/27/quickpost-cracking-pdf-owner-passwords/) -- Malwarebytes Labs - - [You only have nine months to ditch Exchange Server 2013](https://blog.malwarebytes.com/cybercrime/exploits/2022/06/you-only-have-nine-months-to-ditch-exchange-server-2013/) - - [Brave Search wants to replace Google’s biased search results with yours](https://blog.malwarebytes.com/privacy-2/2022/06/brave-search-wants-to-replace-googles-biased-search-results-with-yours/) - - [CISA Log4Shell warning: Patch VMware Horizon installations immediately](https://blog.malwarebytes.com/malwarebytes-news/2022/06/cisa-log4shell-warning-patch-vmware-horizon-installations-immediately/) - - [Instagram introduces new ways for users to verify their age](https://blog.malwarebytes.com/privacy-2/2022/06/instagram-introduces-new-ways-for-users-to-verify-their-age/) - - [A week in security (June 20 – June 26)](https://blog.malwarebytes.com/a-week-in-security/2022/06/a-week-in-security-june-20-june-26/) -- Bug Bounty in InfoSec Write-ups on Medium - - [How i was able to takeover 3 Subdomains of an Organization via Shopify?](https://infosecwriteups.com/how-i-was-able-to-takeover-3-shopify-subdomains-of-an-organization-867141854d37?source=rss----7b722bfd1b8d--bug_bounty) - - [Getting Your First Bug (Part II)](https://infosecwriteups.com/getting-your-first-bug-part-ii-f7081a027f71?source=rss----7b722bfd1b8d--bug_bounty) -- Application Security Blog - - [Celebrating one year of Rapid Scan Static](https://www.synopsys.com/blogs/software-security/rapid-scan-static-anniversary-highlights/) -- SentinelOne - - [Securing the Nation’s Critical Infrastructure | Action Plans to Defend Against Cyber Attacks](https://www.sentinelone.com/blog/securing-the-nations-critical-infrastructure-action-plans-to-defend-against-cyber-attacks/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Exposing an Indian Police Spyware Cyber Operation that Fabricated Evidence on the PCs of Indian Activists - An OSINT Enrichment Analysis](http://ddanchev.blogspot.com/2022/06/exposing-indian-police-spyware-cyber.html) - - [DDanchev is for Hire! - Who Wants to Hire Me in Europe?](http://ddanchev.blogspot.com/2022/06/ddanchev-is-for-hire-who-wants-to-hire.html) - - [Shots from the Wild West - Sample Compilation of RATs (Remote Access Tools) and Trojan Horses Screenshots - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/shots-from-wild-west-sample-compilation.html) - - [Shots from the Wild West - Random Cybercrime Ecosystem Screenshots 2021 - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/shots-from-wild-west-random-cybercrime.html) - - [Exclusive! - Exposing GRU's Unit 74455 "NotPetya" Malware Gang - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/exclusive-exposing-grus-unit-74455.html) -- PortSwigger Blog - - [PortSwigginar - 22 June](https://portswigger.net/blog/portswigginar-22-june) -- PortSwigger Blog - - [PortSwigginar - 22 June](https://portswigger.net/blog/portswigginar-22-june) -- KitPloit - PenTest & Hacking Tools - - [EmoCheck - Emotet Detection Tool For Windows OS](http://www.kitploit.com/2022/06/emocheck-emotet-detection-tool-for.html) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/vlpdrx/rreverseengineerings_weekly_questions_thread/) - - [Cutter 2.1.0 + Rizin 0.4.0: FLIRT signatures database out of the box, Yara plugin, base address autodetection, new intermediate language](https://www.reddit.com/r/ReverseEngineering/comments/vlvmrb/cutter_210_rizin_040_flirt_signatures_database/) - - [TheMatrix - A process inspection tool aimed at easier the malware analysis task](https://www.reddit.com/r/ReverseEngineering/comments/vls1yz/thematrix_a_process_inspection_tool_aimed_at/) - - [A Deep dive into (implicit) Thread Local Storage](https://www.reddit.com/r/ReverseEngineering/comments/vlu4st/a_deep_dive_into_implicit_thread_local_storage/) -- Exploit-DB.com RSS Feed - - [[webapps] Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/50971) - - [[webapps] WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/50970) - - [[webapps] WordPress Plugin Weblizar 8.9 - Backdoor](https://www.exploit-db.com/exploits/50969) -- Intigriti - - [New EU law is changing the game for digital goods producers](https://blog.intigriti.com/2022/06/27/new-eu-law-changing-game-digital-goods-producers/) - - [4 ways Intigriti empowers it’s security researcher community to thrive](https://blog.intigriti.com/2022/06/27/4-ways-intigriti-empowers-security-researcher-community-thrive/) -- The Daily Swig | Cybersecurity news and views - - [Researchers crack MEGA’s ‘privacy by design’ storage, encryption](https://portswigger.net/daily-swig/researchers-crack-megas-privacy-by-design-storage-encryption) - - [Untrusted types: Researcher demos trick to beat Trusted Types protection in Google Chrome](https://portswigger.net/daily-swig/untrusted-types-researcher-demos-trick-to-beat-trusted-types-protection-in-google-chrome) - - [Oracle patches ‘miracle exploit’ impacting Middleware Fusion, cloud services](https://portswigger.net/daily-swig/oracle-patches-miracle-exploit-impacting-middleware-fusion-cloud-services) -- text/plain - - [End of Q2 Check-in](https://textslashplain.com/2022/06/27/end-of-q2-check-in/) -- Mozilla Hacks – the Web developer blog - - [The JavaScript Specification has a New License](https://hacks.mozilla.org/2022/06/the-specification-for-javascript-has-a-new-license/) -- daniel.haxx.se - - [curl 7.84.0 inside every box](https://daniel.haxx.se/blog/2022/06/27/curl-7-84-0-inside-every-box/) -- 奇客Solidot–传递最新科技情报 - - [极端天气侵袭中国](https://www.solidot.org/story?sid=71953) - - [美国情报体系在人工智能方面的力量和陷阱](https://www.solidot.org/story?sid=71952) - - [人工光合作用可在没有阳光的情况下生产食物](https://www.solidot.org/story?sid=71951) - - [通过探索虚拟世界人工智能以新的方式学习](https://www.solidot.org/story?sid=71950) - - [卫星以更快速度落向地球，科学家认为太阳风是“罪魁祸首”](https://www.solidot.org/story?sid=71949) - - [健康码的遗产](https://www.solidot.org/story?sid=71948) - - [今天的程序太臃肿了](https://www.solidot.org/story?sid=71947) - - [辉瑞奥密克戎改良疫苗产生更强免疫应答](https://www.solidot.org/story?sid=71946) - - [1 亿美元加密货币被盗](https://www.solidot.org/story?sid=71945) -- IT Service Management News - - [Vietare Google Analytics](http://blog.cesaregallotti.it/2022/06/vietare-google-analytics.html) - - [Mancanza di esperti di sicurezza (cyber)](http://blog.cesaregallotti.it/2022/06/mancanza-di-esperti-di-sicurezza-cyber.html) - - [Minacce e attacchi: operazione "Finestra sul cortile"](http://blog.cesaregallotti.it/2022/06/minacce-e-attacchi-operazione-finestra.html) -- ICT Security Magazine - - [Blockchain: Permissionless vs Permissioned](https://www.ictsecuritymagazine.com/articoli/blockchain-permissionless-vs-permissioned/) -- Ricerca Security - - [DEF CON CTF Quals 2022: constricted](https://ricercasecurity.blogspot.com/2022/06/def-con-ctf-quals-2022-constricted.html) -- Daniel Miessler - - [News & Analysis | NO. 337](https://danielmiessler.com/podcast/news-analysis-no-337/) -- Security Art Work - - [Blockchain to secure healthcare environments](https://www.securityartwork.es/2022/06/27/blockchain-to-secure-healthcare-environments/) -- Schneier on Security - - [2022 Workshop on Economics and Information Security (WEIS)](https://www.schneier.com/blog/archives/2022/06/2022-workshop-on-economics-and-information-security-weis.html) -- KitPloit - PenTest Tools! - - [EmoCheck - Emotet Detection Tool For Windows OS](http://www.kitploit.com/2022/06/emocheck-emotet-detection-tool-for.html) -- 情报分析师 - - [【重磅资料】《印度国家手册》345页](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507572&idx=1&sn=781a128d9a359a8c3c0a601fe0bbe29b&chksm=8716a77fb0612e6945b6def676dfe3fedaf8f8d382264ac5fd37c8c7f824cbe2293f4cdd35ca&scene=58&subscene=0#rd) - - [【情报课堂】开源情报（osint)理论及其使用方法](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507572&idx=2&sn=1d2ab43b15f45aa96202aaaf7c6ddda1&chksm=8716a77fb0612e6940f66b722c43d02c30352e5282b5e1cd984c169e1028fcd9ed486dcea37f&scene=58&subscene=0#rd) - - [【情报预测】美国海军的未来规划](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507572&idx=3&sn=5650040ca4a64a91def99ec8470b3b1e&chksm=8716a77fb0612e692fc32464ecee3110ce6aad36eab6ba6b6aa090f32fb177e33ffa67a21ded&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [山安院第二届CTF夏令营活动开始报名](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494305&idx=1&sn=98852c94dfca075ae8e8e7d63797cdc0&chksm=fa523f1fcd25b609cf2947271c2e98cbfa75ebc5ceefeb1626585ac6d6b47f7cfd75a24a58ff&scene=58&subscene=0#rd) -- SANS Internet Storm Center, InfoCON: green - - [Encrypted Client Hello: Anybody Using it Yet?, (Mon, Jun 27th)](https://isc.sans.edu/diary/rss/28792) - - [ISC Stormcast For Monday, June 27th, 2022 https://isc.sans.edu/podcastdetail.html?id=8064, (Mon, Jun 27th)](https://isc.sans.edu/diary/rss/28790) -- Instapaper: Unread - - [Google TAG argues that Italian surveillance firm RCS Labs was helped by ISPs to infect mobile users](https://securityaffairs.co/wordpress/132553/malware/rcs-labs-spyware-spreads.html) - - [Mikko Hypponen. La tecnologia non è neutrale](https://channels.theinnovationgroup.it/cybersecurity/mikko-hypponen-tecnologia-non-neutrale/) -- 深信服千里目安全实验室 - - [用安全模式对抗安全软件，RedEpsilon勒索病毒攻击手段升级](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262106&idx=1&sn=eac5d8ff4a4a3313ea8bc3708683a42a&chksm=f3e2702ec495f9383022b63941ba04b600e7694a3febfe056ef5119fa9b64e7cd38b9d0ddd4c&scene=58&subscene=0#rd) -- TorrentFreak - - [Supreme Court: File-Sharing Platform Must Block Search Terms to Stop Piracy](https://torrentfreak.com/supreme-court-file-sharing-platform-must-block-search-terms-to-stop-piracy-220627/) - - [Megaupload Pair Convicted: The Specific Crimes They Admitted in Detail](https://torrentfreak.com/megaupload-pair-convicted-the-specific-crimes-they-admitted-in-detail-220627/) -- 永安在线情报平台 - - [永安在线入选中国信通院“业务安全推进计划”首批成员单位](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493664&idx=1&sn=fbb293ad8d17bdd3151f2164b9ebdb03&chksm=eb12ce1bdc65470d326e5a1e19f267c26085c24c221f6bcc6ef7e38bfc316d6335e3a6cd4554&scene=58&subscene=0#rd) -- 代码卫士 - - [勒索团伙利用 Mitel VoIP 0day 发动攻击](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512575&idx=1&sn=831b8a4cf06da94d6f5012a897e71f84&chksm=ea948095dde3098340317267be4e92ba692ad9ab877266c163231767f839c7ce62ea51baeaf7&scene=58&subscene=0#rd) - - [PyPI 仓库中的恶意Python包将被盗AWS密钥发送至不安全的站点](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512575&idx=2&sn=5af81a53d9263bf10273d86868a77287&chksm=ea948095dde309830949a85914d18a896ce49535f37a9c0cf802e2d84d4dbf264c0e5795396b&scene=58&subscene=0#rd) -- Securityinfo.it - - [APT cinese usa il ransomware per coprire lo spionaggio](https://www.securityinfo.it/2022/06/27/apt-cinese-usa-il-ransomware-per-coprire-lo-spionaggio/?utm_source=rss&utm_medium=rss&utm_campaign=apt-cinese-usa-il-ransomware-per-coprire-lo-spionaggio) - - [Phishing supera l’2FA con app Microsoft WebView2](https://www.securityinfo.it/2022/06/27/phishing-supera-l2fa-con-app-microsoft-webview2/?utm_source=rss&utm_medium=rss&utm_campaign=phishing-supera-l2fa-con-app-microsoft-webview2) - - [Cybersecurity Skilling: training Microsoft per la sicurezza](https://www.securityinfo.it/2022/06/27/cybersecurity-skilling-training-microsoft-per-la-sicurezza/?utm_source=rss&utm_medium=rss&utm_campaign=cybersecurity-skilling-training-microsoft-per-la-sicurezza) -- 绿盟科技研究通讯 - - [1+1>2?当云数据完整性审计遇到可搜索加密](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492445&idx=1&sn=0b49ff46a8f485e88661321908ad162f&chksm=e84c4582df3bcc94d98646badccfd4c6eb45ce85a2f075caefaacd23608d93de538fa2e23700&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】SA-CORE-2019-003：Drupal 远程命令执行分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773083&idx=1&sn=54c93c37622750cfef39e4ffcf0b5134&chksm=88936474bfe4ed62d436aa41b7313cfc3febe6251db8e5b87e36605e7cbc394e3605d4bc15da&scene=58&subscene=0#rd) - - [【安全头条】MetaMask要求“帮帮我们”实则帮帮黑客](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773083&idx=2&sn=abe82ff657fdde8426c08fd12ec8654d&chksm=88936474bfe4ed620b7c45f9c55159faf3c527d5036a6a3d8cd197749cc8fe779162adb54fae&scene=58&subscene=0#rd) -- 默安科技 - - [名列No.33！默安科技跻身2022中国网安产业竞争力50强](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492337&idx=1&sn=d89edf5a3b67542aaef15191444b1cdd&chksm=e93b15d3de4c9cc533785e42387f480717e6212912195d252cfcbda7f02f8ac13064f62b6aeb&scene=58&subscene=0#rd) -- Il Disinformatico - - [Google Analytics, stop anche dal Garante italiano: quanti siti non sono in regola?](http://attivissimo.blogspot.com/2022/06/google-analytics-stop-anche-dal-garante.html) -- Computer Forensics - - [Velociraptor](https://www.reddit.com/r/computerforensics/comments/vm73v8/velociraptor/) - - [Open source tools and DFIR Tryhackme equivalents](https://www.reddit.com/r/computerforensics/comments/vm0i74/open_source_tools_and_dfir_tryhackme_equivalents/) - - [Browser Add-on to screenshot a whole page.](https://www.reddit.com/r/computerforensics/comments/vlivdg/browser_addon_to_screenshot_a_whole_page/) -- 看雪学院 - - [记一次安全产品的漏洞挖掘](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458455526&idx=1&sn=f42801fd98759f7224a3052d45b4cb25&chksm=b18e3d6c86f9b47a27170075f62d9833009f5714725c22fd190ecfd2231efed75f70c04055b2&scene=58&subscene=0#rd) - - [热搜第一！QQ大批账号被盗、发送不雅图片](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458455526&idx=2&sn=3335a4f86f1743184b254418bd4e7a2e&chksm=b18e3d6c86f9b47a95252433db17f1fcaf4801a4daab90b4294beaabc613517330db3131247e&scene=58&subscene=0#rd) - - [【9折预售中】CTF训练营-Web篇，全方位立体化学习！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458455526&idx=3&sn=f63a5dc3b5cc670caf49838ff60cafe6&chksm=b18e3d6c86f9b47ab05f7a4f64090a36eb5fbfa66fe68a391bb3d71a58e7772827075b1be668&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Survey about Cyber Security/Hacking Lab Platforms](https://www.reddit.com/r/netsecstudents/comments/vlskni/survey_about_cyber_securityhacking_lab_platforms/) -- 安恒信息安全研究院 - - [警惕！黑帽SEO投毒，搜索引擎成为帮凶](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247488848&idx=1&sn=6ff72ac2d25cabc494fd5f29ad628dc2&chksm=f9ee79efce99f0f9959c0c56735754dd4f81bcef8134adb5277bc417a61148d16882709147eb&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [GPU算力加速扫描，火绒安全产品再升级](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247505195&idx=1&sn=aff0d0d66cd053c6ff2fb717f9d9bdb2&chksm=eb700b14dc078202352c9e9559ff80be67add0177557ad193f13765398453c0b1941c5b748f5&scene=58&subscene=0#rd) -- Security Affairs - - [The government of Lithuania confirmed it had been hit by an intense cyberattack](https://securityaffairs.co/wordpress/132676/cyber-warfare-2/lithuania-massive-ddos.html) - - [New Matanbuchus Campaign drops Cobalt Strike beacons](https://securityaffairs.co/wordpress/132665/malware/matanbuchus-loader.html) - - [Cyberattack halted the production at the Iranian state-owned Khuzestan Steel company](https://securityaffairs.co/wordpress/132658/cyber-warfare-2/iran-khuzestan-steel-company-cyberattack.html) - - [Ukrainian telecommunications operators hit by DarkCrystal RAT malware](https://securityaffairs.co/wordpress/132651/malware/cert-ua-darkcrystal-rat-attacks.html) - - [Threat actors stole $100M in crypto assets from Harmony](https://securityaffairs.co/wordpress/132642/hacking/harmony-crypto-assets.html) -- Posts By SpecterOps Team Members - Medium - - [Understanding the Function Call Stack](https://posts.specterops.io/understanding-the-function-call-stack-f08b5341efa4?source=rss----f05f8696e3cc---4) -- Graham Cluley - - [Drunk worker loses USB stick containing details of every resident of his city](https://www.bitdefender.com/blog/hotforsecurity/drunk-worker-loses-usb-stick-containing-details-of-every-resident-of-his-city/) -- 腾讯玄武实验室 - - [每日安全动态推送(06-27)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958542&idx=1&sn=9d83930cf02801e181dda7b996d35765&chksm=8baecd91bcd94487590ea652baa7e3e5aa435286f760cdd6a92050b6b595733e2896b95bb4d6&scene=58&subscene=0#rd) -- 复旦白泽战队 - - [前程似锦 | 恭喜系统软件与安全实验室7位同学顺利毕业！](https://mp.weixin.qq.com/s?__biz=MzU4NzUxOTI0OQ==&mid=2247485660&idx=1&sn=4c9ab9ad636799c7b6322e7f2eb95df1&chksm=fdeb8ca2ca9c05b4a05ad91a03ea3d176a51f7a94506dbd24314ee8484940b07b5ed99275ce5&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [一个xray POC的编写全过程](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247489713&idx=1&sn=72f3c21c6e9381cdc42bb1643a8ba4a2&chksm=96f407dca1838eca7888f5511cbcd54504943e6a50a553ddf609272f89f0e7b47b29f6ccdf0d&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (06.20-06.26)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491105&idx=1&sn=740c314575f0de515918507a2d24e288&chksm=fe251b20c9529236e0e61c65c14a44716440a6e137896700ad1d4d358a88a774586d19401970&scene=58&subscene=0#rd) - - [安全日报（2022.06.27）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491105&idx=2&sn=a143defd1094dc71ff3adf39a4313bee&chksm=fe251b20c9529236804184fb81a14640978876712fa6f40a766a6bb04d60297a43e6667897f7&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220627期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527805&idx=1&sn=bbaf8d97321d4e76e0a53b4077cecb8e&chksm=c1e9e12cf69e683a5e36c9d9c6301a3c2aea6a316428c45a341652d8b63b125bfe4153108863&scene=58&subscene=0#rd) - - [公布 | 《中华人民共和国反电信网络诈骗法（草案二次审议稿）》全文](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527805&idx=2&sn=e44bcf28b1188c8d418787b4be363de8&chksm=c1e9e12cf69e683a4f6319853e8b77ae1ecfe87192a8b9fa79c9ec664fc171cc122cb52067f5&scene=58&subscene=0#rd) - - [CISA警告：黑客仍在利用 Log4Shell 漏洞](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247527805&idx=3&sn=c4f152021973ad99b59ac611538ec4a7&chksm=c1e9e12cf69e683a828fd642ac8c33042c141d24ba48da8975e83f4c00981cd7c81e192a415d&scene=58&subscene=0#rd) -- 火线Zone - - [K8s 之 ApiServer 组件风险](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495729&idx=1&sn=03e357ae02940f28c4d26270cc085c01&chksm=eaa97811dddef107113f26a7d324672c9cfb8d65754fd0fd59d8c24c83c20befedd611b71828&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [Revive: from spyware to Android banking trojan | Cleafy Labs](https://www.reddit.com/r/netsec/comments/vlvyhx/revive_from_spyware_to_android_banking_trojan/) - - [VaultBoot: remote attestation](https://www.reddit.com/r/netsec/comments/vltch9/vaultboot_remote_attestation/) - - [Notes on OpenSSL remote memory corruption](https://www.reddit.com/r/netsec/comments/vloirg/notes_on_openssl_remote_memory_corruption/) -- Your Hacking Tutorial by Zempirians - - [Awesome Hacker Search Engines](https://www.reddit.com/r/HowToHack/comments/vlrvba/awesome_hacker_search_engines/) - - [HTTP(S) covert comms software suggestions](https://www.reddit.com/r/HowToHack/comments/vm5zkt/https_covert_comms_software_suggestions/) - - [Hello all, I am trying to host an Ngrok server to make a website public, this website requess 2 access, one for the user to the server, and the other for the server to the user so they can communicate. When i type `./ngrok start --all` it only starts 2 servers on port 80 and 3000 but on https](https://www.reddit.com/r/HowToHack/comments/vlz0qy/hello_all_i_am_trying_to_host_an_ngrok_server_to/) - - [webcam phish for a phone?](https://www.reddit.com/r/HowToHack/comments/vlty43/webcam_phish_for_a_phone/) -- M01NTeam - - [攻击技术研判 | 针对流行web应用程序框架TelerikUI的利用攻击链](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247488547&idx=1&sn=26255346ae80a0c4b02e965be6610fdf&chksm=c187d432f6f05d2435f7c6ed237242fccbb5b939b535d7c42706dddf8c48ea77c8619f786f79&scene=58&subscene=0#rd) -- 安全牛 - - [超自动化与网络安全的未来](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115328&idx=1&sn=79ee1345705dd0e26f7c7e13c3a67e63&chksm=bd147f938a63f685531d82bd98d4f664ebc131959d6723d07d660d19e8cd374fd2b2bf8de9cb&scene=58&subscene=0#rd) - - [简析信息安全风险评估的方法与特点](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115328&idx=2&sn=9b70d482d1dd7128fe5b23980e03e7d5&chksm=bd147f938a63f685a7570466431147ea89497bc355a75aafa28378b0ad549dcf03e6f08a1758&scene=58&subscene=0#rd) - - [安全头条 | 网络安全审查办公室对知网启动网络安全审查；西北工业大学遭受境外网络攻击](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115328&idx=3&sn=41ad9ac97f4c01da02e3477f99bf4698&chksm=bd147f938a63f68541f950379ee7f421690339879782618bf582b8745ff6e4f05b06a662afc4&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [Conti vs. LockBit: A Comparative Analysis of Ransomware Groups](https://www.trendmicro.com/en_us/research/22/f/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.html) -- 字节跳动技术团队 - - [电影兑换券的推荐策略——二分图最优匹配算法](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495648&idx=1&sn=379b34e8e203f924e52c0feb65c1c1c5&chksm=e9d32402dea4ad1490b0172c4790c9ec04d792a5a0713a557b13270fec373bbd16b1c0c92590&scene=58&subscene=0#rd) -- Dark Reading - - [Federal, State Agencies' Aid Programs Face Synthetic Identity Fraud](https://www.darkreading.com/edge-articles/federal-state-agencies-aid-programs-face-synthetic-identity-fraud) - - [LockBit 3.0 Debuts With Ransomware Bug Bounty Program](https://www.darkreading.com/threat-intelligence/lockbit-3-debut-bug-bounty-program) - - [Shadow IT Spurs 1 in 3 Cyberattacks](https://www.darkreading.com/remote-workforce/shadow-it-spurs-1-in-3-cyberattacks) - - [Thrive Acquires DSM](https://www.darkreading.com/operations/thrive-acquires-dsm) - - [It's a Race to Secure the Software Supply Chain — Have You Already Stumbled?](https://www.darkreading.com/vulnerabilities-threats/it-s-a-race-to-secure-the-software-supply-chain-have-you-already-stumbled-) -- The Register - Security - - [OpenSSL 3.0.5 awaits release to fix potential worse-than-Heartbleed flaw](https://go.theregister.com/feed/www.theregister.com/2022/06/27/openssl_304_memory_corruption_bug/) - - [LGBTQ+ folks warned of dating app extortion scams](https://go.theregister.com/feed/www.theregister.com/2022/06/27/ftc-lgbtq-extortion/) - - [Contractor loses entire Japanese city's personal data in USB fail](https://go.theregister.com/feed/www.theregister.com/2022/06/27/security_in_brief/) - - [Beijing probes security at academic journal database](https://go.theregister.com/feed/www.theregister.com/2022/06/27/beijing_investigates_cnki_security/) - - [Singapore promises 'brutal and unrelentingly hard' action on dodgy crypto players](https://go.theregister.com/feed/www.theregister.com/2022/06/27/singapore_cbdc_crypto_policy/) diff --git a/archive/2022/2022-06-29.md b/archive/2022/2022-06-29.md deleted file mode 100644 index b37d05a4df..0000000000 --- a/archive/2022/2022-06-29.md +++ /dev/null @@ -1,337 +0,0 @@ -# 每日安全资讯（2022-06-29） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [WSO2 Management Console Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022060087) - - [Library Management System With QR Code 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022060086) - - [SEO Nethizmet Admin NoRedirect Bypass](https://cxsecurity.com/issue/WLB-2022060085) - - [Coffee Shop Cashiering System 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022060084) - - [Mailhog 1.0.1 Stored Cross-Site Scripting (XSS)](https://cxsecurity.com/issue/WLB-2022060083) - - [OpenCart v3.x So Filter Shop By - Blind SQL Injection](https://cxsecurity.com/issue/WLB-2022060082) - - [AnyDesk 7.0.9 Arbitrary File Write / Denial Of Service](https://cxsecurity.com/issue/WLB-2022060081) -- Files ≈ Packet Storm - - [American Fuzzy Lop plus plus 4.01c](https://packetstormsecurity.com/files/167615/AFLplusplus-4.01c.tar.gz) - - [Red Hat Security Advisory 2022-5214-01](https://packetstormsecurity.com/files/167614/RHSA-2022-5214-01.txt) - - [Red Hat Security Advisory 2022-5224-01](https://packetstormsecurity.com/files/167611/RHSA-2022-5224-01.txt) - - [No cON Name 2022 Barcelona Call For Papers](https://packetstormsecurity.com/files/167610/CFP_NcN_2022_EN.txt) - - [Red Hat Security Advisory 2022-5236-01](https://packetstormsecurity.com/files/167609/RHSA-2022-5236-01.txt) - - [AnyDesk 7.0.9 Arbitrary File Write / Denial Of Service](https://packetstormsecurity.com/files/167608/anydesk709-filewrite.txt) - - [Ubuntu Security Notice USN-5495-1](https://packetstormsecurity.com/files/167607/USN-5495-1.txt) - - [Red Hat Security Advisory 2022-5267-01](https://packetstormsecurity.com/files/167606/RHSA-2022-5267-01.txt) - - [OpenCart 3.x So Filter Shop By SQL Injection](https://packetstormsecurity.com/files/167605/opencart3sfsb-sql.txt) - - [Red Hat Security Advisory 2022-5235-01](https://packetstormsecurity.com/files/167604/RHSA-2022-5235-01.txt) - - [Zoo Management System 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/167603/zooms10stored-xss.txt) - - [Red Hat Security Advisory 2022-5201-01](https://packetstormsecurity.com/files/167602/RHSA-2022-5201-01.txt) - - [Red Hat Security Advisory 2022-5153-01](https://packetstormsecurity.com/files/167601/RHSA-2022-5153-01.txt) - - [MIMEDefang Email Scanner 3.0](https://packetstormsecurity.com/files/167612/mimedefang-3.0.tar.gz) -- 安全客-有思想的安全新媒体 - - [ellite sql注入](https://www.anquanke.com/post/id/275296) - - [PBot挖矿僵尸网络正利用新漏洞发起攻击](https://www.anquanke.com/post/id/275297) - - [CVE-2022-22954 VMware Workspace ONE Access SSTI RCE 漏洞分析](https://www.anquanke.com/post/id/275266) - - [汽车面料供应商TB Kawashima承认遭到网络攻击](https://www.anquanke.com/post/id/275307) -- Microsoft Security Blog - - [How security leaders can help their teams avoid burnout](https://www.microsoft.com/security/blog/2022/06/28/how-security-leaders-can-help-their-teams-avoid-burnout/) -- Sploitus.com Exploits RSS Feed - - [Zoo Management System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167603&utm_source=rss&utm_medium=rss) - - [AnyDesk 7.0.9 Arbitrary File Write / Denial Of Service exploit](https://sploitus.com/exploit?id=PACKETSTORM:167608&utm_source=rss&utm_medium=rss) - - [OpenCart 3.x So Filter Shop By SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167605&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-1903 exploit](https://sploitus.com/exploit?id=83A29417-3671-5CB5-A221-267128F60C73&utm_source=rss&utm_medium=rss) -- FreeBuf网络安全行业门户 - - [直播倒计时十天 ！CIS大会夏日版全议程公布](https://www.freebuf.com/fevents/337584.html) - - [FreeBuf早报 | Killnet攻击立陶宛政府网站；网络攻击使伊朗钢铁公司被迫停产](https://www.freebuf.com/articles/337554.html) - - [伊朗最大的钢铁生产商遭遇网络攻击](https://www.freebuf.com/news/337571.html) - - [《互联网用户账号信息管理规定》发布，8月1日施行](https://www.freebuf.com/news/337559.html) - - [冒充BBVA银行2FA应用程序，Android恶意软件“Revive”的深度伪装](https://www.freebuf.com/news/337547.html) -- 跳跳糖 - 安全与分享社区 - - [DCSync 技术的攻击和检测](https://tttang.com/archive/1634/) -- ElcomSoft blog - - [Full File System and Keychain Acquisition: What, When, and How](https://blog.elcomsoft.com/2022/06/full-file-system-and-keychain-acquisition-what-when-and-how/) -- Blog & What's New | Offensive Security - - [How Pulsar Security Established their Continuous Cyber Workforce Development](https://www.offensive-security.com/offsec/case-study-continous-cyber-workforce-development/) -- Sucuri Blog - - [How to Find & Clean Up the AnonymousFox Hack](https://blog.sucuri.net/2022/06/how-to-find-clean-up-the-anonymousfox-hack.html) -- 奇安信攻防社区 - - [2022 - ACTF dropper & kcov](https://forum.butian.net/share/1726) -- code white | Blog - - [Bypassing .NET Serialization Binders](https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html) -- Security Boulevard - - [Man in the Middle Attacks: What are they anyway, and how to prevent them.](https://securityboulevard.com/2022/06/man-in-the-middle-attacks-what-are-they-anyway-and-how-to-prevent-them/) - - [American Cowboy Hat True Origins: The Mexican Sombrero](https://securityboulevard.com/2022/06/american-cowboy-hat-true-origins-the-mexican-sombrero/) - - [RSOCKS Takedown Means One Less Bulletproof Proxy Vendor](https://securityboulevard.com/2022/06/rsocks-takedown-means-one-less-bulletproof-proxy-vendor/) - - [SOC 2 Compliance: 6 Steps to a Perfect Audit with Trustero](https://securityboulevard.com/2022/06/soc-2-compliance-6-steps-to-a-perfect-audit-with-trustero/) - - [Privacy in the Metaverse](https://securityboulevard.com/2022/06/privacy-in-the-metaverse/) - - [Phishing Scams Are on The Rise, Here’s How to Protect Your Business](https://securityboulevard.com/2022/06/phishing-scams-are-on-the-rise-heres-how-to-protect-your-business/) - - [USENIX Enigma 2022 – Kurt Thomas’ ‘Rethinking “Security” In An Era Of Online Hate And Harassment’](https://securityboulevard.com/2022/06/usenix-enigma-2022-kurt-thomas-rethinking-security-in-an-era-of-online-hate-and-harassment/) - - [Detection, Isolation, and Negotiation: Improving Your Ransomware Preparedness and Response](https://securityboulevard.com/2022/06/detection-isolation-and-negotiation-improving-your-ransomware-preparedness-and-response/) - - [Cerby Emerges From Stealth to Transform Application Security](https://securityboulevard.com/2022/06/cerby-emerges-from-stealth-to-transform-application-security/) - - [The Link Between AWM Proxy & the Glupteba Botnet](https://securityboulevard.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/) -- Didier Stevens - - [Update: cut-bytes.py Version 0.0.15](https://blog.didierstevens.com/2022/06/28/update-cut-bytes-py-version-0-0-15/) -- Trail of Bits Blog - - [The Trail of Bits Hiring Process](https://blog.trailofbits.com/2022/06/28/the-trail-of-bits-hiring-process/) -- blog.avast.com EN - - [Kids are forming hacking groups online. Here's what to do about it.](https://blog.avast.com/kids-discord-hacking-groups) - - [Malware-as-a-service is spreading among teens](https://blog.avast.com/discord-minors-ransomware) -- Malwarebytes Labs - - [City worker loses USB stick containing data on every resident after day of drinking](https://blog.malwarebytes.com/privacy-2/2022/06/city-worker-loses-usb-stick-containing-data-on-every-resident-after-day-of-drinking/) - - [LGBTQ+ community targeted by extortionists who threaten to publish nudes](https://blog.malwarebytes.com/social-engineering/2022/06/lgbtq-community-targeted-by-extortionists-who-threaten-to-publish-nudes/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Is Koobface Botnet's Master KrotReal Back in Business? Try the Adult Entertainment Industry First!](http://ddanchev.blogspot.com/2022/06/is-koobface-botnets-master-krotreal.html) - - [A Compilation of Known Conti Ransomware Malicious Domains - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/a-compilation-of-known-conti-ransomware_4.html) - - [A Compilation of Known Conti Ransomware Gang Malicious Executable Download Locations - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/a-compilation-of-known-conti-ransomware_21.html) -- Hacking and security - - [METASPLOIT CHEATSHEET](https://hackingandsecurity.blogspot.com/2022/06/metasploit-cheatsheet.html) - - [Decebal catre popor](https://hackingandsecurity.blogspot.com/2022/06/decebal-catre-popor.html) - - [OSCP PWK privilege escalation commands](https://hackingandsecurity.blogspot.com/2022/06/oscp-pwk-privilege-escalation-commands.html) - - [Daily useful CISCO commands](https://hackingandsecurity.blogspot.com/2022/06/daily-useful-cisco-commands.html) - - [Why MOST cybersecurity training doesn't work!](https://hackingandsecurity.blogspot.com/2022/06/why-most-cybersecurity-training-doesnt.html) - - [How to Turn Social Media into a business?](https://hackingandsecurity.blogspot.com/2022/06/how-to-turn-social-media-into-business.html) - - [Richest man in Babylon](https://hackingandsecurity.blogspot.com/2022/06/richest-man-in-babylon.html) - - [Sysinternals Malware Analysis notes](https://hackingandsecurity.blogspot.com/2022/06/sysinternals-malware-analysis-notes.html) - - [How to know your stuff in Info Sec and IT](https://hackingandsecurity.blogspot.com/2022/06/how-to-know-your-stuff-in-info-sec-and.html) - - [Scanning for spyware - Steps](https://hackingandsecurity.blogspot.com/2022/06/scanning-for-spyware-steps.html) - - [Social Engineering Tutorial](https://hackingandsecurity.blogspot.com/2022/06/social-engineering-tutorial.html) - - [Old Mad Hacking Skills](https://hackingandsecurity.blogspot.com/2022/06/old-mad-hacking-skills.html) - - [Pentesting notes](https://hackingandsecurity.blogspot.com/2022/06/pentesting-notes.html) - - [More OSCP commands](https://hackingandsecurity.blogspot.com/2022/06/more-oscp-commands.html) - - [Jokes Part 3](https://hackingandsecurity.blogspot.com/2022/06/jokes-part-3.html) - - [A bit of history](https://hackingandsecurity.blogspot.com/2022/06/a-bit-of-history.html) - - [Ganduri alese](https://hackingandsecurity.blogspot.com/2022/06/ganduri-alese.html) - - [Become the greatest computer technician - EVER](https://hackingandsecurity.blogspot.com/2022/06/become-greatest-computer-technician-ever.html) - - [Google hacking list part II](https://hackingandsecurity.blogspot.com/2022/06/google-hacking-list-part-ii.html) - - [Google hacking master list](https://hackingandsecurity.blogspot.com/2022/06/google-hacking-master-list.html) - - [Glume proaste dar hazlii](https://hackingandsecurity.blogspot.com/2022/06/glume-proaste-dar-hazlii.html) - - [Funny stupid jokes - part II](https://hackingandsecurity.blogspot.com/2022/06/funny-stupid-jokes-part-ii.html) - - [Funny stupid jokes](https://hackingandsecurity.blogspot.com/2022/06/funny-stupid-jokes.html) - - [From A to B - pickup lines](https://hackingandsecurity.blogspot.com/2022/06/from-to-b-pickup-lines.html) - - [Cold Calling](https://hackingandsecurity.blogspot.com/2022/06/cold-calling.html) -- Reverse Engineering - - [X-ray reverse-engineering a hybrid module from 1960s Apollo test equipment](https://www.reddit.com/r/ReverseEngineering/comments/vmxft0/xray_reverseengineering_a_hybrid_module_from/) -- Microsoft Security Response Center - - [Service Fabric Privilege Escalation from Containerized Workloads on Linux](https://msrc-blog.microsoft.com/2022/06/28/azure-service-fabric-privilege-escalation-from-containerized-workloads-on-linux/) -- The Daily Swig | Cybersecurity news and views - - [Dozens of cryptography libraries vulnerable to private key theft](https://portswigger.net/daily-swig/dozens-of-cryptography-libraries-vulnerable-to-private-key-theft) - - [Ready meal distributor Apetito restores ‘limited’ deliveries in UK following cyber-attack](https://portswigger.net/daily-swig/ready-meal-distributor-apetito-restores-limited-deliveries-in-uk-following-cyber-attack) - - [Ransomware market evolution results in fewer variants, but rise in off-the-shelf cybercrime kits continues](https://portswigger.net/daily-swig/ransomware-market-evolution-results-in-fewer-variants-but-rise-in-off-the-shelf-cybercrime-kits-continues) -- daniel.haxx.se - - [Oops, I spilled the beans](https://daniel.haxx.se/blog/2022/06/28/oops-i-spilled-the-beans/) -- Sucuri Blog - - [How to Find & Clean Up the AnonymousFox Hack](https://blog.sucuri.net/2022/06/how-to-find-clean-up-the-anonymousfox-hack.html) -- SpiderLabs Blog from Trustwave - - [Interactive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-mark-ii-messenger-chatbot-leveraged-in-a-new-facebook-themed-spam/) -- KitPloit - PenTest & Hacking Tools - - [secureCodeBox (SCB) - Continuous Secure Delivery Out Of The Box](http://www.kitploit.com/2022/06/securecodebox-scb-continuous-secure.html) -- code white | Blog - - [Bypassing .NET Serialization Binders](https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html) -- rtl-sdr.com - - [ESAR – Extraordinarily Simple AIS Receiver written in C](https://www.rtl-sdr.com/esar-extraordinarily-simple-ais-receiver-written-in-c/) -- 黑海洋 - WIKI - - [细说闲鱼引流社群玩法、及注意事项「文末附引流思维导图」](https://blog.upx8.com/2841) - - [开源商用远程工具 HopToDesk v1.2.2.0 中文免费版](https://blog.upx8.com/2839) - - [Android 任务助手_v2.4.5 某宝、东618活动](https://blog.upx8.com/2838) - - [WinFR (数据恢复工具) v1.0.2 界面版](https://blog.upx8.com/2837) - - [OpenWrt 固件和在线定制](https://blog.upx8.com/2835) - - [小程序源码反编译实战笔记](https://blog.upx8.com/2832) - - [极速申请 - 快速创建微信小程序](https://blog.upx8.com/2831) - - [【go库】钉钉机器人](https://blog.upx8.com/2830) -- Secureworks Blog - - [Security Vulnerability Remediation: To Patch or Not to Patch?](https://www.secureworks.com/blog/security-vulnerability-remediation-to-patch-or-not) -- 奇客Solidot–传递最新科技情报 - - [立陶宛网络遭大规模 DDoS 攻击](https://www.solidot.org/story?sid=71966) - - [Linux 支持 Rust 的下一步计划](https://www.solidot.org/story?sid=71965) - - [腾讯最大股东计划减持股份](https://www.solidot.org/story?sid=71964) - - [微软解决导致 Edge 停止响应的 bug](https://www.solidot.org/story?sid=71963) - - [网信办发布《互联网用户账号信息管理规定》](https://www.solidot.org/story?sid=71962) - - [量子纠错](https://www.solidot.org/story?sid=71961) - - [测量人工智能的碳足迹](https://www.solidot.org/story?sid=71960) - - [通过在塑料上“搭便车”病毒可在淡水中存活](https://www.solidot.org/story?sid=71959) - - [为何通胀保持在疫情前的正常水平之上](https://www.solidot.org/story?sid=71958) - - [AMD 公开 FidelityFX Super Resolution 2.0 源代码](https://www.solidot.org/story?sid=71957) -- Christophe Tafani-Dereeper - - [MITM at the Edge: Abusing Cloudflare Workers](https://blog.christophetd.fr/abusing-cloudflare-workers/) -- IntelTechniques Blog - - [UNREDACTED Magazine Issue 003](https://inteltechniques.com/blog/2022/06/28/unredacted-magazine-issue-003/) -- IT Service Management News - - [PEC e REM](http://blog.cesaregallotti.it/2022/06/pec-e-rem.html) -- LuxSci - - [Collecting Patient-Reported Outcomes](https://luxsci.com/blog/collecting-patient-reported-outcomes.html) -- Securityinfo.it - - [Attacchi DDoS russi contro la Lituania](https://www.securityinfo.it/2022/06/28/attacchi-ddos-russi-contro-la-lituania/?utm_source=rss&utm_medium=rss&utm_campaign=attacchi-ddos-russi-contro-la-lituania) - - [Dal NIST linee guida per la sicurezza di mcOS per le aziende](https://www.securityinfo.it/2022/06/28/dal-nist-linee-guida-per-la-sicurezza-di-mcos-per-le-aziende/?utm_source=rss&utm_medium=rss&utm_campaign=dal-nist-linee-guida-per-la-sicurezza-di-mcos-per-le-aziende) -- Diritto dell'Informatica - - [Vietato Google Analytics: Soluzioni alternative](https://www.dirittodellinformatica.it/privacy-e-sicurezza/provvedimento-garante/vietato-google-analytics-soluzioni-alternative.html) -- Chaos Computer Club - last 100 events feed - - [Wie kommt Linux auf meinen Boot-Stick? (petitfoo)](https://cdn.media.ccc.de/contributors/essen/petitfoo/h264-hd/petitfoo-60-deu-Wie_kommt_Linux_auf_meinen_Boot-Stick_hd.mp4) - - [Recording-Setup (petitfoo)](https://cdn.media.ccc.de/contributors/essen/petitfoo/h264-hd/petitfoo-59-deu-Recording-Setup_hd.mp4) -- Daniel Miessler - - [The Cybersecurity Skills Gap is Another Instance of Late-stage Capitalism](https://danielmiessler.com/blog/the-cybersecurity-skills-gap-is-another-instance-of-late-stage-capitalism/) -- Hacking and security - - [METASPLOIT CHEATSHEET](https://hackingandsecurity.blogspot.com/2022/06/metasploit-cheatsheet.html) - - [Decebal catre popor](https://hackingandsecurity.blogspot.com/2022/06/decebal-catre-popor.html) - - [OSCP PWK privilege escalation commands](https://hackingandsecurity.blogspot.com/2022/06/oscp-pwk-privilege-escalation-commands.html) - - [Daily useful CISCO commands](https://hackingandsecurity.blogspot.com/2022/06/daily-useful-cisco-commands.html) - - [Why MOST cybersecurity training doesn't work!](https://hackingandsecurity.blogspot.com/2022/06/why-most-cybersecurity-training-doesnt.html) - - [How to Turn Social Media into a business?](https://hackingandsecurity.blogspot.com/2022/06/how-to-turn-social-media-into-business.html) - - [Richest man in Babylon](https://hackingandsecurity.blogspot.com/2022/06/richest-man-in-babylon.html) - - [Sysinternals Malware Analysis notes](https://hackingandsecurity.blogspot.com/2022/06/sysinternals-malware-analysis-notes.html) - - [How to know your stuff in Info Sec and IT](https://hackingandsecurity.blogspot.com/2022/06/how-to-know-your-stuff-in-info-sec-and.html) - - [Scanning for spyware - Steps](https://hackingandsecurity.blogspot.com/2022/06/scanning-for-spyware-steps.html) - - [Social Engineering Tutorial](https://hackingandsecurity.blogspot.com/2022/06/social-engineering-tutorial.html) - - [Old Mad Hacking Skills](https://hackingandsecurity.blogspot.com/2022/06/old-mad-hacking-skills.html) - - [Pentesting notes](https://hackingandsecurity.blogspot.com/2022/06/pentesting-notes.html) - - [More OSCP commands](https://hackingandsecurity.blogspot.com/2022/06/more-oscp-commands.html) - - [Jokes Part 3](https://hackingandsecurity.blogspot.com/2022/06/jokes-part-3.html) - - [A bit of history](https://hackingandsecurity.blogspot.com/2022/06/a-bit-of-history.html) - - [Ganduri alese](https://hackingandsecurity.blogspot.com/2022/06/ganduri-alese.html) - - [Become the greatest computer technician - EVER](https://hackingandsecurity.blogspot.com/2022/06/become-greatest-computer-technician-ever.html) - - [Google hacking list part II](https://hackingandsecurity.blogspot.com/2022/06/google-hacking-list-part-ii.html) - - [Google hacking master list](https://hackingandsecurity.blogspot.com/2022/06/google-hacking-master-list.html) - - [Glume proaste dar hazlii](https://hackingandsecurity.blogspot.com/2022/06/glume-proaste-dar-hazlii.html) - - [Funny stupid jokes - part II](https://hackingandsecurity.blogspot.com/2022/06/funny-stupid-jokes-part-ii.html) - - [Funny stupid jokes](https://hackingandsecurity.blogspot.com/2022/06/funny-stupid-jokes.html) - - [From A to B - pickup lines](https://hackingandsecurity.blogspot.com/2022/06/from-to-b-pickup-lines.html) - - [Cold Calling](https://hackingandsecurity.blogspot.com/2022/06/cold-calling.html) -- Posts By SpecterOps Team Members - Medium - - [The Phantom Credentials of SCCM: Why the NAA Won’t Die](https://posts.specterops.io/the-phantom-credentials-of-sccm-why-the-naa-wont-die-332ac7aa1ab9?source=rss----f05f8696e3cc---4) -- Schneier on Security - - [When Security Locks You Out of Everything](https://www.schneier.com/blog/archives/2022/06/__trashed-2.html) -- Instapaper: Unread - - [L'Italian Hackers' Embassy a MCH2022](https://www.tipiloschi.net/drupal/MCH2022-Italian-Hackers-Embassy) - - [Full File System and Keychain Acquisition What, When, and How](https://blog.elcomsoft.com/2022/06/full-file-system-and-keychain-acquisition-what-when-and-how/) - - [The strange business of cybercrime](https://www.csoonline.com/article/3663428/the-strange-business-of-cybercrime.html) - - [★ How to Temporarily Disable Face ID or Touch ID, and Require a Passcode to Unlock Your iPhone or iPad](https://daringfireball.net/2022/06/require_a_passcode_to_unlock_your_iphone) - - [The hacking industry faces the end of an era](https://www.technologyreview.com/2022/06/27/1054884/the-hacking-industry-faces-the-end-of-an-era/) - - [Offensive cyber defense, which are the legal aspects](https://www.cybersecitalia.it/offensive-cyber-defense-which-are-the-legal-aspects/19942/) -- Forensic Focus - - [Towards a Working Definition and Classification for Automation in Digital Forensics](https://www.forensicfocus.com/webinars/towards-a-working-definition-and-classification-for-automation-in-digital-forensics/) - - [Exploring Detego’s Multiple Deployment Options](https://www.forensicfocus.com/news/exploring-detegos-multiple-deployment-options/) -- Graham Cluley - - [Carnival Cruises bruised by $6.25 million fine after series of cyberattacks](https://www.bitdefender.com/blog/hotforsecurity/carnival-cruises-bruised-by-6-25-million-find-after-series-of-cyberattacks/) -- SANS Internet Storm Center, InfoCON: green - - [Possible Scans for HiByMusic Devices, (Tue, Jun 28th)](https://isc.sans.edu/diary/rss/28796) - - [ISC Stormcast For Tuesday, June 28th, 2022 https://isc.sans.edu/podcastdetail.html?id=8066, (Tue, Jun 28th)](https://isc.sans.edu/diary/rss/28794) -- TorrentFreak - - [Piracy Domains Seized By US Because Verisign & GoDaddy Are American](https://torrentfreak.com/piracy-domains-seized-by-us-because-verisign-godaddy-are-american-220628/) - - [Pirate Site Blocking Expands to Kenya with Landmark Court Order](https://torrentfreak.com/pirate-site-blocking-expands-to-kenya-with-landmark-court-order-220628/) -- Dark Reading - - [Facebook Business Pages Targeted via Chatbot in Data-Harvesting Campaign](https://www.darkreading.com/attacks-breaches/facebook-business-pages-chatbot-data-harvesting-campaign) - - [Google Analytics Continues to Lose SEO Visibility as Bans Continue](https://www.darkreading.com/analytics/google-analytics-seo-visibility-bans) - - ['Raccoon Stealer' Scurries Back on the Scene After Hiatus](https://www.darkreading.com/attacks-breaches/-raccoon-stealer-resurfaces-as-expected) - - [China-Backed APT Pwns Building-Automation Systems with ProxyLogon](https://www.darkreading.com/attacks-breaches/china-backed-apt-pwns-building-automation-proxylogon) - - [Atlassian Confluence Exploits Peak at 100K Daily](https://www.darkreading.com/attacks-breaches/atlassian-confluence-exploits-peak-100k-daily) - - [Can Zero-Knowledge Cryptography Solve Our Password Problems?](https://www.darkreading.com/emerging-tech/can-zero-knowledge-crypto-solve-our-password-problems-) - - [A WAF Is Not a Free Lunch: Teaching the Shift-Left Security Mindset](https://www.darkreading.com/vulnerabilities-threats/a-waf-is-not-a-free-lunch-teaching-the-shift-left-security-mindset) - - [Ransomware Volume Nearly Doubles 2021 Totals in a Single Quarter](https://www.darkreading.com/attacks-breaches/ransomware-volume-doubles-2021-totals-single-quarter) - - [How to Find New Attack Primitives in Microsoft Azure](https://www.darkreading.com/attacks-breaches/how-to-find-new-attack-primitives-in-microsoft-azure) - - [New Vulnerability Database Catalogs Cloud Security Issues](https://www.darkreading.com/cloud/new-initiative-seeks-to-shed-light-on-cloud-vulnerabilities) - - [NIST Finalizes macOS Security Guidance](https://www.darkreading.com/dr-tech/nist-finalizes-macos-security-guidance) -- KitPloit - PenTest Tools! - - [secureCodeBox (SCB) - Continuous Secure Delivery Out Of The Box](http://www.kitploit.com/2022/06/securecodebox-scb-continuous-secure.html) -- 字节跳动安全中心 - - [字节跳动、蔚来汽车、京东大咖分享数据安全最佳实践【京麒沙龙-数据安全专场】](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489042&idx=1&sn=0807a3f082657f71ab9afd8aa3c33051&chksm=fa9eed44cde964521bd674819a4f78a0fcb156689f409ce2ea7965e6a48495ab39ade8135517&scene=58&subscene=0#rd) - - [第五届小米IoT安全峰会，明天不见不散！](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489042&idx=2&sn=894e431db17782a41ab7cb2a3bd15c4c&chksm=fa9eed44cde9645297d95199aaccb4d5a7328f2ea919cadb03377fb8c1cd9bc40cb32f891d4b&scene=58&subscene=0#rd) -- Full Disclosure - - [Backdoor.Win32.InfecDoor.17.c / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Jun/48) - - [Trojan-Mailfinder.Win32.VB.p / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Jun/47) - - [Backdoor.Win32.Shark.btu / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Jun/46) - - [Yashma Ransomware Builder v1.2 / Insecure Permissions](https://seclists.org/fulldisclosure/2022/Jun/45) - - [AnyDesk Public Exploit Disclosure - Arbitrary file write by symbolic link attack lead to denial-of-service attack on local machine](https://seclists.org/fulldisclosure/2022/Jun/44) - - [SEC-T CFP ongoing](https://seclists.org/fulldisclosure/2022/Jun/43) - - [CFP No cON Name 2022 - Barcelona](https://seclists.org/fulldisclosure/2022/Jun/42) -- Your Hacking Tutorial by Zempirians - - [what is a good next step in hacking prerequisites now that I have passed my CCNA](https://www.reddit.com/r/HowToHack/comments/vn0e5i/what_is_a_good_next_step_in_hacking_prerequisites/) - - [Would a password cracking rig made of 4 3060s be viable for practicing on older hashes?](https://www.reddit.com/r/HowToHack/comments/vmlyxo/would_a_password_cracking_rig_made_of_4_3060s_be/) - - [Security measures? (Learning)](https://www.reddit.com/r/HowToHack/comments/vmoahp/security_measures_learning/) - - [Bypassing 403 Forbidden](https://www.reddit.com/r/HowToHack/comments/vmvobo/bypassing_403_forbidden/) - - [Hi guys i have question from you how some sites like keep2share can limit our download speed???there is any way that can Inactive it and download with normally speed???](https://www.reddit.com/r/HowToHack/comments/vmxa4d/hi_guys_i_have_question_from_you_how_some_sites/) - - [How hard is hacking these days?](https://www.reddit.com/r/HowToHack/comments/vmui2g/how_hard_is_hacking_these_days/) -- /r/netsec - Information Security News & Discussion - - [CVE-2022-30522 - Apache httpd "mod_sed" DoS vulnerability](https://www.reddit.com/r/netsec/comments/vmsn1v/cve202230522_apache_httpd_mod_sed_dos/) - - [Hive Ransomware Decrypter Tool - KISA](https://www.reddit.com/r/netsec/comments/vmta68/hive_ransomware_decrypter_tool_kisa/) - - [Zimbra unauthenticated RCE via unrar path traversal (CVE-2022-30333)](https://www.reddit.com/r/netsec/comments/vmy6ut/zimbra_unauthenticated_rce_via_unrar_path/) - - [Intune hacking: when is a "wipe" not a wipe](https://www.reddit.com/r/netsec/comments/vmhsfj/intune_hacking_when_is_a_wipe_not_a_wipe/) - - [Abusing Cloudflare Workers](https://www.reddit.com/r/netsec/comments/vmzxxq/abusing_cloudflare_workers/) -- 情报分析师 - - [【情报教程】信息收集和情报共享指南](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507970&idx=1&sn=5f2437d0b706388ea4fe949e8da08640&chksm=8716a489b0612d9ffb770dd2753fc064bb59cef64abff144de3aa8df46c5ecf6b7b25de9d019&scene=58&subscene=0#rd) - - [【情报技术】美国的5G时代——平衡大数据和隐私](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507970&idx=2&sn=d9ff9c06c4c1f20ed929a3355b9a1be8&chksm=8716a489b0612d9f8316fbe2dbd7296c1728f90e92882e702b6a1ecbbe86d35f7e81c7716b95&scene=58&subscene=0#rd) - - [【情报机构】印度IB和RAW](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650507970&idx=3&sn=a81642a4c24412d99852f0a4f781e95e&chksm=8716a489b0612d9f60f73b740595f8f711fb8a27de3728f3086dc21f957524d21adc11d42844&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | 关于影响API安全的四个关键因素](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493865&idx=1&sn=68228f2887435c0835a1141f65405edd&chksm=c0074575f770cc63da7ef7d5ab823ac730d4c55a36b3893dbd9631909e6ab8c8bb953486e637&scene=58&subscene=0#rd) -- Social Engineering - - [I Made a Robot That Punishes Me if it Detects That I am Procrastinating on My Assignments](https://www.reddit.com/r/SocialEngineering/comments/vme0bd/i_made_a_robot_that_punishes_me_if_it_detects/) - - [how to sidestep why questions without explaining and defending yourself?](https://www.reddit.com/r/SocialEngineering/comments/vmrvir/how_to_sidestep_why_questions_without_explaining/) -- Security Current - - [Congratulations to the 2022 C100 Winners](/congratulations-to-the-2022-c100-winners/) -- The Register - Security - - [Customized malware coded to target OT systems](https://go.theregister.com/feed/www.theregister.com/2022/06/28/customized_malware_coded_to_target/) - - [AMD targeted by RansomHouse, cybercrims claim to have '450Gb' in stolen data](https://go.theregister.com/feed/www.theregister.com/2022/06/28/amd-ransomhouse-data-extortion/) - - [Have you modelled the attack paths into your organization? Because an attacker already has](https://go.theregister.com/feed/www.theregister.com/2022/06/28/have_you_modelled_the_attack/) - - [Tencent admits to poisoned QR code attack on QQ chat platform](https://go.theregister.com/feed/www.theregister.com/2022/06/28/tencent_qq_qr_code_attack/) - - [Carnival Cruises torpedoed by US states, agrees to pay $6m after wave of cyberattacks](https://go.theregister.com/feed/www.theregister.com/2022/06/28/carnival-cybersecurity-fines/) - - [India extends deadline for compliance with infosec logging rules by 90 days](https://go.theregister.com/feed/www.theregister.com/2022/06/28/india_directions_deadline_logging/) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jun. 28th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495591&idx=1&sn=17fed3cc70cdde0ac86ec0b16f8d4626&chksm=ce96a299f9e12b8fbd99fc4f3f3e608e401daa524f692f0e4787f67aa315167eb7d66089f390&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [Log4Shell Vulnerability in VMware Leads to Data Exfiltration and Ransomware](https://www.trendmicro.com/en_us/research/22/g/log4shell-vulnerability-in-vmware-leads-to-data-exfiltration-and-ransomware.html) - - [Why It’s Time to Map the Digital Attack Surface](https://www.trendmicro.com/en_us/ciso/22/f/reduce-attack-surface-digital-mapping.html) -- 小米安全中心 - - [第五届小米IoT安全峰会，明天不见不散！](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247513720&idx=1&sn=ed82b7cf4e46b7354e474737c44fa9a4&chksm=ea8390edddf419fbbffa76884f0a7bf23d41e9464e192847b7bea23584cb525970763bd6be8b&scene=58&subscene=0#rd) -- 默安科技 - - [来，一起倾听这场来自数字世界的呼唤](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492343&idx=1&sn=e8bc2a2ebc7be99336d1697e5462f47c&chksm=e93b15d5de4c9cc39ed68ca179c49dc5c2656d7e0f710737924e0bab6fefe85fad66399cd883&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [密码学系列｜3.2 RSA公钥密码系统](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494340&idx=1&sn=bbe3a61dfee6fdaa96058fb8a7860121&chksm=fa523f7acd25b66c13751a4913172c45d173432bb495d5fc2b97387afa2e8178178b9a0852a3&scene=58&subscene=0#rd) -- 安全牛 - - [2022年上半年5大勒索软件攻击事件](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115356&idx=1&sn=df5d27398a55a5269d24674b3a62ee57&chksm=bd147f8f8a63f69928791effdbe934e9bf8bb64384f0eb3c307f69b707919c8d3127fd36efae&scene=58&subscene=0#rd) - - [快讯 | 长扬科技完成E+轮近亿元战略融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115356&idx=2&sn=caa6b00ce2b92a065b0f712cde9f0698&chksm=bd147f8f8a63f699b89cd46c5dfb043a0ef07307bad5d650b5942dc0a4f6ea97402bd865e58c&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（29期）：互联网大厂如何应对数据跨境合规风险（二）](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115356&idx=3&sn=81002c4f4a6c92dde45456fb57bf3908&chksm=bd147f8f8a63f699db54a749ef46fbab8243b56f8225fcd5f3d9717a45d47d4de9b326b90953&scene=58&subscene=0#rd) -- Security Affairs - - [NON-STATE ACTORS IN THE CYBERSPACE: AN ATTEMPT TO A TAXONOMIC CLASSIFICATION, ROLE, IMPACT AND RELATIONS WITH A STATE’S SOCIOECONOMIC STRUCTURE](https://securityaffairs.co/wordpress/132716/hacking/non-state-actors-cyberspace.html) - - [LockBit 3.0 introduces important novelties, including a bug bounty program](https://securityaffairs.co/wordpress/132701/cyber-crime/lockbit-3-0.html) - - [Latest OpenSSL version is affected by a remote memory corruption flaw](https://securityaffairs.co/wordpress/132697/security/openssl-remote-memory-corruption-flaw.html) - - [Two critical flaws affect CODESYS ICS Automation Software](https://securityaffairs.co/wordpress/132685/security/codesys-ics-automation-software-flaws.html) -- Krebs on Security - - [The Link Between AWM Proxy & the Glupteba Botnet](https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/) -- Computer Forensics - - [Forensic Tools for Browser Data](https://www.reddit.com/r/computerforensics/comments/vmzxre/forensic_tools_for_browser_data/) - - [Paladin Not Detecting Source Drive](https://www.reddit.com/r/computerforensics/comments/vmqt89/paladin_not_detecting_source_drive/) - - [BitLocker and Unallocated Space](https://www.reddit.com/r/computerforensics/comments/vmb32a/bitlocker_and_unallocated_space/) -- 互联网安全内参 - - [重磅！网络攻击迫使伊朗重要钢铁公司停产](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503863&idx=1&sn=bbe1a1cafea308c289f6cf38a04d2a53&chksm=ebfa88d7dc8d01c14842ecb07ba3d9b40279e6a1e30a0afd5f2ad6bd9acc5fcb03cc49ad0c66&scene=58&subscene=0#rd) - - [QQ出现大规模盗号！自动群发低俗不雅内容，官方致歉](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503863&idx=2&sn=b44dfd550aed86c61c10f83124a5f2d6&chksm=ebfa88d7dc8d01c1ae9e62b17e2bc06566af016a8f13a64efd9a07a99ae5ad921cf82d009602&scene=58&subscene=0#rd) - - [开放环境下大数据安全开发利用的挑战和思考](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503863&idx=4&sn=3f56d1dbd4ddf46ce41228f0a4cb4a1e&chksm=ebfa88d7dc8d01c1f291b332b740f6a402981ec59b2c0892aaf29d30896a6771ef260102c76e&scene=58&subscene=0#rd) -- 代码卫士 - - [HackerOne 谈如何保护软件供应链安全](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512594&idx=1&sn=25d37a6bafc5320878f4bb41d0921a37&chksm=ea948378dde30a6e78d91c406d8238b30eed292329de7f29c36ff88dee3bf9cb144a5576d365&scene=58&subscene=0#rd) - - [勒索团伙推出软件漏洞奖励计划，最高奖励100万美元](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512594&idx=2&sn=b9c3400e62e8c31053ef2557201bf736&chksm=ea948378dde30a6ecdb3fcf3bdce50a8c279dbae1432c233f9226ee3f1be8cf6b59dbe4dfd50&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [绿盟科技战略解决方案系列介绍--全流量威胁分析解决方案](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491838&idx=1&sn=de45dc6d2e30d06a586d67b5d0fb5dd5&chksm=eaac73b9dddbfaaf81ce8b4e41906059ca80c650847a8f4c09e0f87d35ecbb52ba2f66d294a0&scene=58&subscene=0#rd) -- NetSPI - - [Addressing Application Security Challenges in the SDLC](https://www.netspi.com/blog/executive/application-security/application-security-challenges-sdlc/) -- 长亭安全课堂 - - [跨链桥：Web3黑客必争之地](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247489741&idx=1&sn=c566b46e56599545b6c8cb50c99689ab&chksm=96f407a0a1838eb6bdf541ce85a4af8452665d484a5ee00abb383a524351d696fe527052534a&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-28)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958546&idx=1&sn=7d6a2cfcc58fe3558f1a1e6d2265e71d&chksm=8baecd8dbcd9449b7a2efc0b0b9c96df9770220c1f96b7bbb160e9f3f2e35032f379537437a5&scene=58&subscene=0#rd) -- 火线Zone - - [多云环境的风险发现](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495765&idx=1&sn=8bdce93a95c0ecae480c4379650e88e2&chksm=eaa97875dddef163a2eec76fbef285041b427201dd1f3f3266356516a6832e2e4e1a54bd5ae3&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】渗透测试实战-BlackMarket靶机入侵](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773167&idx=1&sn=293684f3706e660de888311cfa5055e6&chksm=88936400bfe4ed1616cf9889f32ab2ec54ce6dbc6d5c4b9e13eef9b5a8a56690eb546827c1ff&scene=58&subscene=0#rd) - - [【安全头条】汽车面料供应商TB Kawashima承认遭到网络攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773167&idx=2&sn=04f182e9b199429a967af7a551350b7b&chksm=88936400bfe4ed1692c0040966490d1fb55c3b08d96b14ae6276a407f70ca56d50d6ce612f56&scene=58&subscene=0#rd) -- Deeplinks - - [EFF to European Court: Keep Encryption Alive](https://www.eff.org/deeplinks/2022/06/eff-european-court-keep-encryption-alive) -- 安恒信息安全研究院 - - [警惕！国内已有5000余个网站中招！关于一种大规模的暗链劫持流量的风险提示](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247488950&idx=1&sn=5a353e6c25066ca15cdd1b9e9d7767ac&chksm=f9ee7909ce99f01f8da42b5c34fe6249ef8a02a59746e31508d1a283914239df72ec53886829&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Getting involved in CyberPatriot](https://www.reddit.com/r/netsecstudents/comments/vmsjm7/getting_involved_in_cyberpatriot/) -- 奇安信CERT - - [【已复现】Spring Cloud Function 拒绝服务漏洞(CVE-2022-22979)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496380&idx=1&sn=eca9992413b3c774e7e60c9c022a9e3e&chksm=fe79d624c90e5f32c8ea5ee773e5fc4c939f64804bef98e7395ab29b116be17a58bcd0e3e983&scene=58&subscene=0#rd) -- 安全学术圈 - - [在软件缺陷预测中使用软件可视化和迁移学习](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247487961&idx=1&sn=059844de22b77e58c3cdadef0f0b1fca&chksm=fe2eee52c95967443744b6b389dbb43cdfa70c2dd6959c9d83289658bc47b5cb4a1abdcfdeb7&scene=58&subscene=0#rd) -- 360Quake空间测绘 - - [巧用Quake发现代理（会员99元活动倒计时三天）](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247485811&idx=1&sn=cecbe8e4f465f83af4c2462fe3023d74&chksm=c37b8e98f40c078eee2fc8795ee7d6fd1a53b2ac493ccafd365991c8657b75481929d4ed1ef7&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [【顶刊论文分享】识别恶意bot](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492473&idx=1&sn=5b6d7f8e0136edbc2800bd5f6d9ec09d&chksm=e84c45a6df3bccb09f79a058a5072eeccfed93dfc4c1b9ea85b1c20c9b7492642d33cf8145fd&scene=58&subscene=0#rd) -- Threatpost - - [Top Six Security Bad Habits, and How to Break Them](https://threatpost.com/six-bad-habits-break/180082/) - - [Mitel VoIP Bug Exploited in Ransomware Attacks](https://threatpost.com/mitel-voip-bug-exploited/180079/) - - [‘Killnet’ Adversary Pummels Lithuania with DDoS Attacks Over Blockade](https://threatpost.com/killnet-pummels-lithuania/180075/) - - [Log4Shell Vulnerability Targeted in VMware Servers to Exfiltrate Data](https://threatpost.com/log4shell-targeted-vmware-data/180072/) -- 三六零CERT - - [安全日报（2022.06.28）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491108&idx=1&sn=08db8516c58e359dc6bc41d9074a59bc&chksm=fe251b25c952923303c52904622279ae7bc2005aeebce5d102634308b0fa7b9b96ca3e6b203e&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-06-30.md b/archive/2022/2022-06-30.md deleted file mode 100644 index 8bc2f635fd..0000000000 --- a/archive/2022/2022-06-30.md +++ /dev/null @@ -1,270 +0,0 @@ -# 每日安全资讯（2022-06-30） - -- Microsoft Security Blog - - [Microsoft at RSA 2022: Envisioning the future of security](https://www.microsoft.com/security/blog/2022/06/29/microsoft-at-rsa-2022-envisioning-the-future-of-security/) -- Files ≈ Packet Storm - - [Global Socket 1.4.36](https://packetstormsecurity.com/files/167626/gsocket-1.4.36.tar.gz) - - [Red Hat Security Advisory 2022-5232-01](https://packetstormsecurity.com/files/167625/RHSA-2022-5232-01.txt) - - [Red Hat Security Advisory 2022-5239-01](https://packetstormsecurity.com/files/167624/RHSA-2022-5239-01.txt) - - [Red Hat Security Advisory 2022-5344-01](https://packetstormsecurity.com/files/167623/RHSA-2022-5344-01.txt) - - [Red Hat Security Advisory 2022-5392-01](https://packetstormsecurity.com/files/167622/RHSA-2022-5392-01.txt) - - [Red Hat Security Advisory 2022-5234-01](https://packetstormsecurity.com/files/167621/RHSA-2022-5234-01.txt) - - [Red Hat Security Advisory 2022-5219-01](https://packetstormsecurity.com/files/167620/RHSA-2022-5219-01.txt) - - [Red Hat Security Advisory 2022-5216-01](https://packetstormsecurity.com/files/167619/RHSA-2022-5216-01.txt) - - [Red Hat Security Advisory 2022-5220-01](https://packetstormsecurity.com/files/167618/RHSA-2022-5220-01.txt) - - [Fruits-Bazar 2021 1.0 SQL Injection](https://packetstormsecurity.com/files/167617/fruitsbazar202110-sql.txt) - - [Laundry Management System 1.0 SQL Injection](https://packetstormsecurity.com/files/167616/lms10lf-sql.txt) -- Der Flounder - - [Session videos from MacDevOps YVR 2022 now available](https://derflounder.wordpress.com/2022/06/29/session-videos-from-macdevops-yvr-2022-now-available/) -- HackerOne Hacker Activity - - [XSS Payload on TikTok Seller Center endpoint](https://hackerone.com/reports/1554048) -- Blog & What's New | Offensive Security - - [Offensive Security Welcomes Cybersecurity Bills Signed into Law](https://www.offensive-security.com/offsec/offsec-welcomes-more-cybersecurity-bills/) -- 跳跳糖 - 安全与分享社区 - - [浅谈pyd文件逆向](https://tttang.com/archive/1641/) -- FreeBuf网络安全行业门户 - - [无限创新，无限机遇 ∞「网安新势力」收官放送](https://www.freebuf.com/fevents/337715.html) - - [FreeBuf早报 | 腾讯QQ惊现密码Bug；BOSS直聘等恢复新用户注册](https://www.freebuf.com/news/337708.html) - - [首发！「网安供应链厂商成分分析及国产化替代指南」报告要点解读·附全文下载](https://www.freebuf.com/articles/337663.html) - - [被盗450GB数据，AMD将对RansomHouse发起调查](https://www.freebuf.com/news/337630.html) - - [企业保护 API 安全迫在眉睫](https://www.freebuf.com/news/337634.html) - - [真实、有用的网安知识 | WIKI知识大陆2.0向你发出共建邀请](https://www.freebuf.com/news/337631.html) -- 绿盟科技技术博客 - - [1+1>2?当云数据完整性审计遇到可搜索加密](http://blog.nsfocus.net/112-cloud/) -- 安全客-有思想的安全新媒体 - - [天价美元损失案Harmony事件分析](https://www.anquanke.com/post/id/275387) - - [超低成本DDoS攻击来袭，看WAF如何绝地防护](https://www.anquanke.com/post/id/275397) - - [“验证器”（Validator）— 美国国家安全局NSA（APT—C—40）的木马尖兵](https://www.anquanke.com/post/id/275517) - - [安全事件周报 (06.20-06.26)](https://www.anquanke.com/post/id/275315) - - [LockBit 3.0推出首个勒索软件漏洞赏金计划](https://www.anquanke.com/post/id/275400) -- Sploitus.com Exploits RSS Feed - - [OpenCart 3.x So Filter Shop By SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37820&utm_source=rss&utm_medium=rss) - - [AnyDesk 7.0.9 Arbitrary File Write / Denial Of Service Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-37819&utm_source=rss&utm_medium=rss) - - [Fruits-Bazar 2021 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167617&utm_source=rss&utm_medium=rss) - - [Laundry Management System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167616&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Wptaskforce Wpcargo Track \& Trace exploit](https://sploitus.com/exploit?id=1FD58EFA-916A-59AC-9863-1ABD793DF745&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=34793974-B475-5BC4-BAAA-64FE57D0B3D9&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [3 key takeaways from our Consumer and Risk Report](https://securityboulevard.com/2022/06/3-key-takeaways-from-our-consumer-and-risk-report/) - - [Analytic Co-Pilot Security Use Cases](https://securityboulevard.com/2022/06/analytic-co-pilot-security-use-cases/) - - [How To Get An ISO27001 Certification](https://securityboulevard.com/2022/06/how-to-get-an-iso27001-certification/) - - [Discovering and Protecting APIs Anywhere](https://securityboulevard.com/2022/06/discovering-and-protecting-apis-anywhere/) - - [ProCircular Maximizes Security Operations with Flexible Low-Code Automation](https://securityboulevard.com/2022/06/procircular-maximizes-security-operations-with-flexible-low-code-automation/) - - [USENIX Enigma 2022 – Reza Shokri’s ‘Auditing Data Privacy For Machine Learning’](https://securityboulevard.com/2022/06/usenix-enigma-2022-reza-shokris-auditing-data-privacy-for-machine-learning/) - - [10 Major Database Security Threats and How to Prevent Them](https://securityboulevard.com/2022/06/10-major-database-security-threats-and-how-to-prevent-them/) - - [2022 IT Trends and Statistics](https://securityboulevard.com/2022/06/2022-it-trends-and-statistics/) - - [Joy Of Tech® ‘Superman’s Social Network Nightmare’](https://securityboulevard.com/2022/06/joy-of-tech-supermans-social-network-nightmare/) - - [American Business Desperate for Trains as Air Travel Falls Apart](https://securityboulevard.com/2022/06/american-business-desperate-for-trains-as-air-travel-falls-apart/) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Atlassian Confluence OGNL Injection Remote Code Execution (RCE) Vulnerability (CVE-2022-26134)](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Forcepoint - - [Things People Say About Security and Complexity](https://www.forcepoint.com/blog/x-labs/simplifying-complexity-in-security) -- Fox-IT International blog - - [Flubot: the evolution of a notorious Android Banking Malware](https://blog.fox-it.com/2022/06/29/flubot-the-evolution-of-a-notorious-android-banking-malware/) -- Bug Bounty in InfoSec Write-ups on Medium - - [OAuth Misconfiguration Leads To Pre-Account Takeover](https://infosecwriteups.com/oauth-misconfiguration-leads-to-pre-account-takeover-8f94c1ef50be?source=rss----7b722bfd1b8d--bug_bounty) - - [Text Based Injection | Content Spoofing on ISRO Website](https://infosecwriteups.com/text-based-injection-content-spoofing-96e9eb1615d8?source=rss----7b722bfd1b8d--bug_bounty) - - [HTML and Hyperlink Injection via Share Option In Microsoft Onenote Application](https://infosecwriteups.com/html-and-hyperlink-injection-via-share-option-in-microsoft-onenote-application-47e94d0e6478?source=rss----7b722bfd1b8d--bug_bounty) -- Malwarebytes Labs - - [Forced Chrome extensions get removed, keep reappearing](https://blog.malwarebytes.com/threat-analysis/2022/06/forced-chrome-extensions-keep-reappearing/) - - [Internet Safety Month: Everything you need to know about Omegle](https://blog.malwarebytes.com/personal/2022/06/internet-safety-month-everything-you-need-to-know-about-omegle/) - - [Hermit spyware is deployed with the help of a victim’s ISP](https://blog.malwarebytes.com/reports/2022/06/hermit-spyware-is-deployed-with-the-help-of-a-victims-isp/) -- Reverse Engineering - - [Obstacles in Dart decompilation and the impact on Flutter app security](https://www.reddit.com/r/ReverseEngineering/comments/vnfewk/obstacles_in_dart_decompilation_and_the_impact_on/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Seeking Cyber Security and Threat Intelligence Experts To Work On Collaborative Sharepoint and Microsoft Access Cyber Threat Actor Database! Approach Me Today!](http://ddanchev.blogspot.com/2022/06/seeking-cyber-security-and-threat.html) -- RET2 Systems Blog - - [Exploiting Intel Graphics Kernel Extensions on macOS](https://blog.ret2.io/2022/06/29/pwn2own-2021-safari-sandbox-intel-graphics-exploit/) -- Didier Stevens - - [Update: format-bytes.py Version 0.0.14](https://blog.didierstevens.com/2022/06/29/update-format-bytes-py-version-0-0-14/) -- blog.avast.com EN - - [Deepfake video call: New effort discovered](https://blog.avast.com/kyiv-mayor-deepfake) -- SentinelOne - - [Rise in Identity-Based Attacks Drives Demand for a New Security Approach](https://www.sentinelone.com/blog/rise-in-identity-based-attacks-drives-demand-for-a-new-security-approach/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-06-27 - TA578 IcedID (Bokbot) with DarkVNC and Cobalt Strike](https://www.malware-traffic-analysis.net/2022/06/28/index.html) - - [2022-06-27 - obama194 Qakbot with DarkVNC and Cobalt Strike](https://www.malware-traffic-analysis.net/2022/06/27/index.html) -- PortSwigger Research - - [Bypassing Firefox's HTML Sanitizer API](https://portswigger.net/research/bypassing-firefoxs-html-sanitizer-api) -- The Daily Swig | Cybersecurity news and views - - [UnRAR path traversal flaw can lead to RCE in Zimbra](https://portswigger.net/daily-swig/unrar-path-traversal-flaw-can-lead-to-rce-in-zimbra) - - [YARAify: Defensive tool scans suspicious files against a large repository of YARA rules](https://portswigger.net/daily-swig/yaraify-defensive-tool-scans-suspicious-files-against-a-large-repository-of-yara-rules) -- HAHWUL - - [Bookmarklet Genereate](https://www.hahwul.com/phoenix/bookmarklet/) -- 4ra1n - - [浅谈Shiro CVE-2022-32532](https://4ra1n.love/post/bHi_S3YrB/) -- rtl-sdr.com - - [MagicSDR: Streaming Audio over UDP to Decoders like Multimon-NG](https://www.rtl-sdr.com/magicsdr-streaming-audio-over-udp-to-decoders-like-multimon-ng/) - - [SDR Academy 2022 Recorded Livestream now Available](https://www.rtl-sdr.com/sdr-academy-2022-recorded-livestream-now-available/) - - [An Improved ExtIO for RTL_TCP](https://www.rtl-sdr.com/an-improved-extio-for-rtl_tcp/) -- Mozilla Hacks – the Web developer blog - - [Neural Machine Translation Engine for Firefox Translations add-on](https://hacks.mozilla.org/2022/06/neural-machine-translation-engine-for-firefox-translations-add-on/) -- KitPloit - PenTest & Hacking Tools - - [Gallia - Extendable Pentesting Framework](http://www.kitploit.com/2022/06/gallia-extendable-pentesting-framework.html) - - [Jwtear - Modular Command-Line Tool To Parse, Create And Manipulate JWT Tokens For Hackers](http://www.kitploit.com/2022/06/jwtear-modular-command-line-tool-to.html) - - [Nimc2 - A C2 Fully Written In Nim](http://www.kitploit.com/2022/06/nimc2-c2-fully-written-in-nim.html) -- 奇客Solidot–传递最新科技情报 - - [FBI 对使用深度伪造申请远程工作发出警告](https://www.solidot.org/story?sid=71980) - - [ARM 宣布首款硬件支持光线跟踪的 GPU](https://www.solidot.org/story?sid=71979) - - [Thunderbird 102 发布](https://www.solidot.org/story?sid=71978) - - [印度暂缓执行 VPN 日志保存规定三个月](https://www.solidot.org/story?sid=71977) - - [40 亿年前的晶体为板块构造何时开始提供线索](https://www.solidot.org/story?sid=71976) - - [我们需要更智慧的城市而不是智慧城市](https://www.solidot.org/story?sid=71975) - - [英国决定 AI 仍然不能申请发明专利](https://www.solidot.org/story?sid=71974) - - [新研究解开引发冰河时代之谜](https://www.solidot.org/story?sid=71973) - - [Airbnb 永久禁止派对房屋租赁](https://www.solidot.org/story?sid=71972) - - [AMD 调查 450Gb 数据遭窃取的安全事件](https://www.solidot.org/story?sid=71971) - - [Firefox 102 发布](https://www.solidot.org/story?sid=71970) - - [台积电季度收入预计将首次超过英特尔](https://www.solidot.org/story?sid=71969) -- Data Breach - - [RansomHouse gang claims to have stolen 450GB of data from chip maker giant AMD](https://securityaffairs.co/wordpress/132721/cyber-crime/ransomhouse-hacked-amd.html) -- 黑海洋 - WIKI - - [http封包拦截修改工具](https://blog.upx8.com/2844) - - [超级ITV 5.1.0 堪比火星 直播电视 纯净版（可回看进度）](https://blog.upx8.com/2843) - - [U盘工具USBOS V3.0 标准版/增强版(持续更新)](https://blog.upx8.com/2842) -- IT Service Management News - - [VERA 7 per la valutazione del rischio](http://blog.cesaregallotti.it/2022/06/vera-7-per-la-valutazione-del-rischio.html) -- bellingcat - - [Russia’s Kremenchuk Claims Versus the Evidence](https://www.bellingcat.com/news/2022/06/29/russias-kremenchuk-claims-versus-the-evidence/) -- Forensic Focus - - [Uncovering Windows Registry Data and the Latest Mac Artifacts](https://www.forensicfocus.com/webinars/uncovering-windows-registry-data-and-the-latest-mac-artifacts/) -- Il Disinformatico - - [Quando MacOS si rifiuta di vedere i dischi di rete](http://attivissimo.blogspot.com/2022/06/quando-macos-si-rifiuta-di-vedere-i.html) -- IntelTechniques Blog - - [Snap to Flatpak on Ubuntu](https://inteltechniques.com/blog/2022/06/29/snap-to-flatpak-on-ubuntu/) -- Qualys Security Blog - - [Atlassian Confluence OGNL Injection Remote Code Execution (RCE) Vulnerability (CVE-2022-26134)](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Schneier on Security - - [Ecuador’s Attempt to Resettle Edward Snowden](https://www.schneier.com/blog/archives/2022/06/ecuadors-attempt-to-resettle-edward-snowden.html) -- Security Current - - [Congratulations to the 2022 C100 Winners](/congratulations-to-the-2022-c100-winners/) -- Instapaper: Unread - - [UNREDACTED Magazine Issue 003](https://inteltechniques.com/blog/2022/06/28/unredacted-magazine-issue-003/) - - [L'Italian Hackers' Embassy a MCH2022](https://www.tipiloschi.net/drupal/MCH2022-Italian-Hackers-Embassy) - - [De-anonymizing ransomware domains on the dark web](http://blog.talosintelligence.com/2022/06/de-anonymizing-ransomware-domains-on.html) - - [When Security Locks You Out of Everything](https://www.schneier.com/blog/archives/2022/06/__trashed-2.html) - - [Overview of Top Mobile Security Threats in 2022](https://thehackernews.com/2022/06/overview-of-top-mobile-security-threats.html) - - [ZuoRAT Malware Hijacking Home-Office Routers to Spy on Targeted Networks](https://thehackernews.com/2022/06/zuorat-malware-hijacking-home-office.html) -- Threatpost - - [Leaky Access Tokens Exposed Amazon Photos of Users](https://threatpost.com/exposed-amazon-photos/180105/) - - [Patchable and Preventable Security Issues Lead Causes of Q1 Attacks](https://threatpost.com/lead-causes-of-q1-attacks/180096/) -- KitPloit - PenTest Tools! - - [Gallia - Extendable Pentesting Framework](http://www.kitploit.com/2022/06/gallia-extendable-pentesting-framework.html) - - [Jwtear - Modular Command-Line Tool To Parse, Create And Manipulate JWT Tokens For Hackers](http://www.kitploit.com/2022/06/jwtear-modular-command-line-tool-to.html) - - [Nimc2 - A C2 Fully Written In Nim](http://www.kitploit.com/2022/06/nimc2-c2-fully-written-in-nim.html) -- Team Cymru - - [The Sliding Scale of Threat Actor Sophistication When Reacting to 0-day Vulnerabilities](https://team-cymru.com/blog/2022/06/29/the-sliding-scale-of-threat-actor-sophistication-when-reacting-to-0-day-vulnerabilities/) -- Securityinfo.it - - [Nasce il database delle vulnerabilità nel cloud](https://www.securityinfo.it/2022/06/29/nasce-il-database-delle-vulnerabilita-nel-cloud/?utm_source=rss&utm_medium=rss&utm_campaign=nasce-il-database-delle-vulnerabilita-nel-cloud) - - [Possibile urto di dati in AMD](https://www.securityinfo.it/2022/06/29/furto-di-dati-in-amd/?utm_source=rss&utm_medium=rss&utm_campaign=furto-di-dati-in-amd) -- /r/netsec - Information Security News & Discussion - - [Exploiting Intel Graphics Kernel Extensions on macOS to Escape the Safari Sandbox](https://www.reddit.com/r/netsec/comments/vnivsw/exploiting_intel_graphics_kernel_extensions_on/) - - [CVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus](https://www.reddit.com/r/netsec/comments/vnftlm/cve202228219_unauthenticated_xxe_to_rce_and/) - - [How to Steal Browser’s Autofill Credentials via Cross-Site Scripting (XSS)](https://www.reddit.com/r/netsec/comments/vnfe2u/how_to_steal_browsers_autofill_credentials_via/) - - [How to Evade Windows Defender and Commercial AV with Msfvenom Payloads](https://www.reddit.com/r/netsec/comments/vn4uo2/how_to_evade_windows_defender_and_commercial_av/) - - [Cryptographic failures in RF encryption allow stealing robotic devices | Cossack Labs](https://www.reddit.com/r/netsec/comments/vnk79u/cryptographic_failures_in_rf_encryption_allow/) - - [CloudGoat detection_evasion Scenario: Avoiding AWS Security Detection and Response](https://www.reddit.com/r/netsec/comments/vnigus/cloudgoat_detection_evasion_scenario_avoiding_aws/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [What are some blue team jobs in the cybersecurity or IT field?](https://www.reddit.com/r/netsecstudents/comments/vnglxr/what_are_some_blue_team_jobs_in_the_cybersecurity/) - - [Hacking session for non tech people? Thoughts?](https://www.reddit.com/r/netsecstudents/comments/vnhhb7/hacking_session_for_non_tech_people_thoughts/) - - [CTF to learn](https://www.reddit.com/r/netsecstudents/comments/vnhm2i/ctf_to_learn/) - - [Active Directory Penetration Testing Sample Report](https://www.reddit.com/r/netsecstudents/comments/vn5o3j/active_directory_penetration_testing_sample_report/) -- 星阑科技 - - [6月，盘点您需要修复的那些API安全漏洞](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247493869&idx=1&sn=73d04a1dc038d2616c5ee0b9d6f3da8f&chksm=c0074571f770cc67b6241e8cf6bab732df594b2f2a477e9b9ce50950185210dc15557eb74cbf&scene=58&subscene=0#rd) -- TorrentFreak - - [Kim Dotcom Not Happy, Says ‘Mega Mass Piracy Report’ is On the Way](https://torrentfreak.com/kim-dotcom-not-happy-says-mega-infringement-report-on-the-way-220629/) - - [ACE Anti-Piracy Alliance Expands Into Asia to Disrupt Illegal Streaming](https://torrentfreak.com/ace-anti-piracy-alliance-expands-into-asia-to-disrupt-illegal-streaming-220629/) -- 奇安信威胁情报中心 - - [美国国家安全局（NSA）“酸狐狸”漏洞攻击武器平台技术分析报告](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247501833&idx=1&sn=c91b745c048596faf0e05510165d2299&chksm=ea663f7edd11b6681e35de65031ad4373f8ee1a722ce3e2a0dd7efed82fc007a21b3e64440ea&scene=58&subscene=0#rd) -- The Register - Security - - [Start using Modern Auth now for Exchange Online](https://go.theregister.com/feed/www.theregister.com/2022/06/29/cisa-microsoft-modern-auth/) - - ['Prolific' NetWalker extortionist pleads guilty to ransomware charges](https://go.theregister.com/feed/www.theregister.com/2022/06/29/netwalker_extortionist_pleaded_guilty/) - - [Microsoft postpones shift to New Commerce Experience subscriptions](https://go.theregister.com/feed/www.theregister.com/2022/06/29/microsoft_nce_indefinite_extension/) - - [FBI warning: Crooks are using deepfake videos in interviews for remote gigs](https://go.theregister.com/feed/www.theregister.com/2022/06/29/fbi_deepfake_job_applicant_warning/) - - [Trio accused of selling $88m of pirated Avaya licenses](https://go.theregister.com/feed/www.theregister.com/2022/06/29/avaya_piracy_doj_fbi/) - - [Walmart accused of turning blind eye to transfer fraud totaling millions of dollars](https://go.theregister.com/feed/www.theregister.com/2022/06/29/walmart_ftc_money_transfer/) -- 安全客 - - [【技术分享】Powershell Empire 绕过AV实现远控](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773217&idx=1&sn=333962e4cb6f56278f8968aded3479d2&chksm=889364cebfe4edd8dff5a7f5a261de74d513df32335b47f18d47692feb2a0931a384a93a1119&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(06-29)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958550&idx=1&sn=8595bd0e301ae79c415e6c88411fb321&chksm=8baecd89bcd9449f6898248ab02cb7aea36b32c92ec4433f94fad0954c9f314fd1d76eb0fa5b&scene=58&subscene=0#rd) -- Graham Cluley - - [Deepfaking crooks seek remote-working jobs to gain access to sensitive data](https://grahamcluley.com/deepfaking-crooks-seek-remote-working-jobs-to-gain-access-to-sensitive-data/) -- 看雪学院 - - [Akamai保护的相关网站（IHG，TI）学习记录](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456133&idx=1&sn=272792304ee86625d9f9323119f121ae&chksm=b18e20cf86f9a9d911d0494110149da6caef387e014351090ff2b2aeb8cb87b5dad9adc3ed37&scene=58&subscene=0#rd) - - [【附PPT下载】干货满满！平安SRC线上沙龙第二期圆满落幕！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456133&idx=2&sn=dbfa7e82529e5adc752a831d5a2ce8f1&chksm=b18e20cf86f9a9d94b2196a78906427d572b7dd3d3fe52203c50797a6a9d788c226e15422639&scene=58&subscene=0#rd) - - [CafePress因数据保护不力被罚款50万美元](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456133&idx=3&sn=b858d6a67110e51fe4d21e67d82b6162&chksm=b18e20cf86f9a9d9b8833bb5a77dffdd2d7e2bd9fcd5b3265d6243bcc97c3fc02e4d4b354039&scene=58&subscene=0#rd) - - [『新课预售』基构网络构建与防护](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456133&idx=4&sn=73f9e9ac50a2ddc07091f447fc974586&chksm=b18e20cf86f9a9d9d92eb39d3150c7eb0289437ec028acb9df0082a646527bb84b014b5f2da0&scene=58&subscene=0#rd) -- Computer Forensics - - [read-only ethernet cable](https://www.reddit.com/r/computerforensics/comments/vnha49/readonly_ethernet_cable/) -- 情报分析师 - - [【情报应用】保护海上安全](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650508693&idx=1&sn=176bce972fb86c3def4acbc2928a5999&chksm=8716a3deb0612ac8a096d3254c4da5447556cfcf697c0fe4c7a1561ffadff8240affa56dad1d&scene=58&subscene=0#rd) - - [【分析报告】西点反恐中心：美国的暴力极右翼](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650508693&idx=2&sn=2be2699caa9f1b7f4f6e35e48050dbcb&chksm=8716a3deb0612ac81412aeb958e335a7ae0b34f32444d446262dac71d7aa31e502d61882ff48&scene=58&subscene=0#rd) - - [【情报课堂】情报报告的类型](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650508693&idx=3&sn=375e9da50a6e8b1a363493126509914e&chksm=8716a3deb0612ac8ae99b2c51c0c1da1c81c869431d810094de9f370d33190f9634b06bb1616&scene=58&subscene=0#rd) -- 火线安全平台 - - [洞态在某互联⽹⾦融科技企业的最佳落地实践](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247491471&idx=1&sn=cba199b6aa733717057fe3dc226419f2&chksm=fdbc3624cacbbf3219e98fc54e3e15be8d39d5901ecbd5b2b1ad37e37956a61c8f647a99e50a&scene=58&subscene=0#rd) - - [DongTai 社区 | v1.8.1 功能更新，新增主动验证配置板块](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247491471&idx=2&sn=f4707656641e2321934bb32ec1907837&chksm=fdbc3624cacbbf3296f9ecdac68bb82c3f6022994bf31762af73609f53476f546061b685e502&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [美国家安全局“酸狐狸”漏洞攻击武器平台技术分析报告](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247489030&idx=1&sn=0c9799377b28ef5851b8b0c3265be8ae&chksm=f9ee7ab9ce99f3af1f06c4c96d4bb9c801b8aba7754b7b1bad8ff4b3ff2973f2dc26926788a7&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [Java安全之Spring框架内存马技术总结](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494351&idx=1&sn=5ccbf3aec5ea7b5e3649ee375bf3a230&chksm=fa523f71cd25b667ccaf165adf0cf2aa30f7a9faf1c1c48008ec30e4182107f5214383114620&scene=58&subscene=0#rd) -- 青藤云安全 - - [重磅披露！上百个重要信息系统被入侵，主机成为重点攻击目标](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650835782&idx=1&sn=c991b2daf70a54936142bd87ea06ac2d&chksm=80dbe8e3b7ac61f5a4b0770383b89ef4292a667bf0b903dec22065b9395383b7ebb47abcf4e3&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [《检验机构能力认可准则在网络安全等级测评领域的应用说明》，7月1日起实施](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491038&idx=1&sn=757cec7a946e0339b909fa045bb1a02e&chksm=feb59ccdc9c215dbb0acf78171a27c9786d9c07d499085f899adad6599df422d8b767490b014&scene=58&subscene=0#rd) -- 安全牛 - - [对两部委“关于开展数据安全管理认证工作的公告”的文件解读与建议](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115416&idx=1&sn=1a1b73de41e9c6706f32fd50f52a4d4a&chksm=bd147f4b8a63f65dae05457af29074f0929e94e3c9a33d4754dc91b0f3605e0138a37af4cec0&scene=58&subscene=0#rd) - - [2022版《互联网用户账号信息管理规定》解读](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115416&idx=2&sn=4f5904e13403b4237ae7e2c9e9437514&chksm=bd147f4b8a63f65d507e97c5191df8e51f819c1d5c1b367e70cfd7f6183a01ae5545a9f48250&scene=58&subscene=0#rd) - - [伊朗钢铁企业由于网络攻击暂停运营](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115416&idx=3&sn=ab20854dea6e2994c59637dc28b8c3e1&chksm=bd147f4b8a63f65d128e9e0e1ddc6a3a13a708a5bc071f86bee0c8c34d72f583b35b944ab6a9&scene=58&subscene=0#rd) -- Yak Project - - [Low Code, Full Turing: Yaklang 分布式引擎 SaaS 化](https://mp.weixin.qq.com/s?__biz=MzAxOTAzOTU3Mw==&mid=2247488619&idx=1&sn=d125d97f54c1022d988f0471d7a570cf&chksm=9bcc4051acbbc9470025205b152dbffbc3f04be4739ee7bb90e269fcf994e97b46dfcf4c1a12&scene=58&subscene=0#rd) -- Security Affairs - - [Path Traversal flaw in UnRAR utility can allow hacking Zimbra Mail servers](https://securityaffairs.co/wordpress/132737/breaking-news/unrar-path-traversal-flaw-zimbra.html) - - [Mitre shared 2022 CWE Top 25 most dangerous software weaknesses](https://securityaffairs.co/wordpress/132730/security/mitre-2022-cwe-top-25.html) - - [RansomHouse gang claims to have stolen 450GB of data from chip maker giant AMD](https://securityaffairs.co/wordpress/132721/cyber-crime/ransomhouse-hacked-amd.html) -- 深信服千里目安全实验室 - - [美国国家安全局（NSA）“酸狐狸”漏洞攻击武器平台技术分析报告](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262249&idx=1&sn=387e5abfc0b1b69c6ef288ae2383baa6&chksm=f3e2709dc495f98b88ccccdbafcac562187befba464c1e9af19a37ae3a8d5268f42ad50dde46&scene=58&subscene=0#rd) - - [【漏洞通告】Apache Shiro认证绕过漏洞CVE-2022-32532](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262249&idx=2&sn=ed04db724f936745b074132d6aebcd0c&chksm=f3e2709dc495f98b0e3e899a5bcde806e37572e125658056ae1f6c9e80514d3bdf6ea6c095c1&scene=58&subscene=0#rd) - - [【漏洞通告】Oracle JDeveloper ADF Faces 远程代码执行漏洞CVE-2022-21445](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262249&idx=3&sn=8fd63ad3978b25934d94e11276ee6f54&chksm=f3e2709dc495f98b5e11b5aeb82a20626744f8bba679f63fcb803b3f1bee0ac99a9eac7f39ca&scene=58&subscene=0#rd) - - [【漏洞通告】Spring Cloud Function拒绝服务漏洞CVE-2022-22979](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262249&idx=4&sn=6ca8c3e5ccc408861d9909ed8d1bc78e&chksm=f3e2709dc495f98b52afbf46e3fc789d99233df7724d7e8d6ed249c841c442a8901b9e97d086&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [第四届字节跳动青训营报名开始啦 ！！！](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495735&idx=1&sn=809a6d7753850d4e1084d5b634c3d0d4&chksm=e9d33bd5dea4b2c35556f2e6065d6432b036ad5d1e7c47a5fe404f1e462902448326bc0968ed&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [江湖寻人，客官请留步！](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247505216&idx=1&sn=cecd62f530ab53b99a7d7f5861211932&chksm=eb700b7fdc0782695cfa7d04288f82967b40bb65bb62cd13d10b509cfe132ac4891bbebfd6aa&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [榜单 | 百度六月众测活动TOP10名单公布](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537292&idx=1&sn=5b2cc495fa3ac75a68e171f5a0df314a&chksm=8bcba5f0bcbc2ce6e8e553076a3bf6dd97c06672582e8731f0611c3bda1a722c62fc569cef01&scene=58&subscene=0#rd) -- 互联网安全内参 - - [构建主动安全态势！美国务院部门提出新网络战略](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503957&idx=1&sn=d7264749bbb8a3eea8f61d12ad683130&chksm=ebfa9775dc8d1e6319ceb21d6de84a07e95456c62a213fccbae0733862ef718edbcbcd6858f5&scene=58&subscene=0#rd) - - [美国家安全局“酸狐狸”漏洞攻击武器平台技术分析报告](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503957&idx=2&sn=5b0b78bed396d22e22eca8124b7a678d&chksm=ebfa9775dc8d1e632fb422e60fb60782b6f3d35f15be37ee4115ae43401720df354eb1cfc931&scene=58&subscene=0#rd) - - [《网安供应链厂商成分分析及国产化替代指南》要点解读 (附下载)](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503957&idx=3&sn=74de74d4ccbfd90c0b0ebe26154c24cd&chksm=ebfa9775dc8d1e63093e4d4b54034eda3a959f471c720643795f61a70099963a2665e7f00997&scene=58&subscene=0#rd) - - [“2022首届业务与应用安全发展论坛”在京召开](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503957&idx=4&sn=f0cd6f2cec0c1c77c1a3fb2957aaac8f&chksm=ebfa9775dc8d1e636486e605699872fc8e51e0cfafa4ef1515b5f90072652cfd1bd13b2a1022&scene=58&subscene=0#rd) -- 雷神众测 - - [ATT&CK实战系列——红队实战(五)](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498115&idx=1&sn=75d6746f48edee9926d02608d2d03730&chksm=f2584b70c52fc266a9001fe8dc69b610630ac20aa01ae7acebe333496449d65954d55cce06d0&scene=58&subscene=0#rd) -- SANS Internet Storm Center, InfoCON: green - - [It's New Phone Day! Time to migrate your MFA!, (Wed, Jun 29th)](https://isc.sans.edu/diary/rss/28800) - - [ISC Stormcast For Wednesday, June 29th, 2022 https://isc.sans.edu/podcastdetail.html?id=8068, (Wed, Jun 29th)](https://isc.sans.edu/diary/rss/28798) -- 奇安信CERT - - [【已复现】Apache Shiro 身份认证绕过漏洞(CVE-2022-32532)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496387&idx=1&sn=ed634e2458a888f961044354d6224c3c&chksm=fe79d65bc90e5f4dea518095d127b0141e945ba0a23b040fcc89632fc42317ec4781bdf0e56a&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.06.29）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491111&idx=1&sn=1512ed8bcfc9fd0c96967336db096b9c&chksm=fe251b26c9529230f6431c6864ff9786d0175ff8ae2e30e943d077e85d550df4371e6119f206&scene=58&subscene=0#rd) -- M01NTeam - - [CVE-2022-24521 Windows CLFS本地提权漏洞分析](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247488567&idx=1&sn=764b71452aaa0695da3626393f362208&chksm=c187d426f6f05d304a4c640ba7243e250dbe5fae353279cbe38685aac8a8fe999efc52d57481&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [2022政府工作报告中的“数据安全”](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528089&idx=1&sn=27ce3a4aac3d6c629969599dbb4dd419&chksm=c1e9e2c8f69e6bde9077af67f09f58d3fc53f0950ee97fe648c35b0f57639d34fe03bbb3dd4f&scene=58&subscene=0#rd) - - [【攻防演练专题】构建欺骗式防御](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528089&idx=2&sn=5cad62513a6232bfce0c91d6fa84b90b&chksm=c1e9e2c8f69e6bdebdfa093ba2f0751ca118beaae668451316e4c0b783bf54d3d24e8ce42bec&scene=58&subscene=0#rd) - - [云与安全深度融合推动原生云安全发展](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528089&idx=3&sn=a4e9939b5b1677e84dae96544101eec0&chksm=c1e9e2c8f69e6bdee4e46661a2fe7ba8362fdd1a431111521b864d82539559404c80cd18e308&scene=58&subscene=0#rd) - - [MEGA云存储服务加密可被攻破](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528089&idx=4&sn=f6912d2005a6687748b62a2055591172&chksm=c1e9e2c8f69e6bde43d3ee90ea49a3463db725728b10c075ace304b15501af6395a5fd90e75f&scene=58&subscene=0#rd) - - [如何正确保护 API 变得越来越紧迫](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528089&idx=5&sn=18f7150f2bd0a6cfbcccecdc7c166470&chksm=c1e9e2c8f69e6bde0d9fc1d9cdc7c8d3812143d566637d21ec9e1c8b765b70fb984b6d639a7f&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [Best Hacking Learning platforms online?](https://www.reddit.com/r/HowToHack/comments/vnt9dv/best_hacking_learning_platforms_online/) - - [Trying to learn fuzzing, not sure if I am doing it right...](https://www.reddit.com/r/HowToHack/comments/vnijm5/trying_to_learn_fuzzing_not_sure_if_i_am_doing_it/) - - [We're to start or continue from?](https://www.reddit.com/r/HowToHack/comments/vnfga3/were_to_start_or_continue_from/) - - [please help!](https://www.reddit.com/r/HowToHack/comments/vns2e5/please_help/) - - [How can I use Python + mitmproxy to intercept the response of a request and edit the response?](https://www.reddit.com/r/HowToHack/comments/vnbs7d/how_can_i_use_python_mitmproxy_to_intercept_the/) - - [CLI software vulnerability assessment](https://www.reddit.com/r/HowToHack/comments/vnaqt4/cli_software_vulnerability_assessment/) - - [Active Directory Penetration Testing Sample Report](https://www.reddit.com/r/HowToHack/comments/vn5o4f/active_directory_penetration_testing_sample_report/) -- Deeplinks - - [The Journalism Competition and Preservation Act Will Produce Neither Competition Nor Preservation](https://www.eff.org/deeplinks/2022/06/journalism-competition-and-preservation-act-will-produce-neither-competition-nor) -- Trend Micro Research, News and Perspectives - - [How to Present Cloud Risk to the Board](https://www.trendmicro.com/en_us/ciso/22/f/cloud-risk-management-assessment-plan.html) -- Dark Space Blogspot - - [Layer Zero e Stargate: Infrastrutture Cross Chain](http://darkwhite666.blogspot.com/2022/06/layer-zero-e-stargate-infrastrutture.html) diff --git a/archive/2022/2022-07-01.md b/archive/2022/2022-07-01.md deleted file mode 100644 index d625747a60..0000000000 --- a/archive/2022/2022-07-01.md +++ /dev/null @@ -1,340 +0,0 @@ -# 每日安全资讯（2022-07-01） - -- HackerOne Hacker Activity - - [Open redirect found on account.brave.com](https://hackerone.com/reports/1338437) - - [Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSS](https://hackerone.com/reports/963155) - - [Arbitrary file download due to bad handling of Redirects in WebTorrent](https://hackerone.com/reports/975514) - - [Redirecting users to malicious torrent-files/websites using WebTorrent](https://hackerone.com/reports/968328) - - [Browser is not following proper flow for redirection cause open redirect](https://hackerone.com/reports/1579374) -- Tenable Blog - - [CVE-2022-28219: Proof-of-Concept Published for Unauthenticated RCE in Zoho ManageEngine ADAudit Plus](https://www.tenable.com/blog/cve-2022-28219-proof-of-concept-published-for-unauthenticated-rce-in-zoho-manageengine-adaudit) -- Sec-News 安全文摘 - - [PSV-2020-0437:Buffer-Overflow-on-Some-Netgear-Routers](https://wiki.ioin.in/url/oo0R) -- Sploitus.com Exploits RSS Feed - - [Backdoor.Win32.Cafeini.b MVID-2022-0617 Hardcoded Credential exploit](https://sploitus.com/exploit?id=PACKETSTORM:167627&utm_source=rss&utm_medium=rss) - - [Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal exploit](https://sploitus.com/exploit?id=ZSL-2022-5709&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Coredoor.10.a MVID-2022-0618 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:167629&utm_source=rss&utm_medium=rss) - - [Fruits-Bazar 2021 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37822&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.EvilGoat.b MVID-2022-0619 Hardcoded Credential exploit](https://sploitus.com/exploit?id=PACKETSTORM:167628&utm_source=rss&utm_medium=rss) - - [Laundry Management System 1.0 SQL Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37821&utm_source=rss&utm_medium=rss) - - [Exploit for Off-by-one Error in F5 Nginx exploit](https://sploitus.com/exploit?id=00455CDF-B814-5424-952E-9088FBB2D42D&utm_source=rss&utm_medium=rss) - - [Exploit for Deserialization of Untrusted Data in Sitecore Experience Platform exploit](https://sploitus.com/exploit?id=897BF6C2-DA98-58E0-941A-A3B16F7CCECD&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [The Different Types of Password Attacks: An Overview](https://securityboulevard.com/2022/06/the-different-types-of-password-attacks-an-overview/) - - [New and Expanded Free Sonatype Learning Resources](https://securityboulevard.com/2022/06/new-and-expanded-free-sonatype-learning-resources/) - - [Vulnerability & Patch Roundup — June 2022](https://securityboulevard.com/2022/06/vulnerability-patch-roundup-june-2022/) - - [API Vulnerability on Cryptocurrency Platform Could have Allowed Large-scale Account Takeover](https://securityboulevard.com/2022/06/api-vulnerability-on-cryptocurrency-platform-could-have-allowed-large-scale-account-takeover/) - - [Cybersecurity Awareness: Definition, Importance, Purpose and Challenges](https://securityboulevard.com/2022/06/cybersecurity-awareness-definition-importance-purpose-and-challenges/) - - [USENIX Enigma 2022 – Ghada Almashaqbeh’s ‘I See You Blockchain User, Or Not! Privacy In The Age Of Blockchains’](https://securityboulevard.com/2022/06/usenix-enigma-2022-ghada-almashaqbehs-i-see-you-blockchain-user-or-not-privacy-in-the-age-of-blockchains/) - - [SOC 2 Controls: Access Removal for Terminated or Transferred Users](https://securityboulevard.com/2022/06/soc-2-controls-access-removal-for-terminated-or-transferred-users/) - - [How Security Automation Bridges the Intelligence-Action Gap](https://securityboulevard.com/2022/06/how-security-automation-bridges-the-intelligence-action-gap/) - - [How to Get Your ISO/IEC 27001:2022 Game On – Here’s Everything You Need to Know](https://securityboulevard.com/2022/06/how-to-get-your-iso-iec-270012022-game-on-heres-everything-you-need-to-know/) - - [The Week in Cybersecurity: NATO creates cyber rapid response](https://securityboulevard.com/2022/06/the-week-in-cybersecurity-nato-creates-cyber-rapid-response/) -- Blog & What's New | Offensive Security - - [Weaponizing and Abusing Hidden Functionalities Contained in Office Document Properties](https://www.offensive-security.com/offsec/macro-weaponization/) - - [The ever-evolving role of the CISO: Cybersecurity leadership skills needed in the future of work](https://www.offensive-security.com/offsec/the-evolving-role-of-the-ciso/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 亚马逊曝严重漏洞，攻击者可访问相册；沃尔玛遭美监管机构起诉](https://www.freebuf.com/news/337834.html) - - [【直播预约】企业实战攻防能力成熟度建设与实践 | CIS大会夏日版议题前瞻](https://www.freebuf.com/fevents/337787.html) - - [MITRE组织公布了2022年CWE最危险的25个软件弱点](https://www.freebuf.com/news/337766.html) - - [被曝高危漏洞，威胁行为者可获取Amazon Photos文件访问权限](https://www.freebuf.com/news/337760.html) -- Trustwave Blog - - [A Cautionary Tale of a Data Breach](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/a-cautionary-tale-of-a-data-breach/) -- 跳跳糖 - 安全与分享社区 - - [XCTF-ACTF 部分区块链题目](https://tttang.com/archive/1637/) -- bunnie's blog - - [Name that Ware, June 2022](https://www.bunniestudios.com/blog/?p=6435) - - [Winner, Name that Ware May 2022](https://www.bunniestudios.com/blog/?p=6433) -- Envato Tuts+ Code - Mobile Development - - [How to Create an Android App Without Coding](https://code.tutsplus.com/articles/how-to-create-an-android-app-without-coding--cms-34673) - - [Android From Scratch: Building Your First Android Application](https://code.tutsplus.com/tutorials/android-from-scratch-building-your-first-android-application--cms-26024) -- ongoing by Tim Bray - - [Long Links](https://www.tbray.org/ongoing/When/202x/2022/06/30/Long-Links) -- Microsoft Security Blog - - [Toll fraud malware: How an Android application can drain your wallet](https://www.microsoft.com/security/blog/2022/06/30/toll-fraud-malware-how-an-android-application-can-drain-your-wallet/) - - [Using process creation properties to catch evasion techniques](https://www.microsoft.com/security/blog/2022/06/30/using-process-creation-properties-to-catch-evasion-techniques/) -- Swing'Blog 浮生若梦 - - [PSV-2020-0437:Buffer-Overflow-on-Some-Netgear-Routers](https://bestwing.me/PSV-2020-0437-Buffer-Overflow-on-Some-Netgear-outers.html) -- 绿盟科技技术博客 - - [【顶刊论文分享】识别恶意bot](http://blog.nsfocus.net/bot-b/) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5497-1](https://packetstormsecurity.com/files/167633/USN-5497-1.txt) - - [Ubuntu Security Notice USN-5496-1](https://packetstormsecurity.com/files/167632/USN-5496-1.txt) - - [Blue Team Training Toolkit (BT3) 2.9](https://packetstormsecurity.com/files/167631/BT3-2.9.tar.gz) - - [Backdoor.Win32.Coredoor.10.a MVID-2022-0618 Authentication Bypass](https://packetstormsecurity.com/files/167629/MVID-2022-0618.txt) - - [Backdoor.Win32.EvilGoat.b MVID-2022-0619 Hardcoded Credential](https://packetstormsecurity.com/files/167628/MVID-2022-0619.txt) - - [Backdoor.Win32.Cafeini.b MVID-2022-0617 Hardcoded Credential](https://packetstormsecurity.com/files/167627/MVID-2022-0617.txt) - - [launchd Heap Corruption](https://packetstormsecurity.com/files/167630/GS20220630154613.txt) -- Trail of Bits Blog - - [A Typical Day as a Trail of Bits Engineer-Consultant](https://blog.trailofbits.com/2022/06/30/a-typical-day-as-a-trail-of-bits-engineer-consultant/) -- Sucuri Blog - - [Vulnerability & Patch Roundup — June 2022](https://blog.sucuri.net/2022/06/vulnerability-patch-roundup-june-2022.html) -- Securelist - - [The SessionManager IIS backdoor](https://securelist.com/the-sessionmanager-iis-backdoor/106868/) -- Hacking Dream - - [SMB Pentest Checklist](https://www.hackingdream.net/2022/06/smb-pentest-checklist.html) -- Forcepoint - - [Insider Risk and the Great Resignation: Preventing Critical Data Loss When Employees Leave](https://www.forcepoint.com/blog/insights/insider-risk-when-employees-leave) -- Sandfly Security Blog RSS Feed - - [Sandfly Linux File Entropy Scanner Updated](https://www.sandflysecurity.com/blog/sandfly-linux-file-entropy-scanner-updated) -- SentinelOne - - [Securing Amazon EKS Anywhere Bare Metal with SentinelOne Singularity](https://www.sentinelone.com/blog/securing-amazon-eks-anywhere-with-sentinelone-singularity/) -- Real-time communications security on Communication Breakdown - Real-Time Communications Security - - [SIPVicious PRO out with 2 releases, ransomware and participation in the survey](https://www.rtcsec.com/newsletter/2022-06-rtcsec-news/) -- Application Security Blog - - [CyRC Vulnerability of the Month: Spring Framework](https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-month-spring-framework/) -- NVISO Labs - - [Enforcing a Sysmon Archive Quota](https://blog.nviso.eu/2022/06/30/enforcing-a-sysmon-archive-quota/) -- 安全客-有思想的安全新媒体 - - [打造数字安全旗舰赛事，2022 DSCTF首届数字空间安全攻防大赛开启报名！](https://www.anquanke.com/post/id/275703) - - [“验证器”（Validator）— 美国国家安全局NSA（APT—C—40）的木马尖兵](https://www.anquanke.com/post/id/275706) - - [针对近期活跃的 Glupteba 木马病毒的分析](https://www.anquanke.com/post/id/275701) - - [世界智能大会开幕 周鸿祎：SaaS是中小微企业数字化转型的杀手锏](https://www.anquanke.com/post/id/275477) - - [K8s 之 ApiServer 组件风险](https://www.anquanke.com/post/id/275390) - - [RSAC 2022 创新沙盒系列分析（四）](https://www.anquanke.com/post/id/275679) - - [数字安全观察-每周简报 （2022.06.13 -2022.06.19）](https://www.anquanke.com/post/id/275660) - - [用uboot"操控"某路由器设备](https://www.anquanke.com/post/id/275630) - - [Bing引擎“意外”通过邮箱注册账号引发隐私思考](https://www.anquanke.com/post/id/275558) -- CFC4N的博客 - - [使用eBPF LSM热修复Linux内核漏洞](https://www.cnxct.com/linux-kernel-hotfix-with-ebpf-lsm/) -- Sucuri Blog - - [Vulnerability & Patch Roundup — June 2022](https://blog.sucuri.net/2022/06/vulnerability-patch-roundup-june-2022.html) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [The Koobface Gang Makes a Comeback - An In-Depth OSINT Enrichment Analysis in 2022](http://ddanchev.blogspot.com/2022/06/the-koobface-gang-makes-comeback-in.html) -- Hexacorn - - [This post mentions many file extensions](https://www.hexacorn.com/blog/2022/06/30/this-post-mentions-many-file-extensions/) -- blog.avast.com EN - - [If you were a queer girl in the 2000s, you were on LiveJournal](https://blog.avast.com/2000s-livejournal) -- The Daily Swig | Cybersecurity news and views - - [Bug Bounty Radar // The latest bug bounty programs for July 2022](https://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-july-2022) - - [OpenSea user email addresses leaked by rogue employee at third-party vendor](https://portswigger.net/daily-swig/opensea-user-email-addresses-leaked-by-rogue-employee-at-third-party-vendor) - - [Chromium browsers vulnerable to dangling markup injection](https://portswigger.net/daily-swig/chromium-browsers-vulnerable-to-dangling-markup-injection) -- Project Zero - - [2022 0-day In-the-Wild Exploitation…so far](https://googleprojectzero.blogspot.com/2022/06/2022-0-day-in-wild-exploitationso-far.html) -- Malwarebytes Labs - - [ZuoRAT is a sophisticated malware that mainly targets SOHO routers](https://blog.malwarebytes.com/reports/2022/06/zuorat-is-a-sophisticated-malware-that-mainly-targets-soho-routers/) - - [Amazon Photos vulnerability could have given attackers access to user files and data](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/amazon-photos-vulnerability-could-have-given-attackers-access-to-user-files-and-data/) - - [Criminals are applying for remote work using deepfake and stolen identities, says FBI](https://blog.malwarebytes.com/social-engineering/2022/06/criminals-are-applying-for-remote-work-using-deepfake-and-stolen-identities-says-fbi/) - - [Immigration organisations targeted by APT group Evilnum](https://blog.malwarebytes.com/cybercrime/2022/06/immigration-organisations-targeted-by-apt-group-evilnum/) - - [Update now! Mozilla fixes security vulnerabilities and introduces a new privacy feature for Firefox](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/update-now-mozilla-fixes-security-vulnerabilities-and-introduces-a-new-privacy-feature-for-firefox/) - - [Raccoon Stealer returns with a new bag of tricks](https://blog.malwarebytes.com/cybercrime/2022/06/raccoon-stealer-returns-with-a-new-bag-of-tricks/) - - [RansomHouse claims to have stolen at least 450GB of AMD’s data](https://blog.malwarebytes.com/hacking-2/2022/06/ransomhouse-claims-to-have-stolen-at-least-450gb-of-amds-data/) -- Sick Codes – Security Research, Hardware & Software Hacking, Consulting, Linux, IoT, Cloud, Embedded, Arch, Tweaks & Tips! - - [Sick Codes @ DEF CON 30 August 11-14 2022!](https://sick.codes/sick-codes-def-con-30/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 6/27/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-6-27-2022/) -- Hack Inn - - [2022平安SRC线上沙龙第二期](https://www.hackinn.com/index.php/archives/791/) -- KitPloit - PenTest & Hacking Tools - - [SharpWSUS - CSharp tool for lateral movement through WSUS](http://www.kitploit.com/2022/06/sharpwsus-csharp-tool-for-lateral.html) -- 奇客Solidot–传递最新科技情报 - - [TikTok 无法阻止用户人肉搜索保守派大法官](https://www.solidot.org/story?sid=71989) - - [狼作为一个单一全球种群在冰河时代幸存下](https://www.solidot.org/story?sid=71988) - - [好奇号漫游车采集到的岩石样本发现含有生命关键成分](https://www.solidot.org/story?sid=71987) - - [章鱼有和人脑一样的“跳跃基因”](https://www.solidot.org/story?sid=71986) - - [人类摇篮遗址中的化石可能比以前认为的早百万年](https://www.solidot.org/story?sid=71985) - - [Vim 9.0 发布](https://www.solidot.org/story?sid=71984) - - [麒麟软件等宣布 openKylin](https://www.solidot.org/story?sid=71983) - - [印度切断拉贾斯坦邦网络以防骚乱](https://www.solidot.org/story?sid=71982) - - [FCC 成员以国家安全理由呼吁苹果谷歌下架 TikTok](https://www.solidot.org/story?sid=71981) -- 博客园 - 郑瀚Andrew.Hann - - [《西方经济学（宏观部分）》（第7版）概念梳理 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/15761458.html) - - [《西方经济学（微观部分）》（第7版）概念梳理 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/15903096.html) - - [【政治经济学】《马克思主义政治经济学概论》概念梳理 - 郑瀚Andrew.Hann](https://www.cnblogs.com/LittleHann/p/16341218.html) -- Yoroi Warning Archive Feed - - [Warning: Librerie crittografiche ed25519 potenzialmente non sicure](https://us9.campaign-archive.com/?u=00093dab1cf5ca5a1d3d08535&id=9f82c8ca43) -- 黑海洋 - WIKI - - [加密加壳工具VMProtect Ultimate v3.6.0](https://blog.upx8.com/2855) - - [Fiddler抓包实战完整教程](https://blog.upx8.com/2854) - - [精易网页助手v2.68](https://blog.upx8.com/2853) - - [Sunny抓包工具2.0](https://blog.upx8.com/2852) - - [QQ号设置无法搜索，教你搜到这个QQ号](https://blog.upx8.com/2851) - - [Wallhaven壁纸桌面版（内有在线壁纸链接）](https://blog.upx8.com/2850) - - [APK反编译工具 APK Easy Tool v1.60 中文免费版](https://blog.upx8.com/2849) - - [个人财务管理工具 HomeBank v5.5.6 中文便携版](https://blog.upx8.com/2848) - - [Whale浏览器 v3.15.136.27 中文版（韩国）](https://blog.upx8.com/2847) - - [Cyberduck(FTP/SFTP工具) v8.4.0.38000](https://blog.upx8.com/2846) -- SANS Internet Storm Center, InfoCON: green - - [Case Study: Cobalt Strike Server Lives on After Its Domain Is Suspended, (Thu, Jun 30th)](https://isc.sans.edu/diary/rss/28804) - - [ISC Stormcast For Thursday, June 30th, 2022 https://isc.sans.edu/podcastdetail.html?id=8070, (Thu, Jun 30th)](https://isc.sans.edu/diary/rss/28802) -- Posts By SpecterOps Team Members - Medium - - [Relaying NTLM Authentication from SCCM Clients](https://posts.specterops.io/relaying-ntlm-authentication-from-sccm-clients-7dccb8f92867?source=rss----f05f8696e3cc---4) -- Security Current - - [CISOs Connect ™ Announces Winners of the 2022 CISOs Top 100 CISOs (C100) Recognition](/cisos-connect-announces-winners-of-the-2022-cisos-top-100-cisos-c100-recognition/) -- Il Disinformatico - - [Google rivela uno spyware governativo che fa vittime anche in Italia](http://attivissimo.blogspot.com/2022/07/google-rivela-uno-spyware-governativo.html) - - [FBI avvisa: occhio ai deepfake nei colloqui di lavoro](http://attivissimo.blogspot.com/2022/07/fbi-avvisa-occhio-ai-deepfake-nei.html) - - [Due chiacchiere su complottismi, fake news, automobili volanti, energia e altro ancora](http://attivissimo.blogspot.com/2022/06/due-chiacchiere-su-complottismi-fake.html) -- Secureworks Blog - - [Friendly Competition and a Cybersecurity Game to Prevent Attacks](https://www.secureworks.com/blog/friendly-competition-cybersecurity-game-to-prevent-attacks) - - [Protecting Against BEC Attacks](https://www.secureworks.com/blog/protecting-against-bec-attacks) - - [7 Tips to Anticipate Cloud Computing Security Risks](https://www.secureworks.com/blog/7-tips-to-anticipate-cloud-computing-security-risks) -- Schneier on Security - - [ZuoRAT Malware Is Targeting Routers](https://www.schneier.com/blog/archives/2022/06/zuorat-malware-is-targeting-routers.html) -- LockBoxx - - [Bootcamp #25: Alert Quality Review](http://lockboxx.blogspot.com/2022/06/bootcamp-25-alert-quality-review.html) -- JUMPSEC - - [JUMPSEC Sponsors Cyber Scheme](https://www.jumpsec.com/2022/06/30/jumpsec-sponsors-cyber-scheme/) -- Securelist - - [The SessionManager IIS backdoor](https://securelist.com/the-sessionmanager-iis-backdoor/106868/) -- Securityinfo.it - - [Vulnerabilità in decine di librerie crittografiche](https://www.securityinfo.it/2022/06/30/vulnerabilita-in-decine-di-librerie-crittografiche/?utm_source=rss&utm_medium=rss&utm_campaign=vulnerabilita-in-decine-di-librerie-crittografiche) - - [Container-escape in Azure Service Fabric per Linux](https://www.securityinfo.it/2022/06/30/container-escape-in-azure-service-fabric-per-linux/?utm_source=rss&utm_medium=rss&utm_campaign=container-escape-in-azure-service-fabric-per-linux) -- Instapaper: Unread - - [Hermit Apple è già riuscita a bloccare lo spyware](https://www.punto-informatico.it/hermit-apple-e-gia-riuscita-a-bloccare-lo-spyware/) - - [Uncovering Windows Registry Data and the Latest Mac Artifacts](https://www.forensicfocus.com/webinars/uncovering-windows-registry-data-and-the-latest-mac-artifacts/) - - [Cyber Triage 3.3.0](https://www.cybertriage.com/blog/releases/cyber-triage-3-3-0/) -- Forensic Focus - - [What Can You Tell Us About Your Password? A Contextual Approach](https://www.forensicfocus.com/webinars/what-can-you-tell-us-about-your-password-a-contextual-approach/) -- Security Affairs - - [Korean cybersecurity agency released a free decryptor for Hive ransomware](https://securityaffairs.co/wordpress/132770/malware/hive-ransomware-decryptor.html) - - [Experts blame North Korea-linked Lazarus APT for the Harmony hack](https://securityaffairs.co/wordpress/132759/hacking/harmony-hack-lazarus-apt.html) - - [Ex-Canadian government employee admits to being a member of the Russian cybercrime gang NetWalker](https://securityaffairs.co/wordpress/132753/cyber-crime/canadian-member-gang-netwalker-sentenced.html) - - [YTStealer info-stealing malware targets YouTube content creators](https://securityaffairs.co/wordpress/132743/malware/ytstealer-malware-dark-web.html) -- Dark Reading - - [Google: Hack-for-Hire Groups Present a Potent Threat](https://www.darkreading.com/threat-intelligence/google-hack-for-hire-groups-present-a-potent-threat) - - [18 Zero-Days Exploited So Far in 2022](https://www.darkreading.com/vulnerabilities-threats/18-zero-days-exploited-2022) - - [API Security Losses Total Billions, But It's Complicated](https://www.darkreading.com/application-security/api-security-losses-billions-complicated) - - [Exchange Servers Backdoored Globally by SessionManager](https://www.darkreading.com/attacks-breaches/new-sessionmanager-exchange-server-backdoor-globally) - - [Study Reveals Traditional Data Security Tools Have a 60% Failure Rate Against Ransomware and Extortion](https://www.darkreading.com/attacks-breaches/study-reveals-traditional-data-security-tools-have-a-60-failure-rate-against-ransomware-and-extortion) - - [A Fintech Horror Story: How One Company Prioritizes Cybersecurity](https://www.darkreading.com/edge-articles/a-fintech-horror-story-how-one-company-prioritizes-cybersecurity) - - [NXM Announces Platform That Protects Space Infrastructure and IoT Devices From Cyberattacks](https://www.darkreading.com/iot/nxm-announces-platform-that-protects-space-infrastructure-and-iot-devices-from-cyberattacks) - - [Critical ManageEngine ADAudit Plus Vulnerability Allows Network Takeover, Mass Data Exfiltration](https://www.darkreading.com/vulnerabilities-threats/manageengine-adaudit-plus-vulnerability-network-takeover-data-exfiltration) - - [Zero-Days Aren't Going Away Anytime Soon & What Leaders Need to Know](https://www.darkreading.com/attacks-breaches/zero-days-aren-t-going-away-anytime-soon-and-what-leaders-need-to-know) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Article by Offensive Security: Weaponizing and Abusing Hidden Functionalities Contained in Office Document Properties](https://www.reddit.com/r/netsecstudents/comments/voewio/article_by_offensive_security_weaponizing_and/) - - [Interview Question - How to filter out a large number of false positives from scanning tools?](https://www.reddit.com/r/netsecstudents/comments/voiojn/interview_question_how_to_filter_out_a_large/) - - [Is there someone I can query haveibeenpwned word lists?](https://www.reddit.com/r/netsecstudents/comments/vo3qml/is_there_someone_i_can_query_haveibeenpwned_word/) - - [Learning CTI](https://www.reddit.com/r/netsecstudents/comments/voe9zj/learning_cti/) - - [Passed eJPT but](https://www.reddit.com/r/netsecstudents/comments/vod701/passed_ejpt_but/) - - [Pretty cool training site TCM](https://www.reddit.com/r/netsecstudents/comments/vnwhf1/pretty_cool_training_site_tcm/) -- KCon黑客大会 - - [KCon宠粉群成立！进群精美周边送不停](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651134792&idx=1&sn=17da312bfb5087c6680baf917e6af83a&chksm=f2c11a28c5b6933ed3971d8f5552546bb0159eb5b7018f4a7266b50e033bc86ca372c822ece8&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit](https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html) - - [DevOps vs SRE: Differences & Similarities](https://www.trendmicro.com/en_us/devops/22/f/devops-vs-sre.html) - - [Hacking the Crypto-monetized Web](https://www.trendmicro.com/en_us/research/22/f/hacking-the-crypto-monetized-web.html) -- The Register - Security - - [OpenSea phishing threat after rogue insider leaks customer email addresses](https://go.theregister.com/feed/www.theregister.com/2022/06/30/opensea_data_breach_phishing/) - - [Jenkins warns of security holes in these 25 plugins](https://go.theregister.com/feed/www.theregister.com/2022/06/30/jenkins_plugins_security_advisories/) - - [California state's gun control websites expose 10 years of personal data](https://go.theregister.com/feed/www.theregister.com/2022/06/30/california_websites_expose_personal_data/) - - [Google battles bots, puts Workspace admins on alert](https://go.theregister.com/feed/www.theregister.com/2022/06/30/google_workspace_admins_alert/) - - [Israel plans ‘Cyber-Dome’ to defeat digital attacks from Iran and others](https://go.theregister.com/feed/www.theregister.com/2022/06/30/israel_cyber_dome/) -- 山石网科安全技术研究院 - - [Windows UAF 漏洞CVE-2021-34486分析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494357&idx=1&sn=b4bd92c79d8a7812aeea975d6cda69c3&chksm=fa523f6bcd25b67dc4ebaac554c2b09719c95aca595aa852ead35aec080902dfcd00dab27e15&scene=58&subscene=0#rd) -- 青藤云安全 - - [攻防盲盒首发！「五行侦察兵」分享蓝队作战图鉴](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650835943&idx=1&sn=19f66b4a70a9a3855ceb9529fe3d2c30&chksm=80dbe842b7ac6154cc3f0249f3041546ac7a50d9bde5ac5b166ef651bac1ac45489f170729c4&scene=58&subscene=0#rd) -- 火线Zone - - [陈宇（Aqua）-安全->云安全->多云安全](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495844&idx=1&sn=3a053adf4fe6154a6aa1150b80e3c930&chksm=eaa97884dddef192fadb7d5d72bd538ddb66ad251c6b794244e38149c075aa647eaeda7d945a&scene=58&subscene=0#rd) -- Graham Cluley - - [Black Basta ransomware – what you need to know](https://www.tripwire.com/state-of-security/security-data-protection/black-basta-ransomware-what-you-need-to-know/) - - [How to get Fortune 500 cybersecurity without the hefty price tag](https://grahamcluley.com/feed-sponsor-solcyber-2/) - - [NFT marketplace OpenSea warns of data breach that could lead to phishing attacks](https://grahamcluley.com/nft-marketplace-opensea-warns-of-data-breach-that-could-lead-to-phishing-attacks/) - - [Smashing Security podcast #281: Debug ransomware and win $1,000,000, period-tracking apps, and AI gets emotional](https://grahamcluley.com/smashing-security-podcast-281/) -- 安全牛 - - [第十届《中国网络安全企业100强》调研启动，信创能力成为正式考量指标](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115467&idx=1&sn=72ea80022b099590f7fb7591a91200e3&chksm=bd147f188a63f60e97fde8b3ae975fcec5d5c65f8630d451e24c2a2dfd9803cb8c0961bb5227&scene=58&subscene=0#rd) - - [​防范未授权访问攻击的10项安全措施](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115467&idx=2&sn=7be6170b018c25ca4244140d7f6e2a3e&chksm=bd147f188a63f60e745435d291c9a5e781db855fb3f73b952b8446bf05f0e0480c73dd113ff7&scene=58&subscene=0#rd) -- NVISO Labs - - [Enforcing a Sysmon Archive Quota](https://blog.nviso.eu/2022/06/30/enforcing-a-sysmon-archive-quota/) -- GobySec - - [直播 | Goby 技术分享直播来袭](https://mp.weixin.qq.com/s?__biz=MzI4MzcwNTAzOQ==&mid=2247516819&idx=1&sn=80e5549fe67956ce8e21549b20abdebd&chksm=eb846933dcf3e02502157a22b69c2d374951f585a04d66dafc379bbdc3da1a062b981c7636a6&scene=58&subscene=0#rd) -- 锦行信息安全 - - [【燃烧吧！天才程序员】——看ATEC科技精英如何破解网络诈骗](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489953&idx=1&sn=1af4cda3aded58e6897f483de95cf1fe&chksm=9799e204a0ee6b12fbceb97060e1ae83153d6643e43d806fbb67fa3be9f184573f72654e79b1&scene=58&subscene=0#rd) -- 虎符智库 - - [反电信网络诈骗法（草案）二审稿解读：四方面变化需关注](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247487784&idx=1&sn=733f1faa702a6efc107b9844448de4c6&chksm=971e7c2aa069f53cdcda32fb6830e1e614a6bd10cbb5add5d2662be5f001645f5257d93a74f6&scene=58&subscene=0#rd) -- Threatpost - - [ZuoRAT Can Take Over Widely Used SOHO Routers](https://threatpost.com/zuorat-soho-routers/180113/) - - [A Guide to Surviving a Ransomware Attack](https://threatpost.com/a-guide-to-surviving-a-ransomware-attack/180110/) -- 三六零CERT - - [CVE-2022-32532：Apache Shiro 身份认证绕过漏洞](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491116&idx=1&sn=21f9abfcf2de1dca06f6cbd909049206&chksm=fe251b2dc952923b53b62afe304cd9f38a09bf7b06c9a7161e8a246fa4f83799aee96e9d2691&scene=58&subscene=0#rd) - - [安全日报（2022.06.30）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491116&idx=2&sn=cc53174e78e521a3087b767958f14160&chksm=fe251b2dc952923bf801b5fe2c18b399c5a2fe47c1c67915cd9f59b1d56fd98f6071bba6b214&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jun. 30th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495595&idx=1&sn=083142750226f4ed930540fc6775acfe&chksm=ce96a295f9e12b8334edaa4bebe51ab058a709077b9b7eeefdf61d93660545ff57cdbb1f86b4&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [【公告】JSRC五月英雄榜单揭晓](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727834896&idx=1&sn=9a17eacafaa9c46b433e8da09c5fba1c&chksm=8050a298b7272b8eb70ced60a2d40ba15711f72b0ac4f4b6da3455f9cb6bdcb48920673a8f20&scene=58&subscene=0#rd) -- Deep Web - - [onion for New York Times without the paywall?](https://www.reddit.com/r/deepweb/comments/vo9o8w/onion_for_new_york_times_without_the_paywall/) - - [Is dark web a part of deep web?](https://www.reddit.com/r/deepweb/comments/vol43n/is_dark_web_a_part_of_deep_web/) -- 长亭安全课堂 - - [前20！长亭科技入选2022安在“大众点评”百强榜](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247489812&idx=1&sn=bec8310e048c78f6222a81e7c3bb6b6e&chksm=96f40679a1838f6fbbfed5be7f12f441f1441d5a67c44887f3ccbae35f43470336e3ee40b082&scene=58&subscene=0#rd) -- 雷神众测 - - [Hackthebox - Paper 靶场实战](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498234&idx=1&sn=04cf9f2adb4c9f0206fcfb37f752a595&chksm=f2584a89c52fc39fe8f56c1d75b29eb4d003a984883bb11c7c752748522fbe2954a1e93dc703&scene=58&subscene=0#rd) -- Social Engineering - - [I want to seem mean and petty , after being a wet blanket almost my entire life .](https://www.reddit.com/r/SocialEngineering/comments/vog8jg/i_want_to_seem_mean_and_petty_after_being_a_wet/) -- Deeplinks - - [Should You Really Delete Your Period Tracking App?](https://www.eff.org/deeplinks/2022/06/should-you-really-delete-your-period-tracking-app) - - [EFF to File Amicus Brief in First U.S. Case Challenging Dragnet Keyword Warrant](https://www.eff.org/deeplinks/2022/06/eff-file-amicus-brief-first-us-case-challenging-dragnet-keyword-warrant) - - [Digital Rights Updates with EFFector 34.4](https://www.eff.org/deeplinks/2022/06/digital-rights-updates-effector-344) - - [Keeping Your Smart Home Secure & Private](https://www.eff.org/deeplinks/2022/06/keeping-your-smart-home-secure-private) -- TorrentFreak - - [Cloudflare & Media Companies Agree to Modify “Power Grab” Piracy Injunction](https://torrentfreak.com/cloudflare-media-companies-agree-to-modify-power-grab-injunction-220630/) - - [Football Piracy: Premier League Granted Extension to ISP Blocking Order](https://torrentfreak.com/football-piracy-premier-league-granted-extension-to-isp-blocking-order-220630/) -- 关键基础设施安全应急响应中心 - - [【攻防演练专题】上线预告](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528161&idx=1&sn=17ac00bcca6b5a01bd225bb75c68adf6&chksm=c1e9e2b0f69e6ba6f7e37bba82b1a97753d7b81a8e2f866c63193615575670fc3d186f4c268b&scene=58&subscene=0#rd) - - [2022大数据十大关键词](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528161&idx=2&sn=6aee021b6e9b6d1132898b544fa29490&chksm=c1e9e2b0f69e6ba6150ef9fcdd278b813bdb3f65c258ac038126ce94bbc45a376f075372fe21&scene=58&subscene=0#rd) - - [构建主动安全态势！美国务院部门提出新网络战略](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528161&idx=3&sn=323a7f0b795022b35a16ffcee3a2db96&chksm=c1e9e2b0f69e6ba69ae83709cdf58bc2c34f71f7b0bfedec48bf77101cda3926363ea96eeda4&scene=58&subscene=0#rd) - - [企业保护API安全迫在眉睫](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528161&idx=4&sn=f8cbd024d1c592bff9847a3c36153800&chksm=c1e9e2b0f69e6ba6dd0023a93d65faae0541cf8faede419f90560b7cc0ec5f650cf1c2890e71&scene=58&subscene=0#rd) -- 胖哈勃 - - [PWNHUB赏金计划｜专属你 “独一无二” 的夏日认证](https://mp.weixin.qq.com/s?__biz=MzI2OTUzMzg3Ng==&mid=2247498507&idx=1&sn=4b21bf3c8c7be7c10cef5da6c5a5ee76&chksm=eadc6cd0ddabe5c652786e21bea6d94ec95f5927316ae4971bd7aeed3c1859ebd65580ec4412&scene=58&subscene=0#rd) -- 互联网安全内参 - - [微软云服务爆容器逃逸漏洞，攻击者可接管Linux集群](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504000&idx=1&sn=dd431b937f81c9d207faa0e84d5e0ff1&chksm=ebfa97a0dc8d1eb61735870c66e1a5f7306d5bb2c304eb07eba979c076e11a986934b93a5f7d&scene=58&subscene=0#rd) - - [满帮、BOSS直聘恢复新用户注册，曾被网络安全审查约一年](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504000&idx=2&sn=ddbe323329eee038cc26996ac88971fb&chksm=ebfa97a0dc8d1eb613a4060c865a90f996428500839f16bd86b7261332e803a8bc977bcc9be3&scene=58&subscene=0#rd) - - [FBI警告：诈骗犯用Deepfake远程应聘美国公司居家办公岗位](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504000&idx=3&sn=964c47081058a93aa05f3de4aa7fa51a&chksm=ebfa97a0dc8d1eb68c2ec4b436432d7013bcbfeaae480eba79a9dadd1273bddec2f71d3265d8&scene=58&subscene=0#rd) - - [应用程序接口 (API) 防护技术发展研究及对策建议](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504000&idx=4&sn=c8cc0dd0f98839ab00fe0540302a4181&chksm=ebfa97a0dc8d1eb6c9282d0bd406d1f3b1f6528a5ff79b0100faea0efe6580a85f96c08c8f8b&scene=58&subscene=0#rd) -- 情报分析师 - - [刚刚！美国情报与研究局发布《网络安全战略》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650508845&idx=1&sn=0bba899640431f8f33c51365b85cd104&chksm=8716a066b0612970c862c3f5fedd19255de2678e75a6ba87576350bcc04fc528c2741520c01c&scene=58&subscene=0#rd) - - [【460页白皮书】普京人格特征、俄罗斯军事战略与俄乌地缘政治](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650508845&idx=2&sn=656b46e6548ffaa45d2f94b88ecc63cf&chksm=8716a066b0612970ae357284b6e3f1af58224a7849a29bc82e46be64d7121e34b441f2f6ffa7&scene=58&subscene=0#rd) - - [【情报教程】网络舆情的特点及分析研判的角度和方法](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650508845&idx=3&sn=32eb54b944ea1e536610cdbe7e81931a&chksm=8716a066b06129707699084fcb1031c754e0f7c5b1410f870702bff6565e5102294301317669&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [WiFi Pineapple E-Book is currently FREE from HAK5](https://www.reddit.com/r/HowToHack/comments/vo6h5r/wifi_pineapple_ebook_is_currently_free_from_hak5/) - - [Callow](https://www.reddit.com/r/HowToHack/comments/vojzld/callow/) - - [How does clicking on an email attachment gain access to your system?](https://www.reddit.com/r/HowToHack/comments/vo22md/how_does_clicking_on_an_email_attachment_gain/) - - [How deauth its work?](https://www.reddit.com/r/HowToHack/comments/vodlmx/how_deauth_its_work/) - - [Does anyone know of any good books about how to program networking protocols? I’m looking to learn in depth.](https://www.reddit.com/r/HowToHack/comments/vnwq9o/does_anyone_know_of_any_good_books_about_how_to/) -- /r/netsec - Information Security News & Discussion - - [Weaponizing and Abusing Hidden Functionalities Contained in Office Document Properties](https://www.reddit.com/r/netsec/comments/voetlt/weaponizing_and_abusing_hidden_functionalities/) - - [Toll fraud malware: How an Android application can drain your wallet](https://www.reddit.com/r/netsec/comments/vocrtq/toll_fraud_malware_how_an_android_application_can/) - - [Cloudy with a Chance of Risk: Managing Risks in Cloud-Managed OT Networks](https://www.reddit.com/r/netsec/comments/vochqz/cloudy_with_a_chance_of_risk_managing_risks_in/) - - [RanSim: a ransomware simulation script written in PowerShell. Useful for testing your defenses and backups in a controlled simulation. The same script is used for encryption and decryption.](https://www.reddit.com/r/netsec/comments/voii89/ransim_a_ransomware_simulation_script_written_in/) - - [Golang code review notes by elttam](https://www.reddit.com/r/netsec/comments/vo048m/golang_code_review_notes_by_elttam/) - - [Flubot: the evolution of a notorious Android Banking Malware](https://www.reddit.com/r/netsec/comments/voj5wk/flubot_the_evolution_of_a_notorious_android/) - - [How to expose a potential cybercriminal due to misconfigurations](https://www.reddit.com/r/netsec/comments/vobx6b/how_to_expose_a_potential_cybercriminal_due_to/) - - [What the 3 major data breaches can teach us](https://www.reddit.com/r/netsec/comments/voc30y/what_the_3_major_data_breaches_can_teach_us/) -- SecPulse安全脉搏 - - [【漏洞预警】Apache Shiro认证绕过漏洞](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044539&idx=1&sn=844200f7ded4e407c1f60c4eaecf3c73&chksm=803fa8e5b74821f35d4b5770f899d11b40c4f3a94a22effe163efe173282d1d87eb8d9b1a296&scene=58&subscene=0#rd) -- GeekPwn - - [FBI 警告｜你那个来远程面试的准同事可能是个深度伪造的诈骗犯](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650344931&idx=1&sn=26d1ef50f19b9e0bc0a4406fdeff1a64&chksm=8740b626b0373f30b55a79b1fa9fe31724596727bcc239caa681b45767bca8139ce3ce9980f9&scene=58&subscene=0#rd) - - [美国国家安全局（NSA）“酸狐狸”漏洞攻击武器平台技术分析报告](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650344931&idx=2&sn=3e7cce36cd8fafedd7691fd8754476b9&chksm=8740b626b0373f30625fd0948617c121549bb31d5fe75b3f927102651251db845aa9935d75d9&scene=58&subscene=0#rd) -- 陌陌安全 - - [夏日炎炎，MMSRC季度抽奖更甜](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487224&idx=1&sn=5c05f9cf3a9cddafcec215de7eb7d942&chksm=eadc049addab8d8c208fe4d25fb465549b607087e84e810a090a72dac6d2f6d2f73de6c3c6a3&scene=58&subscene=0#rd) -- 默安科技 - - [逐鹿安全沙龙·六月期：数字世界“呼唤”更安全的软件](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492380&idx=1&sn=3556c8aeba9b1b87719d08a51d6cd924&chksm=e93b143ede4c9d28f591b6490dd5ab3c63bf3270d3a34d360dd92d5efebed623c68e0217a7f6&scene=58&subscene=0#rd) -- Troy Hunt's Blog - - [Understanding Have I Been Pwned's Use of SHA-1 and k-Anonymity](https://www.troyhunt.com/understanding-have-i-been-pwneds-use-of-sha-1-and-k-anonymity/) -- Computer Forensics - - [Data recovery on a Lumia 550](https://www.reddit.com/r/computerforensics/comments/vohlvg/data_recovery_on_a_lumia_550/) - - [Feishu / Lark Data Extraction](https://www.reddit.com/r/computerforensics/comments/vol6pt/feishu_lark_data_extraction/) - - [How can I create my own tool to acquire RAM memory?](https://www.reddit.com/r/computerforensics/comments/voinph/how_can_i_create_my_own_tool_to_acquire_ram_memory/) - - [Time Machine encrypted with Filevault2 wont accept known password.](https://www.reddit.com/r/computerforensics/comments/vo2tiy/time_machine_encrypted_with_filevault2_wont/) -- 腾讯玄武实验室 - - [每日安全动态推送(06-30)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958554&idx=1&sn=87e913e9ae01ca409769c92d34980eee&chksm=8baecd85bcd944939f400f29b3002c6028002bb5acf4e60781fe23267353eaee73d6b3d22d5d&scene=58&subscene=0#rd) -- 看雪学院 - - [LLVM PASS类pwn题入门](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456164&idx=1&sn=b3277d76441ebe7ca91efa63df278926&chksm=b18e20ee86f9a9f84bbe8e365dc264cd4cb9a76806c72b3aa275e906fd7deeb670f919d5b3cb&scene=58&subscene=0#rd) - - [涉案金额超8800万美元！Avaya员工因销售盗版许可证被起诉](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456164&idx=2&sn=8d330dadc9c86d602427f13ea4b9b171&chksm=b18e20ee86f9a9f888bb15b0a0725b20af36fbafa4ac2a3ac7954e75f6655b028361c26c9151&scene=58&subscene=0#rd) - - [精品课程 | 4h入门PHP代码审计之反序列化](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456164&idx=3&sn=42247f8b89842e32ef934e552e22fddc&chksm=b18e20ee86f9a9f8631073f5994c2d1d3ddd4f5dcdd6af244404c06b7451bdf828fe70e2673f&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [疫情之下如何保护个人信息](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491128&idx=1&sn=def8dc1181b70951ad3019d55eb4f796&chksm=feb59f2bc9c2163d7331b577ee3538dad471c0debd3552f061c51ec31c39ec2774d7aa37cad4&scene=58&subscene=0#rd) - - [网络安全日常防护措施小贴士](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491128&idx=2&sn=7200fc63762a80dd6b8b2c5ff07705c5&chksm=feb59f2bc9c2163d80be9655428b4ef8a188ddbc2c02f633d96ef9ef03f0cdfe9e7e160940d0&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [杀软0检出！Confucius APT组织近期新活动深入分析](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247489107&idx=1&sn=691ce8e78f593d84fb3a84a61b741dda&chksm=f9ee7aecce99f3fad897bcf4290600c0c308353aac80d675f85113bf7b0308cc7a505fe62d30&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [8K HDR!｜为 Chromium 实现 HEVC 硬解 - 原理/实测指南](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247495926&idx=1&sn=cfc8161d565b96c47b2211002c2e5c33&chksm=e9d33b14dea4b202216ab6e26654c90d3ad2457d5b3b6b6b33cecf61e77a3fe45b222fa7df92&scene=58&subscene=0#rd) -- 代码卫士 - - [UnRAR二进制中出现路径遍历缺陷，可导致在Zimbra上执行远程代码](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512652&idx=1&sn=1f0239704b1c73ee0e257706adbbdb7b&chksm=ea948326dde30a30d018078b393ff08ad41338fe3d025707bd85876ba4871ec610ccf27fe747&scene=58&subscene=0#rd) - - [微软 Azure FabricScape 漏洞可被用于劫持 Linux 集群](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512652&idx=2&sn=41462de310311abaadf3c81fa66dab19&chksm=ea948326dde30a30b6628410dbec18f7095b4ceac398685c020321f11a956d0d0c573779d4f5&scene=58&subscene=0#rd) - - [亚马逊悄悄修复安卓相册 app 中的高危漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512652&idx=3&sn=2b4e8e13ba0800dd1fc7f8468b6a0829&chksm=ea948326dde30a308994628b3b2468662db78d6469ed717a69fd91089fce0e26e5820559f664&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】使用scapy进行ARP攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773270&idx=1&sn=2f0ab6ea778d910c702f2cf806c2e856&chksm=889364b9bfe4edaf52b6d843a9e0179476195d14a8143a1ddb4db3273b4189de6ba3faf6549e&scene=58&subscene=0#rd) - - [【安全头条】Bing引擎“意外”通过邮箱注册账号引发隐私思考](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773270&idx=2&sn=6784b46d37171208f35ccc2dff8f321a&chksm=889364b9bfe4edaf950fd9db7f6b0fbccbfdc77b8d66c3a81b868a440ce240eadd1cdd986e73&scene=58&subscene=0#rd) -- KitPloit - PenTest Tools! - - [SharpWSUS - CSharp tool for lateral movement through WSUS](http://www.kitploit.com/2022/06/sharpwsus-csharp-tool-for-lateral.html) diff --git a/archive/2022/2022-07-02.md b/archive/2022/2022-07-02.md deleted file mode 100644 index 7c37ecd401..0000000000 --- a/archive/2022/2022-07-02.md +++ /dev/null @@ -1,369 +0,0 @@ -# 每日安全资讯（2022-07-02） - -- Sec-News 安全文摘 - - [K8s 之 ApiServer 组件风险](https://wiki.ioin.in/url/092B) -- HackerOne Hacker Activity - - [June 2022 Incident Report](https://hackerone.com/reports/1622449) - - [Unauthorized Access - downgraded admin roles to none can still edit projects through brupsuite](https://hackerone.com/reports/1607756) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-July-1) -- NOSEC 安全讯息平台 - 漏洞预警 - - [GitLab远程代码执行漏洞（CVE-2022-2185）](https://nosec.org/home/detail/5023.html) -- Security Boulevard - - [Making CMMC Compliance Affordable For SMBs](https://securityboulevard.com/2022/07/making-cmmc-compliance-affordable-for-smbs/) - - [Wicked Good Development: Vulnerability Drills – the Intention, Habit, and Impact](https://securityboulevard.com/2022/07/wicked-good-development-vulnerability-drills-the-intention-habit-and-impact/) - - [Security BSides Athens 2022 – Jessica Roussou’s ‘Hearty Welcome To Security BSides Athens 2022’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-jessica-roussous-hearty-welcome-to-security-bsides-athens-2022/) - - [Joy Of Tech® ‘My Body/My Data!’](https://securityboulevard.com/2022/07/joy-of-tech-my-body-my-data/) - - [DIDs approved to W3C recommendation](https://securityboulevard.com/2022/07/dids-approved-to-w3c-recommendation/) - - [CISO Talk EP 22 – Diversity, Equity and Inclusion in Security – TechStrong TV](https://securityboulevard.com/2022/07/ciso-talk-ep-22-diversity-equity-and-inclusion-in-security-techstrong-tv/) - - [Security BSides Athens 2022 ‘Cinematic Intro to Security BSides Athens 2022’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-cinematic-intro-to-security-bsides-athens-2022/) - - [Facial recognition in Oz](https://securityboulevard.com/2022/07/facial-recognition-in-oz/) - - [GUEST ESSAY: The post-pandemic challenges of securely managing employee endpoints](https://securityboulevard.com/2022/07/guest-essay-the-post-pandemic-challenges-of-securely-managing-employee-endpoints/) - - [USENIX Enigma 2022 – Panel Moderator: Mike Masnick, Panel Speakers: Cathy Gellis, Kate Klonick, Adelin Cai ‘Understanding Section 230’](https://securityboulevard.com/2022/07/usenix-enigma-2022-panel-moderator-mike-masnick-panel-speakers-cathy-gellis-kate-klonick-adelin-cai-understanding-section-230/) -- SecWiki News - - [SecWiki News 2022-07-01 Review](http://www.sec-wiki.com/?2022-07-01) -- Sploitus.com Exploits RSS Feed - - [WiFi Mouse 1.7.8.5 - Remote Code Execution(v2) exploit](https://sploitus.com/exploit?id=EDB-ID:50972&utm_source=rss&utm_medium=rss) - - [Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37825&utm_source=rss&utm_medium=rss) - - [PHP Library Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167683&utm_source=rss&utm_medium=rss) - - [BigBlueButton 2.3 / 2.4.7 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37824&utm_source=rss&utm_medium=rss) - - [WiFi Mouse 1.7.8.5 - Remote Code Execution Exploit (2) exploit](https://sploitus.com/exploit?id=1337DAY-ID-37823&utm_source=rss&utm_medium=rss) - - [Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:167684&utm_source=rss&utm_medium=rss) - - [PHP Library Remote Code Execution Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37827&utm_source=rss&utm_medium=rss) - - [BigBlueButton 2.3 / 2.4.7 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167682&utm_source=rss&utm_medium=rss) - - [TypeORM SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167634&utm_source=rss&utm_medium=rss) - - [TypeORM SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37826&utm_source=rss&utm_medium=rss) - - [Classified Listing 2.2.9 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167635&utm_source=rss&utm_medium=rss) - - [Exploit for Missing Authentication for Critical Function in F5 Big-Ip Access Policy Manager exploit](https://sploitus.com/exploit?id=052EB402-154C-59B2-80CF-42FF91E8B731&utm_source=rss&utm_medium=rss) -- 安全牛 - - [随着混合办公环境的到来，企业防火墙应该如何演进————思科新一代防火墙Secure Firewall 3100 系列发布](https://www.aqniu.com/industry/85320.html) - - [网络攻防演练中的员工安全意识培养](https://www.aqniu.com/industry/85316.html) - - [以一体化零信任方案构建新信任体系](https://www.aqniu.com/industry/85313.html) - - [用AI攻击AI？对抗性机器学习的威胁与防御](https://www.aqniu.com/industry/85310.html) - - [悬镜安全携手OpenChain，共同守护中国软件供应链安全](https://www.aqniu.com/industry/85305.html) - - [Tech Talk · 云技术有话聊 | 如何构建云安全中心？](https://www.aqniu.com/industry/85301.html) - - [安全特辑|《安全软件工厂白皮书》知识分享](https://www.aqniu.com/industry/85297.html) - - [全融合 全场景 可信任 | 数字认证密码云战略开启密码交付新模式](https://www.aqniu.com/industry/85285.html) - - [2022信创分类排行榜 | 慧盾安全名列信息安全企业30强](https://www.aqniu.com/industry/85279.html) - - [31省市数据要素“十四五”规划重点](https://www.aqniu.com/industry/85277.html) - - [世平信息：数字经济新业态下数据安全合规治理的思考与实践](https://www.aqniu.com/industry/85267.html) - - [世平信息首席科学家吕喆：构建以数据和人员为中心的安全能力](https://www.aqniu.com/industry/85266.html) - - [上讯信息获CNNVD技术支撑单位2021年度新秀奖！](https://www.aqniu.com/industry/85261.html) - - [上讯信息荣获“鑫智奖·2022金融数据智能数据治理与数据平台创新优秀解决方案”奖](https://www.aqniu.com/industry/85258.html) -- 世事难料，保持低调 - - [[原](二)大话深度学习编译器中的自动调优·DSL与IR](https://blog.csdn.net/ariesjzj/article/details/124760878) - - [[原](一)大话深度学习编译器中的自动调优·前言](https://blog.csdn.net/ariesjzj/article/details/122891904) -- 跳跳糖 - 安全与分享社区 - - [Shiro 历史漏洞分析](https://tttang.com/archive/1645/) -- Files ≈ Packet Storm - - [Packet Storm New Exploits For June, 2022](https://packetstormsecurity.com/files/167685/202206-exploits.tgz) - - [Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal](https://packetstormsecurity.com/files/167684/ZSL-2022-5709.txt) - - [PHP Library Remote Code Execution](https://packetstormsecurity.com/files/167683/jahx221-exec.txt) - - [BigBlueButton 2.3 / 2.4.7 Cross Site Scripting](https://packetstormsecurity.com/files/167682/bigbluebutton23-xss.txt) - - [CPSIoTSec 2022 Call For Papers](https://packetstormsecurity.com/files/167681/cpsiotsec2022-cfp.txt) - - [Hardwear.io NL 2022 Call For Papers](https://packetstormsecurity.com/files/167680/hardwearioNL2022-cfp.txt) - - [Red Hat Security Advisory 2022-5483-01](https://packetstormsecurity.com/files/167679/RHSA-2022-5483-01.txt) - - [Red Hat Security Advisory 2022-5481-01](https://packetstormsecurity.com/files/167678/RHSA-2022-5481-01.txt) - - [Red Hat Security Advisory 2022-5245-01](https://packetstormsecurity.com/files/167677/RHSA-2022-5245-01.txt) - - [Red Hat Security Advisory 2022-5475-01](https://packetstormsecurity.com/files/167676/RHSA-2022-5475-01.txt) - - [Red Hat Security Advisory 2022-5257-01](https://packetstormsecurity.com/files/167675/RHSA-2022-5257-01.txt) - - [Red Hat Security Advisory 2022-5439-01](https://packetstormsecurity.com/files/167674/RHSA-2022-5439-01.txt) - - [Red Hat Security Advisory 2022-5249-01](https://packetstormsecurity.com/files/167673/RHSA-2022-5249-01.txt) - - [Red Hat Security Advisory 2022-5251-01](https://packetstormsecurity.com/files/167672/RHSA-2022-5251-01.txt) - - [Red Hat Security Advisory 2022-5244-01](https://packetstormsecurity.com/files/167671/RHSA-2022-5244-01.txt) - - [Red Hat Security Advisory 2022-5479-01](https://packetstormsecurity.com/files/167670/RHSA-2022-5479-01.txt) - - [Red Hat Security Advisory 2022-5476-01](https://packetstormsecurity.com/files/167669/RHSA-2022-5476-01.txt) - - [Red Hat Security Advisory 2022-5263-01](https://packetstormsecurity.com/files/167668/RHSA-2022-5263-01.txt) - - [Red Hat Security Advisory 2022-5482-01](https://packetstormsecurity.com/files/167667/RHSA-2022-5482-01.txt) - - [Red Hat Security Advisory 2022-5242-01](https://packetstormsecurity.com/files/167666/RHSA-2022-5242-01.txt) - - [Red Hat Security Advisory 2022-5474-01](https://packetstormsecurity.com/files/167665/RHSA-2022-5474-01.txt) - - [Red Hat Security Advisory 2022-5480-01](https://packetstormsecurity.com/files/167664/RHSA-2022-5480-01.txt) - - [Red Hat Security Advisory 2022-5250-01](https://packetstormsecurity.com/files/167663/RHSA-2022-5250-01.txt) - - [Red Hat Security Advisory 2022-5252-01](https://packetstormsecurity.com/files/167662/RHSA-2022-5252-01.txt) - - [Ubuntu Security Notice USN-5499-1](https://packetstormsecurity.com/files/167661/USN-5499-1.txt) -- 安全客-有思想的安全新媒体 - - [CVE-2022-2185：GitLab 远程代码执行漏洞](https://www.anquanke.com/post/id/275796) - - [CVE-2022-25165：AWS VPN 客户端中的 SYSTEM 权限提升](https://www.anquanke.com/post/id/275263) - - [RSAC 2022 创新沙盒系列分析（五）](https://www.anquanke.com/post/id/275683) - - [一个xray POC的编写全过程](https://www.anquanke.com/post/id/275480) - - [沃尔玛否认遭勒索软件攻击](https://www.anquanke.com/post/id/275696) -- FreeBuf网络安全行业门户 - - [FreeBuf 周报 | 8月1日起施行《互联网用户账号信息管理规定》；加拿大前政府雇员参与勒索攻击](https://www.freebuf.com/articles/337969.html) - - [「斗象攻防演练宝典」之“红队隐蔽隧道检测”](https://www.freebuf.com/articles/network/337949.html) - - [攻防演练中如何“防钓鱼” | FreeBuf甲方群话题讨论](https://www.freebuf.com/articles/neopoints/337941.html) - - [BlueHound-一款自研主机威胁狩猎工具](https://www.freebuf.com/sectool/337937.html) - - [直指word附件，勒索软件AstraLocker 2.0来袭！](https://www.freebuf.com/news/337881.html) - - [MuddyWater 持续瞄准中东发起攻击](https://www.freebuf.com/articles/network/337876.html) - - [身处高频实战攻防时代 | FreeBuf咨询行业攻防视图发布](https://www.freebuf.com/news/337875.html) - - [国家互联网信息办公室发布《个人信息出境标准合同规定（征求意见稿）》](https://www.freebuf.com/news/337867.html) - - [vivo刘洪善：做安全行业的长期主义者](https://www.freebuf.com/articles/people/337856.html) -- 宋宝华 - - [[原]宋宝华：谈一谈Linux写时拷贝(COW)的安全漏洞（1）](https://blog.csdn.net/21cnbao/article/details/122396533) -- 安全脉搏 - - [干货 | 文件上传绕过的一次思路总结学习](https://www.secpulse.com/archives/182247.html) - - [记一奇葩弱口令到内网实战](https://www.secpulse.com/archives/182210.html) -- HackerNews - - [直指 word 附件，勒索软件 AstraLocker 2.0 来袭！](https://hackernews.cc/archives/39640) - - [国家互联网信息办公室发布《个人信息出境标准合同规定（征求意见稿）》](https://hackernews.cc/archives/39630) - - [微软云服务爆容器逃逸漏洞，攻击者可接管 Linux 集群](https://hackernews.cc/archives/39623) - - [MITRE 组织公布了 2022 年 CWE 最危险的 25 个软件弱点](https://hackernews.cc/archives/39620) - - [被盗 450GB 数据，AMD 将对 RansomHouse 发起调查](https://hackernews.cc/archives/39615) - - [Uber 前安全主管面临欺诈指控 曾隐瞒数据泄露事件](https://hackernews.cc/archives/39605) -- Der Flounder - - [Removing unwanted Time Machine backups from APFS-formatted Time Machine backup drives on macOS Monterey](https://derflounder.wordpress.com/2022/07/01/removing-unwanted-time-machine-backups-from-apfs-formatted-time-machine-backup-drives-on-macos-monterey/) -- Innost的专栏 - - [[原]边缘设备、系统及计算杂谈(18)——Meteor JS学习](https://blog.csdn.net/Innost/article/details/125437442) - - [[原]人生不惑，钻研技术——ZFS和LVM](https://blog.csdn.net/Innost/article/details/123587817) - - [[原]边缘设备、系统及计算杂谈(17)——Ansible学习](https://blog.csdn.net/Innost/article/details/123304050) - - [[原]边缘设备、系统及计算杂谈(16)——Apache学习](https://blog.csdn.net/Innost/article/details/122762436) -- 一个被知识诅咒的人 - - [[原]Python爬虫编程思想（153）：使用Scrapy抓取数据，抓取多个Url](https://blog.csdn.net/nokiaguy/article/details/125506849) - - [[原]Python爬虫编程思想（152）：使用Scrapy抓取数据，使用ItemLoader保存多条抓取的数据](https://blog.csdn.net/nokiaguy/article/details/125506738) - - [[原]Python爬虫编程思想（151）：使用Scrapy抓取数据，用ItemLoader保存单条抓取的数据](https://blog.csdn.net/nokiaguy/article/details/125464683) - - [[原]Python爬虫编程思想（150）：使用Scrapy抓取数据，并将抓取到的数据保存为多种格式的文件](https://blog.csdn.net/nokiaguy/article/details/125250642) - - [[原]Python爬虫编程思想（149）：使用Scrapy抓取数据，并通过XPath指定解析规则](https://blog.csdn.net/nokiaguy/article/details/125250572) - - [[原]Python爬虫编程思想（148）：在PyCharm中使用扩展工具运行Scrapy程序](https://blog.csdn.net/nokiaguy/article/details/125102180) - - [[原]Python爬虫编程思想（147）：在PyCharm中使用Scrapy](https://blog.csdn.net/nokiaguy/article/details/124994018) - - [[原]Python爬虫编程思想（146）：创建和使用Scrapy工程](https://blog.csdn.net/nokiaguy/article/details/124778211) - - [[原]Python爬虫编程思想（145）：使用Scrapy Shell抓取Web资源](https://blog.csdn.net/nokiaguy/article/details/124694521) - - [[原]Python爬虫编程思想（144）：爬虫框架Scrapy的基础知识](https://blog.csdn.net/nokiaguy/article/details/124677048) - - [[原]Python爬虫编程思想（143）：项目实战：多线程和多进程爬虫](https://blog.csdn.net/nokiaguy/article/details/124676867) - - [[原]Python爬虫编程思想（142）：多线程和多进程爬虫--多进程](https://blog.csdn.net/nokiaguy/article/details/123881304) - - [[原]Python爬虫编程思想（141）：多线程和多进程爬虫--生产者-消费者问题与queue模块](https://blog.csdn.net/nokiaguy/article/details/123881249) - - [[原]Python爬虫编程思想（140）：多线程和多进程爬虫--信号量](https://blog.csdn.net/nokiaguy/article/details/123881148) - - [[原]Python爬虫编程思想（139）：多线程和多进程爬虫--线程锁](https://blog.csdn.net/nokiaguy/article/details/123880984) - - [[原]Python爬虫编程思想（138）：多线程和多进程爬虫--从Thread类继承](https://blog.csdn.net/nokiaguy/article/details/123575697) - - [[原]Python爬虫编程思想（137）：多线程和多进程爬虫--Thread类与线程对象](https://blog.csdn.net/nokiaguy/article/details/123575537) - - [[原]Python爬虫编程思想（136）：多线程和多进程爬虫--Thread类与线程函数](https://blog.csdn.net/nokiaguy/article/details/123575424) - - [[原]Python爬虫编程思想（135）：多线程和多进程爬虫--Python与线程](https://blog.csdn.net/nokiaguy/article/details/123389171) - - [[原]Python爬虫编程思想（134）：多线程和多进程爬虫--线程与进程详解](https://blog.csdn.net/nokiaguy/article/details/123389085) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [伴随十年变迁，2022西湖论剑有哪些数据安全亮点](https://www.4hou.com/posts/4Kz7) - - [悬镜安全携手OpenChain，共同守护中国软件供应链安全](https://www.4hou.com/posts/3JyA) - - [MEGA云存储服务加密可被攻破](https://www.4hou.com/posts/ZX8g) - - [安全特辑|《安全软件工厂白皮书》知识分享](https://www.4hou.com/posts/ZXzQ) - - [谷歌警告称攻击者正在部署针对安卓和iOS用户的间谍软件](https://www.4hou.com/posts/pVZy) - - [嘶吼安全产业研究院融资洞察 | 2022上半年中国网络安全产业投融资洞察](https://www.4hou.com/posts/WBQE) - - [网络犯罪分子扩大攻击半径和勒索软件痛点](https://www.4hou.com/posts/8YqW) - - [全融合 全场景 可信任 | 数字认证密码云战略开启密码交付新模式](https://www.4hou.com/posts/VZ7z) -- 绿盟科技技术博客 - - [伊朗钢铁惨遭“黑手” 虎狼环伺 钢铁安全如何守护](http://blog.nsfocus.net/gonjeshk-dar/) - - [GitLab多个高危漏洞通告](http://blog.nsfocus.net/gitlab-202207/) - - [绿盟威胁情报月报-202206](http://blog.nsfocus.net/monthly-202206/) - - [【顶刊论文分享】告警分析全家桶](http://blog.nsfocus.net/dete-alert/) - - [Apache Shiro 身份认证绕过漏洞（CVE-2022-32532）通告](http://blog.nsfocus.net/apache-shiro-cve-2022-32532/) -- 天融信阿尔法实验室 - - [Hello world](http://blog.topsec.com.cn/farisoducirytycy/) -- MWR Publications - - [Top](https://labs.withsecure.com/publications/#top%22%20class=%22btn-gototop) - - [Printing Shellz](https://labs.withsecure.com/publications/printing-shellz/) - - [Threat Intelligence Report: Lazarus Group Campaign Targeting the Cryptocurrency Vertical](https://labs.withsecure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical/) - - [The Fake Cisco](https://labs.withsecure.com/publications/the-fake-cisco/) - - [Spoofing Call Stacks To Confuse EDRs](https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs/) - - [Scheduled Task Tampering](https://labs.withsecure.com/blog/scheduled-task-tampering/) - - [Faking Another Positive COVID Test](https://labs.withsecure.com/blog/faking-another-positive-covid-test/) -- Trail of Bits Blog - - [libmagic: The Blathering](https://blog.trailofbits.com/2022/07/01/libmagic-the-blathering/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Search Engine for Hackers/Analysts/Bloggers/OSINT Analysts and Threat Intelligence Experts! Here We Go!](http://ddanchev.blogspot.com/2022/07/search-engine-for-hackersanalystsblogge.html) - - [Rogue iFrame Injected Web Sites Lead to the AndroidOS/FakeInst/Trojan-SMS.J2ME.JiFake Mobile Malware](http://ddanchev.blogspot.com/2013/09/rogue-iframe-injected-web-sites-lead-to_16.html) - - [Bogus "Shocking Video" Content at Scribd Exposes Malware Monetization Scheme Through Parked Domains](http://ddanchev.blogspot.com/2013/06/bogus-video-content-at-scribd-exposes.html) - - [Exposing GRU's Unit 74455 "NotPetya" Malware Gang - An OSINT Analysis](http://ddanchev.blogspot.com/2022/06/exposing-grus-unit-74455-notpetya.html) -- blog.avast.com EN - - [DIDs approved to W3C recommendation](https://blog.avast.com/dids-approved-w3c) - - [Facial recognition in Oz](https://blog.avast.com/australia-facial-recognition) -- Didier Stevens - - [Overview of Content Published in June](https://blog.didierstevens.com/2022/07/01/overview-of-content-published-in-june-7/) -- Malwarebytes Labs - - [Ransomware review: June 2022](https://blog.malwarebytes.com/threat-intelligence/2022/07/ransomware-review-june-2022/) - - [AstraLocker 2.0 ransomware isn’t going to give you your files back](https://blog.malwarebytes.com/ransomware/2022/07/astralocker-2-0-ransomware-isnt-going-to-give-you-your-files-back/) - - [YTStealer targets YouTube content creators](https://blog.malwarebytes.com/scams/2022/07/ytstealer-targets-youtube-content-creators/) -- - - [Captain’s Log: June 2022](https://cornerpirate.com/2022/07/01/captains-log-june-2022/) -- KitPloit - PenTest & Hacking Tools - - [awsEnum - Enumerate AWS Cloud Resources Based On Provided Credential](http://www.kitploit.com/2022/07/awsenum-enumerate-aws-cloud-resources.html) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 27](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-27-3/) -- Intigriti - - [Enhanced Reporting Experience](https://blog.intigriti.com/2022/07/01/enhanced-reporting-experience/) -- Exploit的小站~ - - [[原]深入理解TornadoCash技术原理](https://blog.csdn.net/u011721501/article/details/124324991) - - [[原]2021区块链犯罪与司法实践报告](https://blog.csdn.net/u011721501/article/details/123641286) - - [[原]Tornado.Cash ZK过程深入解析](https://blog.csdn.net/u011721501/article/details/123008452) -- Hexacorn - - [Da Li’L World of DLL Exports and Entry Points, Part 5](https://www.hexacorn.com/blog/2022/07/01/da-lil-world-of-dll-exports-and-entry-points-part-5/) -- Security Café - - [Web Cache Deception attacks](https://securitycafe.ro/2022/07/01/web-cache-deception-attacks/) -- Misaki's Blog - - [LD_PRELOAD变量注入](https://misakikata.github.io/2022/07/LD-PRELOAD%E5%8F%98%E9%87%8F%E6%B3%A8%E5%85%A5/) -- The Daily Swig | Cybersecurity news and views - - [Gitlab patches critical RCE bug in latest security release](https://portswigger.net/daily-swig/gitlab-patches-critical-rce-bug-in-latest-security-release) - - [Cyber Europe 2022: EU completes large-scale cyber war game exercise](https://portswigger.net/daily-swig/cyber-europe-2022-eu-completes-large-scale-cyber-war-game-exercise) - - [Latest web hacking tools – Q3 2022](https://portswigger.net/daily-swig/latest-web-hacking-tools-q3-2022) -- 奇客Solidot–传递最新科技情报 - - [现代城市居民失去了半数肠道微生物群](https://www.solidot.org/story?sid=72005) - - [通用无人驾驶出租车挤在一起堵塞了旧金山的交通](https://www.solidot.org/story?sid=72004) - - [拉丁美洲主要城市近百万万人的死亡可能与极端气温有关](https://www.solidot.org/story?sid=72003) - - [MIT 建议造巴西大小的“太空气泡”帮地球降温](https://www.solidot.org/story?sid=72002) - - [AI 通过监听鸡叫声改善养殖鸡的福祉](https://www.solidot.org/story?sid=72001) - - [新算法提前一周预测未来犯罪准确率 90%](https://www.solidot.org/story?sid=72000) - - [中国科学家提议海王星核驱动探测器](https://www.solidot.org/story?sid=71999) - - [俄罗斯政府转向 Linux 操作系统](https://www.solidot.org/story?sid=71998) - - [美国最高法院裁决 EPA 无权规定减排指标](https://www.solidot.org/story?sid=71997) -- IntelTechniques Blog - - [The Privacy, Security, & OSINT Show – Episode 268](https://inteltechniques.com/blog/2022/07/01/the-privacy-security-osint-show-episode-268/) -- Securityinfo.it - - [Triplicano le armi per gli attacchi DDoS](https://www.securityinfo.it/2022/07/01/triplicano-le-armi-per-gli-attacchi-ddos/?utm_source=rss&utm_medium=rss&utm_campaign=triplicano-le-armi-per-gli-attacchi-ddos) - - [Pubblicata la lista delle 25 vulnerabilità più pericolose del 2022](https://www.securityinfo.it/2022/07/01/pubblicata-la-lista-delle-25-vulnerabilita-piu-pericolose-del-2022/?utm_source=rss&utm_medium=rss&utm_campaign=pubblicata-la-lista-delle-25-vulnerabilita-piu-pericolose-del-2022) -- TS-WAY - - [Weekly Threats N. 26 2022](https://www.ts-way.com/it/weekly-threats/2022/07/01/weekly-threats-n-26-2022/) -- Schneier on Security - - [Friday Squid Blogging: Multiplexing SQUIDs for X-ray Telescopes](https://www.schneier.com/blog/archives/2022/07/friday-squid-blogging-multiplexing-squids-for-x-ray-telescopes.html) - - [Analyzing the Swiss E-Voting System](https://www.schneier.com/blog/archives/2022/07/analyzing-the-swiss-e-voting-system.html) -- Pentestmag - - [Honeypots in Endpoint Security and How to Deploy a Honeynet](https://pentestmag.com/honeypots-in-endpoint-security-and-how-to-deploy-a-honeynet/?utm_source=rss&utm_medium=rss&utm_campaign=honeypots-in-endpoint-security-and-how-to-deploy-a-honeynet) -- daniel.haxx.se - - [5 years on OSS-Fuzz](https://daniel.haxx.se/blog/2022/07/01/5-years-on-oss-fuzz/) -- Il Disinformatico - - [Podcast RSI - Alexa fa parlare i morti, Google blocca spyware di stato, deepfake nei colloqui di lavoro online](http://attivissimo.blogspot.com/2022/07/podcast-rsi-alexa-fa-parlare-i-morti.html) - - [Alexa fa parlare i morti](http://attivissimo.blogspot.com/2022/07/alexa-fa-parlare-i-morti.html) -- SANS Internet Storm Center, InfoCON: green - - [ISC Stormcast For Friday, July 1st, 2022 https://isc.sans.edu/podcastdetail.html?id=8072, (Fri, Jul 1st)](https://isc.sans.edu/diary/rss/28806) -- Full Disclosure - - [JAHx221 - RCE in copy/pasted PHP compat libraries, json_decode function](https://seclists.org/fulldisclosure/2022/Jun/56) - - [Backdoor.Win32.EvilGoat.b / Weak Hardcoded Credentials](https://seclists.org/fulldisclosure/2022/Jun/55) - - [Backdoor.Win32.Coredoor.10.a / Authentication Bypass](https://seclists.org/fulldisclosure/2022/Jun/54) - - [Backdoor.Win32.Cafeini.b / Weak Hardcoded Credentials](https://seclists.org/fulldisclosure/2022/Jun/53) - - [BigBlueButton - Stored XSS in username (CVE-2022-31064)](https://seclists.org/fulldisclosure/2022/Jun/52) - - [typeorm CVE-2022-33171](https://seclists.org/fulldisclosure/2022/Jun/51) - - [🐞 CFP for Hardwear.io NL 2022 is OPEN!](https://seclists.org/fulldisclosure/2022/Jun/50) - - [[Extension: CPSIoTSec 2022] The Workshop on CPS&IoT Security and Privacy **Submission Deadline: July 25, 2022**](https://seclists.org/fulldisclosure/2022/Jun/49) -- Deeplinks - - [New Ipandetec’s Report Features ISPs’ Privacy Best Practices and Flaws in Panamá](https://www.eff.org/deeplinks/2022/06/new-ipandetecs-report-features-isps-privacy-best-practices-and-flaws-panama) -- The Register - Security - - [Cyberattack shuts down unemployment, labor websites across the US](https://go.theregister.com/feed/www.theregister.com/2022/07/01/gsi-cyberattack-state-unemployment/) - - [Crypto sleuths pin $100 million Harmony theft on Lazarus Group](https://go.theregister.com/feed/www.theregister.com/2022/07/01/lazarus-crypto-hack-harmony/) - - [Microsoft gives its partners power to change AD privileges on customer systems – without permission](https://go.theregister.com/feed/www.theregister.com/2022/07/01/gdap_permissionless_change_window/) -- Graham Cluley - - [FTC warns LGBTQ+ community of extortion scams targeting them on dating apps](https://www.bitdefender.com/blog/hotforsecurity/ftc-warns-lgbtq-community-of-extortion-scams-targeting-them-on-dating-apps/) - - [AMD held to ransom by gang that claims 450GB of data has been stolen](https://www.bitdefender.com/blog/hotforsecurity/amd-held-to-ransom-by-gang-that-claims-450gb-of-data-has-been-stolen/) -- Arturo Di Corinto - - [CODICE 2022 – LA VITA DIGITALE](https://dicorinto.it/formato/video/codice-2022-la-vita-digitale/) - - [Codice contro la disinformazione: iniziativa di Stampa Romana l’otto Luglio](https://dicorinto.it/formazione/codice-contro-la-disinformazione-iniziativa-di-stampa-romana-lotto-luglio/) -- KitPloit - PenTest Tools! - - [awsEnum - Enumerate AWS Cloud Resources Based On Provided Credential](http://www.kitploit.com/2022/07/awsenum-enumerate-aws-cloud-resources.html) -- Instapaper: Unread - - [Countering Hack-for-Hire Groups](https://blog.google/threat-analysis-group/countering-hack-for-hire-groups/#new_tab) - - [ZuoRAT malware hijacks SOHO Routers to spy in the vitims](https://securityaffairs.co/wordpress/132709/hacking/zuorat-soho-campaign.html) - - [Google rivela uno spyware governativo che fa vittime anche in Italia](https://attivissimo.blogspot.com/2022/07/google-rivela-uno-spyware-governativo.html) -- Computer Forensics - - [Free Course online: Introduction to Cybersecurity by Cisco Networking Academy](https://www.reddit.com/r/computerforensics/comments/vopww8/free_course_online_introduction_to_cybersecurity/) - - [what's the diffrent between logical copy to physical copy in windows forensics image?](https://www.reddit.com/r/computerforensics/comments/vou0j3/whats_the_diffrent_between_logical_copy_to/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [It just occurred to me that source address IP spoofing doesn't have any apparent reliable countermeasure. Is there an option I'm missing? How can we mitigate well-executed DDoS?](https://www.reddit.com/r/netsecstudents/comments/vpco1o/it_just_occurred_to_me_that_source_address_ip/) - - [Practical DevSecOps Professional vs DevSecOps Expert](https://www.reddit.com/r/netsecstudents/comments/vozmjg/practical_devsecops_professional_vs_devsecops/) -- 默安科技 - - [默安科技党支部入选浙江省网安行业党建工作示范点](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492522&idx=1&sn=99f7ecc6e7e4dd280150d0c3b154d24a&chksm=e93b1488de4c9d9e00f37b602c54385feda61c1fbd2c8aa448a2c64237aa6b4e29c760494645&scene=58&subscene=0#rd) -- TorrentFreak - - [‘Tarantino Doesn’t Own the Copyright to Pulp Fiction Screenplay NFTs’](https://torrentfreak.com/tarantino-doesnt-own-the-copyright-to-pulp-fiction-screenplay-nfts-220701/) - - [Seven Pirate IPTV Operators Sentenced to Almost Nine Years in Prison For Fraud](https://torrentfreak.com/seven-pirate-iptv-operators-sentenced-to-almost-nine-years-in-prison-for-fraud-220701/) -- 字节跳动技术团队 - - [海量数据冷热分离方案与实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496008&idx=1&sn=e0d73b2427a716e6b92e30205b42b9b1&chksm=e9d33aaadea4b3bc3051a0942ff275960e7705cb80f5b9cfdf8ad249a7115cc10854367d4c7c&scene=58&subscene=0#rd) -- 安恒威胁情报中心 - - [安恒高级安全威胁情报周报（2022.6.25~7.1）](https://mp.weixin.qq.com/s?__biz=MzI1MDU5NjYwNg==&mid=2247495962&idx=1&sn=f664b99e68e814314629db88bb6cd4f5&chksm=e9fd6c8bde8ae59d9e683021c13ec734d238d3c05a5f1823783eefaa01245ad5fa7d1bdda8c8&scene=58&subscene=0#rd) -- 代码卫士 - - [谷歌分析2022在野0day利用后，得出令人意外的结论](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512679&idx=1&sn=0c82369854fa59dc4fa12f66f58f28ba&chksm=ea94830ddde30a1bcbbf95307bc949733929927064b26c19848a6f40b73600efda78313738e8&scene=58&subscene=0#rd) - - [博通Brocade漏洞影响多家大厂的存储解决方案](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512679&idx=2&sn=59d6ec9653aaf6de0cfe4f624fe39695&chksm=ea94830ddde30a1b240c47dd7ca7dba361eef098dba1a723363510aee0f8b42df1d2234a6ae5&scene=58&subscene=0#rd) -- Security Affairs - - [SessionManager Backdoor employed in attacks on Microsoft IIS servers worldwide](https://securityaffairs.co/wordpress/132783/malware/sessionmanager-backdoor-ms-iis.html) - - [A long-running cryptomining campaign conducted by 8220 hackers now targets Linux servers](https://securityaffairs.co/wordpress/132777/cyber-crime/8220-cryptomining-campaign.html) - - [Pro-Russian hackers launched a massive DDoS attack against Norway](https://securityaffairs.co/wordpress/132765/hacking/legion-ddos-norway.html) -- 火线Zone - - [浅识 K8S 中的"准入控制器"](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495851&idx=1&sn=93bd8403416a300da9a76241865addc2&chksm=eaa9788bdddef19d6567abdcd3f91f7f8719054d30c9bd2a63b46f2fe9dd7ec94f38cb1df166&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [逆向工程系列 | Ghidra for Beginner I](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494368&idx=1&sn=81819c0519984bebb9a647203dfc93e9&chksm=fa523f5ecd25b6480c6a6203d65ee207a7f0e225ddf9f7ab07955bf7c1f6788a82f53c2b7d26&scene=58&subscene=0#rd) -- ChaMd5安全团队 - - [网络安全的“奥运会”——第三届“网鼎杯”网络安全大赛即将开幕](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247505630&idx=1&sn=8c0aeb1532994c9913bcd4f9ed09b0b1&chksm=e89dfe06dfea7710f99533d9251d6c15454dcd5f9d2fd01c239150eeec89d72a2f8aedc7cdc8&scene=58&subscene=0#rd) -- GeekPwn - - [连个Wi-Fi就被绑架了？只有电影才这么“刑”](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650344949&idx=1&sn=dc4f42657d5035e89ccaf3171b77ba9b&chksm=8740b630b0373f26f76c72f9f508ed1ca04c21957579f24c696ee07fb3e0ba78994ae7d492f0&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [重新认识一下吧！我叫“长亭技术沙盒”](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247489832&idx=1&sn=de88353281ec47f539a8a8fc5a14ac04&chksm=96f40645a1838f5334b006c306d2076165021c3297ef21c5e8c8a9c06976fb9a151e41fe430a&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [国家互联网信息办公室关于《个人信息出境标准合同规定（征求意见稿）》公开征求意见的通知](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528258&idx=1&sn=a6a9d9cfca7e6ac81c79ae9b17689947&chksm=c1e9e313f69e6a05704453ba18dfc5800442027eb99d309fe655313bde03f003c098442377e7&scene=58&subscene=0#rd) - - [【攻防演练专题】防守要点与解决方案](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528258&idx=2&sn=eb17eef793ba32c6b19ca7e19845e72c&chksm=c1e9e313f69e6a057fcc2f18cb2ddc86442e8c481fc7cb07c397d8d567670bd0b67eb2c8328f&scene=58&subscene=0#rd) - - [反电信网络诈骗法（草案）二审稿解读：四方面变化需关注](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528258&idx=3&sn=9ce0ade43da98edeb35e60006d97eb37&chksm=c1e9e313f69e6a058d859718183be7f1b7105bde92a42bc3b3cf7df7e5d6a584cd641152d20c&scene=58&subscene=0#rd) - - [微软云服务爆容器逃逸漏洞，攻击者可接管Linux集群](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528258&idx=4&sn=6c1fd15c19332a2003f81012c6193bec&chksm=c1e9e313f69e6a05a216a34674fb5f7357f5b9cdeabce8b2fcc0b676ced25855a0e807dd764d&scene=58&subscene=0#rd) - - [RansomHouse宣布盗取芯片制造巨头AMD 450GB数据](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528258&idx=5&sn=f8a76c36f547c341835b3eb316af7ede&chksm=c1e9e313f69e6a056e37469e99e9b3af44cce5bedea55955bd5078dc5f6765d519fbb017e240&scene=58&subscene=0#rd) -- 数世咨询 - - [如何在网络账户被创建之前将其劫持](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494076&idx=1&sn=55424186423e88fce64066d5e6b88b34&chksm=c1449b01f63312173b401ed455f63dc0832814e29783f751a428ac5b519419845bffdf8c1eee&scene=58&subscene=0#rd) - - [一种使用TCP自定义加密通信的APT样本分析](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494076&idx=2&sn=62bed3b34ec2deb1eca30d1b1a37ecb1&chksm=c1449b01f6331217ab76c1fee819af33047ef49a86e20d9ba40056593fdbcddb5900f72712b1&scene=58&subscene=0#rd) -- 互联网安全内参 - - [网络攻击迫使挪威主要政务网站瘫痪数小时｜俄乌冲突](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504105&idx=1&sn=737de248990e94fb9e3c3b2db2637c15&chksm=ebfa97c9dc8d1edf1e9e43833c4ca3c8464c88a2f9f7cb02ab8e87a8f3ca39528c973f2edd05&scene=58&subscene=0#rd) - - [工商银行领“罚单”：收集与业务无关的消费者金融信息](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504105&idx=2&sn=b191874265c7bfad3b22af52aa14548e&chksm=ebfa97c9dc8d1edf7bd58cfb71c767c185dac1164b2828df6080e9925a7c1d050fb6cdc00400&scene=58&subscene=0#rd) - - [网信办《个人信息出境标准合同规定 (征求意见稿)》公开征求意见](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504105&idx=3&sn=e259c130ac6cc40564b8da5d0812a298&chksm=ebfa97c9dc8d1edfca544e66f607d2f4d557125d38d99f8553d6e64ae3dd0fac417171a916b2&scene=58&subscene=0#rd) - - [第十届全球云计算大会·中国站首日启幕](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504105&idx=4&sn=1d1ebf6175219aae78c6419af5f2379e&chksm=ebfa97c9dc8d1edfa510a616f1cdf4dfeb1e66cce6cc5657be6b26389c9615608742f22c9cd2&scene=58&subscene=0#rd) -- Dark Reading - - [ICYMI: A Microsoft Warning, Follina, Atlassian, and More](https://www.darkreading.com/vulnerabilities-threats/icymi-cyber-pro-hopelessness-follina-atlassian) - - [OpenSea NFT Marketplace Faces Insider Hack](https://www.darkreading.com/vulnerabilities-threats/opensea-nft-marketplace-faces-insider-hack) - - [Time Constraints Hamper Security Awareness Programs](https://www.darkreading.com/edge-threat-monitor/time-constraints-hamper-security-awareness-programs) - - [Criminals Use Deepfake Videos to Interview for Remote Work](https://www.darkreading.com/attacks-breaches/criminals-deepfake-video-interview-remote-work) - - [DragonForce Malaysia Releases LPE Exploit, Threatens Ransomware](https://www.darkreading.com/vulnerabilities-threats/dragonforce-malaysia-releases-lpe-exploit-threatens-ransomware) - - [When It Comes to SBOMs, Do You Know the Ingredients in Your Ingredients?](https://www.darkreading.com/vulnerabilities-threats/when-it-comes-to-sboms-do-you-know-the-ingredients-in-your-ingredients-) - - [Microsoft Going Big on Identity with the Launch of Entra](https://www.darkreading.com/omdia/microsoft-going-gig-on-identity-with-the-launch-of-entra) -- CNCERT风险评估 - - [国家互联网应急中心(CNCERT/CC)勒索软件动态周报-2022年第17期（总第25期）(20220423-20220429)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496851&idx=1&sn=a89d0e8044072bcea9e87049f182b111&chksm=973ac7f1a04d4ee7f9ff3a1f3d1cc71251a9c42d2356e25554db9b67da2f87e142673c693b6f&scene=58&subscene=0#rd) - - [国家互联网应急中心(CNCERT/CC)勒索软件动态周报-2022年第16期（总第24期）(20220416-20220422)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496851&idx=2&sn=064094d949f4dc58bdfec2ed69db552c&chksm=973ac7f1a04d4ee729eb75f0cc6e3be7f5aa0b2688bd6e90e6dfcb4b8bfe583b9046e081b728&scene=58&subscene=0#rd) -- Yak Project - - [谁说没技术就不能进网络安全行业了？](https://mp.weixin.qq.com/s?__biz=MzAxOTAzOTU3Mw==&mid=2247488757&idx=1&sn=eaeb8485a63ae1626ca071db52ab5eda&chksm=9bcc40cfacbbc9d964761c7bbb41942eea0d636b92e7c7afef501d781e3334980f8746f8da95&scene=58&subscene=0#rd) -- 看雪学院 - - [UAC Bypass 技术学习](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456382&idx=1&sn=ef1b2f298beb36fec8bff49972f48cdb&chksm=b18e21b486f9a8a2b9f04a37821da60d6dec9c89770fd92942892f9c875155d83d6d3fee4f41&scene=58&subscene=0#rd) - - [RansomHouse团伙声称从AMD窃取了450GB的数据](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456382&idx=2&sn=a177da253ce93b3e7714706ce5b99926&chksm=b18e21b486f9a8a282c9094a12a64cdf71df12733f10ba5a9dfc479df0b463c146c335f1e884&scene=58&subscene=0#rd) - - [职位又更新啦！高薪工作速来](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456382&idx=3&sn=944eabae471ca15aafd58070df9a67b0&chksm=b18e21b486f9a8a28200c3e8dad90636a21624d618e668db03ba7e81b0d69dbb9d2b5f75b4f9&scene=58&subscene=0#rd) - - [如何利用高级查杀技术，通杀恶意程序？](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456382&idx=4&sn=a0113c9fc69279f1502d670a4ffc7109&chksm=b18e21b486f9a8a2e6399a73737e91b0c65b428d6b1a5036b50389a46010e509649f5e7703e0&scene=58&subscene=0#rd) -- 情报分析师 - - [情报分析经典教材大汇编5000页！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650508998&idx=1&sn=3f0465065abff590bf71f66951562311&chksm=8716a08db061299b17439eac09df696ce871439bade498ff077b85d5379027e8f1d42ee8840b&scene=58&subscene=0#rd) - - [美情报机构报告：美中竞争五个关键领域](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650508998&idx=2&sn=179850559454f5d68095f3f33074a6cb&chksm=8716a08db061299b8ce5c6b2a4c7b2cd5ffe5785c17cd1a8d82a530ed312efa017aba5f46312&scene=58&subscene=0#rd) -- Social Engineering - - [SE 101](https://www.reddit.com/r/SocialEngineering/comments/vpad92/se_101/) - - [People who lack cognitive reflectiveness are more likely to believe Trump's false election fraud claims, study finds](https://www.reddit.com/r/SocialEngineering/comments/vpbtbb/people_who_lack_cognitive_reflectiveness_are_more/) -- 安全牛 - - [用AI攻击AI？对抗性机器学习的威胁与防御](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115533&idx=1&sn=bf6ff41639ce10861872e5c76ab92bd5&chksm=bd1460de8a63e9c805f38fd8a971c7ed1fa093008e1d090b4c3dd71bc496e933f8714108a65e&scene=58&subscene=0#rd) - - [以一体化零信任方案构建新信任体系](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115533&idx=2&sn=b6232e9398877974219f841f3304bdae&chksm=bd1460de8a63e9c828187a171aa4716c4b3e973a027a0c7d607d48fe6bdc9e5df66078a103e9&scene=58&subscene=0#rd) - - [网络攻防演练中的员工安全意识培养](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115533&idx=3&sn=1772d9cddca04cccc52bc58f35105e35&chksm=bd1460de8a63e9c8751bbbd0271026503d9e9bd936aa3f7eebcaa0b5c5441039479870d8029a&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [how do i get my router username and password](https://www.reddit.com/r/HowToHack/comments/vp7qjz/how_do_i_get_my_router_username_and_password/) - - [SANS SEC 560 Class Notes by Jeff McJunkin](https://www.reddit.com/r/HowToHack/comments/vozwhf/sans_sec_560_class_notes_by_jeff_mcjunkin/) -- 长亭科技 - - [攻防演练别再硬防了！长亭发来拟态防护新思路（文末福利）](https://mp.weixin.qq.com/s?__biz=MzIwNDA2NDk5OQ==&mid=2651381814&idx=1&sn=fdd2a3252868d6640e19ac709c427699&chksm=8d3991beba4e18a8b611cee5c743b485a308871c8c4fe5d390241f620012509dd2aa42d5a6c5&scene=58&subscene=0#rd) - - [重新认识一下吧！我有个小号叫“长亭技术沙盒”](https://mp.weixin.qq.com/s?__biz=MzIwNDA2NDk5OQ==&mid=2651381814&idx=2&sn=d0e6724442e9a1093be4c585d89e4833&chksm=8d3991beba4e18a8012b67e0fc157d5957ccc00c85d4703a5b97282fc4a92a35a52881d3615e&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [热烈庆祝建党101周年暨香港回归祖国25周年！](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491141&idx=1&sn=b59bc05603e15960cd1cc8fe7b1f4c1a&chksm=feb59f56c9c2164095a0b73c28bedf8fb551f010b6cc3aeec8814a48c10da9f2d064f21cede3&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(07-01)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958558&idx=1&sn=93054d1878c7cb042c3559cbe2e2491b&chksm=8baecd81bcd9449748d68f90a0f55d0ae9e62ef73e61df1c544be1fd5764269b76d1bc54a2e3&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】零零信安：0.zone攻击面查询和收敛平台——攻防演练神器](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773319&idx=1&sn=c7b6fd68a4adbfffb1fd6c00bbbc5a52&chksm=88936568bfe4ec7ef060f9fcaf5ec73beb28b6feda7621023dbab81d1b6f3ce206b7dc989aea&scene=58&subscene=0#rd) - - [【安全头条】沃尔玛否认遭勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773319&idx=2&sn=8b55fdf62300ae982faa7fae580d1626&chksm=88936568bfe4ec7e6978f348b9683def66cdf2dd388aaf1d9ca9140cb98b1f5ed0c6fc76fed3&scene=58&subscene=0#rd) -- 东软网络安全 - - [东软NetEye荣获车载安全优秀技术服务商](https://mp.weixin.qq.com/s?__biz=MjM5NTAyODkxNw==&mid=2649212410&idx=1&sn=7d88b2bfc2157c99a115733b4504bff9&chksm=beedaf20899a2636d3875edb618ca173d4a70ae68989d62ca0cc508c91f7c2266c20965a8fc9&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [代码安全扫描实践——使用自定义lint检查](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247488659&idx=1&sn=b406067ce2aced86e933a91639bd7790&chksm=e9b932ffdecebbe97076ad4eaab5b65de925da0a8cd1021b9978cdb35eef6cd022feb4f4d738&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [每周高级威胁情报解读(2022.06.23~06.30)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247501881&idx=1&sn=60bd5a5956c6cb94c0210674ec5426c6&chksm=ea663f4edd11b658369e761f9411089e91427f5b43a31de1b40c6601a75e9205b2e11aba96af&scene=58&subscene=0#rd) -- 青藤云安全 - - [倒计时！你需要这份《2022攻防演练蓝队防守指南》](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650835965&idx=1&sn=efc20b9b4a6f8e2187fea19033224d0a&chksm=80dbe858b7ac614efefe72650ca672df3f58827c34f4826526eaa57c381866cb51a5a9bc5295&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [每周勒索威胁摘要](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247489900&idx=1&sn=2463fe37ee8a32e3e219cc2e728a43ba&chksm=ec6a6944db1de052b6efa3a24dfce777afbc8fdad5177338342c36f9368cd07cd2d1a25a27bb&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [It’s Been Zero Days Since BIND9 Crashed](https://www.reddit.com/r/netsec/comments/voxiu2/its_been_zero_days_since_bind9_crashed/) - - [Intel SGX deprecation review](https://www.reddit.com/r/netsec/comments/voy8z1/intel_sgx_deprecation_review/) - - [Building a scalable static analysis program at Razorpay](https://www.reddit.com/r/netsec/comments/vp1399/building_a_scalable_static_analysis_program_at/) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-07-01 KCFI](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490591&idx=1&sn=a4eb528142f56faaadc7ffeaeccc502f&chksm=c06032c6f717bbd0646d98942354442a74626e51928f1df363cd11028236e012a89c4db595e2&scene=58&subscene=0#rd) -- 三六零CERT - - [CVE-2022-2185：GitLab 远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491121&idx=1&sn=6109b0bcbf7e058596687514ab9900c1&chksm=fe251b30c9529226066d2a759791f33156e1850f7313a8efc73a2e3e7000d6cc768c0a394ea0&scene=58&subscene=0#rd) - - [安全日报（2022.07.01）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491121&idx=2&sn=cba066b57981d74099bd6b8c26938cb2&chksm=fe251b30c95292268df58df03435435f1511f3c3fea506718b3f8ce8bb447eb8c6576aa6c367&scene=58&subscene=0#rd) -- Hakin9 – IT Security Magazine - - [GooFuzz - The Power of Google Dorks](https://hakin9.org/goofuzz-the-power-of-google-dorks/) - - [WEF - WiFi Exploitation Framework](https://hakin9.org/wef-wifi-exploitation-framework/) -- 腾讯安全威胁情报中心 - - [腾讯安全发布《BOT管理白皮书》｜解读BOT攻击，探索防护之道](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500372&idx=1&sn=a05c481b183bed6e21adad517097b53c&chksm=ec9f1b27dbe892310d324781259dc57d463f189dc9f8a95135f34611a8bc26483276b69952d9&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-03.md b/archive/2022/2022-07-03.md deleted file mode 100644 index a98b8c005e..0000000000 --- a/archive/2022/2022-07-03.md +++ /dev/null @@ -1,102 +0,0 @@ -# 每日安全资讯（2022-07-03） - -- HackerOne Hacker Activity - - [Federated editing allows iframing possibly malicious remotes](https://hackerone.com/reports/1210424) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [](https://cxsecurity.com/issue/WLB-2022070005) - - [BigBlueButton 2.3 / 2.4.7 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022070004) - - [PHP Library Remote Code Execution](https://cxsecurity.com/issue/WLB-2022070003) - - [WiFi Mouse 1.7.8.5 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022070002) - - [WordPress Plugin Blue Admin 21.06.01 Cross-Site Request Forgery (CSRF)](https://cxsecurity.com/issue/WLB-2022070001) -- SecWiki News - - [SecWiki News 2022-07-02 Review](http://www.sec-wiki.com/?2022-07-02) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [构建安全可信数字世界 2022西湖论剑•网络安全大会举办](https://www.4hou.com/posts/0305) - - [2022 SaaS安全调查报告：解读7个重点发现](https://www.4hou.com/posts/gXpr) - - [乌克兰遭网络攻击近800次](https://www.4hou.com/posts/YXyA) -- Sploitus.com Exploits RSS Feed - - [Stock Management System 2020 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37828&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Certificate Validation in Apple Mac Os X exploit](https://sploitus.com/exploit?id=D954D476-E9C6-5689-BFAE-284FB0BCEE63&utm_source=rss&utm_medium=rss) -- Armin Ronacher's Thoughts and Writings - - [A Non Fungible Future](http://lucumr.pocoo.org/2022/7/2/non-fungible-future) -- Security Boulevard - - [Security BSides Athens 2022 – Christina Skouloudi’s ‘Talk 2 – Team Europe & The International Cybersecurity Challenge’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-christina-skouloudis-talk-2-team-europe-the-international-cybersecurity-challenge/) - - [XKCD ‘The Universe By Scientific Field’](https://securityboulevard.com/2022/07/xkcd-the-universe-by-scientific-field/) - - [Security BSides Athens 2022 – Brian Contos’ ‘Talk 1 – Cameras, CACs & Clocks: Enterprise IoT Security Sucks – A Story of Two Million Interrogated Production IoT Devices’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-brian-contos-talk-1-cameras-cacs-clocks-enterprise-iot-security-sucks-a-story-of-two-million-interrogated-production-iot-devices/) - - [Java Serialisation – the gift that keeps on taking (Part 3)](https://securityboulevard.com/2022/07/java-serialisation-the-gift-that-keeps-on-taking-part-3/) -- Hexacorn - - [DriverPack – Clean PDB paths](https://www.hexacorn.com/blog/2022/07/02/driverpack-clean-pdb-paths/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Historical OSINT - Profiling a Compilation of Known Apophis Exploit Kit C&C Public Domains - An OSINT Analysis](http://ddanchev.blogspot.com/2022/07/historical-osint-profiling-compilation.html) -- KitPloit - PenTest & Hacking Tools - - [DeepTraffic - Deep Learning Models For Network Traffic Classification](http://www.kitploit.com/2022/07/deeptraffic-deep-learning-models-for.html) - - [Microsoft-365-Extractor-Suite - A Set Of PowerShell Scripts That Allow For Complete And Reliable Acquisition Of The Microsoft 365 Unified Audit Log](http://www.kitploit.com/2022/07/microsoft-365-extractor-suite-set-of.html) - - [Dlinject - Inject A Shared Library (I.E. Arbitrary Code) Into A Live Linux Process, Without Ptrace](http://www.kitploit.com/2022/07/dlinject-inject-shared-library-ie.html) -- HAHWUL - - [Insecure File Upload](https://www.hahwul.com/cullinan/insecure-file-upload/) - - [WebSocket Security](https://www.hahwul.com/cullinan/websocket/) -- Reverse Engineering - - [MENTALESE - An Architecture-Agnostic Analysis Framework for Binary Executables [PDF, PhD thesis]](https://www.reddit.com/r/ReverseEngineering/comments/vq2ic3/mentalese_an_architectureagnostic_analysis/) - - [Proceedings of Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) 2022](https://www.reddit.com/r/ReverseEngineering/comments/vq2r2k/proceedings_of_detection_of_intrusions_and/) -- 黑海洋 - WIKI - - [金山数字签名工具V2.6（防止杀毒软件误报）](https://blog.upx8.com/2861) - - [一键上传图床工具（百度api）](https://blog.upx8.com/2860) - - [Scratch少儿编程软件 v3.29.1 中文版](https://blog.upx8.com/2859) - - [R-Studio Network 中文破解版（持续更新）](https://blog.upx8.com/2858) - - [高情商聊天表达沟通演讲](https://blog.upx8.com/2857) -- 奇客Solidot–传递最新科技情报 - - [Google 将从位置记录中自动删除用户去堕胎诊所的信息](https://www.solidot.org/story?sid=72009) - - [宝马车载信息系统将从 Linux 切换到 Android Automotive](https://www.solidot.org/story?sid=72008) -- IT Service Management News - - [Vietare Google Analytics](http://blog.cesaregallotti.it/2022/07/vietare-google-analytics.html) - - [NIST su digital forensics e OT](http://blog.cesaregallotti.it/2022/07/nist-su-digital-forensics-e-ot.html) -- Light Cube - - [关于我大学这四年的碎碎念](https://github.red/bye-hdu/) -- SANS Internet Storm Center, InfoCON: green - - [YARA 4.2.2 Released, (Sat, Jul 2nd)](https://isc.sans.edu/diary/rss/28808) -- Security Affairs - - [The role of Social Media in modern society – Social Media Day 22 interview](https://securityaffairs.co/wordpress/132810/social-networks/the-role-of-social-media.html) - - [Experts shared PoC exploit code for RCE in Zoho ManageEngine ADAudit Plus tool](https://securityaffairs.co/wordpress/132797/hacking/zoho-manageengine-adaudit-plus-rce.html) - - [A ransomware attack forced publishing giant Macmillan to shuts down its systems](https://securityaffairs.co/wordpress/132792/cyber-crime/macmillan-ransomware-attack.html) -- Social Engineering - - [Fault & Responsibility - Are You Accepting Both?](https://www.reddit.com/r/SocialEngineering/comments/vpr23y/fault_responsibility_are_you_accepting_both/) -- KitPloit - PenTest Tools! - - [DeepTraffic - Deep Learning Models For Network Traffic Classification](http://www.kitploit.com/2022/07/deeptraffic-deep-learning-models-for.html) - - [Microsoft-365-Extractor-Suite - A Set Of PowerShell Scripts That Allow For Complete And Reliable Acquisition Of The Microsoft 365 Unified Audit Log](http://www.kitploit.com/2022/07/microsoft-365-extractor-suite-set-of.html) - - [Dlinject - Inject A Shared Library (I.E. Arbitrary Code) Into A Live Linux Process, Without Ptrace](http://www.kitploit.com/2022/07/dlinject-inject-shared-library-ie.html) -- Troy Hunt's Blog - - [Weekly Update 302](https://www.troyhunt.com/weekly-update-302/) -- 深信服千里目安全实验室 - - [【漏洞通告】Apache Tomcat 拒绝服务漏洞CVE-2022-29885](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262298&idx=1&sn=b71dae788eb6ba44375ebb4ba143ab55&chksm=f3e2716ec495f878452397dce8b93dd7935057c7e07a7820294dfdbcb9c0cd2c84897bf2f208&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [When and how to transition from fundamentals of hacking into writing exploits?](https://www.reddit.com/r/HowToHack/comments/vpsvgb/when_and_how_to_transition_from_fundamentals_of/) - - [How to get wifi connection without knowing the password (basically bypassing)](https://www.reddit.com/r/HowToHack/comments/vpv64h/how_to_get_wifi_connection_without_knowing_the/) - - [Best way to crack bcrypt passwords](https://www.reddit.com/r/HowToHack/comments/vprkh1/best_way_to_crack_bcrypt_passwords/) -- Computer Forensics - - [Linux Forensics](https://www.reddit.com/r/computerforensics/comments/vpsn98/linux_forensics/) -- /r/netsec - Information Security News & Discussion - - [Bulk Analysis of Cobalt Strike’s Beacon Configurations](https://www.reddit.com/r/netsec/comments/vphlp8/bulk_analysis_of_cobalt_strikes_beacon/) -- 情报分析师 - - [美国总统乔·拜登的性格特征和领导风格分析](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509028&idx=1&sn=96dccb0b1337ae1029eb4d1660883a98&chksm=8716a0afb06129b9dfe6cbc429232eb2b11bf32cf6a4ea0f5d17b6969518b8e01dc14ea54ec0&scene=58&subscene=0#rd) - - [使用区块链分析评估朝鲜黑客的优势和漏洞](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509028&idx=2&sn=a6c0e4d6fefc50442fb0b9c34e30a9cb&chksm=8716a0afb06129b9afabd6b44caed4aa05205fd94662cf91b3e8775d536d09f43da2b1d5beeb&scene=58&subscene=0#rd) -- The Register - Security - - [Google location tracking to forget you were ever at that medical clinic](https://go.theregister.com/feed/www.theregister.com/2022/07/02/google_medical_privacy/) -- 威努特工控安全 - - [威努特与国新风投联合开展“庆七一、忆回归”主题党日活动](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651085577&idx=1&sn=6e8c96554282b1702ec0b3fed2e15309&chksm=80e641b9b791c8afa1caaaffc538c3186b32a1790f11e2f1bc8fa8d45f0141f80fac7f0d359d&scene=58&subscene=0#rd) -- 看雪学院 - - [补丁分析到滥用GDI对象提权实践](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456402&idx=1&sn=fba4d7303900c47f06339645a90dd04f&chksm=b18e21d886f9a8ce9fdcb1b29196b2bafde692371576a1feff9d31aae848aabe9b252f435a54&scene=58&subscene=0#rd) - - [【预售】CTF训练营-Web篇，全方位立体化学习！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456402&idx=2&sn=f885c82e338747520d237876d3314593&chksm=b18e21d886f9a8ce962d50cb0d74cb669ac18917c11f1e3133ff93085dc7ded652f109421b37&scene=58&subscene=0#rd) -- TorrentFreak - - [UK Govt. Prepares to Dissolve Anti-Piracy Group & Seize Its Assets](https://torrentfreak.com/uk-govt-prepares-to-dissolve-anti-piracy-group-seize-its-assets-220702/) -- 互联网安全内参 - - [反电信网络诈骗法（草案）二审稿解读：四方面变化需关注](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504108&idx=1&sn=9d89445f9ee6c1e4231b74961e1bedbe&chksm=ebfa97ccdc8d1edae2952a7ce23503ff20a4409e74812b9b67e95129b0fee2b95899e5867627&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Voice Activity Detection in smart home](https://www.reddit.com/r/netsecstudents/comments/vpr7xf/voice_activity_detection_in_smart_home/) -- Tor Project blog - - [New Alpha Release: Tor Browser 11.5a13 (Android, Windows, macOS, Linux)](https://blog.torproject.org/new-release-tor-browser-115a13/) - - [New Release: Tor Browser 11.0.15 (Android, Windows, macOS, Linux)](https://blog.torproject.org/new-release-tor-browser-11015/) -- 数世咨询 - - [交易不再匿名：一篇论文干翻比特币](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494084&idx=1&sn=aacedb4ee407fb49d6bdbf977e088d3f&chksm=c1449b79f633126f3ec64da77db0fac0c4bc533d80c62e448aa3522501f95bd533ce362e78f9&scene=58&subscene=0#rd) - - [2022年迄今为止半数零日漏洞都是之前漏洞的变体](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494084&idx=2&sn=e4761b62c8c1a41c94b18ede48d34cac&chksm=c1449b79f633126f670b14ddef2e1a65bca0ae22df29f70cc80fd6c7a9681175bd94cdde591f&scene=58&subscene=0#rd) -- Dark Space Blogspot - - [Cosa Sono Le Securities? SEC e Criptovalute](http://darkwhite666.blogspot.com/2022/07/cosa-sono-le-securities-sec-e.html) diff --git a/archive/2022/2022-07-04.md b/archive/2022/2022-07-04.md deleted file mode 100644 index e5a8b3e50f..0000000000 --- a/archive/2022/2022-07-04.md +++ /dev/null @@ -1,90 +0,0 @@ -# 每日安全资讯（2022-07-04） - -- Security Boulevard - - [DS620slim tiny home server](https://securityboulevard.com/2022/07/ds620slim-tiny-home-server/) - - [Security BSides Athens 2022 – Nikolaos Vourdas’ ‘Talk 4 – COM HIJACKING VOODOO’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-nikolaos-vourdas-talk-4-com-hijacking-voodoo/) - - [Fredo & Pid’jin™ ‘Don’t Install That’](https://securityboulevard.com/2022/07/fredo-pidjin-dont-install-that/) - - [Security BSides Athens 2022 – Kiriaki Solomidou’s, John Torakis’ And George Tsigourakos’ ‘Talk 3 – Tales From The DevSecOps World. SIEM Completely “As Code”‘](https://securityboulevard.com/2022/07/security-bsides-athens-2022-kiriaki-solomidous-john-torakis-and-george-tsigourakos-talk-3-tales-from-the-devsecops-world-siem-completely-as-code/) - - [Where Next for Quantum Computing and Cybersecurity?](https://securityboulevard.com/2022/07/where-next-for-quantum-computing-and-cybersecurity/) - - [How to Change Mac Address in Linux – HackerNet](https://securityboulevard.com/2022/07/how-to-change-mac-address-in-linux-hackernet/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [缩小应用程序安全性和可观察性之间的差距](https://www.4hou.com/posts/NWQm) - - [可修补和可预防的安全漏洞成为第一季度攻击的主要原因](https://www.4hou.com/posts/EQ0W) -- cloud world - - [OpenKruise 源码分析之 ContainerRecreateRequest](https://cloudsjhan.github.io/2022/07/03/OpenKruise-%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E4%B9%8B-ContainerRecreateRequest/) -- 2019's blog - - [Google CTF 2022 d8: From V8 Bytecode to Code Execution](https://mem2019.github.io/jekyll/update/2022/07/03/Google-CTF.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [A swag for a Open Redirect — Google Dork — Bug Bounty](https://infosecwriteups.com/a-swag-for-a-open-redirect-google-dork-bug-bounty-2143b943f34e?source=rss----7b722bfd1b8d--bug_bounty) -- Hacking and security - - [Automate registry email add](https://hackingandsecurity.blogspot.com/2022/07/automate-registry-email-add.html) - - [SBD : Backtrack 5: Maintaining Access: OS Backdoors: SBD](https://hackingandsecurity.blogspot.com/2022/07/sbd-backtrack-5-maintaining-access-os.html) - - [Methodology for Penetration Testing with Kali Linux: Part 2](https://hackingandsecurity.blogspot.com/2022/07/methodology-for-penetration-testing_3.html) - - [Methodology for Penetration Testing with Kali Linux: Part 1](https://hackingandsecurity.blogspot.com/2022/07/methodology-for-penetration-testing.html) - - [Metasploit cheatsheet - more attack vectors](https://hackingandsecurity.blogspot.com/2022/07/metasploit-cheatsheet-more-attack.html) - - [Metasploit vs. Adobe PDFs exploitation and hacking](https://hackingandsecurity.blogspot.com/2022/07/metasploit-vs-adobe-pdfs-exploitation.html) - - [Mici afaceri 2022](https://hackingandsecurity.blogspot.com/2022/07/mici-afaceri-2022.html) - - [Don’t Get Married Yet If Your Partner Does These 9 Things](https://hackingandsecurity.blogspot.com/2022/07/dont-get-married-yet-if-your-partner.html) - - [5 Steps to Help Employees Deal with Stress by Julie Winkle Giulioni](https://hackingandsecurity.blogspot.com/2022/07/5-steps-to-help-employees-deal-with.html) -- 奇客Solidot–传递最新科技情报 - - [第一款面向开发者的 RISC-V 笔电](https://www.solidot.org/story?sid=72014) - - [作家倪匡去世](https://www.solidot.org/story?sid=72013) - - [darktable 4.0.0 发布](https://www.solidot.org/story?sid=72012) -- 黑海洋 - WIKI - - [漫画二次元客户端Jasmine Comic](https://blog.upx8.com/2863) -- Have I Been Pwned latest breaches - - [Bookchor - 498,297 breached accounts](https://haveibeenpwned.com/PwnedWebsites#Bookchor) - - [Bourse des Vols - 1,460,130 breached accounts](https://haveibeenpwned.com/PwnedWebsites#BourseDesVols) -- KitPloit - PenTest & Hacking Tools - - [Aiodnsbrute - DNS Asynchronous Brute Force Utility](http://www.kitploit.com/2022/07/aiodnsbrute-dns-asynchronous-brute.html) -- Hacking and security - - [Automate registry email add](https://hackingandsecurity.blogspot.com/2022/07/automate-registry-email-add.html) - - [SBD : Backtrack 5: Maintaining Access: OS Backdoors: SBD](https://hackingandsecurity.blogspot.com/2022/07/sbd-backtrack-5-maintaining-access-os.html) - - [Methodology for Penetration Testing with Kali Linux: Part 2](https://hackingandsecurity.blogspot.com/2022/07/methodology-for-penetration-testing_3.html) - - [Methodology for Penetration Testing with Kali Linux: Part 1](https://hackingandsecurity.blogspot.com/2022/07/methodology-for-penetration-testing.html) - - [Metasploit cheatsheet - more attack vectors](https://hackingandsecurity.blogspot.com/2022/07/metasploit-cheatsheet-more-attack.html) - - [Metasploit vs. Adobe PDFs exploitation and hacking](https://hackingandsecurity.blogspot.com/2022/07/metasploit-vs-adobe-pdfs-exploitation.html) - - [Mici afaceri 2022](https://hackingandsecurity.blogspot.com/2022/07/mici-afaceri-2022.html) - - [Don’t Get Married Yet If Your Partner Does These 9 Things](https://hackingandsecurity.blogspot.com/2022/07/dont-get-married-yet-if-your-partner.html) - - [5 Steps to Help Employees Deal with Stress by Julie Winkle Giulioni](https://hackingandsecurity.blogspot.com/2022/07/5-steps-to-help-employees-deal-with.html) -- Il Disinformatico - - [Ufologia, rispondo su Tio.ch a Candida Mammoliti (Centro Ufologico Svizzera Italiana)](http://attivissimo.blogspot.com/2022/07/ufologia-rispondo-su-tioch-candida.html) -- SANS Internet Storm Center, InfoCON: green - - [7-Zip & MoW, (Sun, Jul 3rd)](https://isc.sans.edu/diary/rss/28810) -- Security Affairs - - [Tens of Jenkins plugins are affected by zero-day vulnerabilities](https://securityaffairs.co/wordpress/132836/security/jenkins-plugins-zero-day-flaws.html) - - [Microsoft: Raspberry Robin worm already infected hundreds of networks](https://securityaffairs.co/wordpress/132826/malware/microsoft-raspberry-robin-spreading.html) - - [Security Affairs newsletter Round 372 by Pierluigi Paganini](https://securityaffairs.co/wordpress/132822/breaking-news/security-affairs-newsletter-round-372-by-pierluigi-paganini.html) - - [Half of actively exploited zero-day issues in H1 2022 are variants of previous flaws](https://securityaffairs.co/wordpress/132813/security/h1-2022-zero-day-variants-previous-flaws.html) -- KitPloit - PenTest Tools! - - [Aiodnsbrute - DNS Asynchronous Brute Force Utility](http://www.kitploit.com/2022/07/aiodnsbrute-dns-asynchronous-brute.html) -- Deep Web - - [Darkweb Currency](https://www.reddit.com/r/deepweb/comments/vqdesc/darkweb_currency/) -- The Register - Security - - [What to do about inherent security flaws in critical infrastructure?](https://go.theregister.com/feed/www.theregister.com/2022/07/03/inherent_security_flaws_ics/) -- TorrentFreak - - [‘Bungie Wants PayPal’s Help to Expose Cheaters’](https://torrentfreak.com/bungie-wants-paypals-help-to-expose-cheaters-220703/) -- Errata Security - - [DS620slim tiny home server](https://blog.erratasec.com/2022/07/ds620slim-tiny-home-server.html) -- Your Hacking Tutorial by Zempirians - - [How can I create a file full of 0s?](https://www.reddit.com/r/HowToHack/comments/vqdvku/how_can_i_create_a_file_full_of_0s/) - - [Having issues with gobuster, unable to locate wordlist, even though I have verified that this is the correct file directory (I am running ubuntu via docker)](https://www.reddit.com/r/HowToHack/comments/vqmmf6/having_issues_with_gobuster_unable_to_locate/) -- Social Engineering - - [Is it possible to effectively resume my Facebook conversation with a friend whom i haven't seen for a long while?](https://www.reddit.com/r/SocialEngineering/comments/vqqn95/is_it_possible_to_effectively_resume_my_facebook/) -- /r/netsec - Information Security News & Discussion - - [Bypassing Firefox's HTML Sanitizer API](https://www.reddit.com/r/netsec/comments/vqo7xq/bypassing_firefoxs_html_sanitizer_api/) - - [nday exploit: netgear orbi unauthenticated command injection (CVE-2020-27861)](https://www.reddit.com/r/netsec/comments/vqpway/nday_exploit_netgear_orbi_unauthenticated_command/) - - [Code replay attack on the myGovID Scheme](https://www.reddit.com/r/netsec/comments/vqhzbu/code_replay_attack_on_the_mygovid_scheme/) -- Computer Forensics - - [What do you think is lacking in the industry nowadays?](https://www.reddit.com/r/computerforensics/comments/vq736h/what_do_you_think_is_lacking_in_the_industry/) -- 情报分析师 - - [【实战技法】如何使用创造力和太阳计算器进行图像地理定位](https://mp.weixin.qq.com/s/enNK2~rhuqnW0h-sXO4z2w) - - [刚刚发布！北约2022战略概念](https://mp.weixin.qq.com/s/ERIWvGSC5pgpOa2DLEXRTA) -- 白帽100安全攻防实验室 - - [WMCTF|一个“正经”的官宣](https://mp.weixin.qq.com/s?__biz=MzIxMDYyNTk3Nw==&mid=2247489946&idx=1&sn=fa3b4f8db881ded7835307aec4bec819&chksm=9760ed4ca017645a2d199e76fff80d803fe8b854ecc3bad32e6999ae7a1b8a1beb9d37384c31&scene=58&subscene=0#rd) -- 看雪学院 - - [公开课直播预告 | Frida特征检测之高维对抗-今晚8点](https://mp.weixin.qq.com/s/njA5sxpGJqPpmkuvpXdoag) - - [SVC的TraceHook沙箱的实现&无痕Hook实现思路](https://mp.weixin.qq.com/s/V7tlgg6mxY5fTvrYR7Y36A) - - [LLVM与代码混淆技术，详解3种经典代码混淆方式+2种变体](https://mp.weixin.qq.com/s/480UYEe~u404ymjcRIuifQ) -- Dark Space Blogspot - - [Migliori "Move To Earn" Su Blockchain (Top Ten)](http://darkwhite666.blogspot.com/2022/07/migliori-move-to-earn-su-blockchain-top.html) diff --git a/archive/2022/2022-07-05.md b/archive/2022/2022-07-05.md deleted file mode 100644 index 871c75932f..0000000000 --- a/archive/2022/2022-07-05.md +++ /dev/null @@ -1,260 +0,0 @@ -# 每日安全资讯（2022-07-05） - -- HackerOne Hacker Activity - - [SMTP Command Injection in iCalendar Attachments to Emails via Newlines](https://hackerone.com/reports/1516377) - - [Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`](https://hackerone.com/reports/1543770) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（20220627-20220703）](http://blog.nsfocus.net/weekly-20220627/) - - [Code Virtualizer逆向工程浅析](http://blog.nsfocus.net/code-virtualizer/) -- 先知安全技术社区 - - [PHP文件上传流量层面WAF绕过](https://xz.aliyun.com/t/11486) - - [AspectJWeaver反序列化利用链](https://xz.aliyun.com/t/11499) - - [CVE-2022-22980 Spring Data MongoDB SpEL表达式注入](https://xz.aliyun.com/t/11484) -- Security Boulevard - - [The Top 10 SMB cyber security mistakes. Find out how to fix these security risks.](https://securityboulevard.com/2022/07/the-top-10-smb-cyber-security-mistakes-find-out-how-to-fix-these-security-risks/) - - [Hands-on Mobile App and API Security – Runtime Secrets Protection](https://securityboulevard.com/2022/07/hands-on-mobile-app-and-api-security-runtime-secrets-protection/) - - [What Makes Elixir and Phoenix a Better Choice in 2022 for Web App Development](https://securityboulevard.com/2022/07/what-makes-elixir-and-phoenix-a-better-choice-in-2022-for-web-app-development/) - - [Medical scams: Educate yourself and your loved ones](https://securityboulevard.com/2022/07/medical-scams-educate-yourself-and-your-loved-ones/) - - [A 5–Step Checklist To Securing Your Mobile Apps](https://securityboulevard.com/2022/07/a-5-step-checklist-to-securing-your-mobile-apps/) - - [United States of America, Independence Day 2022](https://securityboulevard.com/2022/07/united-states-of-america-independence-day-2022/) - - [Secure SMTPs Port – Which are Secure SSL Email Ports (25,465,587 & 2525)](https://securityboulevard.com/2022/07/secure-smtps-port-which-are-secure-ssl-email-ports-25465587-2525/) - - [7 steps to avoid uncoordinated vulnerability disclosure](https://securityboulevard.com/2022/07/7-steps-to-avoid-uncoordinated-vulnerability-disclosure/) - - [Period Tracking Apps and Your Privacy, Vendor Impersonation Attacks, LockBit Ransomware Bug Bounty Program](https://securityboulevard.com/2022/07/period-tracking-apps-and-your-privacy-vendor-impersonation-attacks-lockbit-ransomware-bug-bounty-program/) - - [The Need of Privacy Certifications for Lawyers](https://securityboulevard.com/2022/07/the-need-of-privacy-certifications-for-lawyers/) -- 跳跳糖 - 安全与分享社区 - - [WMI检测思路与实现](https://tttang.com/archive/1639/) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-5491-01](https://packetstormsecurity.com/files/167696/RHSA-2022-5491-01.txt) - - [Ubuntu Security Notice USN-5501-1](https://packetstormsecurity.com/files/167695/USN-5501-1.txt) - - [Ubuntu Security Notice USN-5500-1](https://packetstormsecurity.com/files/167694/USN-5500-1.txt) - - [Ubuntu Security Notice USN-5493-2](https://packetstormsecurity.com/files/167693/USN-5493-2.txt) - - [Ubuntu Security Notice USN-5485-2](https://packetstormsecurity.com/files/167692/USN-5485-2.txt) - - [Global Socket 1.4.37](https://packetstormsecurity.com/files/167691/gsocket-1.4.37.tar.gz) - - [Bash / Netcat Reverse Shells](https://packetstormsecurity.com/files/167690/bashnetcat-reverse.txt) - - [Ransom Lockbit 3.0 MVID-2022-0620 Buffer Overflow](https://packetstormsecurity.com/files/167689/MVID-2022-0620.txt) - - [DouPHP 1.2 Release 20141027 SQL Injection](https://packetstormsecurity.com/files/167688/douphp12-sql.txt) - - [Paymoney 3.3 Cross Site Scripting](https://packetstormsecurity.com/files/167687/paymoney33-xss.txt) - - [Stock Management System 2020 SQL Injection](https://packetstormsecurity.com/files/167686/sms2020-sql.txt) -- SecWiki News - - [SecWiki News 2022-07-04 Review](http://www.sec-wiki.com/?2022-07-04) -- 安全牛 - - [NFT流动性市场安全问题频发—NFT交易平台Quixotic被黑事件分析](https://www.aqniu.com/vendor/85420.html) - - [一种使用TCP自定义加密通信的APT样本分析](https://www.aqniu.com/vendor/85409.html) - - [供应链风险管理（SCRM）：看这篇文章就够了](https://www.aqniu.com/vendor/85406.html) - - [网络威胁分析师必须具备的十种能力](https://www.aqniu.com/industry/85392.html) - - [2022年第二季度电子邮件安全观察](https://www.aqniu.com/industry/85391.html) - - [安全头条 | 国家互联网信息办公室发布《互联网用户账号信息管理规定》；公安部网安局启动打击整治“网络水军”专项工作](https://www.aqniu.com/industry/85390.html) - - [用攻击面视角构建主动防御 成为贯穿未来网络安全的理念](https://www.aqniu.com/vendor/85361.html) - - [构建安全可信数字世界 2022西湖论剑•网络安全大会举办](https://www.aqniu.com/vendor/85360.html) - - [上讯信息的信创朋友圈又扩容新伙伴](https://www.aqniu.com/vendor/85357.html) - - [MSP精华实录|能源行业之移动应用安全解决方案](https://www.aqniu.com/vendor/85356.html) - - [世平信息参编｜《数据防泄露（DLP）选型指南》报告发布](https://www.aqniu.com/vendor/85355.html) - - [第十四届信息安全高级云论坛暨美国2022RSA热点研讨会圆满收官](https://www.aqniu.com/vendor/85329.html) - - [悬镜安全携手OpenChain，共同守护中国软件供应链安全](https://www.aqniu.com/vendor/85328.html) - - [社区访谈丨一个IT新人眼中的JumpServer开源堡垒机](https://www.aqniu.com/vendor/85327.html) - - [报名丨2022 JumpServer开源堡垒机 城市遇见 · 深圳站](https://www.aqniu.com/activity-meeting/85326.html) - - [真实力好口碑！Fortinet又双叒叕获评Gartner“客户之选”荣誉称号](https://www.aqniu.com/vendor/85325.html) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal](https://cxsecurity.com/issue/WLB-2022070011) - - [OPSTECH Thailand Gov Management System Multiple Vulnerabilities](https://cxsecurity.com/issue/WLB-2022070010) - - [Ransom Lockbit 3.0 MVID-2022-0620 Buffer Overflow](https://cxsecurity.com/issue/WLB-2022070009) - - [Stock Management System 2020 SQL Injection](https://cxsecurity.com/issue/WLB-2022070008) - - [Paymoney 3.3 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022070007) - - [DouPHP 1.2 Release 20141027 SQL Injection](https://cxsecurity.com/issue/WLB-2022070006) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 欧盟举办超大规模网络安全演习；恶意软件破坏了多个美国州失业网站](https://www.freebuf.com/news/338192.html) - - [【直播享好礼】虚拟主播FreeBee首次亮相CIS大会夏日版](https://www.freebuf.com/articles/338171.html) - - [HackerOne员工出售漏洞报告牟利](https://www.freebuf.com/news/338142.html) - - [TikTok向美国立法者保证，努力保护用户数据不受中国员工的影响](https://www.freebuf.com/news/338129.html) - - [认证账户被黑，威胁行为者借名人推特发送钓鱼信息](https://www.freebuf.com/news/338120.html) - - [一文看懂网络安全五年之巨变](https://www.freebuf.com/articles/338103.html) - - [Jenkins安全团队披露了29个受0Day漏洞影响的插件](https://www.freebuf.com/news/338090.html) - - [微软已在数百个网络中发现 Raspberry Robin 蠕虫](https://www.freebuf.com/news/338069.html) - - [【直播预约】双直播间首次启用 | CIS大会夏日版5天后见](https://www.freebuf.com/fevents/338250.html) - - [FreeBuf早报 | TikTok中国员工能访问部分不敏感美国用户数据；HackerOne员工“监守自盗”](https://www.freebuf.com/articles/338065.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [第十四届信息安全高级云论坛暨美国2022RSA热点研讨会圆满收官](https://www.4hou.com/posts/8YMj) - - [真实力好口碑！Fortinet又双叒叕获评Gartner“客户之选”荣誉称号](https://www.4hou.com/posts/jJ0y) - - [【七彩话安全】美BIS新规枪口指向中国，未来开源安全将何去何从？](https://www.4hou.com/posts/7JpQ) - - [Symbiote——利用 LD_PRELOAD 注入全系统进程的恶意软件，可以完全隐藏自身](https://www.4hou.com/posts/jJq4) - - [梁胜博士：软件供应链的安全挑战丨周五直播分享](https://www.4hou.com/posts/l62j) - - [微软Azure Service Fabric曝安全漏洞](https://www.4hou.com/posts/KELG) -- 安全客-有思想的安全新媒体 - - [跨链桥：Web3黑客必争之地](https://www.anquanke.com/post/id/275550) - - [Smoke Loader 木马病毒分析](https://www.anquanke.com/post/id/275795) - - [Macmillan遭勒索软件攻击后关闭系统](https://www.anquanke.com/post/id/275794) - - [安全研究人员锁定chaplin.exe--攻击伊朗三家钢铁制造企业的恶意软件](https://www.anquanke.com/post/id/275857) -- Sploitus.com Exploits RSS Feed - - [Ransom Lockbit 3.0 MVID-2022-0620 Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:167689&utm_source=rss&utm_medium=rss) - - [Stock Management System 2020 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167686&utm_source=rss&utm_medium=rss) - - [DouPHP 1.2 Release 20141027 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167688&utm_source=rss&utm_medium=rss) - - [Paymoney 3.3 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167687&utm_source=rss&utm_medium=rss) - - [Exploit for Missing Authentication for Critical Function in F5 Big-Ip Access Policy Manager exploit](https://sploitus.com/exploit?id=51F21941-30E2-5FD0-986D-88D74D835300&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=18B2B79F-C680-583E-8CD2-F27E10E7C736&utm_source=rss&utm_medium=rss) - - [Exploit for Incorrect Default Permissions in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=2F93A054-50AD-529C-A586-5BE5E04A859E&utm_source=rss&utm_medium=rss) -- Hacking and security - - [Modern Hackers and Hacking techniques](https://hackingandsecurity.blogspot.com/2022/07/modern-hackers-and-hacking-techniques.html) - - [Buffer Overflow for kids - part II](https://hackingandsecurity.blogspot.com/2022/07/buffer-overflow-for-kids-part-ii.html) - - [Buffer Overflow for kids - part I](https://hackingandsecurity.blogspot.com/2022/07/buffer-overflow-for-kids-part-i.html) - - [The Art of Listening and the Power of Speaking - notes](https://hackingandsecurity.blogspot.com/2022/07/the-art-of-listening-and-power-of.html) - - [Windows Server 2008](https://hackingandsecurity.blogspot.com/2022/07/windows-server-2008.html) -- HackerNews - - [TikTok 向美国立法者保证，努力保护用户数据不受中国员工的影响](https://hackernews.cc/archives/39678) - - [认证账户被黑，威胁行为者借名人推特发送钓鱼信息](https://hackernews.cc/archives/39671) - - [RansomHouse 宣布盗取芯片制造巨头 AMD 450GB 数据](https://hackernews.cc/archives/39668) - - [Jenkins 安全团队披露了 29 个受 0Day 漏洞影响的插件](https://hackernews.cc/archives/39665) - - [微软已在数百个网络中发现 Raspberry Robin 蠕虫](https://hackernews.cc/archives/39661) - - [英国陆军的 YouTube 和 Twitter 账户被黑客用于推广加密货币骗局](https://hackernews.cc/archives/39656) - - [HackerOne 的流氓员工偷窃漏洞报告并将其作为副业出售](https://hackernews.cc/archives/39652) - - [有 Android 恶意软件被发现在受害者不知情的情况下为其订阅付费服务](https://hackernews.cc/archives/39645) -- blog.avast.com EN - - [Medical scams: Educate yourself and your loved ones](https://blog.avast.com/medical-scams) -- Hex Rays - - [Igor’s tip of the week #96: Loading additional files](https://hex-rays.com/blog/igors-tip-of-the-week-96-loading-additional-files/) -- Malwarebytes Labs - - [HackerOne insider fired for trying to claim other people’s bounties](https://blog.malwarebytes.com/reports/2022/07/hackerone-insider-fired-for-trying-to-claim-other-peoples-bounties/) - - [When good-faith hacking gets people arrested, with Harley Geiger: Lock and Code S03E14](https://blog.malwarebytes.com/podcast/2022/07/when-good-faith-hacking-gets-people-arrested-with-harley-geiger-lock-and-code-s03e14/) - - [Insider Threat: Employees indicted for stealing $88 million of license keys](https://blog.malwarebytes.com/cybercrime/2022/07/insider-threat-employees-indicted-for-stealing-88-million-of-license-keys/) - - [5 pro-freedom technologies that could change the Internet](https://blog.malwarebytes.com/opinion/2022/07/5-pro-freedom-technologies-that-could-change-the-internet/) - - [“Free UK visa” offers on WhatsApp are fakes](https://blog.malwarebytes.com/scams/2022/07/free-uk-visa-offers-on-whatsapp-are-fakes/) - - [My Body, My Data Act would lock down reproductive and sexual health data](https://blog.malwarebytes.com/privacy-2/2022/07/my-body-my-data-act-would-lock-down-reproductive-and-sexual-health-data/) - - [A week in security (June 27 – July 3)](https://blog.malwarebytes.com/a-week-in-security/2022/07/a-week-in-security-june-27-july-3/) -- ふるつき - - [Google CTF 2022 quals writeup - Maybe Someday](https://furutsuki.hatenablog.com/entry/2022/07/04/104524) -- 安全脉搏 - - [stm32逆向入门](https://www.secpulse.com/archives/182315.html) - - [SAST 如何提高整体安全性?](https://www.secpulse.com/archives/182267.html) - - [革新：数字科技，比我们想的还重要](https://www.secpulse.com/archives/182295.html) -- The Daily Swig | Cybersecurity news and views - - [‘Does anybody like CAPTCHAs?’ – Cloudflare CTO John Graham-Cumming envisages a frictionless future for website Turing tests](https://portswigger.net/daily-swig/does-anybody-like-captchas-cloudflare-cto-john-graham-cumming-envisages-a-frictionless-future-for-website-turing-tests) - - [Australia’s Monash University launches public bug bounty program](https://portswigger.net/daily-swig/australias-monash-university-launches-public-bug-bounty-program) - - [US eye clinic suffers data breach impacting 92,000 patients](https://portswigger.net/daily-swig/us-eye-clinic-suffers-data-breach-impacting-92-000-patients) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/vr1gaz/rreverseengineerings_weekly_questions_thread/) -- HAHWUL - - [맥북을 Self-hosted Github action runner로 만들기](https://www.hahwul.com/2022/07/05/macos-github-action-runner/) -- 黑海洋 - WIKI - - [阿里云盘TV版 无广告（持续更新）](https://blog.upx8.com/2867) - - [大学生理性爱国要懂政治](https://blog.upx8.com/2866) - - [UltraViewer (远程控制软件)](https://blog.upx8.com/2865) - - [分布式RPC系统框架实战教程](https://blog.upx8.com/2864) -- IT Service Management News - - [2022 CWE Top 25 Most Dangerous Software Weaknesses](http://blog.cesaregallotti.it/2022/07/2022-cwe-top-25-most-dangerous-software.html) -- 奇客Solidot–传递最新科技情报 - - [东非黑猩猩会挖井取水](https://www.solidot.org/story?sid=72025) - - [日本如何成功控制新冠疫情](https://www.solidot.org/story?sid=72024) - - [台奧密克戎患者出现脑炎高重症率](https://www.solidot.org/story?sid=72023) - - [日本经历有记录以来最强热浪](https://www.solidot.org/story?sid=72022) - - [Ubuntu Unity 桌面复活](https://www.solidot.org/story?sid=72021) - - [萨尔瓦多的比特币实验是威权宣传吗](https://www.solidot.org/story?sid=72020) - - [加州推迟开课时间的法令意在保证学生睡眠](https://www.solidot.org/story?sid=72019) - - [NASA 资助探索火星洞穴的机器人](https://www.solidot.org/story?sid=72018) - - [客观现实可能不存在](https://www.solidot.org/story?sid=72017) - - [Meta 将关闭加密货币项目 Novi](https://www.solidot.org/story?sid=72016) - - [大学拿回了支付的比特币赎金，发现还赚了](https://www.solidot.org/story?sid=72015) -- Have I Been Pwned latest breaches - - [Capital Economics - 263,829 breached accounts](https://haveibeenpwned.com/PwnedWebsites#CapialEconomics) -- Data Breach - - [Data of a billion Chinese residents available for sale on the dark web](https://securityaffairs.co/wordpress/132860/data-breach/chinese-residents-data-dark-web.html) -- Securityinfo.it - - [900.000 aziende esposte su Internet attraverso Kubernetes](https://www.securityinfo.it/2022/07/04/900-000-aziende-esposte-su-internet-attraverso-kubernetes/?utm_source=rss&utm_medium=rss&utm_campaign=900-000-aziende-esposte-su-internet-attraverso-kubernetes) - - [Vulnerabilità PwnKit di Linux sfruttata dai pirati](https://www.securityinfo.it/2022/07/04/vulnerabilita-pwnkit-di-linux-sfruttata-dai-pirati/?utm_source=rss&utm_medium=rss&utm_campaign=vulnerabilita-pwnkit-di-linux-sfruttata-dai-pirati) -- Daniel Miessler - - [Two Americas](https://danielmiessler.com/blog/two-americas/) - - [L33t H4cking vs. M0st H4acking](https://danielmiessler.com/blog/l33t-h4cking-vs-m0st-h4acking/) -- SANS Internet Storm Center, InfoCON: green - - [&#xa;7-Zip & MoW: "For Office files", (Mon, Jul 4th)](https://isc.sans.edu/diary/rss/28812) -- Pentestmag - - [9 New Cyber Threats and How to Successfully Avoid Them](https://pentestmag.com/9-new-cyber-threats-and-how-to-successfully-avoid-them/?utm_source=rss&utm_medium=rss&utm_campaign=9-new-cyber-threats-and-how-to-successfully-avoid-them) -- IntelTechniques Blog - - [The Return of the Online Search Tools](https://inteltechniques.com/blog/2022/07/04/the-return-of-the-online-search-tools/) -- ImperialViolet - - [Passkeys](http://www.imperialviolet.org/2022/07/04/passkeys.html) -- Hacking and security - - [Modern Hackers and Hacking techniques](https://hackingandsecurity.blogspot.com/2022/07/modern-hackers-and-hacking-techniques.html) - - [Buffer Overflow for kids - part II](https://hackingandsecurity.blogspot.com/2022/07/buffer-overflow-for-kids-part-ii.html) - - [Buffer Overflow for kids - part I](https://hackingandsecurity.blogspot.com/2022/07/buffer-overflow-for-kids-part-i.html) - - [The Art of Listening and the Power of Speaking - notes](https://hackingandsecurity.blogspot.com/2022/07/the-art-of-listening-and-power-of.html) - - [Windows Server 2008](https://hackingandsecurity.blogspot.com/2022/07/windows-server-2008.html) -- Il Disinformatico - - [Samantha Cristoforetti farà un’EVA il 21 luglio, con sorvolo dell’Italia alle 21:40: quello che si sa fin qui](http://attivissimo.blogspot.com/2022/07/samantha-cristoforetti-fara-uneva-il-21.html) -- Graham Cluley - - [Official British Army Twitter and YouTube accounts hijacked by NFT scammers](https://www.bitdefender.com/blog/hotforsecurity/official-british-army-twitter-and-youtube-accounts-hijacked-by-nft-scammers/) -- Troy Hunt's Blog - - [Welcoming the Polish Government to Have I Been Pwned](https://www.troyhunt.com/welcoming-the-polish-government-to-have-i-been-pwned/) -- Security Affairs - - [Google fixes the fourth Chrome zero-day in 2022](https://securityaffairs.co/wordpress/132863/hacking/4th-chrome-zero-day.html) - - [Data of a billion Chinese residents available for sale on the dark web](https://securityaffairs.co/wordpress/132860/data-breach/chinese-residents-data-dark-web.html) - - [Popular Django web framework affected by a SQL Injection flaw. Upgrade it now!](https://securityaffairs.co/wordpress/132853/security/django-framework-sql-injection.html) - - [Unfaithful HackerOne employee steals bug reports to claim additional bounties](https://securityaffairs.co/wordpress/132846/cyber-crime/hackerone-incident.html) - - [Threat Report Portugal: Q2 2022](https://securityaffairs.co/wordpress/132842/security/threat-report-portugal-q2-2022.html) - - [CISA orders federal agencies to patch CVE-2022-26925 by July 22](https://securityaffairs.co/wordpress/132830/security/cisa-orders-patch-cve-2022-26925.html) -- TorrentFreak - - [Broadest US Pirate Site Injunction Rewritten/Tamed By Cloudflare](https://torrentfreak.com/broadest-us-pirate-site-injunction-rewritten-tamed-by-cloudflare-220704/) - - [ACE Seizes Domains Of Large Sports Streaming Pirate Sites](https://torrentfreak.com/ace-seizes-domains-of-large-sports-streaming-pirate-sites-220704/) -- Social Engineering - - [Alcohol is a lie.](https://www.reddit.com/r/SocialEngineering/comments/vrkqb4/alcohol_is_a_lie/) -- 星阑科技 - - [API NEWS | 如何提高基于云的安全性的开放 API](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494012&idx=1&sn=8f38bc30a07f80ab202b631fc41bcdbe&chksm=c00744e0f770cdf6d7327ad34e91fcc46aa851063609ccec554f2ad0101a5ad5369a5ffbf484&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [IOT/OT蜜罐-RIoTPot介绍](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494382&idx=1&sn=c5e82b059b67a65ec66a340dc1e50734&chksm=fa523f50cd25b646ec7031adf83bceb27d9d9992f4e602126ed1569d4acf9722092ea74aa251&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第26期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491947&idx=1&sn=c45f6af39402e6bf7a9cbdc86f0bf1b3&chksm=fd74d1a2ca0358b491c9365630034adc97d24c805030c42371ced87322714ad2aed020f20247&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220627-20220703)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491947&idx=2&sn=63ee4c1b9fa053be95bc0f1c9370c6ea&chksm=fd74d1a2ca0358b427e20224e8a653c31c277065d7f398044b40f369b05beb959d2fc649d070&scene=58&subscene=0#rd) -- 默安科技 - - [喜讯！默安科技斩获“云鼎奖”年度最佳解决方案](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492558&idx=1&sn=118110ac14dd27752ca1432f7abc5452&chksm=e93b14ecde4c9dfa55bc21ccdea3a837861b68f162045fb73bd8376da3490185db99e637ea15&scene=58&subscene=0#rd) -- Blackhat Library: Hacking techniques and research - - [My girlfriend's spied on by her ex boyfriend, what to do?](https://www.reddit.com/r/blackhat/comments/vr9wm2/my_girlfriends_spied_on_by_her_ex_boyfriend_what/) -- Computer Forensics - - [Is it feasible to image a 12tb storage server? What is the best storage solution for the image? Which imaging software? (Solaris os)](https://www.reddit.com/r/computerforensics/comments/vr603n/is_it_feasible_to_image_a_12tb_storage_server/) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [A security misconfiguration bug I found](https://www.reddit.com/r/netsecstudents/comments/vreedt/a_security_misconfiguration_bug_i_found/) - - [what course modules should I look for learning more about security?](https://www.reddit.com/r/netsecstudents/comments/vr9ghh/what_course_modules_should_i_look_for_learning/) - - [Burp Suite Intruder Issue?](https://www.reddit.com/r/netsecstudents/comments/vrdcx4/burp_suite_intruder_issue/) - - [What other projects could I do to add to my knowledge and fill in some gaps?](https://www.reddit.com/r/netsecstudents/comments/vrf507/what_other_projects_could_i_do_to_add_to_my/) -- 安全客 - - [【技术分享】记一次arm架构的ret to dl_resolve利用](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773405&idx=1&sn=aa0a1418fcfdc4a2074c0061fab0f327&chksm=88936532bfe4ec24f8516aaa9e1be1c83b7b4032b55a0810d756df28c09e2034fc702c3447c3&scene=58&subscene=0#rd) - - [【安全头条】Macmillan遭勒索软件攻击后关闭系统](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773405&idx=2&sn=e6c58066a50581a63844d9fb40516361&chksm=88936532bfe4ec24a97b75db5f1ab3aaeb2bda6d90ff96a5a7d30e4b629a99a1d2c98dc388da&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(07-04)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958562&idx=1&sn=1a0e1cca5cdd7fb2a63a4a54be5c9426&chksm=8baecdbdbcd944abd4d967251fdc6f850a5380456c696785ac63a24932bfb155b069b2a7766d&scene=58&subscene=0#rd) -- ICT Security Magazine - - [Blockchain e Data Protection: prospettive future nelle policy UE](https://www.ictsecuritymagazine.com/articoli/blockchain-e-data-protection-prospettive-future-nelle-policy-ue/) -- 360Quake空间测绘 - - [自动“测”你想测之QUAKE监测功能~~~](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247485831&idx=1&sn=7c530bb813ae943c1e74e3a475314916&chksm=c37b8e6cf40c077ab8d2611f459e369ba4784affd21137b5ec0c92d12459b887b2f8a3e95f50&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【二次通告】Apache Tomcat拒绝服务漏洞 CVE-2022-29885](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262364&idx=1&sn=23a9f8f73e26b7428f3f7f597f7287b8&chksm=f3e27128c495f83e8a3d4fc3f2b249f39136a9ceb5d3f131d4c8f4f543320f46478cde5ac6f1&scene=58&subscene=0#rd) - - [疑似Confucius组织最新攻击行动分析](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262364&idx=2&sn=af73239db9dad9071bfcc75270d6166f&chksm=f3e27128c495f83e7f3c2b9c080acceed45e0f439c076b47e313d50c8e4ed93aa8e7cdf0435e&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [融合模型权限管理设计方案](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496013&idx=1&sn=14c795f89ad889f5dc014f4667cd5e47&chksm=e9d33aafdea4b3b9fe2859d940a0689417a5acc13257331444549a9bd9468f82ed873b554bb1&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [活动 | 美团外卖企业业务开放测试，为白帽提供测试账号，速来！](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247489596&idx=1&sn=bb05c99473d9b606a5c58e4f6085245a&chksm=ec1bf9efdb6c70f91733f40640101683150fa4347ca900c6bdd31c457a1abb1e5e750bf1715f&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [牧云容器安全六大核心能力，构建云原生实战防护体系](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247489954&idx=1&sn=0668ddc70e041041aa2d30970a2326b9&chksm=96f406cfa1838fd96eeab2d28162fbbf2095b778ca6783b851cb5ec30a36cac06a9b9a83c3e4&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220704期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528329&idx=1&sn=0d54d6be06de37dc223421dbb9d90c8a&chksm=c1e9e3d8f69e6ace6d5220f3d9fa016a071dc2bfd36f03fc6c6135d506de046e6bf342fc5ad9&scene=58&subscene=0#rd) - - [世界生物安全论坛举行，专家提出应对国际生物霸权策略](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528329&idx=2&sn=69132db36d70b9c2ff4ef69ea7e7d561&chksm=c1e9e3d8f69e6acebec6e40d860ae9de5fcc1c71093aa3f74c1aa2e4b8daf8f0f8689b1713a9&scene=58&subscene=0#rd) - - [【攻防演练专题】七大场景化专项防护](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528329&idx=3&sn=7a366c46c1ed8688946007f1a1849ca5&chksm=c1e9e3d8f69e6ace8eee04a28dc0eb8bcfffb4f9ac23f467e08a931f38b883eb4972885eee47&scene=58&subscene=0#rd) - - [​乌克兰DTEK能源公司遭俄罗斯黑客网络攻击损失不明！](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528329&idx=4&sn=679f65bc5908a56d8659c6f43c83af51&chksm=c1e9e3d8f69e6ace9a405c38697c21d06123b5bf8a76508ebfce204bd623215988e0035c4f2e&scene=58&subscene=0#rd) - - [可修补和可预防的安全漏洞成为第一季度攻击的主要原因](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528329&idx=5&sn=15363350536361a51f100750382d49d8&chksm=c1e9e3d8f69e6ace29cc68a40086dc6b1b30f780dee8dca12c567a48f20d11b1861f72c4786d&scene=58&subscene=0#rd) -- 奇安信CERT - - [安全热点周报|第二百五十一期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496400&idx=1&sn=b8f7f2a4f4912ab9532cd8e9edffba76&chksm=fe79d648c90e5f5eeae92c08b6ae1efecd32222cde9d3e10a03844ad5e8fba169460ef9c293e&scene=58&subscene=0#rd) -- The Register - Security - - [British Army Twitter and YouTube feeds hijacked by crypto-promos](https://go.theregister.com/feed/www.theregister.com/2022/07/04/british_army_social_media_hijcaked/) -- /r/netsec - Information Security News & Discussion - - [From Misconfigured Certificate Template to Windows Domain Admin](https://www.reddit.com/r/netsec/comments/vrgs55/from_misconfigured_certificate_template_to/) -- 互联网安全内参 - - [欧盟举办超大规模网络安全演习：医疗基础设施遭全链条打击](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504143&idx=1&sn=33a05a107cf92fbdd5300a20d6c6d5f9&chksm=ebfa962fdc8d1f39146434b586b24761fc26450caf375b7de64c768621252d137e553951115c&scene=58&subscene=0#rd) - - [51job招聘网站海量用户数据泄露？官方正式回应](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504143&idx=2&sn=c1613736c2424b3ebaffd76aa8afbdb9&chksm=ebfa962fdc8d1f3983c8e38d850a18d9bac510d5c742f9d617f4403ccf5e7633ebe5b90d5764&scene=58&subscene=0#rd) - - [损失不明！乌克兰DTEK能源公司遭俄罗斯黑客网络攻击](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504143&idx=3&sn=75a7b1eedaf416da7bf58b21ac20c73a&chksm=ebfa962fdc8d1f397f387a45308a03fba4b13b555237b4465f48bba64aea0b806e91041d4940&scene=58&subscene=0#rd) - - [乌克兰核电站遭到物理/网络协同攻击？微软报告遭众多网络专家质疑](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504143&idx=4&sn=89e88f4a12c1af42ba9599d95bda866f&chksm=ebfa962fdc8d1f392cfd43a2d31c3c2a4557810fbaede6a78d101f976a48a9cc600c9cc31595&scene=58&subscene=0#rd) -- SecPulse安全脉搏 - - [记一奇葩弱口令到内网实战](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044541&idx=1&sn=40c9521b8a415ab5dd0026f7a9530286&chksm=803fa8e3b74821f5218d99790bad9706444d662950f558397d0cc1aa9c1adc7ac760f77cff17&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报手册】如何进行有效的在线查询（第一部分）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509241&idx=1&sn=ee97210f9fce772a43c5335b9130f26d&chksm=8716a1f2b06128e4fdb75cf2510a081736a269c9e3c05923b6c5fa7261f9b01ff1b558a72f91&scene=58&subscene=0#rd) - - [【情报课堂】如何像情报分析师一样写作](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509241&idx=2&sn=23671f496972a49b1807aa870354c013&chksm=8716a1f2b06128e422a871a2581fe636f6a9e88b935a2fbb93b54aab349ea67556df8f4337cc&scene=58&subscene=0#rd) - - [【死亡地图】俄罗斯在与乌克兰的战争中的损失](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509241&idx=3&sn=9e0464e711e83e79351fcb837f012b10&chksm=8716a1f2b06128e4bc23489a23964785626c50438df69b20a542e0c472973fc0a09de1d08a4d&scene=58&subscene=0#rd) -- Your Hacking Tutorial by Zempirians - - [In real world pen testing, how often are you using tools or advanced exploits/hacking vs social engineering and exploiting Ng trust?](https://www.reddit.com/r/HowToHack/comments/vrbodf/in_real_world_pen_testing_how_often_are_you_using/) - - [Social Engineering](https://www.reddit.com/r/HowToHack/comments/vr1yq4/social_engineering/) - - [Debunking Movies: Unfriended: Dark Web](https://www.reddit.com/r/HowToHack/comments/vrb5xm/debunking_movies_unfriended_dark_web/) - - [A forgotten step for email security when it comes to email accounts.](https://www.reddit.com/r/HowToHack/comments/vrfj5w/a_forgotten_step_for_email_security_when_it_comes/) diff --git a/archive/2022/2022-07-06.md b/archive/2022/2022-07-06.md deleted file mode 100644 index 7fba921101..0000000000 --- a/archive/2022/2022-07-06.md +++ /dev/null @@ -1,308 +0,0 @@ -# 每日安全资讯（2022-07-06） - -- 绿盟科技技术博客 - - [汽车以太网协议之 SOME/IP（下）](http://blog.nsfocus.net/some-ip-2/) - - [浅谈云原生安全之CWPP](http://blog.nsfocus.net/cloud-cwpp/) - - [安全多方计算(3) MPC万能钥匙：混淆电路](http://blog.nsfocus.net/3-mpc/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [SEO Nethizmet Admin NoRedirect Bypass](https://cxsecurity.com/issue/WLB-2022070015) - - [Backdoor.Win32.Coredoor.10.a / Authentication Bypass](https://cxsecurity.com/issue/WLB-2022070014) - - [launchd Heap Corruption](https://cxsecurity.com/issue/WLB-2022070013) - - [Advanced Testimonials Manager 5.6 SQL Injection](https://cxsecurity.com/issue/WLB-2022070012) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 北约将发展快速网络响应能力；PCI DSS 4.0发布以应对新兴威胁和技术](https://www.freebuf.com/news/338335.html) - - [网络攻防演练心态调整 | FreeBuf甲方社群直播回顾](https://www.freebuf.com/articles/338304.html) - - [Chrome被爆严重零日漏洞，谷歌督促用户尽快更新](https://www.freebuf.com/news/338299.html) - - [CISA命令美国联邦机构在7月22日前为CVE-2022-26925打补丁](https://www.freebuf.com/news/338298.html) - - [英国签署协议，与美国边防警卫共享生物识别数据库](https://www.freebuf.com/news/338275.html) -- Security Boulevard - - [How to Achieve Fast and Secure Continuous Delivery of Cloud-Native Applications](https://securityboulevard.com/2022/07/how-to-achieve-fast-and-secure-continuous-delivery-of-cloud-native-applications/) - - [Slack for Security – How to do Policy Acknowledgements in Slack](https://securityboulevard.com/2022/07/slack-for-security-how-to-do-policy-acknowledgements-in-slack/) - - [OWASP API Security Top 10: Security risks that should be on your radar](https://securityboulevard.com/2022/07/owasp-api-security-top-10-security-risks-that-should-be-on-your-radar/) - - [Security BSides Athens 2022 – Ignatios’ ‘Talk 6 – API Security Testing Automation: A Story Of Shifting Left’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-ignatios-talk-6-api-security-testing-automation-a-story-of-shifting-left/) - - [Where’s the Authority in Identity?: Part II](https://securityboulevard.com/2022/07/wheres-the-authority-in-identity-part-ii/) - - [‘ChinaDan’ Hacks 1 BILLION Police Records from Shanghai: 23TB of PII for Sale](https://securityboulevard.com/2022/07/chinadan-hacks-1-billion-police-records-from-shanghai-23tb-of-pii-for-sale/) - - [What Is a Zero-Day Attack?](https://securityboulevard.com/2022/07/what-is-a-zero-day-attack-2/) - - [SOC 2 Compliance: Questions and Answers with Compliance Expert Bert Friedman](https://securityboulevard.com/2022/07/soc-2-compliance-questions-and-answers-with-compliance-expert-bert-friedman/) - - [Top 5 Most Common WordPress Malware Infections: An Anatomy Lesson](https://securityboulevard.com/2022/07/top-5-most-common-wordpress-malware-infections-an-anatomy-lesson/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 388’](https://securityboulevard.com/2022/07/robert-m-lees-jeff-haas-little-bobby-comic-week-388/) -- HackerOne Hacker Activity - - [SSRF via Office file thumbnails](https://hackerone.com/reports/671935) - - [Exposure of a valid Gitlab-Workhorse JWT leading to various bad things](https://hackerone.com/reports/1040786) - - [Reflected Cross site Scripting (XSS) on https://one.newrelic.com](https://hackerone.com/reports/1367642) - - [Reflected XSS on https://wwwapps.ups.com/ctc/request?loc=](https://hackerone.com/reports/1536461) -- SecWiki News - - [SecWiki News 2022-07-05 Review](http://www.sec-wiki.com/?2022-07-05) -- Sploitus.com Exploits RSS Feed - - [Advanced Testimonials Manager 5.6 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167698&utm_source=rss&utm_medium=rss) - - [Paymoney 3.3 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37829&utm_source=rss&utm_medium=rss) - - [Ransom Lockbit 3.0 MVID-2022-0621 Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167700&utm_source=rss&utm_medium=rss) - - [Stock Management System 2020 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37830&utm_source=rss&utm_medium=rss) - - [DouPHP 1.2 Release 20141027 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37831&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Rarlab Unrar exploit](https://sploitus.com/exploit?id=A573E62D-1BE0-5CD3-8E6D-EB184127464A&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=DBAD59E8-9E48-5D54-92A0-AAD5B57C39F6&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Initialization in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=54CB6211-047E-5129-8A15-3E47982A69B7&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Wso2 Api Manager exploit](https://sploitus.com/exploit?id=4B3CB1BD-2DBD-59B4-894B-D3A7D260BC7A&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Oracle Graalvm exploit](https://sploitus.com/exploit?id=9BC861BB-9B85-5E2F-93A5-C10739416EFD&utm_source=rss&utm_medium=rss) -- Jiajun的编程随想 - - [任务队列简介](https://jiajunhuang.com/articles/2022_07_05-task_queue.md.html) -- 安全客-有思想的安全新媒体 - - [多云环境的风险发现](https://www.anquanke.com/post/id/275482) - - [RSA加密解密详解](https://www.anquanke.com/post/id/275389) - - [Hackerone员工偷卖漏洞报告截胡安全研究员](https://www.anquanke.com/post/id/275888) -- Sucuri Blog - - [Top 5 Most Common WordPress Malware Infections: An Anatomy Lesson](https://blog.sucuri.net/2022/07/top-5-most-common-wordpress-malware-infections-an-anatomy-lesson.html) -- 安全牛 - - [企业数字化发展中的6个安全陋习，每一个都很危险！](https://www.aqniu.com/industry/85467.html) - - [规模和增速双爆发！奇安信云工作负载市场份额位居第一](https://www.aqniu.com/vendor/85466.html) - - [零信任不能只是“看上去很美”](https://www.aqniu.com/industry/85435.html) - - [激活数据要素潜能，上讯信息ADM护航金融科技数据能力建设](https://www.aqniu.com/vendor/85434.html) - - [上讯信息入选中国信通院“网络安全能力评价工作组”首批成员单位](https://www.aqniu.com/vendor/85433.html) - - [深度剖析：伊朗钢铁厂入侵路径推测及对钢企数字化安全转型启示](https://www.aqniu.com/vendor/85432.html) - - [深圳CA粤港互认电子认证服务，实时完成港股在线开户](https://www.aqniu.com/vendor/85431.html) -- 体验盒子 - - [macOS安装多版本JDK切换与管理](https://www.uedbox.com/post/67818/) -- Files ≈ Packet Storm - - [OpenSSL Toolkit 3.0.5](https://packetstormsecurity.com/files/167703/openssl-3.0.5.tar.gz) - - [OpenSSL Toolkit 1.1.1q](https://packetstormsecurity.com/files/167704/openssl-1.1.1q.tar.gz) - - [TripleCross Linux eBPF Rootkit](https://packetstormsecurity.com/files/167702/TripleCross-master.zip) - - [Ubuntu Security Notice USN-5479-2](https://packetstormsecurity.com/files/167701/USN-5479-2.txt) - - [Ransom Lockbit 3.0 MVID-2022-0621 Code Execution](https://packetstormsecurity.com/files/167700/MVID-2022-0621.txt) - - [C Language Reverse Shell Generator](https://packetstormsecurity.com/files/167699/C-language-reverse-shells.py.txt) - - [Advanced Testimonials Manager 5.6 SQL Injection](https://packetstormsecurity.com/files/167698/atm56-sql.txt) - - [Windows Defender Remote Credential Guard Authentication Relay Privilege Escalation](https://packetstormsecurity.com/files/167697/GS20220705135846.tgz) -- 安全脉搏 - - [CVE-2022-28346：Django SQL注入漏洞](https://www.secpulse.com/archives/182469.html) - - [【Vulnhub靶机系列】DC5](https://www.secpulse.com/archives/182431.html) - - [疑似Confucius组织最新攻击行动分析](https://www.secpulse.com/archives/182403.html) - - [一次edu证书站的挖掘](https://www.secpulse.com/archives/182388.html) - - [简单实用远控小工具Todesk](https://www.secpulse.com/archives/182351.html) -- Microsoft Security Blog - - [Hive ransomware gets upgrades in Rust](https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/) -- HackerNews - - [荷兰警方为马斯特里赫特大学追回勒索软件赎金 三年后竟还升值了](https://hackernews.cc/archives/39743) - - [Debian GNU/Linux 9 已结束长期支持 官方建议升级至新版本](https://hackernews.cc/archives/39730) - - [在防勒索软件方面 Microsoft Defender 以满分通过 AV-TEST 测试](https://hackernews.cc/archives/39718) - - [欧盟举办超大规模网络安全演习：医疗基础设施遭全链条打击](https://hackernews.cc/archives/39715) - - [Chrome 被爆严重零日漏洞，谷歌督促用户尽快更新](https://hackernews.cc/archives/39709) - - [CISA 命令美国联邦机构在 7 月 22 日前为 CVE-2022-26925 打补丁](https://hackernews.cc/archives/39706) - - [英国签署协议，与美国边防警卫共享生物识别数据库](https://hackernews.cc/archives/39702) - - [调查显示传统数据安全工具在 60% 情况下无法抵御勒索软件攻击](https://hackernews.cc/archives/39698) -- 先知安全技术社区 - - [GoAhead历史洞分析](https://xz.aliyun.com/t/11511) - - [Nacos结合Spring Cloud Gateway RCE利用](https://xz.aliyun.com/t/11493) - - [K8s 之 ApiServer 组件风险](https://xz.aliyun.com/t/11495) - - [基于开源工具实现软件成分分析SCA](https://xz.aliyun.com/t/11492) -- ElcomSoft blog - - [iCloud backups: the Dark Territory](https://blog.elcomsoft.com/2022/07/icloud-backups-the-dark-territory/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [Icinga Web 中的路径遍历漏洞](https://www.4hou.com/posts/mNlE) - - [Flubot恶意软件网络被摧毁](https://www.4hou.com/posts/DER5) - - [【技术原创】F5 BIG-IP漏洞调试环境搭建](https://www.4hou.com/posts/KEOJ) - - [密码“丰”会2022—密码行业年度颁奖盛典即将荣耀启幕！](https://www.4hou.com/posts/vJZ8) - - [零信任步入规模落地期， 2022零信任产业发展论坛探索新方向](https://www.4hou.com/posts/l6R1) - - [告别脚本小子系列丨JAVA安全(6)——反序列化利用链（上）](https://www.4hou.com/posts/gXpj) - - [2022西湖论剑•网络安全大会 威胁情报及应急响应论坛在杭州举行](https://www.4hou.com/posts/r792) -- Forcepoint - - [RSA 2022 Observations: Revealing Security’s Dirty Secrets](https://www.forcepoint.com/blog/insights/revealing-securitys-dirty-secrets-ceo-manny-rivelo) -- RyotaK's Blog - - [プライバシーポリシー](https://blog.ryotak.me/privacy/) -- Malwarebytes Labs - - [TikTok is “unacceptable security risk” and should be removed from app stores, says FCC](https://blog.malwarebytes.com/privacy-2/2022/07/tiktok-is-unacceptable-security-risk-and-should-be-removed-from-app-stores-says-fcc/) - - [Cloud-based malware is on the rise. How can you secure your business?](https://blog.malwarebytes.com/business-2/2022/07/cloud-based-malware-is-on-the-rise-how-can-you-secure-your-business/) - - [Update now! Chrome patches ANOTHER zero-day vulnerability](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/07/update-now-chrome-patches-another-zero-day-vulnerability/) -- Reverse Engineering - - [hooking libc functions in Rust - mirrord internals](https://www.reddit.com/r/ReverseEngineering/comments/vrrbs2/hooking_libc_functions_in_rust_mirrord_internals/) -- Hacking Dream - - [RPC Pentest Checklist](https://www.hackingdream.net/2022/07/rpc-pentest-checklist.html) -- Application Security Blog - - [OWASP API Security Top 10: Security risks that should be on your radar](https://www.synopsys.com/blogs/software-security/owasp-api-security-top-10/) -- Sucuri Blog - - [Top 5 Most Common WordPress Malware Infections: An Anatomy Lesson](https://blog.sucuri.net/2022/07/top-5-most-common-wordpress-malware-infections-an-anatomy-lesson.html) -- The Daily Swig | Cybersecurity news and views - - [Spring Data MongoDB hit by another critical SpEL injection flaw](https://portswigger.net/daily-swig/spring-data-mongodb-hit-by-another-critical-spel-injection-flaw) - - [CWE Top 25: These are the most dangerous software weaknesses of 2022](https://portswigger.net/daily-swig/cwe-top-25-these-are-the-most-dangerous-software-weaknesses-of-2022) - - [HackerOne employee stole data from bug bounty reports for financial gain](https://portswigger.net/daily-swig/hackerone-employee-stole-data-from-bug-bounty-reports-for-financial-gain) -- PortSwigger Blog - - [New Repeater features to help you test more efficiently](https://portswigger.net/blog/new-repeater-features-to-help-you-test-more-efficiently) -- SentinelOne - - [Surviving the Storm | Defending Against Cloud Misconfigurations, Vulnerabilities, and Insider Threats](https://www.sentinelone.com/blog/surviving-the-storm-defending-against-cloud-misconfigurations-vulnerabilities-and-insider-threats/) -- 博客园 - 飘渺红尘✨ - - [java反序列化漏洞专项 - 飘渺红尘✨](https://www.cnblogs.com/piaomiaohongchen/p/16447244.html) -- KitPloit - PenTest & Hacking Tools - - [Cspparse - A Tool To Evaluate Content Security Policies](http://www.kitploit.com/2022/07/cspparse-tool-to-evaluate-content.html) -- PortSwigger Blog - - [New Repeater features to help you test more efficiently](https://portswigger.net/blog/new-repeater-features-to-help-you-test-more-efficiently) -- 黑海洋 - WIKI - - [创业思维课程：菜鸟该如何创业](https://blog.upx8.com/2871) - - [全流程JAVAEE企业级完整项目](https://blog.upx8.com/2870) - - [伪Pandownload公测版（百度网盘不限速下载 ）](https://blog.upx8.com/2869) -- LuxSci - - [How to Avoid Business Email Compromise Attacks](https://luxsci.com/blog/how-to-avoid-business-email-compromise-attacks.html) -- Secureworks Blog - - [Cybersecurity Games Gain New and Informative Perspectives](https://www.secureworks.com/blog/cybersecurity-games-gain-new-informative-perspectives) -- 奇客Solidot–传递最新科技情报 - - [当用户代理是 Linux 时 Xbox Cloud 串流会降低画质](https://www.solidot.org/story?sid=72040) - - [加密货币崩溃黑人投资者损失惨重](https://www.solidot.org/story?sid=72039) - - [2022 年度菲尔兹奖公布](https://www.solidot.org/story?sid=72038) - - [西班牙和葡萄牙经历 1200 年来最严重干旱](https://www.solidot.org/story?sid=72037) - - [Debian 9 LTS 结束支持](https://www.solidot.org/story?sid=72036) - - [小米在越南生产手机](https://www.solidot.org/story?sid=72035) - - [以加密货币为目标的朝鲜黑客](https://www.solidot.org/story?sid=72034) - - [周冠宇撞车事故与挽救性命的 Halo 系统](https://www.solidot.org/story?sid=72033) - - [PC 销售放缓](https://www.solidot.org/story?sid=72032) - - [生命帮助制造地球几乎一半的矿物质](https://www.solidot.org/story?sid=72031) - - [FCC 为汽车、船只和飞机的 Starlink 服务开绿灯](https://www.solidot.org/story?sid=72030) - - [人类在水下的听力比以前认为的要好得多](https://www.solidot.org/story?sid=72029) - - [年轻人易死于交通事故](https://www.solidot.org/story?sid=72028) - - [迪士尼的米老鼠版权即将到期](https://www.solidot.org/story?sid=72027) - - [BioNTec/辉瑞测试通用冠状病毒疫苗](https://www.solidot.org/story?sid=72026) -- TrustedSec - - [A Diamond in the Ruff](https://www.trustedsec.com/blog/a-diamond-in-the-ruff/) -- IntelTechniques Blog - - [New Breach Data Lesson I: Barcode Scanning](https://inteltechniques.com/blog/2022/07/05/new-breach-data-lesson-i-barcode-scanning/) -- Daniel Miessler - - [News & Analysis | NO. 338](https://danielmiessler.com/podcast/news-analysis-no-338/) - - [The Workforce Pincer Move During Recessions](https://danielmiessler.com/blog/the-workforce-pincer-move-during-recessions/) -- SANS Internet Storm Center, InfoCON: green - - [EternalBlue 5 years after WannaCry and NotPetya, (Tue, Jul 5th)](https://isc.sans.edu/diary/rss/28816) - - [ISC Stormcast For Tuesday, July 5th, 2022 https://isc.sans.edu/podcastdetail.html?id=8074, (Tue, Jul 5th)](https://isc.sans.edu/diary/rss/28814) -- Securityinfo.it - - [Calano i nuovi ransomware scoperti](https://www.securityinfo.it/2022/07/05/calano-i-nuovi-ransomware-scoperti/?utm_source=rss&utm_medium=rss&utm_campaign=calano-i-nuovi-ransomware-scoperti) - - [Deepfake usati in frodi aziendali](https://www.securityinfo.it/2022/07/05/deepfake-usati-in-frodi-aziendali/?utm_source=rss&utm_medium=rss&utm_campaign=deepfake-usati-in-frodi-aziendali) -- Volatility Labs - - [The 10th Annual Volatility Plugin Contest!](https://volatility-labs.blogspot.com/2022/07/the-10th-annual-volatility-plugin-contest.html) -- HACKMAGEDDON - - [1-15 June 2022 Cyber Attacks Timeline](https://www.hackmageddon.com/2022/07/05/1-15-june-2022-cyber-attacks-timeline/) -- Security Current - - [Fireside Chat: LinkedIn, Its Algorithm and You](https://us06web.zoom.us/meeting/register/tZErfu6qqTgiH9FpkdKaTcYNi4rD4ftZEfk9#new_tab) -- Threatpost - - [Latest Cyberattack Against Iran Part of Ongoing Campaign](https://threatpost.com/cyberattack-iran-campaign/180122/) - - [Google Patches Actively Exploited Chrome Bug](https://threatpost.com/actively-exploited-chrome-bug/180118/) -- Forensic Focus - - [Cellebrite’s Monica Harris on Achieving Balance in Corporate Investigations and E-Discovery](https://www.forensicfocus.com/podcast/cellebrites-monica-harris-on-achieving-balance-in-corporate-investigations-and-e-discovery/) -- Appsecco - Medium - - [Hacking AWS Lambda for security, fun and profit](https://blog.appsecco.com/hacking-aws-lambda-for-security-fun-and-profit-c140426b6167?source=rss----e2adb3957733---4) -- 字节跳动安全中心 - - [进化的隐藏水印：深度学习提升版权保护的鲁棒性](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489098&idx=1&sn=8c01a87408f2d745bd9de38bcad1713d&chksm=fa9eed1ccde9640a1e34f35437460b7f5101639ee719e7499f23d5926776ce16fe9d31c1ac86&scene=58&subscene=0#rd) -- 火线Zone - - [AWS：代理服务器上的远程代码执行（hackerone漏洞报告）](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495894&idx=1&sn=bfe228cd674fd5b9b7a208578e579652&chksm=eaa978f6dddef1e0a33a0d4fd3ddae36722123c81c3ba71c439bc5d78ef5f272a090e44d4d22&scene=58&subscene=0#rd) -- 星阑科技 - - [星阑科技受邀参加工信部“数据安全产业发展研讨会——数字金融安全专题会议”，并进行专题分享](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494044&idx=1&sn=5f2aff9ca269395239d457ef47f3fa52&chksm=c0074400f770cd1654638c4a684f8554786b277b5085df5128fdd3bbbbcd86e625d5b1a6c9c5&scene=58&subscene=0#rd) -- Social Engineering - - [How do you tell someone to stop doing something in a smart way, without using the words - stop that - because usually telling someone to stop, will have the same effect as telling a child not to curse - they will curse more to push your buttons, asking questions can work but not always](https://www.reddit.com/r/SocialEngineering/comments/vsb8hp/how_do_you_tell_someone_to_stop_doing_something/) - - [Hunt for what consumers need and communicate a want](https://www.reddit.com/r/SocialEngineering/comments/vrxstt/hunt_for_what_consumers_need_and_communicate_a/) -- CNCERT风险评估 - - [CNVD漏洞周报2022年第26期](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496884&idx=1&sn=59c9ecb4ae1f668e9c383685ef0e7995&chksm=973ac7d6a04d4ec0321712b56a386c1138a7eb54af390cf9baca9a0033b97754e3346d1f3792&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220627-20220703)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496884&idx=2&sn=da05f25da1830fb5bb4144111a223a75&chksm=973ac7d6a04d4ec00d5d8082e9db04e6672acc20be8e4209e32a2b84b38598c8b60067b419f5&scene=58&subscene=0#rd) - - [每周移动恶意程序传播渠道安全监测报告（2022年06月27日—2022年07月03日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496884&idx=3&sn=4fd0af49665ddf4aceccf63ea365e726&chksm=973ac7d6a04d4ec0cb239b8b512a224a2e112af0f4deec3f19a244bb7a23a408a0402777fe8f&scene=58&subscene=0#rd) -- TorrentFreak - - [The Pirate Bay Has a Documentary, Tamil Rockers Get an Action Thriller](https://torrentfreak.com/the-pirate-bay-has-a-documentary-tamil-rockers-get-an-action-thriller-220705/) - - [Court Denies Summary Judgments in ISP’s Piracy Liability Lawsuit](https://torrentfreak.com/court-denies-summary-judgments-in-isps-piracy-liability-lawsuit-220705/) -- KitPloit - PenTest Tools! - - [Cspparse - A Tool To Evaluate Content Security Policies](http://www.kitploit.com/2022/07/cspparse-tool-to-evaluate-content.html) -- NetSPI - - [Infosecurity Europe 2022: Observations from the ExCel](https://www.netspi.com/blog/executive/security-industry-trends/infosecurity-europe-oberservations/) -- 默安科技 - - [走进成都“交子云端”：默安科技谈平战状态下的数据安全管控](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492593&idx=1&sn=787a32777acd2d231d6f03f9a140b932&chksm=e93b14d3de4c9dc5aedd9d1626dffd0d8dee3ec7313587a2a39443c69ab15333590406f885fa&scene=58&subscene=0#rd) -- Deeplinks - - [EFF Statement on EU Parliament’s Adoption of Digital Services Act and Digital Markets Act](https://www.eff.org/press/releases/eff-statement-eu-parliaments-formal-approval-digital-services-act-and-digital-markets) - - [Cheers to EFF's 15th Annual Cyberlaw Trivia Winners!](https://www.eff.org/deeplinks/2022/06/cheers-effs-15th-annual-cyberlaw-trivia-winners) -- 情报分析师 - - [【情报资料】G7会议公报及相关文档资料](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509334&idx=1&sn=32d31cb75add9483ef244af5159dbb51&chksm=8716be5db061374b242b364af5dba04643643efe011d061071429c8e306ab7fc61da9b90df8c&scene=58&subscene=0#rd) - - [拜登的政治性格在他的政治决定中的体现](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509334&idx=2&sn=c24ac787f8a1c22df93991932a5f7705&chksm=8716be5db061374b9700a8df8d2b587e17ab86aa8193e23ed8e35004340cf4b33ba7e645e066&scene=58&subscene=0#rd) - - [【情报课堂】如何找到拍摄照片的位置](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509334&idx=3&sn=1bdfcfda610d3c293fd2071019418f3e&chksm=8716be5db061374b267ba40969ae5c9ca56f4d1d3892d05d4f66b850ebd4a7bce7ffda2581a3&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [vivo刘洪善：做安全行业的长期主义者，vivo全面守护用户隐私](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247488695&idx=1&sn=27a7197bdbf66965017ee6a38b0ee5bd&chksm=e9b932dbdecebbcd4e0566474849d52451a807a6f375a0032bb302f62954ba25c4d8e0bfc309&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜进退维谷：runC的阿克琉斯之踵](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651134836&idx=1&sn=71b3e4067a1139f207fa851dd8b37341&chksm=f2c11a14c5b693025fb066f9e777004a84b95b185ec16932a7d80135a780c6bf4c61c1459623&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Is it possible to work part-time as a pentester?](https://www.reddit.com/r/netsecstudents/comments/vs3kf5/is_it_possible_to_work_parttime_as_a_pentester/) - - [M1 Mac for cyber security student](https://www.reddit.com/r/netsecstudents/comments/vs4n6e/m1_mac_for_cyber_security_student/) - - [Is my degree enough to work in this area?](https://www.reddit.com/r/netsecstudents/comments/vrth7x/is_my_degree_enough_to_work_in_this_area/) -- 山石网科安全技术研究院 - - [鹏城杯WriteUp｜Web、Misc方向](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494468&idx=1&sn=43b29f5ead728c7b0a1f073082e5c1e5&chksm=fa523efacd25b7ec6ca0288a7251a170e2194427b19a4e465854c1530b059dfbdff24824211b&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (06.27-07.03)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491125&idx=1&sn=a5ce6622043f63b966968bf35008c5e7&chksm=fe251b34c9529222b77efc33a8f5f0f0bbe4e3be2315406e02ffd628504f7ce5d4cb70ccad64&scene=58&subscene=0#rd) - - [安全日报（2022.07.05）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491125&idx=2&sn=2f61b186d798bc75028e6d30fddbac1a&chksm=fe251b34c9529222a99bb608bd4466efeacc06f1a34191586b528fd0f4fc29f655b09cd7fed9&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [基于 http-flv 的抖音直播端到端延迟优化实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496039&idx=1&sn=9d3c0750d604d615f718cebf4382dc25&chksm=e9d33a85dea4b3933be8e80ec47958993e358867203f9bde23d1f2364d666bfa6de9d8f0223f&scene=58&subscene=0#rd) -- Instapaper: Unread - - [Free smartphone stalkerware detection tool gets dedicated hub](https://www.bleepingcomputer.com/news/security/free-smartphone-stalkerware-detection-tool-gets-dedicated-hub/) - - [AstraLocker ransomware shuts down and releases decryptors](https://www.bleepingcomputer.com/news/security/astralocker-ransomware-shuts-down-and-releases-decryptors/) - - [FOR585 Course Animation Solid State Memory Properties](https://www.youtube.com/watch?v=LvmiAuV6PJA) - - [FOR585 Course Animation Potential Crime Scene iPhone and Android](https://www.youtube.com/watch?v=G-7i_GkviDo) - - [How to Assess an E-voting System](https://freedom-to-tinker.com/2022/06/27/how-to-assess-an-e-voting-system/) - - [Search Engine for HackersAnalystsBloggersOSINT Analysts and Threat Intelligence Experts! Here We Go!](https://ddanchev.blogspot.com/2022/07/search-engine-for-hackersanalystsblogge.html) - - [Giant data breach Leaked personal data of one billion people has been spotted for sale on the dark web](https://www.zdnet.com/article/giant-data-breach-leaked-personal-data-of-one-billion-people-has-been-spotted-for-sale-on-the-dark-web/) -- Your Hacking Tutorial by Zempirians - - [Is Ettercap + SSLstrip still worth these days?](https://www.reddit.com/r/HowToHack/comments/vs5db7/is_ettercap_sslstrip_still_worth_these_days/) - - [Brute force tool for webpages](https://www.reddit.com/r/HowToHack/comments/vs1iml/brute_force_tool_for_webpages/) - - [Now that I have a home hacking lab set up, what's next?](https://www.reddit.com/r/HowToHack/comments/vro4pt/now_that_i_have_a_home_hacking_lab_set_up_whats/) - - [Getting form parameters of a site](https://www.reddit.com/r/HowToHack/comments/vs7vcx/getting_form_parameters_of_a_site/) -- Computer Forensics - - [Recover Bitlocker Drive that has been formatted](https://www.reddit.com/r/computerforensics/comments/vs8id7/recover_bitlocker_drive_that_has_been_formatted/) - - [Re-architecture of lab environment: workstations vs. server?](https://www.reddit.com/r/computerforensics/comments/vs9h8b/rearchitecture_of_lab_environment_workstations_vs/) - - [Google Photo Cache?](https://www.reddit.com/r/computerforensics/comments/vrxqnx/google_photo_cache/) -- ChaMd5安全团队 - - [CTM - Escrow Contract Agreement攻击样本分析](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247505899&idx=1&sn=03df1e47a07ab1ff5b9085adbc9916d1&chksm=e89dff33dfea7625c7869855e7c51728318f516491f119dbd2e983d19ba5d549eca487ed1d35&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】最好的邮箱采集工具0.zone](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773477&idx=1&sn=a48bfc1fb4deecf8c8f016357fafd70f&chksm=889365cabfe4ecdc24f0ef9d2c4f84cae62a88bdef372e1d83852a6f9591d2c6134867af58df&scene=58&subscene=0#rd) - - [【安全头条】Hackerone员工偷卖漏洞报告截胡安全研究员](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773477&idx=2&sn=06bbfe9783ac4d923c198482f5e3ab6c&chksm=889365cabfe4ecdc4a39d6acb7fd25cfcc8aead738389aa7888518bf934bb0a8fe70a8739ba9&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [预警：新僵尸网络家族正在利用IoT设备构建攻击网络](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528474&idx=1&sn=4aecd4fa797569bd77698a6e3868ab19&chksm=c1e9fc4bf69e755da828c47cef57ff2bc3403db7a0f434894f1aafb9d3b320b6a40e5282d322&scene=58&subscene=0#rd) - - [CANoe16搭建SOME/IP通信仿真环境](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528474&idx=2&sn=c238924afa02462e263bbac6f77c9a4e&chksm=c1e9fc4bf69e755d6de9a353fbed2f492d5a5ab55219f297517ad9bcae47265b0e6380854121&scene=58&subscene=0#rd) - - [【攻防演练专题】终端/云主机安全防护](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528474&idx=3&sn=600f845f4f51020123fa654f10b296a8&chksm=c1e9fc4bf69e755ddc66d0db40e567222132013deb63f59a0d03e71e631be2f7f168dda24c02&scene=58&subscene=0#rd) - - [我国政务云服务安全的观察与浅见](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528474&idx=4&sn=0638f9274df63616e20334c8713823f4&chksm=c1e9fc4bf69e755dc84d95b5dac142c2767f4139255f83788f642172fad16f7580d472422a7d&scene=58&subscene=0#rd) - - [数据治理安全（DGS）白皮书](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528474&idx=5&sn=9459eff00693f22e352012adee4f8940&chksm=c1e9fc4bf69e755df67694282a3a7d40a061a5f15d2175bc36d71b8e541c08732325b391c371&scene=58&subscene=0#rd) - - [欧盟举办超大规模网络安全演习：医疗基础设施遭全链条打击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528474&idx=6&sn=79911d1adc5ef80b59b1899b8e7f7136&chksm=c1e9fc4bf69e755df7eb078b8864c5b2dddabc4783458a1759f81c2d3b8fd0d085cf0edb357e&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-07-05](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490618&idx=1&sn=4b17a1a6f613ce983c4e06e695ca4437&chksm=c06032e3f717bbf5e6801f275a78974baa7beac45858fdf240215875bbbe95726381bb405378&scene=58&subscene=0#rd) -- Dark Reading - - [NIST Picks Four Quantum-Resistant Cryptographic Algorithms](https://www.darkreading.com/emerging-tech/nist-picks-four-quantum-resistant-cryptographic-algorithms) - - [HackerOne Employee Fired for Stealing and Selling Bug Reports for Personal Gain](https://www.darkreading.com/vulnerabilities-threats/hackerone-employee-fired-for-stealing-and-selling-bug-reports-for-personal-gain) - - [Supply Chain Attack Deploys Hundreds of Malicious NPM Modules to Steal Data](https://www.darkreading.com/attacks-breaches/supply-chain-attack-malicious-npm-modules-steal-data) - - [Why Browser Vulnerabilities Are a Serious Threat — and How to Minimize Your Risk](https://www.darkreading.com/attacks-breaches/why-browser-vulnerabilities-are-a-serious-threat-and-how-to-minimize-your-risk) - - [Google Chrome WebRTC Zero-Day Faces Active Exploitation](https://www.darkreading.com/vulnerabilities-threats/google-chrome-webrtc-zero-day-active-exploitation) - - [3 Cyber Threats Resulting From Today's Technology Choices to Hit Businesses by 2024](https://www.darkreading.com/vulnerabilities-threats/3-cyber-threats-resulting-from-today-s-technology-choices-to-hit-businesses-by-2024) - - [Name That Edge Toon: On Guard](https://www.darkreading.com/edge-articles/name-that-edge-toon-on-guard) -- Security Affairs - - [Iranian Fars News Agency claims cyberattack on a company involved in the construction of Tel Aviv metro](https://securityaffairs.co/wordpress/132897/hacking/tel-aviv-metro-company-attacked.html) - - [Cyber Police of Ukraine arrested 9 men behind phishing attacks on Ukrainians attempting to capitalize on the ongoing conflict](https://securityaffairs.co/wordpress/132891/cyber-crime/cyber-police-of-ukraine-phishing.html) - - [Threat actors compromised British Army ’s Twitter, YouTube accounts to promote crypto scams](https://securityaffairs.co/wordpress/132876/hacking/british-army-accounts-hacked.html) - - [AstraLocker ransomware operators shut down their operations](https://securityaffairs.co/wordpress/132871/malware/astralocker-ransomware-shut-down.html) -- /r/netsec - Information Security News & Discussion - - [Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135)](https://www.reddit.com/r/netsec/comments/vsakmq/abusing_functionality_to_exploit_a_super_ssrf_in/) - - [From NtObjectManager to PetitPotam](https://www.reddit.com/r/netsec/comments/vrz3xy/from_ntobjectmanager_to_petitpotam/) -- 小米安全中心 - - [《数据安全治理框架及落地实践》李雪妮](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247513832&idx=1&sn=e2961d898d9f4b5f957bfa9ba294268e&chksm=ea83907dddf4196bf0346ab2482ea9364634d22a93f03f78fac72355ce84846e759908ac95ad&scene=58&subscene=0#rd) -- 代码卫士 - - [Chrome 103紧急修复已遭利用的0day](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512717&idx=1&sn=90d9ee1cbcb33e3442cfd9d4d4c1d958&chksm=ea9483e7dde30af103b74637ffdefd0a6d62164388d12598a2a74b18e802f659d18f3e11a70f&scene=58&subscene=0#rd) - - [Django 修复SQL注入漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512717&idx=2&sn=e7d555a3b2e371cc5f51269f55621112&chksm=ea9483e7dde30af1515cb24b488607e05e070f64625e434938207bb79bcccb49fafba26a620a&scene=58&subscene=0#rd) - - [澳大利亚莫纳什大学推出公开漏洞奖励计划](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512717&idx=3&sn=ed4f540ffb43d12f8f07655065653095&chksm=ea9483e7dde30af173547333a59e5ef20cbd256045c377a56722b6cac0af0d581a27bc4b07a1&scene=58&subscene=0#rd) -- 安全牛 - - [企业数字化发展中的6个安全陋习，每一个都很危险！](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115675&idx=1&sn=73e8f49b6930e95d81bce82cec388995&chksm=bd1460488a63e95e57fa355b8bc08696d90aae10c4f061bc10f4da0b8fe76fee99617be6b1d0&scene=58&subscene=0#rd) - - [零信任不能只是“看上去很美”](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115675&idx=2&sn=fc7f24ce3153db6c89d5033367503fc6&chksm=bd1460488a63e95e9ea938b7331e508e216b945e07253a81d7b9a43bbd6b860d241a2ef07082&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（30期）：WINDOWS应急响应](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115675&idx=3&sn=3596972438a332cda2d75c08909ed4c5&chksm=bd1460488a63e95e5d1e8a78bde89524d054493cf8399da3d07cc363712fb595785f8a90fcb8&scene=58&subscene=0#rd) -- Adam Caudill - - [On Art, Heritage, Nazis, & 3D Scanners](https://adamcaudill.com/2022/07/05/on-art-heritage-nazis-3d-scanners/?utm_source=atom_feed) -- 看雪学院 - - [2022 CISCN初赛 Satool](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456988&idx=1&sn=a3a8c08263efee84e985eb9af97ba71b&chksm=b18e231686f9aa007a6903e8fcf915418fd42c06f002a7a254297c78f4cae96bb11266471b45&scene=58&subscene=0#rd) - - [乌克兰人损失2262万元！一犯罪团伙通过经济援助钓鱼网站实施诈骗](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456988&idx=2&sn=6a2099dde01ce5d87e3b8a2d2b3d31a3&chksm=b18e231686f9aa00230b9f7c4dbbb44534dcb8af1e5e64fc1b83c24c5d62f2020c7cd1dd5fbf&scene=58&subscene=0#rd) - - [反勒索软件开发实战篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458456988&idx=3&sn=c2787c2572785376164457c733f63361&chksm=b18e231686f9aa006ee1f642c28c97192d72968000672019defd7e4150ea7dd9dd22d971b4a8&scene=58&subscene=0#rd) -- The Register - Security - - [Actual quantum computers don't exist yet. The encryption to defeat them may already be here](https://go.theregister.com/feed/www.theregister.com/2022/07/05/us_nist_quantum_algorithms/) - - [Pentagon: We'll pay you if you can find a way to hack us](https://go.theregister.com/feed/www.theregister.com/2022/07/05/dod-hackus-bug-bounty/) - - [Calls for bans on Chinese CCTV makers Hikvision, Dahua expand](https://go.theregister.com/feed/www.theregister.com/2022/07/05/uk_ban_hikvision_dahua/) - - [How to spot your biggest security threat? Just look out for the humans](https://go.theregister.com/feed/www.theregister.com/2022/07/05/how_to_spot_your_biggest/) - - [Germany unveils plan to tackle cyberattacks on satellites](https://go.theregister.com/feed/www.theregister.com/2022/07/05/bsi_satellite_baseline/) - - [Alibaba's finance arm open sources its privacy software and a 'Secure Processing Unit'](https://go.theregister.com/feed/www.theregister.com/2022/07/05/ant_group_open_source/) - - [Dutch University retrieves Bitcoin ransomware payment and makes a profit](https://go.theregister.com/feed/www.theregister.com/2022/07/05/maastricht_university_ransom_return/) - - [Billion-record stolen Chinese database for sale on breach forum](https://go.theregister.com/feed/www.theregister.com/2022/07/05/shanghai_police_database_for_sell/) - - [Google updates Chrome to squash actively exploited WebRTC Zero Day](https://go.theregister.com/feed/www.theregister.com/2022/07/05/chrome_webrtc_zero_day/) -- 腾讯玄武实验室 - - [每日安全动态推送(07-05)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958566&idx=1&sn=6208a63e72f0bcab1a05a4a8ae60fd5c&chksm=8baecdb9bcd944af52e9f94060b477b7476935a0a9e00926eb451c1cb12763d763bc1da7c876&scene=58&subscene=0#rd) -- 补天平台 - - [转发有奖|补天校园沙龙，带你玩转挖洞！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494324&idx=1&sn=66d45c0ef7763f247ea8327df02428ce&chksm=eaf9a2f8dd8e2bee9ffc983077696a47e54a8206c152782a99b8fac204a77cbdf73e861b3a68&scene=58&subscene=0#rd) -- Paul's Security Weekly - - [ESW #276 - Matt McGuirk & Ian Glazer](http://podcast.securityweekly.com/esw-276-matt-mcguirk-ian-glazer) diff --git a/archive/2022/2022-07-07.md b/archive/2022/2022-07-07.md deleted file mode 100644 index abc81bb7b5..0000000000 --- a/archive/2022/2022-07-07.md +++ /dev/null @@ -1,288 +0,0 @@ -# 每日安全资讯（2022-07-07） - -- HackerOne Hacker Activity - - [Privilege escalation possible in dovecot when similar passdbs are used](https://hackerone.com/reports/1561579) - - [Ownership check missing when updating or deleting attachments](https://hackerone.com/reports/1579820) - - [Blind User-Agent SQL Injection to Blind Remote OS Command Execution at █████████](https://hackerone.com/reports/1339430) -- NOSEC 安全讯息平台 - 漏洞预警 - - [OpenSSL远程代码执行漏洞 （CVE-2022-2274）](https://nosec.org/home/detail/5025.html) -- Sec-News 安全文摘 - - [Froxlor Server Management Panel File Upload Filter Bypass and RCE](https://wiki.ioin.in/url/vn6X) -- Sploitus.com Exploits RSS Feed - - [Magnolia CMS 6.2.19 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167705&utm_source=rss&utm_medium=rss) - - [EQS Integrity Line Cross Site Scripting / Information Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:167706&utm_source=rss&utm_medium=rss) - - [Xen PV Guest Non-SELFSNOOP CPU Memory Corruption exploit](https://sploitus.com/exploit?id=PACKETSTORM:167710&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=2B2A8A69-A893-5E85-8B02-6D8A77B54853&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Redis exploit](https://sploitus.com/exploit?id=10641534-830A-59F4-9316-7E94F60F1456&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-31749 exploit](https://sploitus.com/exploit?id=9CED34A7-B9F7-5B83-816A-0BB22C237331&utm_source=rss&utm_medium=rss) -- 安全客-有思想的安全新媒体 - - [进化的隐藏水印：深度学习提升版权保护的鲁棒性](https://www.anquanke.com/post/id/276006) - - [放眼后量子时代：NIST希望新标准可防止量子计算机破解加密](https://www.anquanke.com/post/id/276057) - - [微信小程序抓包之路](https://www.anquanke.com/post/id/275674) - - [CVE-2022-2274: OpenSSL RSA 远程代码执行漏洞通告](https://www.anquanke.com/post/id/276046) - - [CVE-2022-23222 eBPF verifier 提权漏洞分析](https://www.anquanke.com/post/id/275966) - - [决策树与随机森林](https://www.anquanke.com/post/id/275484) - - [AstraLocker勒索组织联系媒体发布解密工具](https://www.anquanke.com/post/id/275965) -- Security Boulevard - - [Did the Cloud Provide Safe Haven in the Ukraine-Russia Cyber War? [Microsoft Perspective]](https://securityboulevard.com/2022/07/did-the-cloud-provide-safe-haven-in-the-ukraine-russia-cyber-war-microsoft-perspective/) - - [EBI Files Patent for Blockchain Drive to Thwart Ransomware Attacks](https://securityboulevard.com/2022/07/ebi-files-patent-for-blockchain-drive-to-thwart-ransomware-attacks/) - - [Palo Alto Networks Issues BRc4 Attack Simulation Tool Warning](https://securityboulevard.com/2022/07/palo-alto-networks-issues-brc4-attack-simulation-tool-warning/) - - [Stolen Apes: Protecting Communities Using Behavioral Data](https://securityboulevard.com/2022/07/stolen-apes-protecting-communities-using-behavioral-data/) - - [How To Detect Privilege Escalation: An Attack Simulation](https://securityboulevard.com/2022/07/how-to-detect-privilege-escalation-an-attack-simulation/) - - [How JumpCloud Can Meet CMMC/NIST Requirements](https://securityboulevard.com/2022/07/how-jumpcloud-can-meet-cmmc-nist-requirements/) - - [Security BSides Athens 2022 – Leo Tsaousis’ ‘Talk 8 – Baby, Don’t Forget My Number. OSINT Using Your Phone’s Address Book’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-leo-tsaousis-talk-8-baby-dont-forget-my-number-osint-using-your-phones-address-book/) - - [What Features to Look for in Data Classification Software](https://securityboulevard.com/2022/07/what-features-to-look-for-in-data-classification-software/) - - [Remote Work and IoT Devices Create At-Home Vulnerabilities](https://securityboulevard.com/2022/07/remote-work-and-iot-devices-create-at-home-vulnerabilities/) -- 安全牛 - - [重磅发布｜上讯信息参编《数据安全法》实施参考（第一版）](https://www.aqniu.com/vendor/85513.html) - - [安全资讯 | 移动安全管理实力“出圈”，保障疫情下的移动办公](https://www.aqniu.com/vendor/85512.html) - - [数智转型 护航业务安全，2022 CIO信息安全高峰论坛成功举办！](https://www.aqniu.com/vendor/85493.html) - - [水利行业工控系统网络安全防护方案](https://www.aqniu.com/vendor/85492.html) - - [即刻开启零信任网络之旅，绎云推出永久免费的轻量级零信任网络产品](https://www.aqniu.com/vendor/85491.html) - - [重磅预告 | 派拉软件数字安全云战略发布会，开启云纳万物的数字安全新时代](https://www.aqniu.com/vendor/85473.html) - - [攻防演练 | 无惧无文件钓鱼，这里有一份硬核指南](https://www.aqniu.com/vendor/85472.html) -- paper - Last paper - - [.NET 反序列化漏洞之绕过 SerializationBinder 不安全的类型绑定](https://paper.seebug.org/1927/) -- 绿盟科技技术博客 - - [实力代表 | 绿盟科技被Gartner列为SOAR市场代表供应商](http://blog.nsfocus.net/gartner-soar/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Advanced Testimonials Manager v5.5 Reinstall Add Admin Vulnerability](https://cxsecurity.com/issue/WLB-2022070020) - - [Ransom Lockbit 3.0 / Code Execution](https://cxsecurity.com/issue/WLB-2022070019) - - [Designed By Sevy INC. - SQL Injection Vulnerability, Unrestricted File Upload Vulnerability and Default Admin Credentials](https://cxsecurity.com/issue/WLB-2022070018) - - [Xen PV Guest Non-SELFSNOOP CPU Memory Corruption](https://cxsecurity.com/issue/WLB-2022070017) - - [EQS Integrity Line Cross Site Scripting / Information Disclosure](https://cxsecurity.com/issue/WLB-2022070016) -- HackerNews - - [Hive 勒索软件升级为 Rust，以实现更复杂的加密方法](https://hackernews.cc/archives/39783) - - [入侵数百个网站和程序，NPM 供应链攻击造成的影响不可估量](https://hackernews.cc/archives/39784) - - [新勒索软件 RedAlert 来袭！已有 Windows、Linux 等服务器中招](https://hackernews.cc/archives/39771) - - [研究人员分享了在暗网上发现匿名勒索软件网站的技术](https://hackernews.cc/archives/39748) - - [美国执法部门通过在线旅行社长期监视俄罗斯黑客行踪](https://hackernews.cc/archives/39762) - - [卡巴斯基为 TinyCheck 设立官网，以协助全球受害者做出应对](https://hackernews.cc/archives/39757) - - [放眼后量子时代：NIST 希望新标准可防止量子计算机破解加密](https://hackernews.cc/archives/39753) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | NPM供应链攻击影响数百个网站；英国军队社交媒体账户被劫持](https://www.freebuf.com/news/338414.html) - - [数据安全治理：数据治理与数据安全治理思考](https://www.freebuf.com/articles/database/338431.html) - - [入侵数百个网站和程序，NPM供应链攻击造成的影响不可估量](https://www.freebuf.com/news/338412.html) - - [新勒索软件RedAlert来袭！已有Windows、Linux等服务器中招](https://www.freebuf.com/news/338387.html) -- Files ≈ Packet Storm - - [Zeek 5.0.0](https://packetstormsecurity.com/files/167712/zeek-5.0.0.tar.gz) - - [Windows Kerberos Redirected Logon Buffer Privilege Escalation](https://packetstormsecurity.com/files/167711/GS20220706153551.tgz) - - [Xen PV Guest Non-SELFSNOOP CPU Memory Corruption](https://packetstormsecurity.com/files/167710/GS20220706153018.txt) - - [Red Hat Security Advisory 2022-5498-01](https://packetstormsecurity.com/files/167709/RHSA-2022-5498-01.txt) - - [Ubuntu Security Notice USN-5502-1](https://packetstormsecurity.com/files/167708/USN-5502-1.txt) - - [Ubuntu Security Notice USN-5503-1](https://packetstormsecurity.com/files/167707/USN-5503-1.txt) - - [EQS Integrity Line Cross Site Scripting / Information Disclosure](https://packetstormsecurity.com/files/167706/eqsintegrityline-xss.txt) - - [Magnolia CMS 6.2.19 Cross Site Scripting](https://packetstormsecurity.com/files/167705/magnoliacms6219-xss.txt) -- 美团技术团队 - - [外卖广告大规模深度学习模型工程实践 | 美团外卖广告工程实践专题连载](https://tech.meituan.com/2022/07/06/largescaledeeplearningmodel-engineeringpractice-in-mtwaimaiad.html) - - [大众点评搜索相关性技术探索与实践](https://tech.meituan.com/2022/07/06/semantic-relevance-matching.html) -- 跳跳糖 - 安全与分享社区 - - [神奇的 C++ 模板 —— 2022-ACTF-Nagi-Knows Writeup](https://tttang.com/archive/1643/) -- Envato Tuts+ Code - Mobile Development - - [18 Best Flutter Mobile App Templates on CodeCanyon in 2022](https://code.tutsplus.com/articles/best-flutter-app-templates-on-codecanyon--cms-35676) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [漏洞预警|Apache Shiro身份认证绕过漏洞](https://www.4hou.com/posts/LBJD) - - [Amazon Photos安全漏洞](https://www.4hou.com/posts/gXnr) - - [常见的安全错误配置及其后果](https://www.4hou.com/posts/1EwP) - - [攻防演练 | 2022年蓝队备战指南火热领取中](https://www.4hou.com/posts/ykX6) - - [火热报名中！第三届“网鼎杯”等你来战](https://www.4hou.com/posts/JXQK) - - [专业分析远离社死！如何看待QQ出现大面积盗号？](https://www.4hou.com/posts/vJ88) -- Planet Classpath - - [Thomas Fitzsimmons: uLisp on the SMART Response XE](https://www.fitzsim.org/blog/?p=460) -- Jiajun的编程随想 - - [OIDC(OpenID Connect) 简介](https://jiajunhuang.com/articles/2022_07_06-openid_connect.md.html) -- 先知安全技术社区 - - [红队队开发基础-基础免杀(二)](https://xz.aliyun.com/t/11496) - - [未授权、越权类漏洞探究](https://xz.aliyun.com/t/11500) - - [记一次阿里云Linux沙箱体验](https://xz.aliyun.com/t/11522) -- xorl %eax, %eax - - [Why the Equation Group (EQGRP) is NOT the NSA](https://xorl.wordpress.com/2022/07/06/why-the-equation-group-eqgrp-is-not-the-nsa/) -- 体验盒子 - - [卡在Running Gradle task ‘assembleTgRelease’.很久的解决方案](https://www.uedbox.com/post/67823/) -- Real-time communications security on Communication Breakdown - Real-Time Communications Security - - [SIPVicious PRO experimental now supports STIR/SHAKEN and 5 new tools](https://www.rtcsec.com/post/2022/07/sipviciouspro-with-stir-shaken-support-and-new-tools/) -- NVISO Labs - - [Investigating an engineering workstation – Part 4](https://blog.nviso.eu/2022/07/06/investigating-an-engineering-workstation-part-4/) -- FortyNorth Security Blog - - [net.exe vs C# - Adding Users and Changing Passwords](https://fortynorthsecurity.com/blog/the-basics-adding-users-and-changing-passwords/) -- Forcepoint - - [ZTNA is key to securing the hybrid workforce](https://www.forcepoint.com/blog/insights/forcepoint-one-ztna-secures-hybrid-workforces) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Time to Say Goodbye!](http://ddanchev.blogspot.com/2022/07/time-to-say-goodbye.html) -- Malwarebytes Labs - - [Verified Twitter accounts phished via hate speech warnings](https://blog.malwarebytes.com/social-engineering/2022/07/verified-twitter-accounts-phished-via-hate-speech-warnings/) - - [Discord Shame channel goes phishing](https://blog.malwarebytes.com/scams/2022/07/discord-shame-channel-goes-phishing/) - - [IconBurst software supply chain attack offers malicious versions of NPM packages](https://blog.malwarebytes.com/malwarebytes-news/2022/07/iconburst-software-supply-chain-attack-offers-malicious-versions-of-npm-packages/) - - [Google to delete location data of trips to abortion clinics](https://blog.malwarebytes.com/privacy-2/2022/07/google-to-delete-location-data-of-trips-to-abortion-clinics/) -- Securelist - - [Dynamic analysis of firmware components in IoT devices](https://securelist.com/dynamic-analysis-of-firmware-components-in-iot-devices/106901/) -- Reverse Engineering - - [How it's made: Aimbots (four part series)](https://www.reddit.com/r/ReverseEngineering/comments/vse5u0/how_its_made_aimbots_four_part_series/) -- Webroot Blog - - [Can your business stop social engineering attacks?](https://www.webroot.com/blog/2022/07/06/can-your-business-stop-social-engineering-attacks/) -- The Daily Swig | Cybersecurity news and views - - [Atlassian patches full-read SSRF in Jira](https://portswigger.net/daily-swig/atlassian-patches-full-read-ssrf-in-jira) - - [High severity OpenSSL bug could lead to remote code execution](https://portswigger.net/daily-swig/high-severity-openssl-bug-could-lead-to-remote-code-execution) -- SentinelOne - - [From the Front Lines | New macOS ‘covid’ Malware Masquerades as Apple, Wears Face of APT](https://www.sentinelone.com/blog/from-the-front-lines-new-macos-covid-malware-masquerades-as-apple-wears-face-of-apt/) -- Black Hills Information Security - - [Lessons Learned While Pentesting GraphQL](https://www.blackhillsinfosec.com/lessons-learned-while-pentesting-graphql/) -- Data Breach - - [Marriott International suffered a new data breach, attackers stole 20GB of data](https://securityaffairs.co/wordpress/132943/data-breach/marriott-new-data-breach.html) -- Secureworks Blog - - [Q&A with Team Cybersecurity 101, 4th Place in Recent Secureworks Security Games](https://www.secureworks.com/blog/team-cybersecurity-101-security-games) -- Arturo Di Corinto - - [Baldoni, Agenzia Cyber: “Draghi ci ha chiesto rigore e rapidità per rendere l’Italia sicura”](https://dicorinto.it/testate/repubblica-it/baldoni-agenzia-cyber-draghi-ci-ha-chiesto-rigore-e-rapidita-per-rendere-litalia-sicura/) -- 黑海洋 - WIKI - - [PDF编辑IceCream Pdf Editor Pro 中文激活版（持续更新）](https://blog.upx8.com/2873) - - [纯净桌面整理软件 小智桌面 v3.0.2.62 官方版](https://blog.upx8.com/2872) -- Forensic Focus - - [Bridging the Gap: Standardizing Representation of Inferences in Diverse Digital Forensic Contexts](https://www.forensicfocus.com/webinars/bridging-the-gap-standardizing-representation-of-inferences-in-diverse-digital-forensic-contexts/) - - [Digital Intelligence Joins Forces with Detego for a Global Webinar Series](https://www.forensicfocus.com/news/digital-intelligence-joins-forces-with-detego-for-a-global-webinar-series/) - - [MSAB Announces Its Second Major Release for 2022: XRY 10.2, XAMN 7.2 and XEC 7.2](https://www.forensicfocus.com/news/msab-announces-its-second-major-release-for-2022-xry-10-2-xamn-7-2-and-xec-7-2/) -- Have I Been Pwned latest breaches - - [Mangatoon - 23,040,238 breached accounts](https://haveibeenpwned.com/PwnedWebsites#Mangatoon) -- Light Blue Touchpaper - - [Text mining is harder than you think](https://www.lightbluetouchpaper.org/2022/07/06/text-mining-is-harder-than-you-think/) -- IntelTechniques Blog - - [New Breach Data Lesson II: Stealer Logs](https://inteltechniques.com/blog/2022/07/06/new-breach-data-lesson-ii-stealer-logs/) -- TG Soft Software House - News - - [Phishing: i tentativi di furto credenziali e/o dati maggiormente diffusi nel mese di LUGLIO 2022...](http://www.tgsoft.it/italy/news_archivio.asp?id=1322) -- Securelist - - [Dynamic analysis of firmware components in IoT devices](https://securelist.com/dynamic-analysis-of-firmware-components-in-iot-devices/106901/) -- Security Current - - [CISO Choice Awards 2022](/ciso-choice-awards-2022/) -- SANS Internet Storm Center, InfoCON: green - - [How Many SANs are Insane?, (Wed, Jul 6th)](https://isc.sans.edu/diary/rss/28820) - - [ISC Stormcast For Wednesday, July 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=8076, (Wed, Jul 6th)](https://isc.sans.edu/diary/rss/28818) -- 奇客Solidot–传递最新科技情报 - - [PulseAudio 和 Systemd 作者 Lennart Poettering 离开 Red Hat](https://www.solidot.org/story?sid=72049) - - [开发者考虑 Gtk 5 停止支持 X11](https://www.solidot.org/story?sid=72048) - - [字幕艺术正在消亡](https://www.solidot.org/story?sid=72047) - - [街区更多的狗意味着更少的犯罪](https://www.solidot.org/story?sid=72046) - - [美国西部干旱可能影响数据中心](https://www.solidot.org/story?sid=72045) - - [LHC 发现三种新奇特粒子](https://www.solidot.org/story?sid=72044) - - [比亚迪电动汽车销量超过特斯拉](https://www.solidot.org/story?sid=72043) - - [Twitter 因内容审查命令起诉印度政府](https://www.solidot.org/story?sid=72042) - - [在战争和平中间发现数学的魔法](https://www.solidot.org/story?sid=72041) -- Securityinfo.it - - [Ransomware AstraLocker chiude e distribuisce i decriptatori](https://www.securityinfo.it/2022/07/06/ransomware-astralocker-chiude-e-distribuisce-i-decriptatori/?utm_source=rss&utm_medium=rss&utm_campaign=ransomware-astralocker-chiude-e-distribuisce-i-decriptatori) - - [Diciotto Zero-Day sfruttati nel 2022](https://www.securityinfo.it/2022/07/06/diciotto-zero-day-sfruttati-nel-2022/?utm_source=rss&utm_medium=rss&utm_campaign=diciotto-zero-day-sfruttati-nel-2022) -- NVISO Labs - - [Investigating an engineering workstation – Part 4](https://blog.nviso.eu/2022/07/06/investigating-an-engineering-workstation-part-4/) -- Troy Hunt's Blog - - [MVP Award 12](https://www.troyhunt.com/mvp-award-12/) -- Threatpost - - [Human Error Blamed for Leak of 1 Billion Records of Chinese Citizens](https://threatpost.com/hbillion-records/180125/) -- /dev/random - - [Pass-The-Salt 2022 Wrap-Up](https://blog.rootshell.be/2022/07/06/pass-the-salt-2022-wrap-up/) -- Social Engineering - - [HAPPY... happy... HAPPY...](https://www.reddit.com/r/SocialEngineering/comments/vsvdmi/happy_happy_happy/) - - [Are there any cybersecurity internships that involve social engineering that are open to people with autism?](https://www.reddit.com/r/SocialEngineering/comments/vsf09n/are_there_any_cybersecurity_internships_that/) -- 默安科技 - - [默安科技荣获“深蓝-2022”网络安全攻防演练“优秀攻击队”称号](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492626&idx=1&sn=f67022147250c0baea3df4f5b994ce7d&chksm=e93b1330de4c9a2623962d989ee6492c61ce8b02df3f1944075add312c9fffc3c50b84b3be34&scene=58&subscene=0#rd) -- SecIN技术平台 - - [原创 | XXE利用:结合Local DTD和Error-Based技巧bypass防火墙](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494466&idx=1&sn=d47f31dd9da206a4cc9b075c14c5d26e&chksm=eb84b616dcf33f0097d3e7c3bf0607f3d9c53f5375e906e593bc38cf038fc9e5620c81e0cd73&scene=58&subscene=0#rd) -- 星阑科技 - - [星阑科技入选中国信通院《应用安全全景视图》，API安全实力再获认可](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494045&idx=1&sn=e1eedc4c60ad160a5bb1cb139bd02b44&chksm=c0074401f770cd17daf91c65e50ecc9691b1b173a9eb8614a40d3dd335b90d775f089412e5f4&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【漏洞通告】OpenSSL RSA远程代码执行漏洞CVE-2022-2274](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262453&idx=1&sn=2b7746553f0c0e3d4ed703dc8fab40b0&chksm=f3e271c1c495f8d72bd29f5c5b4741ca59b0a8b857e1ff25b3b7623846e75a73581471a5894d&scene=58&subscene=0#rd) - - [【漏洞通告】Atlassian Jira 服务端请求伪造漏洞CVE-2022-26135](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262453&idx=2&sn=f1fb121971a29c99a975d8e7df0be8de&chksm=f3e271c1c495f8d74a08147d922a615822018a077d038527118151841decf5f705161a2a571c&scene=58&subscene=0#rd) -- Schneier on Security - - [Friday Squid Blogging: Fishing for Squid](https://www.schneier.com/blog/archives/2022/07/friday-squid-blogging-fishing-for-squid.html) - - [NIST Announces First Four Quantum-Resistant Cryptographic Algorithms](https://www.schneier.com/blog/archives/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms.html) -- Graham Cluley - - [Comprehensive risk-based API protection with AppTrana](https://grahamcluley.com/feed-sponsor-indusface-2/) -- 火绒安全实验室 - - [又一款勒索病毒要求微信支付，火绒安全可解密](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247505948&idx=1&sn=a05b943a1b61deafaafd8dd5cc89bf1f&chksm=eb700623dc078f357bca18c2a5ca6d3cf124acb18cce7b7a857b45ca1cf9abbb7eb443352519&scene=58&subscene=0#rd) -- Security Affairs - - [Marriott International suffered a new data breach, attackers stole 20GB of data](https://securityaffairs.co/wordpress/132943/data-breach/marriott-new-data-breach.html) - - [Cyberattacks against law enforcement are on the rise](https://securityaffairs.co/wordpress/132929/cyber-crime/cyberattacks-against-law-enforcement.html) - - [Less popular, but very effective, Red-Teaming Tool BRc4 used in attacks in the wild](https://securityaffairs.co/wordpress/132922/hacking/brc4-used-in-attacks.html) - - [New Hive ransomware variant is written in Rust and use improved encryption method](https://securityaffairs.co/wordpress/132914/malware/hive-ransomware-new-variant.html) - - [Malicious NPM packages used to grab data from apps, websites](https://securityaffairs.co/wordpress/132904/malware/fake-npm-packages-stealing-data.html) -- Palo Alto Networks Blog - - [Enterprise-Grade Security for 5G — Why It’s Needed](https://www.paloaltonetworks.com/blog/2022/07/enterprise-grade-security-for-5g/) -- 字节跳动技术团队 - - [日新增两万次变更背后的奥秘，聊聊字节跳动的云原生实践与开源](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496092&idx=1&sn=d1f6b6bd908e6ecd041d799ebea57b68&chksm=e9d33a7edea4b3688723e1c14657484fdbad81db64d2be76d83ec3de4df87762528c70fa42fb&scene=58&subscene=0#rd) -- Trend Micro Research, News and Perspectives - - [ICS & OT Cybersecurity Attack Trends](https://www.trendmicro.com/en_us/ciso/22/g/ics-ot-cybersecurity-attack-trends.html) - - [Brand-New HavanaCrypt Ransomware Poses as Google Software Update App, Uses Microsoft Hosting Service IP Address as C&C Server](https://www.trendmicro.com/en_us/research/22/g/brand-new-havanacrypt-ransomware-poses-as-google-software-update.html) -- TorrentFreak - - [Anti-Piracy Lawyer Wins ‘Unique’ YTS Trademark Case Against Pirate Sites & Apps](https://torrentfreak.com/anti-piracy-lawyer-wins-unique-yts-trademark-case-against-pirate-sites-apps-220706/) - - [MPA: Openload Piracy Investigation Hit “Dead End” Due to Fake Customer Info](https://torrentfreak.com/mpa-openload-piracy-investigation-hit-dead-end-due-to-fake-customer-info-220706/) -- The Register - Security - - [Here today, gone to Maui: That's your data captured by North Korean ransomware](https://go.theregister.com/feed/www.theregister.com/2022/07/06/here_today_gone_to_maui/) - - [Hive ransomware gang rapidly evolves with complex encryption, Rust code](https://go.theregister.com/feed/www.theregister.com/2022/07/06/hive-ransomware-rust-microsoft/) - - [Being hit with a cyber-attack is bad. Not having a recovery plan is worse](https://go.theregister.com/feed/www.theregister.com/2022/07/06/being_hit_with_a_cyberattack/) - - [Typo-squatting NPM software supply chain attack uncovered](https://go.theregister.com/feed/www.theregister.com/2022/07/06/npm_supply_chain_attack/) - - [Marriott Hotels admits to third data breach in 4 years](https://go.theregister.com/feed/www.theregister.com/2022/07/06/marriott_hotels_suffer_yet_another/) - - [Multi-cloud doesn’t have to mean multi problems for data protection](https://go.theregister.com/feed/www.theregister.com/2022/07/06/multicloud_doesnt_have_to_mean/) - - [Near-undetectable malware linked to Russia's Cozy Bear](https://go.theregister.com/feed/www.theregister.com/2022/07/06/brc4_state_sponsored_apt29/) - - [AstraLocker ransomware reportedly closes doors to pursue cryptojacking](https://go.theregister.com/feed/www.theregister.com/2022/07/06/astralocker-ransomware-shutters-operations/) -- Dark Reading - - [Prevention Takes Priority Over Response](https://www.darkreading.com/tech-trends/prevention-takes-priority-over-response) - - [North Korean State Actors Deploy Surgical Ransomware in Ongoing Cyberattacks on US Healthcare Orgs](https://www.darkreading.com/attacks-breaches/north-korean-state-actors-deploy-surgical-ransomware-in-ongoing-cyberattacks-us-healthcare-orgs) - - [Apple Debuts Spyware Protection for State-Sponsored Cyberattacks](https://www.darkreading.com/application-security/apple-debuts-state-sponsored-spyware-protection) - - [I Built a Cheap 'Warshipping' Device in Just Three Hours — And So Can You](https://www.darkreading.com/edge-articles/i-built-a-cheap-warshipping-device-in-just-three-hours-and-so-can-you) - - [Marriott Data Breach Exposes PII, Credit Cards](https://www.darkreading.com/attacks-breaches/marriott-data-breach-pii-credit-cards) - - [How to Keep EVs From Taking Down the Electrical Grid](https://www.darkreading.com/attacks-breaches/how-to-keep-evs-from-taking-down-the-electrical-grid) - - [Cloud Misconfig Exposes 3TB of Sensitive Airport Data in Amazon S3 Bucket: 'Lives at Stake'](https://www.darkreading.com/application-security/cloud-misconfig-exposes-3tb-sensitive-airport-data-amazon-s3-bucket) - - [Identity Access Management Is Set for Exploding Growth, Big Changes — Report](https://www.darkreading.com/application-security/identity-access-management-exploding-growth-big-changes) - - [The Cyber-Asset Management Playbook for Supply Chain Modernization](https://www.darkreading.com/attacks-breaches/the-cyber-asset-management-playbook-for-supply-chain-modernization) - - [Roundtable: Amid Cyberattack Frenzy, How Can QNAP Customers Protect the Business?](https://www.darkreading.com/attacks-breaches/roundtable-cyberattack-frenzy-qnap-customers-protect-business) -- ICT Security Magazine - - [Application Security Management – Sicurezza DevOps attraverso l’automazione](https://www.ictsecuritymagazine.com/notizie/application-security-management-sicurezza-devops-attraverso-lautomazione/) - - [App e Sicurezza nazionale: come cambia la cyber security in Cina](https://www.ictsecuritymagazine.com/articoli/app-e-sicurezza-nazionale-come-cambia-la-cyber-security-in-cina/) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-07-06](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490650&idx=1&sn=b27297590a78782181c2f3ad90809d8a&chksm=c0603283f717bb950e9c3b057c1fb9d2a16fd45c4dbbe5be0c34c591781426c2474226e54444&scene=58&subscene=0#rd) -- 青藤云安全 - - [作战图鉴：12大场景详述容器安全建设要求](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650836035&idx=1&sn=4759607edd96d96d35852f9fa3c70b04&chksm=80dbefe6b7ac66f0be1fc40ade1d281a115651841986d6a76d3efbe9f9f0124773de70fdaa44&scene=58&subscene=0#rd) -- 互联网安全内参 - - [网络攻击致使美国多个州无法发放失业救济金](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504210&idx=1&sn=db16b8fdaadb58931b01b06228acd7a8&chksm=ebfa9672dc8d1f642053d97924ac1d6cf938eb774bb85bcd3c53cde7b39a745100374a97585d&scene=58&subscene=0#rd) - - [国家漏洞库CNNVD：关于OpenSSL安全漏洞的通报](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504210&idx=2&sn=79f8d32946140092fa33441779333b22&chksm=ebfa9672dc8d1f640b262f54dc1e1e622c0124172e3a1b037969f5a2588a2bce5a59a9c690e7&scene=58&subscene=0#rd) - - [美国专家评析俄罗斯网络战运用及对未来启示](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504210&idx=3&sn=6e771bff78c2bf8e947fe489c44b3121&chksm=ebfa9672dc8d1f64371a19df7358e3bb78b00c405ba039f75bd5f569e6dcdb7ab63d5f21533f&scene=58&subscene=0#rd) - - [欧洲议会研究局发布元宇宙网络安全报告，呼吁修订GDPR应对挑战](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504210&idx=4&sn=8683df708e70d53e98f930d233f5d8fa&chksm=ebfa9672dc8d1f6476f23330a233141f909b97dc5d66497c08b95d520c1d17f2717fd16d7933&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [实力代表 | 绿盟科技被Gartner列为SOAR市场代表供应商](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491890&idx=1&sn=7b5f624219c2c990fd8a85dc3130c201&chksm=eaac7275dddbfb63e69e48ee1ed249da7f3c935c3017aac572d88d0d5ec363d53d52097fd885&scene=58&subscene=0#rd) -- Blackhat Library: Hacking techniques and research - - [Hello World, I created a new sub dedicated to sharing exploits to reward systems](https://www.reddit.com/r/blackhat/comments/vsejnf/hello_world_i_created_a_new_sub_dedicated_to/) -- Your Hacking Tutorial by Zempirians - - [WiFi pineapple vs arpspoof + wireshark](https://www.reddit.com/r/HowToHack/comments/vt0j8j/wifi_pineapple_vs_arpspoof_wireshark/) - - [A starting point?](https://www.reddit.com/r/HowToHack/comments/vsj5fz/a_starting_point/) - - [Help me regain memories.](https://www.reddit.com/r/HowToHack/comments/vsgklk/help_me_regain_memories/) -- 腾讯玄武实验室 - - [每日安全动态推送(07-06)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958570&idx=1&sn=72a45e99e0f54dbcc980e74a67bdc8f2&chksm=8baecdb5bcd944a3cbbcf8aba2dd85407efbdcb574b5e3ad2dfd39a7790a63f0897f6d8de88a&scene=58&subscene=0#rd) -- netsecstudents: Subreddit for students studying Network Security and its related subjects - - [Can a cachebuster affect server-side functionality when carrying out automated tests?](https://www.reddit.com/r/netsecstudents/comments/vsqwi2/can_a_cachebuster_affect_serverside_functionality/) -- 情报分析师 - - [数据泄露——对经济和国家安全的影响](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509599&idx=1&sn=1398ebaa47b990bfac303ae1073e8e53&chksm=8716bf54b0613642330098ce31eec3cb20238569116d0695d0cea54fd802dcf2af25d4c76a38&scene=58&subscene=0#rd) - - [【分析报告】数据泄露调查报告2022](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509599&idx=2&sn=8b8cbd429420890afc8235129a486f1b&chksm=8716bf54b0613642be09166575fc859f917ea93a08a36b5a8828a79c36eb8410415b79d15cd4&scene=58&subscene=0#rd) - - [【情报课堂】数据情报与数据分析](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509599&idx=3&sn=6ac450068ab309d11d59223fd3905895&chksm=8716bf54b0613642df9325f75d0d4dfa468efb77489d0a89a94ef7c8d63287cf953a472ad29d&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [数据出境“绿色通道”——《个人信息出境标准合同规定（征求意见稿）》](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528522&idx=1&sn=c5519096bef3c84be982a564b71379c3&chksm=c1e9fc1bf69e750d8b063d82c28c33d98214613b709a8e9f76d2b5eceb2835a56f4fd1843246&scene=58&subscene=0#rd) - - [《智慧城轨常态化信息安全服务指南》顺利通过结题验收](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528522&idx=2&sn=ac07de5a36102fffb9563284ef0635a6&chksm=c1e9fc1bf69e750da2b040ee1b5f8bde273e490d4dcf0633997c96e811cdd4d7c4a6f628893d&scene=58&subscene=0#rd) - - [【攻防演练专题】流量侧持续监测](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528522&idx=3&sn=c0f8d953cead7d5bc72b6a5832651d05&chksm=c1e9fc1bf69e750d4230332fb5f9525fa34f74f2dff530e79de34aa8faeba7e00e59044a41b9&scene=58&subscene=0#rd) - - [中国云安全市场发展特点和热点技术](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528522&idx=4&sn=25a6b665972a1e3eefd5f3cd25757f7d&chksm=c1e9fc1bf69e750d2cdb89e628806fdc5745d52d4e5546bca715ceb1eed109d3ad14e2cf5c21&scene=58&subscene=0#rd) - - [工业网络安全范式的转变](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528522&idx=5&sn=d07a49dd75d8b92adf1f43a79ff0b5e5&chksm=c1e9fc1bf69e750d79265398c36d9c9f0bf3f996d640f14630c2b91955f5dca519d081bb4cbd&scene=58&subscene=0#rd) - - [美国执法部门命令在线旅行社长期监视俄罗斯黑客行踪](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528522&idx=6&sn=2447bc32897876d55bf9ec8fc5399b46&chksm=c1e9fc1bf69e750d5ddfc22f811593dddc88c1b9289eba94ae3aa34ff4b3be046d57243caa5c&scene=58&subscene=0#rd) -- 奇安信CERT - - [【已复现】Atlassian Jira 多款产品Mobile Plugin服务端请求伪造漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496413&idx=1&sn=75d27dd23e9c49860973d4d084f41ccf&chksm=fe79d645c90e5f53a4e9ab2f690ed0a413b755370fcb4e5fdb4dc86290849b9f070b82e8475d&scene=58&subscene=0#rd) -- Deeplinks - - [For the Love of the Wild Web 🖤](https://www.eff.org/deeplinks/2022/07/do-it-love-wild-web) -- vivo千镜安全实验室 - - [成员推理攻击技术介绍](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247488756&idx=1&sn=26a739ab948b08802863bb23f140f7b4&chksm=e9b93298decebb8e35ff97015c34e10f81ce933c0e6f107b348360c9206bd956eb8d4b566fa1&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】《Dive into Windbg系列》Wireshark的卡死与崩溃](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773489&idx=1&sn=0a9d83bd9be21095cfae7c2f89068ef9&chksm=889365debfe4ecc8e857f20755762a5c3b1ce8657340c15a8873d44099dbc5ac39aa93550d06&scene=58&subscene=0#rd) - - [【安全头条】AstraLocker勒索组织联系媒体发布解密工具](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773489&idx=2&sn=15a3ebf08ccbb7af5d93ac145933834a&chksm=889365debfe4ecc8079968e4a78a4a14b466502d179422e17e054a473794be5cffceec3f1878&scene=58&subscene=0#rd) -- /r/netsec - Information Security News & Discussion - - [Optimizing CI/CD Credential Hygiene – A Comparison of CI/CD Solutions](https://www.reddit.com/r/netsec/comments/vsqi5l/optimizing_cicd_credential_hygiene_a_comparison/) -- 山石网科安全技术研究院 - - [山安院第二届CTF夏令营活动报名中](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494470&idx=1&sn=cb0222d884a2d3451668542a60b5501b&chksm=fa523ef8cd25b7ee84e9f2067968c3c1d7848cc74dca2fcd6e5b3f045200f173bf3c861ebdc5&scene=58&subscene=0#rd) -- Security Through Education - - [My First Three Years in the Social Engineering World](https://www.social-engineer.org/newsletter/my-first-three-years-in-the-social-engineering-world/) -- 360Quake空间测绘 - - [也太好用了吧，用Quake能躺币吗？](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247485855&idx=1&sn=3dc42d1d704c82efd90d6952df9bcbda&chksm=c37b8e74f40c0762ae413b56c816d956be7bb2a0f55f0948df1b99bbfafd8d71573fa3ad7298&scene=58&subscene=0#rd) -- 三六零CERT - - [CVE-2022-2274: OpenSSL RSA 远程代码执行漏洞通告](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491130&idx=1&sn=a09de7b60ad7b88ab2ef105951eb808b&chksm=fe251b3bc952922d3e5ed8edf8a35d43000a2780c8a2890adeefa1fc7d073d3aa3c510dce848&scene=58&subscene=0#rd) - - [安全日报（2022.07.06）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491130&idx=2&sn=4934300c3bfb4558c01dc5e7b8ca81bc&chksm=fe251b3bc952922dde42fb011679ce508783e3c200f2f4aab7efe89475baaa59e5ca766b3557&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-08.md b/archive/2022/2022-07-08.md deleted file mode 100644 index 739b6d1144..0000000000 --- a/archive/2022/2022-07-08.md +++ /dev/null @@ -1,285 +0,0 @@ -# 每日安全资讯（2022-07-08） - -- Sploitus.com Exploits RSS Feed - - [EQS Integrity Line Cross Site Scripting / Information Disclosure Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-37833&utm_source=rss&utm_medium=rss) - - [Magnolia CMS 6.2.19 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37834&utm_source=rss&utm_medium=rss) - - [Apache Commons remote code execution vulnerability exploit](https://sploitus.com/exploit?id=CNVD-2022-49973&utm_source=rss&utm_medium=rss) - - [Xen PV Guest Non-SELFSNOOP CPU Memory Corruption Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37832&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26135 exploit](https://sploitus.com/exploit?id=EB6097B8-1E76-548B-8AEC-815E8F61130D&utm_source=rss&utm_medium=rss) -- HackerOne Hacker Activity - - [Clickjacking Vulnerability In Whole Page Ads Tiktok](https://hackerone.com/reports/1418857) - - [HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding](https://hackerone.com/reports/1524555) - - [HTTP Request Smuggling Due To Improper Delimiting of Header Fields](https://hackerone.com/reports/1524692) - - [HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding](https://hackerone.com/reports/1501679) - - [Brute force of a current password on a disable 2fa leads to guess password and disable 2fa.](https://hackerone.com/reports/1465277) - - [Remote denial of service in HyperLedger Fabric](https://hackerone.com/reports/1604951) - - [Stack Buffer Overflow via `gmp_sprintf`in `BLSSignature` and `BLSSigShare`](https://hackerone.com/reports/1546935) -- Twitter @Nicolas Krassas - - [Ubiquitous Surveillance by ICE](https://twitter.com/Dinosn/status/1545114616749035522) - - [QNAP warns of new Checkmate ransomware targeting NAS devices](https://twitter.com/Dinosn/status/1545106205802102786) - - [Chromium's WebRTC zero-day fix arrives in Microsoft Edge](https://twitter.com/Dinosn/status/1545105957037948930) - - [Altiris Methods for Lateral Movement](https://twitter.com/Dinosn/status/1545070591761424389) - - [Buggy 'Log in With Google' API Implementation Opens Crypto Wallets to Account Takeover](https://twitter.com/Dinosn/status/1545070295719059456) - - [Online programming IDEs can be used to launch remote cyberattacks](https://twitter.com/Dinosn/status/1545055318844985344) - - [Apple slaps hard against ‘mercenary’ surveillance-as-a-service industry](https://twitter.com/Dinosn/status/1545048281251688451) - - [PoC verification of Django vulnerability (CVE-2022-34265)](https://twitter.com/Dinosn/status/1545035577430622210) - - [RT Joseph Cox: New: we've obtained the code the FBI used to backdoor an encrypted messaging app, and we're publishing parts of it today. Code shows ap...](https://twitter.com/josephfcox/status/1545030641586212865) - - [mx-takeover: detects misconfigured MX records](https://twitter.com/Dinosn/status/1545024432942587904) - - [Over 1200 NPM Packages Found Involved in "CuteBoi" Cryptomining Campaign](https://twitter.com/Dinosn/status/1545024207754592257) - - [North Korean Maui Ransomware Actively Targeting U.S. Healthcare Organizations](https://twitter.com/Dinosn/status/1545024067371245569) - - [Hack Allows Drone Takeover Via ‘ExpressLRS’ Protocol](https://twitter.com/Dinosn/status/1545012654502252546) - - [ENISA released the Threat Landscape Methodology](https://twitter.com/Dinosn/status/1545007949692784640) - - [RT jkana101: Cool swag from @SynackRedTeam ! Thank you so much!! 🤩 #bugbounty #swag](https://twitter.com/jkana101/status/1545006841822089216) - - [Re @haxor31337 @SynackRedTeam @NMartineau Thank you very much mate, really appreciated!](https://twitter.com/Dinosn/status/1545006564737781760) - - [Re @SynackRedTeam @paramil @popeax @any1 @nukedx @ozgur @Aringo @akmal @AyushBawariya @clod @jkana101 @magicsam @NikS @w Most of the tags are wrong pl...](https://twitter.com/Dinosn/status/1545006209547358208) - - [Re @SynackRedTeam @NMartineau This is actually wrong :) Guardian of Trust it's me @Dinosn](https://twitter.com/Dinosn/status/1545001715019255808) -- Files ≈ Packet Storm - - [Windows Kerberos KerbRetrieveEncodedTicketMessage AppContainer Privilege Escalation](https://packetstormsecurity.com/files/167716/GS20220707131306.tgz) - - [Dovecot IMAP Server 2.2 Improper Access Control](https://packetstormsecurity.com/files/167715/DOV-5320.txt) - - [Ubuntu Security Notice USN-5505-1](https://packetstormsecurity.com/files/167714/USN-5505-1.txt) - - [Ubuntu Security Notice USN-5488-2](https://packetstormsecurity.com/files/167713/USN-5488-2.txt) -- Security Boulevard - - [10 Help Desk Metrics to Track for Maximum Efficiency](https://securityboulevard.com/2022/07/10-help-desk-metrics-to-track-for-maximum-efficiency/) - - [Risks to Your Network from Insecure Code Signing Processes](https://securityboulevard.com/2022/07/risks-to-your-network-from-insecure-code-signing-processes/) - - [Introducing YaRadare](https://securityboulevard.com/2022/07/introducing-yaradare/) - - [Video Demo: Cloud Security Risk Analyzed in 15 Minutes](https://securityboulevard.com/2022/07/video-demo-cloud-security-risk-analyzed-in-15-minutes/) - - [Amid Exodus, Threat Actor Advertises US Immigration Services on Russian-Language DDW Forum XSS](https://securityboulevard.com/2022/07/amid-exodus-threat-actor-advertises-us-immigration-services-on-russian-language-ddw-forum-xss/) - - [Security BSides Athens 2022 – Tapendra Dev’s ‘Talk 10 – Future Of Application Security’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-tapendra-devs-talk-10-future-of-application-security/) - - [Ubiquitous Surveillance by ICE](https://securityboulevard.com/2022/07/ubiquitous-surveillance-by-ice/) - - [Improving Business Outcomes with Zero Trust](https://securityboulevard.com/2022/07/improving-business-outcomes-with-zero-trust/) - - [Koh: The Token Stealer](https://securityboulevard.com/2022/07/koh-the-token-stealer/) - - [SOC 2 Compliance: 4 Ways to Prevent Personnel Problems](https://securityboulevard.com/2022/07/soc-2-compliance-4-ways-to-prevent-personnel-problems/) -- 先知安全技术社区 - - [记一次对某站点详细的渗透测试](https://xz.aliyun.com/t/11502) - - [进程注入的探索](https://xz.aliyun.com/t/11489) - - [Android Proguard混淆对抗之我见](https://xz.aliyun.com/t/11488) - - [域委派原理与利用（个人学习的理解）](https://xz.aliyun.com/t/11487) -- 先知安全技术社区 - - [记一次对某站点详细的渗透测试](https://xz.aliyun.com/t/11502) - - [进程注入的探索](https://xz.aliyun.com/t/11489) - - [Android Proguard混淆对抗之我见](https://xz.aliyun.com/t/11488) - - [域委派原理与利用（个人学习的理解）](https://xz.aliyun.com/t/11487) -- Microsoft Security Blog - - [KuppingerCole rates Microsoft as outstanding in functionality for secure collaboration](https://www.microsoft.com/security/blog/2022/07/07/kuppingercole-rates-microsoft-as-outstanding-in-functionality-for-secure-collaboration/) -- Trustwave Blog - - [When it Comes to Email Security Good Enough is Not Enough](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/when-it-comes-to-email-security-good-enough-is-not-enough/) -- obaby@mars - - [由电源计划导致的CPU占用率100%](http://h4ck.org.cn/2022/07/%e7%94%b1%e7%94%b5%e6%ba%90%e8%ae%a1%e5%88%92%e5%af%bc%e8%87%b4%e7%9a%84cpu%e5%8d%a0%e7%94%a8%e7%8e%87100/) - - [修改iTunes备份文件路径](http://h4ck.org.cn/2022/07/%e4%bf%ae%e6%94%b9itunes%e5%a4%87%e4%bb%bd%e6%96%87%e4%bb%b6%e8%b7%af%e5%be%84/) -- Sucuri Blog - - [SiteCheck Malware Trends Report – Q2 2022](https://blog.sucuri.net/2022/07/sitecheck-malware-trends-report-q2-2022.html) -- 安全脉搏 - - [【漏洞预警】Mitel MiVoice Connect远程代码执行漏洞](https://www.secpulse.com/archives/182735.html) - - [什么是远程代码执行漏洞?](https://www.secpulse.com/archives/182582.html) - - [【红蓝对抗】一次直达工控区的&简单&渗透](https://www.secpulse.com/archives/182699.html) - - [致盲 windows defender](https://www.secpulse.com/archives/182585.html) -- unSafe.sh - 不安全 - - [记一次对某站点详细的渗透测试](https://buaq.net/go-116479.html) - - [进程注入的探索](https://buaq.net/go-116480.html) - - [Android Proguard混淆对抗之我见](https://buaq.net/go-116481.html) - - [域委派原理与利用（个人学习的理解）](https://buaq.net/go-116482.html) - - [Awesome Bug Bounty Tools](https://buaq.net/go-116478.html) - - [Stigmergy in programming](https://buaq.net/go-116472.html) - - [Integrating your Linux Desktop Ubuntu with your Android Smartphone](https://buaq.net/go-116477.html) - - [Apple Lockdown Mode helps protect users from spyware](https://buaq.net/go-116471.html) -- 安全客-有思想的安全新媒体 - - [记一奇葩弱口令到内网实战](https://www.anquanke.com/post/id/275698) - - [XCarnival遭遇攻击，黑客获利3000余枚ETH事件分析](https://www.anquanke.com/post/id/275516) - - [IconBurst：影响数百网站的NPM供应链攻击](https://www.anquanke.com/post/id/276021) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [公行安全科技有限公司招聘信息](https://www.4hou.com/posts/QL7G) - - [网络可见性：或将成为网络安全中决定生死的关键要素](https://www.4hou.com/posts/kM8v) - - [SessionManager IIS 后门](https://www.4hou.com/posts/9XDJ) - - [微信三端登录功能被黑灰产利用趋势预警](https://www.4hou.com/posts/KEQG) - - [勒索攻击深观察：网络安全行业的挑战与机遇](https://www.4hou.com/posts/MBJm) - - [一种使用TCP自定义加密通信的APT样本分析](https://www.4hou.com/posts/XVrv) - - [未来智安入选首批“网络安全能力评价工作组”成员单位](https://www.4hou.com/posts/PJzA) - - [腾讯安全发布《BOT管理白皮书》｜解读BOT攻击，探索防护之道](https://www.4hou.com/posts/50RY) - - [如何保护火电厂DCS系统网络安全](https://www.4hou.com/posts/6VBO) - - [新路径，新征程！2022西湖论剑·安全托管运营服务论坛成功举行](https://www.4hou.com/posts/nJO5) - - [在实际应用场景下，XDR的优势在哪？](https://www.4hou.com/posts/oJyY) - - [100%免疫数据勒索解决方案](https://www.4hou.com/posts/MB1m) - - [技术干货|HoneyGuide-SOAR应用最佳实践：黑白名单](https://www.4hou.com/posts/O98R) -- tail -f /var/log/messages | grep vegard - - [Stigmergy in programming](http://www.vegardno.net/2022/07/stigmergy.html) -- SecWiki News - - [SecWiki News 2022-07-07 Review](http://www.sec-wiki.com/?2022-07-07) -- ElcomSoft blog - - [Keychain: the Gold Mine of Apple Mobile Devices](https://blog.elcomsoft.com/2022/07/keychain-the-gold-mine-of-apple-mobile-devices/) -- 跳跳糖 - 安全与分享社区 - - [2022虎符_vdq(rust_cve)详解](https://tttang.com/archive/1585/) -- hn security - - [Automating binary vulnerability discovery with Ghidra and Semgrep](https://security.humanativaspa.it/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep/) -- blog.avast.com EN - - [How to Safely Make Online Friends | Avast](https://blog.avast.com/safely-make-online-friends) -- Twitter @bytehx - - [RT Ahmad Halabi: I wrote an Article explaining one of my interesting Vulnerabilities that I found in Apple. #bugbountytips #bugbountytip #cybersecurit...](https://twitter.com/Ahmad_Halabi_/status/1545073891202289669) - - [RT reverseame: Access Token Manipulation Part 0x01](https://twitter.com/reverseame/status/1545021012382814209) -- Hexacorn - - [Shall we say… Good bye, phishing queue?](https://www.hexacorn.com/blog/2022/07/07/shall-we-say-good-bye-phishing-queue/) -- 博客园 - admin-神风 - - [从SpringInspector源码视角深入浅出静态代码分析技术 - admin-神风](https://www.cnblogs.com/wh4am1/p/16454905.html) -- SAP Blogs - - [Get started with SAP HANA Cloud and ArcGIS Pro for Free in 5 easy steps](https://blogs.sap.com/2022/07/07/get-started-with-sap-hana-cloud-and-arcgis-pro-for-free-in-5-easy-steps/) - - [The New Normal: adjusting our hiring expectations with SAP Fieldglass](https://blogs.sap.com/2022/07/07/the-new-normal-adjusting-our-hiring-expectations-with-sap-fieldglass/) - - [Obligatory Electronic Invoices in Poland (KSeF) solution: “SAP DR Compliance” cloud service](https://blogs.sap.com/2022/07/07/obligatory-electronic-invoices-in-poland-ksef-solution-sap-dr-compliance-cloud-service/) - - [Open Connectors – Types of Common Resources](https://blogs.sap.com/2022/07/07/open-connectors-types-of-common-resources/) - - [SAP Champion Spotlight Interview: Angela Wheeler](https://blogs.sap.com/2022/07/07/sap-champion-spotlight-interview-angela-wheeler/) - - [Free Trial of SAP Product Footprint Management](https://blogs.sap.com/2022/07/07/free-trial-of-sap-product-footprint-management/) - - [Production order time elements](https://blogs.sap.com/2022/07/07/production-order-time-elements/) - - [ABAP CDS Cheat Sheet: Amounts and Quantities in ABAP CDS](https://blogs.sap.com/2022/07/07/abap-cds-cheat-sheet-amounts-and-quantities-in-abap-cds/) - - [Synthetic User Monitoring for S/4 HANA with SAP Cloud ALM](https://blogs.sap.com/2022/07/07/synthetic-user-monitoring-for-s-4-hana-with-sap-cloud-alm/) - - [Building Mesh With SAP Event Mesh – MQTT Client](https://blogs.sap.com/2022/07/07/building-mesh-with-sap-event-mesh-mqtt-client/) -- Application Security Blog - - [CyRC Vulnerability of the Month: curl](https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-month-curl/) -- Hex Rays - - [Vulnerability fix 2022-07-07](https://hex-rays.com/blog/vulnerability-fix-2022-07-07/) -- Sucuri Blog - - [SiteCheck Malware Trends Report – Q2 2022](https://blog.sucuri.net/2022/07/sitecheck-malware-trends-report-q2-2022.html) -- KitPloit - PenTest & Hacking Tools - - [CrackQL - GraphQL Password Brute-Force And Fuzzing Utility](http://www.kitploit.com/2022/07/crackql-graphql-password-brute-force.html) -- The Daily Swig | Cybersecurity news and views - - [Lockdown Mode: Apple offers $2m bug bounty for vulnerabilities in new anti-spyware tech](https://portswigger.net/daily-swig/lockdown-mode-apple-offers-2m-bug-bounty-for-vulnerabilities-in-new-anti-spyware-tech) - - [SMEs slow to adopt MFA – study](https://portswigger.net/daily-swig/smes-slow-to-adopt-mfa-study) - - [Fortinet patch batch remedies multiple path traversal vulnerabilities](https://portswigger.net/daily-swig/fortinet-patch-batch-remedies-multiple-path-traversal-vulnerabilities) -- Malwarebytes Labs - - [Apple Lockdown Mode helps protect users from spyware](https://blog.malwarebytes.com/malwarebytes-news/2022/07/apple-lockdown-mode-helps-protect-users-from-spyware/) -- 绿盟科技技术博客 - - [vsomeip — SOME/IP 开源实现](http://blog.nsfocus.net/vsomeip-some-ip/) -- Reverse Engineering - - [Reversing C++, Qt based applications using Ghidra](https://www.reddit.com/r/ReverseEngineering/comments/vtegkj/reversing_c_qt_based_applications_using_ghidra/) - - [Automating binary vulnerability discovery with Ghidra and Semgrep](https://www.reddit.com/r/ReverseEngineering/comments/vtcsku/automating_binary_vulnerability_discovery_with/) - - [Yara4Ida IDA plugin - Crypto/hash/encryption dumper](https://www.reddit.com/r/ReverseEngineering/comments/vt54f1/yara4ida_ida_plugin_cryptohashencryption_dumper/) -- Security Uncorked - - [Zero Trust: Real-World Tactics and Strategies [BrightTalk On-Demand]](https://securityuncorked.com/2022/07/zero-trust-real-world-tactics-and-strategies-brighttalk-on-demand/) -- 安全牛 - - [国家级认可 | 江南信安再获【信息安全服务资质】一级认证](https://www.aqniu.com/vendor/85590.html) - - [数据合规管理已成刚需，如何更好应对相关风险与挑战？](https://www.aqniu.com/vendor/85569.html) - - [世平信息商用密码应用检查系统正式发布！数字时代合规管控路径再突破](https://www.aqniu.com/vendor/85568.html) - - [作战图鉴：12大场景详述容器安全建设要求](https://www.aqniu.com/vendor/85567.html) - - [案例 ①｜主机安全建设：3个层级，11大能力的最佳实践](https://www.aqniu.com/vendor/85566.html) - - [谷歌发布Chrome高危漏洞警告 奇安信可信浏览器率先解决](https://www.aqniu.com/vendor/85564.html) - - [NIST发布新算法应对量子攻击，可支持下一代加密标准](https://www.aqniu.com/industry/85559.html) - - [应对混合办公，多场景下的企业身份安全管理一体化建设](https://www.aqniu.com/industry/85553.html) - - [安全配置管理（SCM）的价值与应用](https://www.aqniu.com/industry/85551.html) - - [超3成医院未通过等保测评？亚信安全终端一体化赋能医疗行业安全](https://www.aqniu.com/vendor/85552.html) -- HackerNews - - [Edge 跟随 Chrome 发布紧急更新 修复高危零日漏洞](https://hackernews.cc/archives/39828) - - [针对可能导致 RCE 攻击的高危漏洞，OpenSSL 发布补丁](https://hackernews.cc/archives/39803) - - [美声称朝鲜黑客正利用勒索软件攻击医疗保健机构](https://hackernews.cc/archives/39815) - - [从日入 1500 万美元到崩盘 一份虚假招聘让 Axie Infinity 损失 6 亿美元](https://hackernews.cc/archives/39805) - - [高级网络钓鱼瞄准中东，冒充阿联酋人力资源部](https://hackernews.cc/archives/39799) - - [连锁酒店巨头万豪证实其发生又一起数据泄露事件](https://hackernews.cc/archives/39794) -- 奇客Solidot–传递最新科技情报 - - [天文学家观察到双星存在共有包层的直接证据](https://www.solidot.org/story?sid=72063) - - [TikTok 放弃欧美直播带货](https://www.solidot.org/story?sid=72062) - - [欧盟批准核能为绿色能源](https://www.solidot.org/story?sid=72061) - - [万豪再次曝出数据泄露](https://www.solidot.org/story?sid=72060) - - [关闭互联网使今年至今全球经济损失 100 亿美元](https://www.solidot.org/story?sid=72059) - - [世界首个用冻干皮肤细胞克隆的小鼠诞生](https://www.solidot.org/story?sid=72058) - - [世界最高观测站上的雪融化得比以往任何时候都早](https://www.solidot.org/story?sid=72057) - - [甲烷对全球变暖的敏感性比以前认为的高](https://www.solidot.org/story?sid=72056) - - [恐龙如何躲过三叠纪末的生物大灭绝](https://www.solidot.org/story?sid=72055) - - [绿色能源解决方案沙储能](https://www.solidot.org/story?sid=72054) - - [Axie Infinity 是如何被盗走数亿美元加密货币的](https://www.solidot.org/story?sid=72053) - - [苹果预览 Lockdown 模式抵御间谍软件攻击](https://www.solidot.org/story?sid=72052) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 中国红客联盟宣布解散并更名；人脸识别漏洞成骗子作案工具](https://www.freebuf.com/news/338542.html) - - [用户认可 | 斗象科技入选2022网络安全“大众点评”百强榜](https://www.freebuf.com/news/338532.html) - - [为什么API网关不足以保证API安全？API安全之路指向何处](https://www.freebuf.com/articles/neopoints/338509.html) - - [升级为Rust，Hive勒索软件加密将变得更加复杂](https://www.freebuf.com/news/338484.html) - - [万豪国际数据遭泄露，20GB文件被窃取](https://www.freebuf.com/news/338477.html) -- 黑海洋 - WIKI - - [渗透测试的八个步骤（基础理论课件）](https://blog.upx8.com/2890) - - [桌面快捷启动 Lily v5.0](https://blog.upx8.com/2888) - - [AI翻译神器DeepL Pro v2.4.0](https://blog.upx8.com/2887) - - [PIKPAK网盘上架IOS（资源不和谐）新增CHROME浏览器扩展支持](https://blog.upx8.com/2886) - - [视频人像美化 PrettyUp v4.5.0 解锁年费VIP](https://blog.upx8.com/2885) - - [免流文件传输 | 互传 Easyshare v3.5.9.0 官方版](https://blog.upx8.com/2884) - - [重启还原精灵 v2.2.0.0 免费官方版](https://blog.upx8.com/2883) - - [查询微信被谁投诉方法技巧！](https://blog.upx8.com/2880) - - [使用阿里云邮件实现SMTP发送邮件隐藏源IP](https://blog.upx8.com/2879) - - [同城交友项目：借助短视频创作引流，单日收入1000+](https://blog.upx8.com/2878) -- SecPulse安全脉搏 - - [【漏洞预警】Mitel MiVoice Connect远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044546&idx=1&sn=c32a18047a3a1752df8b8559ea654cc6&chksm=803fa89cb748218ad642fa5994adfc65fb9ffd8480c7820dfb145f4205848194093580b59c54&scene=58&subscene=0#rd) -- qz安全情报分析 - - [企业智能安全运营的秘密](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907763&idx=1&sn=fe2a56a6f2efb1c66d66978491eb4abc&chksm=f18eeb35c6f96223fb05042bc3b5e4d7ce4130d422ae861c762beaadd04879bc64a3d5a2eadc&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】2020 Codegate Web题解](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773527&idx=1&sn=25d3c732eeac8bcf77f0b6dcbbeda3ae&chksm=889365b8bfe4ecaea890be3c49a94a3d2d77db4c487797446acb9ed555e013d032cfcdb2e011&scene=58&subscene=0#rd) - - [【安全头条】IconBurst：影响数百网站的NPM供应链攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773527&idx=2&sn=28cd110bfea98f20de5a1640cc2dd7a4&chksm=889365b8bfe4ecae76f754011e8ad3ec32f9785eb1c56940994d2a7d8b2d2aa6feb8d42c7b76&scene=58&subscene=0#rd) -- 看雪学院 - - [Frida inlineHook原理分析及简单设计一款AArch64 inlineHook工具](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458457019&idx=1&sn=1b8dcdc9fbce79e5b202463fec3c77cc&chksm=b18e233186f9aa27180271881bde18b3a60fd0d84b8c1508815d3e4b0fe21202d36d80dc34ef&scene=58&subscene=0#rd) - - [9月1日起施行！国家网信办公布《数据出境安全评估办法》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458457019&idx=2&sn=9361508758f0dea3ed40b64c0fac9d7c&chksm=b18e233186f9aa2701a129f38887720333fb7b3282f77302be078ca7a5ee0ec0c973f3123762&scene=58&subscene=0#rd) - - [Unicorn高级逆向与反混淆](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458457019&idx=3&sn=b5e6ffcbc6940cbe04eee0cf887962fc&chksm=b18e233186f9aa27e3edb55e9eeb29cf8ff11d0aac4da98bf7aa23823b46f669b69a0e3c0036&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [绿盟科技战略解决方案系列介绍--数据安全解决方案](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491904&idx=1&sn=f276823de66a4629b9242c8703c3bd47&chksm=eaac7207dddbfb11683ef008cef80b6599f8ef8b3109af9df561278699ba2e841d753afbf05c&scene=58&subscene=0#rd) -- PeiQi文库 - - [Goby 2.0 | 引擎大升级 · DIY 指纹时代](https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247493560&idx=1&sn=6d6effc8db38fa182a230fde76446fa2&chksm=cecc4fe1f9bbc6f754c334b1448023ef4c035ba15998e5533e6f1bcc9f99896de376c1cfd538&scene=58&subscene=0#rd) -- 互联网安全内参 - - [保卫我方卫星！德国公布太空基础设施安全指南](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504231&idx=1&sn=1ece8db9b8f8f70af325556f18d9d802&chksm=ebfa9647dc8d1f5197f2a33e5d8201fbfd44d68f31f4d632527f395923d942a2770028c82bf0&scene=58&subscene=0#rd) - - [国家网信办公布《数据出境安全评估办法》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504231&idx=2&sn=fe61c654c4fa076712e6176231c90ed3&chksm=ebfa9647dc8d1f515157b17f3afd5635fa8105aef981e2f3cdb903e989e321703a7f3600ba18&scene=58&subscene=0#rd) - - [NIST发布新算法应对量子攻击，可支持下一代加密标准](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504231&idx=3&sn=0a7afba24d1fa211c364c439c2efaf5f&chksm=ebfa9647dc8d1f5118d95bf0b7553c9cac3c4060e1757d55701fb29ed220c8de30b80e9a732e&scene=58&subscene=0#rd) - - [苹果公司将为iPhone增加“隔离模式”，防范间谍软件](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504231&idx=4&sn=2857925ac4b86ad6df561c938a756655&chksm=ebfa9647dc8d1f51656e23cc02783a02c488795c4c1b546cb8ed3af240c568b610a078f5f99c&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】以“泰达币”支付拖欠工资被起诉，法院裁定非法！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004281&idx=1&sn=3237bd45ed7d487cb12fc7d60a2030fb&chksm=f36f73f9c418faef249024e36751395e2053e59f58d984d83ce5aa764b5999e309a351ff9a91&scene=58&subscene=0#rd) - - [【安全圈】数亿网民受影响，OpenSSL又被爆高危漏洞](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004281&idx=2&sn=35525b8ca0386fbd0815c59395cecadc&chksm=f36f73f9c418faefe1ef2c39a5ec66305c98045404db0b4eee9f2ce2738288343e142c2d8813&scene=58&subscene=0#rd) - - [【安全圈】连锁酒店巨头万豪证实其发生又一起数据泄露事件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004281&idx=3&sn=a55a391d316924d60cad4d01a1823f9f&chksm=f36f73f9c418faef195c4c0dffa318d686bed0312ac9dde1797b37f90cd546c9550a3ed3fb09&scene=58&subscene=0#rd) - - [【安全圈】新勒索软件RedAlert来袭！已有Windows、Linux等服务器中招](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004281&idx=4&sn=d057237a7f4d539db1ec7f5629043ced&chksm=f36f73f9c418faef21828b748af841ba68fc52212c23ed19313374a99496825031142a1b854b&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [国家互联网信息办公室公布《数据出境安全评估办法》](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496935&idx=1&sn=65f05f13f206e565e0f88c67d3e27d5a&chksm=973ac785a04d4e93810be8ea9012fa9e1102fcc4fedca8cc39bb3472b647b5c8eeeb4cfec1cf&scene=58&subscene=0#rd) - - [数据出境安全评估办法](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496935&idx=2&sn=fb7ef70991693fd9887a2844f1c03e41&chksm=973ac785a04d4e930ae587d446e072f811a19c0900b729a9b4486df654531a78a74f15a38c35&scene=58&subscene=0#rd) - - [国家互联网应急中心(CNCERT/CC)勒索软件动态周报-2022年第26期（总第34期）(20220625-20220701)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496935&idx=3&sn=da935e4f7a37bc418cfe7c3686a02b9f&chksm=973ac785a04d4e93c2d46f5e2a28237094b97e8935c8a127aaa89a89147f561f17eccda5e1b6&scene=58&subscene=0#rd) - - [国家互联网应急中心(CNCERT/CC)勒索软件动态周报-2022年第25期（总第33期）(20220618-20220624)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496935&idx=4&sn=16f3403e4f5e96c224685792b5b51fa4&chksm=973ac785a04d4e938ae0e2351913dcf0bd200f361fa0c2a2b9a55c87d0ad60d51ff5b9368050&scene=58&subscene=0#rd) - - [国家互联网应急中心(CNCERT/CC)勒索软件动态周报-2022年第24期（总第32期）(20220611-20220617)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496935&idx=5&sn=54c6390778c299db1c9fd2d0dfa37430&chksm=973ac785a04d4e934c735e174b9b22987c8ed2260f14d7dc4d915bd102760f3127862eba9098&scene=58&subscene=0#rd) - - [网络安全信息与动态周报2022年第27期（6月27日-7月3日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496935&idx=6&sn=2cbc915754c61a53e288f9fa3fbc9e6c&chksm=973ac785a04d4e93d2312a6cf76042cdfd6506b4453048dd1f395d9358e2ceaadff810c6080e&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [鹏城杯WriteUp | Pwn、密码、Reverse方向](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494481&idx=1&sn=9bbc98b61494bb86f010c61340fa2cc5&chksm=fa523eefcd25b7f93cf243470a3906643823696462f11bbca257e0f72d5845fb66c1a89fa321&scene=58&subscene=0#rd) -- 代码卫士 - - [高危OpenSSL 漏洞可导致远程代码执行](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512767&idx=1&sn=b404692db2fa859fc1ee08badadbb004&chksm=ea9483d5dde30ac3dd034ce16f1c411008f5df15f75344c3da5e32814ca23e20bc24795ba92a&scene=58&subscene=0#rd) - - [Atlassian 修复Jira 中的完全读取SSRF漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512767&idx=2&sn=a0b241acce83341531e098b976dc2d6c&chksm=ea9483d5dde30ac37e8cb4cb914a843a0ddc13924b0915e5518a0e2ebe4c6725758f476fb8fb&scene=58&subscene=0#rd) - - [美国防部为公开暴露资产设“Hack US”奖励计划，奖金池$11万](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512767&idx=3&sn=6214e5e9710fa7a604669c3ebf073592&chksm=ea9483d5dde30ac38fd458f76cff7f3b7a3e7f51026f54c4da00fa3890fd5751110a537d4d31&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [【攻防演习专题】运用文件分析提升威胁发现](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528556&idx=1&sn=7cb84bd5125eb4642eaa5df560adc7b7&chksm=c1e9fc3df69e752b71a342166c9a8da3fc032f24865dde513f73aa6e88ad4792fb51edee7803&scene=58&subscene=0#rd) - - [完善网络文明建设的基础性保障制度](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528556&idx=2&sn=0b02f217c6c21292d1b1c0123ca11178&chksm=c1e9fc3df69e752b313f6423531e3bec7730d602fda0df0d0e5ed412ba52f4c67457f27f4b67&scene=58&subscene=0#rd) - - [防范数据泄露“崩盘”，安全配置管理是本手](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528556&idx=3&sn=b23f99969d0c84f24b571ba4375e48c8&chksm=c1e9fc3df69e752b2bf31d9fc44ca64dc03a86fc70eec2f00ac0e45976ad8bd8d5c04005c9af&scene=58&subscene=0#rd) - - [网络攻击致使美国多个州无法发放失业救济金](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528556&idx=4&sn=fd212763ec89e9cbaaf75e020f131c33&chksm=c1e9fc3df69e752b3a9effd5eb3febbf3d19f212d35f962245e84303635816d665edef473c25&scene=58&subscene=0#rd) -- 中国信息安全 - - [重磅 | 国家网信办公布《数据出境安全评估办法》（附全文）](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161034&idx=1&sn=f213a6a3d476ba2db27dd59d5f9f0730&chksm=8b5eddf3bc2954e5faa7c71360f2f8d33b496c60a80cb7218c2e5eea57728436ed1c67eb47a5&scene=58&subscene=0#rd) - - [2022“DSG数安先锋行”正式启航：首期“数据安全合规与治理”主题沙龙活动诚邀您参与](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161034&idx=2&sn=6a21416cc0f30de8d1f468cb3a8e68c4&chksm=8b5eddf3bc2954e54358c7a0f1ee2c5ccdf169ed64f5b5cc54e4202ba8781e4c5307419b624c&scene=58&subscene=0#rd) - - [国家网信办负责人就《数据出境安全评估办法》答记者问](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161034&idx=3&sn=78ebeb2684e5807c22fe36aa2bc1a3dc&chksm=8b5eddf3bc2954e5d7c33812a19c02453805789ae4ec0728601553dcda4456fb8229de7b90d5&scene=58&subscene=0#rd) - - [教育部发布预警：高校招生录取期间，谨防诈骗](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161034&idx=4&sn=7d86f7c02f98e38cbf5c8857a7b72206&chksm=8b5eddf3bc2954e530c3e618a86edefb9fed330cd52008d1b810ac8d8920fdd808e046d535a4&scene=58&subscene=0#rd) - - [观点 | 从源头保护个人信息安全](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161034&idx=5&sn=45b3f8a1fc16f1738882d18ee2a0d970&chksm=8b5eddf3bc2954e5de9a77bc064edb4cb973f12e063ff53c655003a51a7679fcee9458a99231&scene=58&subscene=0#rd) -- 安全牛 - - [NIST发布新算法应对量子攻击，可支持下一代加密标准](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115768&idx=1&sn=ed7cee8226066d5cd75eb66df93e657c&chksm=bd14602b8a63e93deb89c7b116d2a886803d731a0642ed86c04de0f62e09ff5c783b30cc2403&scene=58&subscene=0#rd) - - [应对混合办公，多场景下的企业身份安全管理一体化建设](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115768&idx=2&sn=5c22b41922f2d8630e7651d9d1979a42&chksm=bd14602b8a63e93d9f882ea22fbf740df564191406deb45e113080f02b1cb01f4373e464bede&scene=58&subscene=0#rd) - - [安全配置管理（SCM）的价值与应用](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115768&idx=3&sn=40b865760991d6e2e9b8267001b548c8&chksm=bd14602b8a63e93d8d16ffbc074666de8dda93b22519dc99797a933c689de9047d1fb78b252a&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.07.07）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491133&idx=1&sn=7dd2fcf8f2c2f5707330c875048f83c7&chksm=fe251b3cc952922ad9f11082bd908c7708838ad9df5b60e24a4d8a4140c8d368b6993d825c8d&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [@所有人 永安在线免费开放API风险情报能力](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493731&idx=1&sn=2156edd5ba934b9fe9cc413c70aac9f9&chksm=eb12ce58dc65474e22f2d104bd4c666613b00210da902371437289a0621d586977c0dbb709d6&scene=58&subscene=0#rd) -- 极客公园 - - [被华为怼「不熟」，陈春花：已请律师；TikTok 放弃欧美直播带货；马斯克弟弟接盘英特尔无人机｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652958941&idx=1&sn=b36199ddcf77ce09dad90869a6068672&chksm=7e558d6b4922047d2f1d695749805987d0af2546890a108ec9b5b571037a5b92679627b3ae29&scene=58&subscene=0#rd) -- 补天平台 - - [数据库暴露成随时引爆的“地雷”，鹰图平台帮你扫雷排爆](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494341&idx=1&sn=78a6f447deb8ed7572e6a97b0dc09873&chksm=eaf9a289dd8e2b9fe0812bd18587216842670162477437928c17f985b06b1411567c0ce28bd5&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜解锁工控设备固件提取的各类方法](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651134919&idx=1&sn=f50f94aafd871009b484fade8895be05&chksm=f2c11aa7c5b693b196186990b3c18b58b94e49efc625d8464fc851c782eca4a3f878e9fb71d5&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-07-07](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490659&idx=1&sn=154db82230e158cc27b5c6d92cc327ce&chksm=c06032baf717bbaca761326875a97f04aa7df65a755e01a1739e936fc2f7494dd22d057d44b4&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [活动 | “七”待你来，不容错过](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537310&idx=1&sn=68f01f1309513f11d294ce9e3163fc21&chksm=8bcba5e2bcbc2cf46054a1605a315b64a0b9a4f3ca0349371f747ddd5ada5088bc9a339c8068&scene=58&subscene=0#rd) -- 情报分析师 - - [【重磅资料】巴基斯坦国家手册](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509821&idx=1&sn=4e3af6dbc53ae65a07953923f34a000d&chksm=8716bfb6b06136a096da5e1b8b6122ce06e5c37be71da027232cada1e8f2fede6b41f7c4649a&scene=58&subscene=0#rd) - - [【实战技法】如何运用阴影和太阳计算时间](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509821&idx=2&sn=3d6c0abc698bda707f74caeb38c2e3ea&chksm=8716bfb6b06136a09e4ed15ddd456f6b4c4cfab6906a66cfae0c65c37d96e20b67103f74d798&scene=58&subscene=0#rd) - - [【智库报告】俄乌战争对全球粮食安全的影响](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509821&idx=3&sn=59921eed823090fc1268f06c4b2bdb79&chksm=8716bfb6b06136a0a49ef2ac48a50ac463e35f908b6df1a43e710be54125d7dc377990719e86&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [网络可见性：或将成为网络安全中决定生死的关键要素](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247544977&idx=1&sn=ca8ee58959bf63176eac5978416bf6b5&chksm=e915e0abde6269bde70169f4e3fc88bb0be16cbf51ec5c069858398f4574f1ac1f44bf7638b6&scene=58&subscene=0#rd) - - [SessionManager IIS 后门](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247544977&idx=2&sn=fbec0acc4585e6114cb65c4ba906b757&chksm=e915e0abde6269bdb6d81f77cf8fcb424c4d9e328a63d6e121d50a46a83598a4429b1cd120dc&scene=58&subscene=0#rd) -- 安全行者老霍 - - [Gartner 2021 防火墙关键能力](https://mp.weixin.qq.com/s?__biz=Mzg3NjU4MDI4NQ==&mid=2247485153&idx=1&sn=ea2eada034e38d6248587de0dba6813f&chksm=cf315a33f846d32569411e92d5e260c38ec9603d5929e7c8b6379c29fbc4d53d09480b0dcb81&scene=58&subscene=0#rd) -- 长赢指数投资 - - [E篇日记——越多越好吗。22年7月6日、7日。](https://mp.weixin.qq.com/s?__biz=MzIwMTIzNDMwNA==&mid=2653411417&idx=1&sn=11ce59b73366c6905d0c1614dee40aaa&chksm=8d227ab6ba55f3a081a8da1e333294b056760929b1aa518918b2dcbd0f8abe3c74ab0f1e0ac0&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [天融信TOPSRC全网上线！前方五重惊喜让你哇（挖）~](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495667&idx=1&sn=df225cf85cb7662e064bedb724d9d03d&chksm=ce96a2cdf9e12bdbc6355bba331bd01335f52a1de650d3bb359b800eb637b9854be8b04cd309&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Jul.7th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495667&idx=2&sn=097b234051b7661da9c9fb94b7cea4f9&chksm=ce96a2cdf9e12bdb163bf941f042139bb0e735e502d3657eceb5c7460df6758ded4f17718db6&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【漏洞通告】Apache Commons Configuration远程代码执行漏洞 CVE-2022-33980](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262474&idx=1&sn=17494a4f8ddb70e8c1fafc7aa2641ec2&chksm=f3e271bec495f8a8dfedeb8a32ca8d5f62b465276c84cc0d2715cba580fe4f28d45d6d16a481&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-09.md b/archive/2022/2022-07-09.md deleted file mode 100644 index 01117a0691..0000000000 --- a/archive/2022/2022-07-09.md +++ /dev/null @@ -1,270 +0,0 @@ -# 每日安全资讯（2022-07-09） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Dovecot IMAP Server 2.2 Improper Access Control](https://cxsecurity.com/issue/WLB-2022070025) - - [Ransom Lockbit 3.0 MVID-2022-0621 Code Execution](https://cxsecurity.com/issue/WLB-2022070024) - - [Backdoor.Win32.Cafeini.b / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022070023) - - [Backdoor.Win32.EvilGoat.b / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022070022) - - [Openbiz Cubi 3.0.8 Xss/Html inject Upload Vulnerability](https://cxsecurity.com/issue/WLB-2022070021) -- HackerOne Hacker Activity - - [Unauthorized packages modification or secrets exfiltration via GitHub actions](https://hackerone.com/reports/1548870) - - [Open Redirect through POST Request in www.redditinc.com](https://hackerone.com/reports/1310230) - - [Exposed valid AWS, Mysql, Sendgrid and other secrets](https://hackerone.com/reports/1580567) -- Security Boulevard - - [Killnet: Russian DDoS Group Claims Attack on US Congress Website](https://securityboulevard.com/2022/07/killnet-russian-ddos-group-claims-attack-on-us-congress-website/) - - [Contrast employees recharge with ‘Namasday’ holidays](https://securityboulevard.com/2022/07/contrast-employees-recharge-with-namasday-holidays/) - - [Automating JumpCloud Workflows with Multiplier](https://securityboulevard.com/2022/07/automating-jumpcloud-workflows-with-multiplier/) - - [Security BSides Athens 2022 – Dave Lewis’ ‘Talk 12 – Security Debt, Running With Scissors’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-dave-lewis-talk-12-security-debt-running-with-scissors/) - - [The Week in Cybersecurity: NPM removes malicious modules, Microsoft backtracks on macros](https://securityboulevard.com/2022/07/the-week-in-cybersecurity-npm-removes-malicious-modules-microsoft-backtracks-on-macros/) - - [New OpenSource .Net Security Tool Released](https://securityboulevard.com/2022/07/new-opensource-net-security-tool-released/) - - [Bare Metal Cloud vs. IaaS](https://securityboulevard.com/2022/07/bare-metal-cloud-vs-iaas/) - - [Why Should MSPs Offer Identity Management?](https://securityboulevard.com/2022/07/why-should-msps-offer-identity-management/) - - [STUPID Microsoft U-Turn: Unblocks Malicious Macros in Office](https://securityboulevard.com/2022/07/stupid-microsoft-u-turn-unblocks-malicious-macros-in-office/) - - [The M&A Open Source Risk Number](https://securityboulevard.com/2022/07/the-ma-open-source-risk-number/) -- 跳跳糖 - 安全与分享社区 - - [从一文中了解SSRF的各种绕过姿势及攻击思路](https://tttang.com/archive/1648/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [漏洞预警|Apache Commons Configuration远程代码执行漏洞](https://www.4hou.com/posts/3JwA) - - [攻击者利用Mitel VoIP漏洞进行勒索软件攻击](https://www.4hou.com/posts/yk96) - - [【技术原创】渗透基础——远程从lsass.exe进程导出凭据](https://www.4hou.com/posts/LBgj) -- Sploitus.com Exploits RSS Feed - - [Dovecot IMAP Server 2.2 Improper Access Control Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37835&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-33980 exploit](https://sploitus.com/exploit?id=47D4A7AD-7A58-597F-8030-37CB4076FA2F&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=35830627-EBEC-59C8-A142-2F06CCF8EA5B&utm_source=rss&utm_medium=rss) -- unSafe.sh - 不安全 - - [YouTube AI wrongfully flags horror short “Show for Children” as suitable for children](https://buaq.net/go-116555.html) - - [Building an Efficient Password Recovery Workstation: NVIDIA RTX Passwords-per-Watt Benchmarks](https://buaq.net/go-116547.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 28](https://buaq.net/go-116546.html) - - [【文末福利】公开！月薪2w网安人都在关注的公众号！](https://buaq.net/go-116545.html) -- Recent Commits to cve:main - - [Update Fri Jul 8 12:46:00 UTC 2022](https://github.com/trickest/cve/commit/bf88a342335c9482600e651fe5fa708d3ed59bf8) -- Blog & What's New | Offensive Security - - [New and Improved: Learn Fundamentals](https://www.offensive-security.com/offsec/new-and-improved-learn-fundamentals/) -- 安全客-有思想的安全新媒体 - - [数字安全观察-每周简报 （2022.06.29 -2022.07.06）](https://www.anquanke.com/post/id/276173) - - [简单实用远控小工具Todesk](https://www.anquanke.com/post/id/275941) - - [浅识k8s中的准入控制器](https://www.anquanke.com/post/id/275872) - - [MITRE漏洞公告意外展示易受攻击资产](https://www.anquanke.com/post/id/276096) -- 安全脉搏 - - [活跃的 Hezb 挖矿木马分析](https://www.secpulse.com/archives/182799.html) - - [通过下载站传播的匿影僵尸网络分析](https://www.secpulse.com/archives/182779.html) - - [FOFA-攻防挑战](https://www.secpulse.com/archives/182755.html) -- SecWiki News - - [SecWiki News 2022-07-08 Review](http://www.sec-wiki.com/?2022-07-08) -- root@cyberworld:~# Noah Lab - - [CVE-2022-26377: Apache HTTPd AJP Request Smuggling](http://noahblog.360.cn/apache-httpd-ajp-request-smuggling/) -- ElcomSoft blog - - [Building an Efficient Password Recovery Workstation: NVIDIA RTX Passwords-per-Watt Benchmarks](https://blog.elcomsoft.com/2022/07/building-an-efficient-password-recovery-workstation-nvidia-rtx-passwords-per-watt-benchmarks/) -- Hex Rays - - [Igor’s tip of the week #97: Cross reference depth](https://hex-rays.com/blog/igors-tip-of-the-week-97-cross-reference-depth/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 28](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-28-4/) -- SAP Blogs - - [Maintaining Long text in the EWM Product Master](https://blogs.sap.com/2022/07/08/maintaining-long-text-in-the-ewm-product-master/) - - [SAP Analytics Cloud – Application Design Overview](https://blogs.sap.com/2022/07/08/sap-analytics-cloud-application-design-overview/) - - [All about Sustain projects: how to set up and get best out to sustain support](https://blogs.sap.com/2022/07/08/all-about-sustain-projects-how-to-set-up-and-get-best-out-to-sustain-support/) - - [Election of SAP Academic Board DACH](https://blogs.sap.com/2022/07/08/election-of-sap-academic-board-dach/) - - [Date of Manufacture and Offset in Days in Production Scheduling Profile in SAP S/4HANA 2020](https://blogs.sap.com/2022/07/08/date-of-manufacture-and-offset-in-days-in-production-scheduling-profile-in-sap-s-4hana-2020/) - - [Cloud Operations Best Practices for SAP Ariba Run Operations](https://blogs.sap.com/2022/07/08/cloud-operations-best-practices-for-sap-ariba-run-operations/) - - [How SAPUI5 brings together consultants and developers](https://blogs.sap.com/2022/07/08/how-sapui5-brings-together-consultants-and-developers/) - - [Ariba Guided Buying (AGB): Ariba Master data update via SAP Process Orchestration (SAP PO)](https://blogs.sap.com/2022/07/08/ariba-guided-buying-agb-ariba-master-data-update-via-sap-process-orchestration-sap-po/) - - [Decomposition Tree with R-Visualization in SAC.](https://blogs.sap.com/2022/07/08/decomposition-tree-with-r-visualization-in-sac./) - - [S/4HANA Q2C Sales Flexibility – Determine Requested Delivery Date on Sales Document](https://blogs.sap.com/2022/07/08/s-4hana-q2c-sales-flexibility-determine-requested-delivery-date-on-sales-document/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [A Visual Representation of Today's Modern Cybercrime Ecosystem - A Cybercrime-Friendly Forum Communities Screenshots Compilation - An Analysis](http://ddanchev.blogspot.com/2022/07/a-visual-representation-of-todays.html) - - [Upcoming Personal Memoir - Official Announcement!](http://ddanchev.blogspot.com/2022/07/upcoming-personal-memoir-official.html) - - [Call for Interest - Establishing the Foundations for a Part-Time Project-Based Cybercrime Project Task Force](http://ddanchev.blogspot.com/2020/06/call-for-interest-establishing.html) - - [Dancho Danchev's Blog - Soliciting Contributing Writers and Guest Bloggers](http://ddanchev.blogspot.com/2019/09/dancho-danchevs-blog-soliciting.html) - - [Historical OSINT - The Koobface Gang Mixing Social Engineering Vectors](http://ddanchev.blogspot.com/2018/07/historical-osint-koobface-gang-mixing.html) - - [Real-Time OSINT vs Historical OSINT in Russia/Georgia Cyberattacks](http://ddanchev.blogspot.com/2018/07/real-time-osint-vs-historical-osint-in.html) - - [The DDoS Attack Against Bobbear.co.uk](http://ddanchev.blogspot.com/2018/05/the-ddos-attack-against-bobbearcouk.html) - - [Who's Behind the GPcode Ransomware?](http://ddanchev.blogspot.com/2018/05/whos-behind-gpcode-ransomware.html) - - [Who's Behind the Georgia Cyber Attacks?](http://ddanchev.blogspot.com/2018/05/whos-behind-georgia-cyber-attacks.html) - - [Dissecting the Koobface Worm's December Campaign](http://ddanchev.blogspot.com/2018/01/dissecting-koobface-worms-december.html) -- Reverse Engineering - - [Understanding Pointers for Reverse Engineers - Pointer Basics in Assembly (OALABS Tutorial)](https://www.reddit.com/r/ReverseEngineering/comments/vufwfp/understanding_pointers_for_reverse_engineers/) - - [Reactivating diagnostic debug output in the 1997 game "Carmageddon"](https://www.reddit.com/r/ReverseEngineering/comments/vtzofp/reactivating_diagnostic_debug_output_in_the_1997/) -- Twitter @Nicolas Krassas - - [Large-scale cryptomining campaign is targeting the NPM JavaScript package repository](https://twitter.com/Dinosn/status/1545373592795348992) - - [New stealthy OrBit malware steals data from Linux devices](https://twitter.com/Dinosn/status/1545373524608667648) - - [kubeaudit: audit Kubernetes clusters for various different security concerns](https://twitter.com/Dinosn/status/1545367879247446016) - - [Researcher released CVE-2022-34265 PoC for Django SQL Injection flaw](https://twitter.com/Dinosn/status/1545367826705293314) - - [CVE-2022-26377: Apache HTTPd AJP Request Smuggling](https://twitter.com/Dinosn/status/1545367393941295104) - - [tofu: modular tool for hacking offline Windows filesystems and bypassing login screens](https://twitter.com/Dinosn/status/1545367291029868544) - - [Free decryptor released for AstraLocker, Yashma ransomware victims](https://twitter.com/Dinosn/status/1545367230757883906) - - [Experts Uncover 350 Browser Extension Variants Used in ABCsoup Adware Campaign](https://twitter.com/Dinosn/status/1545367120627761152) - - [Microsoft rolls back decision to block Office macros by default](https://twitter.com/Dinosn/status/1545367033952477184) - - [Koh: The Token Stealer](https://twitter.com/Dinosn/status/1545338472822620160) - - [RT inversecos ᐡ ꒳ ᐡ: 1\ #ThreatHunting: Detecting Linux Hooking via LD_PRELOAD Did you know a correlating /etc/ld.so.preload is NOT always created ...](https://twitter.com/inversecos/status/1545298731545018368) - - [A curated list of web3Security materials and resources For Pentesters and Bug Hunters.](https://twitter.com/Dinosn/status/1545277615644332033) - - [Koh is a C# and and Beacon Object File (BOF) toolset that allows for the capture of user credential material via purposeful token/logon session leakag...](https://twitter.com/Dinosn/status/1545276531504824322) -- 博客园 - admin-神风 - - [CVE-2022-22947 Spring Cloud Gateway漏洞浅析 - admin-神风](https://www.cnblogs.com/wh4am1/p/16457533.html) -- Malwarebytes Labs - - [Fake job offer leads to $600 million theft](https://blog.malwarebytes.com/cybercrime/2022/07/fake-job-offer-leads-to-600-million-theft/) - - [YouTube AI wrongfully flags horror short “Show for Children” as suitable for children](https://blog.malwarebytes.com/awareness/2022/07/youtube-ai-wrongfully-flags-horror-short-show-for-children-as-suitable-for-children/) - - [Report: Brazil must do more to encrypt, back up data](https://blog.malwarebytes.com/cybercrime/2022/07/report-brazil-must-do-more-to-encrypt-back-up-data/) -- Application Security Blog - - [The M&A Open Source Risk Number](https://www.synopsys.com/blogs/software-security/open-source-risks-mergers-acquisitions/) -- blog.avast.com EN - - [Macro-based malware: A new way to fight it](https://blog.avast.com/macro-malware) -- KitPloit - PenTest & Hacking Tools - - [Haxx - Untethered + Unsandboxed Code Execution Haxx As Root On iOS 14 - iOS 14.8.1](http://www.kitploit.com/2022/07/haxx-untethered-unsandboxed-code.html) -- The Daily Swig | Cybersecurity news and views - - [AstraLocker ransomware decryptors released by Emsisoft](https://portswigger.net/daily-swig/astralocker-ransomware-decryptors-released-by-emsisoft) - - [Decentralized Identifiers: Everything you need to know about the next-gen web ID tech](https://portswigger.net/daily-swig/decentralized-identifiers-everything-you-need-to-know-about-the-next-gen-web-id-tech) - - [Node.js fixes multiple bugs that could lead to RCE, HTTP request smuggling](https://portswigger.net/daily-swig/node-js-fixes-multiple-bugs-that-could-lead-to-rce-http-request-smuggling) -- HackerNews - - [CertiK：2022 上半年 Web3 项目已因黑客攻击损失超 20 亿美元](https://hackernews.cc/archives/39870) - - [研究人员警告新的 OrBit Linux 恶意软件会劫持执行流程](https://hackernews.cc/archives/39842) - - [5G 容易遭受对抗性攻击：可拖慢手机网速甚至断网](https://hackernews.cc/archives/39857) - - [专业恶意软件频现？IT服务巨头 SHI International 也成为攻击目标！](https://hackernews.cc/archives/39852) - - [苹果将推出新安全功能“封锁模式”，可保护设备免受间谍软件攻击](https://hackernews.cc/archives/39846) - - [APT 黑客组织 Bitter 持续攻击孟加拉国军事目标](https://hackernews.cc/archives/39833) -- Security Uncorked - - [Wireless Segmentation Concepts: When, Why, and How](https://securityuncorked.com/2022/07/wireless-segmentation-concepts-when-why-and-how/) -- 黑海洋 - WIKI - - [特狗TV 神马壳点播（持续更新）](https://blog.upx8.com/2892) -- 奇客Solidot–传递最新科技情报 - - [内存价格下跌](https://www.solidot.org/story?sid=72073) - - [网信办发布《数据出境安全评估办法》](https://www.solidot.org/story?sid=72072) - - [高传染性奥密克戎亚型在美国快速传播](https://www.solidot.org/story?sid=72071) - - [《超时空接触》上映 25 年](https://www.solidot.org/story?sid=72070) - - [停止手机分心的常识建议可能是误导](https://www.solidot.org/story?sid=72069) - - [Hive 勒索软件从 Go 切换到 Rust](https://www.solidot.org/story?sid=72068) - - [为什么有如此多的编程语言？](https://www.solidot.org/story?sid=72067) - - [空客的太阳能飞机已连续飞行逾二十天](https://www.solidot.org/story?sid=72066) - - [安倍晋三遇刺](https://www.solidot.org/story?sid=72065) - - [Lennart Poettering 加盟微软](https://www.solidot.org/story?sid=72064) -- 酒仙桥六号部队 - - [今日忌：在喜欢的女孩自拍下评论“你是不是没化妆”](https://mp.weixin.qq.com/s?__biz=MzAwMzYxNzc1OA==&mid=2247500461&idx=1&sn=5ea094b15fb8ccdf1fa8a236ad39a2ee&chksm=9b3ae41cac4d6d0a85e55042302c94021a69f125b6e92679a0e03132d40b5c42cd50537a237d&scene=58&subscene=0#rd) - - [AMD被黑客窃取450Gb机密数据原因曝光：用123456当密码 | 安全事件18](https://mp.weixin.qq.com/s?__biz=MzAwMzYxNzc1OA==&mid=2247500461&idx=2&sn=a392ab50280f99b9b661bcb61a39d742&chksm=9b3ae41cac4d6d0ab0042782eecee6273314762ee280ab8e43e3ea97b42c9e2da57eb0f1271b&scene=58&subscene=0#rd) - - [比尔·兰德雷斯——昔日的天才黑客，如今在街头流浪（上） | 人物志041](https://mp.weixin.qq.com/s?__biz=MzAwMzYxNzc1OA==&mid=2247500452&idx=1&sn=51af45873589d9876d24335baaeba418&chksm=9b3ae415ac4d6d033afa2168bf4c4605400ec201298a81e67c3172040df2bf6d5c1f27a5bc43&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(07-08)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958578&idx=1&sn=284e9697b302154e0443da16ca0491df&chksm=8baecdadbcd944bbdfe8bcf4283ea6bfa1ef499ecfebdf634aaef6e5fb311c0599165cb1f9a6&scene=58&subscene=0#rd) -- Web安全与前端 - - [全国攻防演习的防守体系建设](https://mp.weixin.qq.com/s?__biz=MzIxMDA4NzAyMQ==&mid=2247483938&idx=1&sn=b75db6428192ee4f8a0d519de79e92be&chksm=9768bf20a01f3636d8a94c1999e4e48d6d213fd9857c20c001dbee0fa60573574693e1d36771&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [xray社区三周年直播庆典福利放送进行时～～好礼享享享不停](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247490006&idx=1&sn=1457a68628a1269e3625de60863f3608&chksm=96f406bba1838fad621b5808bf8a44329ca1498e7bb4d0f69edcc8c25775bc0fb5e0deadf6df&scene=58&subscene=0#rd) -- 雷神众测 - - [WSDL测试webservice接口指南](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498569&idx=1&sn=35ae3033377e88e8a459afc9018856c2&chksm=f258493ac52fc02c69aac5d204f04b19074c41b3b5d6e37a116740817843cc40eabbfe75c244&scene=58&subscene=0#rd) -- 杨龙 - - [Microsoft Visual C++可再发行的最新支持下载 Visual Studio 2015、2017、2019 和 2022](https://www.yanglong.pro/microsoft-visual-c%e5%8f%af%e5%86%8d%e5%8f%91%e8%a1%8c%e7%9a%84%e6%9c%80%e6%96%b0%e6%94%af%e6%8c%81%e4%b8%8b%e8%bd%bd-visual-studio-2015%e3%80%812017%e3%80%812019-%e5%92%8c-2022/) -- 绿盟科技金融事业部 - - [应对攻防演练 | 一站式中台服务，你值得拥有](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491930&idx=1&sn=875624b8fe94a25e94a453a5a5aa8749&chksm=eaac721ddddbfb0bc43373c60c73d8d157c63500ff67525bd5a93c0abd699acfe25e6b342c58&scene=58&subscene=0#rd) -- 安全牛 - - [硬核案例 | 构筑医疗行业数据安全“保护盾”](https://www.aqniu.com/vendor/85676.html) - - [盘点|2022上半年十大勒索攻击事件](https://www.aqniu.com/vendor/85677.html) - - [北信源安全专家：攻防演练，应加强即时通讯关键信息基础设施安全](https://www.aqniu.com/vendor/85669.html) - - [数字安全旗舰赛事，2022 DSCTF首届数字空间安全攻防大赛7月13日截止报名！](https://www.aqniu.com/vendor/85666.html) - - [新一代隐私保护技术简析与应用](https://www.aqniu.com/industry/85657.html) - - [《欺骗式防御技术应用指南》报告调研启动](https://www.aqniu.com/industry/85656.html) - - [国家网信办公布《数据出境安全评估办法》，9月1日正式施行](https://www.aqniu.com/industry/85655.html) - - [4000万+援港物资速达的背后：7*24小时守护的网络安全力量](https://www.aqniu.com/vendor/85654.html) - - [梆梆安全荣列首批数据安全产业研究工作组成员单位及专家委员会](https://www.aqniu.com/vendor/85651.html) - - [梆梆安全受邀出席“智车智驾，智向未来”产业沙龙，聚焦“智能汽车与自动驾驶中的安全”](https://www.aqniu.com/vendor/85642.html) - - [梆梆安全顺利通过软件能力成熟度模型集成CMMI L3认证](https://www.aqniu.com/vendor/85639.html) - - [“聚势谋远 · 链创未来”中国移动2022科技周盛大开幕，梆梆安全受邀发表主题演讲](https://www.aqniu.com/vendor/85636.html) - - [实力认证 ｜ 梆梆安全入选2022年中国数字安全百强“中坚力量”](https://www.aqniu.com/vendor/85633.html) - - [安全合规管控与应急响应建设论坛顺利举办](https://www.aqniu.com/vendor/85628.html) - - [标准解读 | 移动互联网应用程序信息服务管理规定](https://www.aqniu.com/vendor/85616.html) - - [梆梆观点 ｜ 人脸识别绕过常见攻击与防护](https://www.aqniu.com/vendor/85600.html) - - [基于控制器深度防护技术构建针对工业控制器的可靠安全防线](https://www.aqniu.com/vendor/85596.html) - - [科技适老时代如何保护个人信息安全，梆梆安全给您支招儿](https://www.aqniu.com/vendor/85593.html) -- rtl-sdr.com - - [Watch out for new RTL-SDR Blog V3 Counterfeits](https://www.rtl-sdr.com/watch-out-for-new-rtl-sdr-blog-v3-counterfeits/) -- 互联网安全内参 - - [5G容易遭受对抗性攻击：可拖慢手机网速甚至断网](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504252&idx=1&sn=9fc52e139f816bea9929a5a625d1c231&chksm=ebfa965cdc8d1f4a1904d84090d5db5267728db96249a10f0adad94c046850a3b3659444b349&scene=58&subscene=0#rd) - - [API安全形势严峻：38万台K8s API服务器暴露在公网](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504252&idx=2&sn=94ffcae7e0ca7deb91c7b4cce81557c0&chksm=ebfa965cdc8d1f4a2c54584c40f5cff98853738f3ac66a2712f6de9fbd8ffe6b1c3c21cb53c0&scene=58&subscene=0#rd) - - [黑客公布伊朗钢铁巨头近20G绝密文件，疑似以色列幕后支持](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504252&idx=3&sn=45f823b99670d4b0daae173a430870bb&chksm=ebfa965cdc8d1f4a62953f37fae901978fd8b11e0b033fbfc3a18514ff28408cd54ba2d2addd&scene=58&subscene=0#rd) - - [强势布局AI防御与产业优势，英国《国防人工智能战略》详解](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504252&idx=4&sn=94df2da52fdde57c8ad00e75d3f1ffbf&chksm=ebfa965cdc8d1f4a87519a773c85a97722c0fd6bc586cbf4e266d10a2a03f5eac50f8256ac7c&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】Office文件格式基础知识（1）](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773579&idx=1&sn=a95785490e4e7fb9e556694fc7c6e047&chksm=88936664bfe4ef726fe1650eba75b2959c5c226aeab8736118f69948dade847afa2a36aa26b9&scene=58&subscene=0#rd) - - [【安全头条】MITRE漏洞公告意外展示易受攻击资产](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773579&idx=2&sn=4cb7ffe230f86a2c2553adb40958c57e&chksm=88936664bfe4ef728792b708d3886e1a0f4fddd75aa1e4f69e8bcb0b25fec577f0bef2e9db66&scene=58&subscene=0#rd) -- 奇安信CERT - - [【已复现】OpenSSL RSA远程代码执行漏洞(CVE-2022-2274)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496422&idx=1&sn=0c7bbd815d87ed3ade312f727855681b&chksm=fe79d67ec90e5f6837a7057cda5e1c60e03430e10eb68c3f5cb6941f44ba46df5138c7bc63ef&scene=58&subscene=0#rd) -- 代码卫士 - - [苹果为Lockdown Mode 新特性推出漏洞奖励计划，最高200万美元](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512788&idx=1&sn=e187454b1e7105eca3d4a6988c305073&chksm=ea9483bedde30aa831b27a1729e393da823f28bb3b86c526f3c936e95d2d9c1d928b50b2db9d&scene=58&subscene=0#rd) - - [超过1200个NPM包被滥用于挖掘密币](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512788&idx=2&sn=4c32e4527086293a7818964114f8f398&chksm=ea9483bedde30aa83c18110efcfdb4132953af05353a129973a5d2cce78b95557ee9ae42ce1a&scene=58&subscene=0#rd) - - [Fortinet 修复多个路径遍历漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512788&idx=3&sn=894340534673ba25a49c72eec950b0d7&chksm=ea9483bedde30aa8e9c0b3355eeee1ce56ec6cb1f2d55b60888cea9487bd8397fff4294a955d&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【技巧】如何调查美国人的违法违规前科？](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651130241&idx=1&sn=8f56277e74d7b1f08e46e035a7b76e05&chksm=f1af7ebbc6d8f7ad7c8574448c0583bd3bf88a17bc35f4c1c80fa8f6729b0d794508db3c5ee0&scene=58&subscene=0#rd) -- FreeBuf网络安全行业门户 - - [12万从业者同频！CIS网络安全创新大会·夏日版“元宇宙”齐冲浪](https://www.freebuf.com/fevents/338660.html) - - [「斗象攻防演练宝典」之弱密码如何“扫雷”](https://www.freebuf.com/articles/network/338629.html) - - [参数化导致的WAF绕过研究](https://www.freebuf.com/articles/network/338604.html) - - [苹果将推出新安全功能“封锁模式”，可保护设备免受间谍软件攻击](https://www.freebuf.com/news/338587.html) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-07-08 Jenny](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490672&idx=1&sn=e42b8fdd2b3488dc82b9c81140ca82ac&chksm=c06032a9f717bbbf5e8c7b577b53b0cfb4f5664019e4c3674d4c5b5c16b9da09d761c9cbf4e5&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [每周勒索威胁摘要](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247489928&idx=1&sn=2215a7f9d1a45285cb4ac45d46d70948&chksm=ec6a69a0db1de0b69925eb7600becd7a94ca69bbb841a4f8ee194a4101c84bade57084e3e10f&scene=58&subscene=0#rd) -- 无害实验室sec - - [对轰炸APP逆向分析 小绵羊](https://mp.weixin.qq.com/s?__biz=MzkwMTE4NDM5NA==&mid=2247485896&idx=1&sn=a39525c2df9e4548ef05d27085c87273&chksm=c0b9e72df7ce6e3bdf8730fe8ceff069f59e9753e8172abd05ea928d06916afa541a8fa996d1&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [国家互联网信息办公室公布《数据出境安全评估办法》](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491349&idx=1&sn=c006e488c311a09c58c96fcc20765d11&chksm=feb59e06c9c217100b7da529e260e85aaee4fd812a8ab26ece7e2d7dff20f25c330e4777fbf7&scene=58&subscene=0#rd) -- 情报分析师 - - [【秘笈战法】像间谍一样生存](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509869&idx=1&sn=9857cf7bd515a3c1cfddb81e935efb7e&chksm=8716bc66b06135702c55f55947ecf6f9a55e5d7fe5ad0e5c482b82e484018d8ab95cd36ab60e&scene=58&subscene=0#rd) - - [【事实核查】这个片段没有显示俄罗斯在乌克兰的导弹 ——来自视频游戏](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650509869&idx=2&sn=e772bc982af65ff7e324eab7c8427b49&chksm=8716bc66b061357074f424bd732c2c1b92f84622786602cd9c56f4f2d1a2d54669592b1fb4fe&scene=58&subscene=0#rd) -- 数据安全与取证 - - [“逻辑采集”知多少](https://mp.weixin.qq.com/s?__biz=MzIyNzU0NjIyMg==&mid=2247486776&idx=1&sn=82763657ed6b130ed3803e7da0bb0e99&chksm=e85ec839df29412f1476f18e9cfe832e1ab4cd0aed28383b72cbe1c2e4cb49a72e02e197d471&scene=58&subscene=0#rd) -- 小米安全中心 - - [《小米 IoT 隐私合规实践及思考》黄著馨](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247513894&idx=1&sn=f0f2debc73fb65bf920529fe194c26be&chksm=ea8391b3ddf418a596c9404a13e2a7d58c26b73903c0d0aaa56cd95c7eb00373abab227fe638&scene=58&subscene=0#rd) -- 极客公园 - - [以太坊——Web3 的「黄埔军校」是怎么炼成的](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959318&idx=1&sn=b33f43764296c64ef48c8f3ac039ffbe&chksm=7e558fe0492206f6f8c803a0d762a426a489d864083d5c7c646ce65aafe2614dda6df19f9466&scene=58&subscene=0#rd) - - [都说开源公司赚钱难，到底是为什么？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959318&idx=2&sn=fd1112e1458f65402381ee2266dddf69&chksm=7e558fe0492206f6e61109a47ff3a0fb42ad1854552bf95d56b4c004df8680d151e8c9d4cda2&scene=58&subscene=0#rd) - - [余承东：汽车是华为唯一亏损业务；Musical.ly 创始人阳陆育从字节离职；狂买百万亩，盖茨成美国最大地主｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959156&idx=1&sn=df288421ce5727e9c73719766b51f4d1&chksm=7e558c02492205142de59fbbef1d83c4be71e3ecb98ccdcb66eacc9b731ec6566b548ecccabb&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】B站2.2亿余条用户信息只值7万元？B站：网传数据为错误信息](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004359&idx=1&sn=3c394c558d7947ddbb5a5834517ea72e&chksm=f36f4c47c418c551b365fcccee70cb63458cb07e06d339333ac81edd6b9f8f65766230546e37&scene=58&subscene=0#rd) - - [【安全圈】前员工指控Facebook偷看Messenger数据 并提供给警方](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004359&idx=2&sn=5733fe966492ea0555e1ea4d043e0c49&chksm=f36f4c47c418c551bd71651c70035f14ec4c5966f7cbbc5c725d3f16404ec62661cc51399658&scene=58&subscene=0#rd) - - [【安全圈】重磅！中国红客联盟宣布解散](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004359&idx=3&sn=194ea98ccb4e72945d44257b6a80687d&chksm=f36f4c47c418c551f05b92919b90544202e6304c3512ba00b37166c676ae966bd6395acc8b79&scene=58&subscene=0#rd) - - [【安全圈】API安全形势严峻：38万台K8s API服务器暴露在公网](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004359&idx=4&sn=596716b06792298fdbb1bb8f00c6818c&chksm=f36f4c47c418c5511d532bdd6d82077360d2f7ccad47f6ad968389bd52a7b34d6ba6c70d462e&scene=58&subscene=0#rd) -- 火线Zone - - [Kubernetes NGINX Ingress Controller 中的新漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495947&idx=1&sn=7be2fddc2b9ac35897eb4701fa3b71ff&chksm=eaa9792bdddef03dcf44a4ae02879e3ad5eec37ae4221401b1c26110a283014cffdf8ac9b536&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜公有云下，企业安全审计框架和构建可审计的安全环境](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651134920&idx=1&sn=35cd8b92315dde95f097bffa747b4fae&chksm=f2c11aa8c5b693bed531570e212fd7e65a6034908bc50ed03bb563e3266d6ea35a1b8772de1e&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [【技术原创】渗透基础——远程从lsass.exe进程导出凭据](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545015&idx=1&sn=664dde541ed1fae58c780a70f123dfcb&chksm=e915e08dde62699bc58a9cbbc850a3b9a180a0793cbdc9d1d7427b371e72894417d167764124&scene=58&subscene=0#rd) - - [攻击者利用Mitel VoIP漏洞进行勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545015&idx=2&sn=3fe05d16ee63b849c702a1c7a93be17c&chksm=e915e08dde62699ba6a1f483893a804920d08555152b59808714f7e5036fb45df19e866e0e30&scene=58&subscene=0#rd) -- 暗影安全 - - [对话奇安信丨红蓝攻防，网络安全的矛与盾](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163038&idx=1&sn=726ab7096146ab3685b3ee4e7d32af5e&chksm=f1d4e5fbc6a36ced9e388f1b4f329b0c47418e1ae67c04398081e891812f2684185fd1bdb526&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 促流动、保安全 –《数据出境安全评估办法》规范数据出境活动安全有序](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529254&idx=1&sn=e960518cb853f457f826648f37f2a9c4&chksm=fa93c5e7cde44cf15602e2c52e82ae5444941a2e66e5ea4f6756970cab5896d09d906e5fa1bd&scene=58&subscene=0#rd) - - [国家互联网信息办公室公布《数据出境安全评估办法》](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529254&idx=2&sn=05ca91761422fb248ef32730e68becad&chksm=fa93c5e7cde44cf177a5a7c6c74ecea0038eb14795a40657182f4009ffbd06398104e5a068bb&scene=58&subscene=0#rd) - - [数据出境安全评估办法](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529254&idx=3&sn=91ced73b7a28df9142f4c5b59c72588d&chksm=fa93c5e7cde44cf1154172a4a9d32cd303bbe32695da6804aa8b01fc0e374393e3ec28a80514&scene=58&subscene=0#rd) - - [【攻防演练专题】WEB 在线实时主动防御](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529254&idx=4&sn=eeacf6d84efbe20c693b2de0c288f820&chksm=fa93c5e7cde44cf100ddea13b2b16569aa52c7e17c2a3af0ad4df91f85ad52350dc8f18f284f&scene=58&subscene=0#rd) - - [一种涉密场所物理信息泄漏风险评估办法](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529254&idx=5&sn=6dab9d32d26da5df8c8af0ba28575b83&chksm=fa93c5e7cde44cf1ce37e936b406e7fa669c8ca8b1d78a6d556aa8476e0556b8bbd7214d458e&scene=58&subscene=0#rd) - - [2022年网络安全市场十五大关键预测](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529254&idx=6&sn=b730e24ceb08b462ece4b5f3e81504b1&chksm=fa93c5e7cde44cf19b97cb72c5b50de741fe0ab6555ec696342bcdd9311222d54a48cfeec821&scene=58&subscene=0#rd) - - [专业恶意软件频现？这家IT服务巨头也成为攻击目标！](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529254&idx=7&sn=b85bc07452df9bbf802a7003857dca1d&chksm=fa93c5e7cde44cf19a1032cc2a651ae10ce84a186acdb8f361581b9be3fcf8f6b1df3cad9b43&scene=58&subscene=0#rd) -- 虎符智库 - - [国家勒索：勒索软件开启新时代](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247487808&idx=1&sn=f98e7376fae06967dcfc56551f3672c3&chksm=971e7c42a069f554c24ca34a74f2206f11f69ce387b609b2dec3252e65abfdb9b1ae56e7e7e8&scene=58&subscene=0#rd) -- 补天平台 - - [【限时福利】突然就想上一个活动](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494387&idx=1&sn=1b646e262e0a513e12f0de2aaa4014b6&chksm=eaf9a2bfdd8e2ba99260c435968d3840dfad70d7e11c59701f970b9296115b9691d7781c5e80&scene=58&subscene=0#rd) -- 安恒威胁情报中心 - - [安恒高级安全威胁情报周报（2022.7.2~7.8）](https://mp.weixin.qq.com/s?__biz=MzI1MDU5NjYwNg==&mid=2247496002&idx=1&sn=c9f0cf406f27b7642f0e597bef4b633f&chksm=e9fd6cd3de8ae5c5fa749cf36c5f57e3721b4570beb3ddc06682094658b53f75c941a7ec3128&scene=58&subscene=0#rd) -- 先生制造 - - [在北京精英中学和宁夏扶贫中学，“努力”有什么区别？| 噪音开始了](https://mp.weixin.qq.com/s?__biz=MzAxNzQ5MDg2NA==&mid=2649618641&idx=1&sn=6405d5b69c48a0408e1217ca9f3cb9d6&chksm=83fdee0eb48a671845e3a3166b946e93e6b0036663f9183826407c879ffd87a3eef4f8e05f4c&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [原创 | 数据出境“安检”新规——《数据出境安全评估办法》深度解读](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528622&idx=1&sn=9d96c2d178388628a32fa79f474d320b&chksm=c1e9fcfff69e75e95b554c9c72c83baba699f5038d4d9964bda0a86a2e74760075a1a44b2bb3&scene=58&subscene=0#rd) - - [国家互联网信息办公室公布《数据出境安全评估办法》](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528622&idx=2&sn=a186a7bebddf6c797e0e01183d98a65b&chksm=c1e9fcfff69e75e95422eec646cd5d8217c996950c44a1cc5edcb79694e66d8c1fb250a5520e&scene=58&subscene=0#rd) - - [数据出境安全评估办法](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528622&idx=3&sn=3b9099f3aa53a11100e9b9a6493f6a61&chksm=c1e9fcfff69e75e9a339c909d5556b4bcc659466d513eab30d70c073253d03dee43a66f39417&scene=58&subscene=0#rd) - - [【攻防演练专题】WEB 在线实时主动防御](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528622&idx=4&sn=c31a404cefdee46b1304bc5e1945aef3&chksm=c1e9fcfff69e75e9d3c693b3aebe2a84532d90decae360eb56f766d42581923ddaca9436cdf0&scene=58&subscene=0#rd) - - [保卫我方卫星！德国公布太空基础设施安全指南](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528622&idx=5&sn=547aaae28d884e9d16607125f2595035&chksm=c1e9fcfff69e75e960eb9756c951ab4fca83b8384f60608224acc3b9023043843a8f34e73b1c&scene=58&subscene=0#rd) - - [黑客公布伊朗钢铁制造企业近20G绝密文件-疑是以色列幕后支持](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528622&idx=6&sn=08c60d3b5cf1e5379cd244077dae91de&chksm=c1e9fcfff69e75e91002b12d7a113ea9dc6414b7634ccc04d8135bbdb52493af831f5ee11ad7&scene=58&subscene=0#rd) - - [网络可见性：或将成为网络安全中决定生死的关键要素](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528622&idx=7&sn=a4b5b9414cbf0d380bea7b5e6e21afe4&chksm=c1e9fcfff69e75e920b030ea51b2365ae048f822749564666c5fb16c39a080e727f549f58d07&scene=58&subscene=0#rd) -- 安全牛 - - [新一代隐私保护技术简析与应用](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115797&idx=1&sn=1771fa2056fdab934e6a46a37487635d&chksm=bd1461c68a63e8d04f68923052ffa0710f0bccd14f775e5b2ff23c7e5eb10a9a2d0b508ac3ac&scene=58&subscene=0#rd) - - [《欺骗式防御技术应用指南》报告调研启动](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115797&idx=2&sn=8440379521497aad6cdb85c6c94c9f81&chksm=bd1461c68a63e8d0d22c8df99fc1531ba4963de1351d59a882ddb1608c708b90f72647a49c4b&scene=58&subscene=0#rd) - - [国家网信办公布《数据出境安全评估办法》，9月1日正式施行](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115797&idx=3&sn=5874e62dec43d32342ae1327a351f22d&chksm=bd1461c68a63e8d00fc60c4595fac801b5ed3d9256d76718183a06a5251ebe3268de93ea9caf&scene=58&subscene=0#rd) -- 邱贞玮 - - [踢馆 | 2022.7.8](https://mp.weixin.qq.com/s?__biz=MzIxOTI4NjI2Mw==&mid=2247488434&idx=1&sn=591577ecd8ce513acd1251a8e8f1e991&chksm=97dccc2aa0ab453c59eb004d6dd92a2e03d7e311c14970546b1fb6e702a6d88a51df129b1814&scene=58&subscene=0#rd) -- 从零开始定投日记 - - [欲吃更胖，必承其重！ [2022.7.8]](https://mp.weixin.qq.com/s?__biz=MzI4ODQ2NjA4OQ==&mid=2247485073&idx=1&sn=69645d3785748b273c58c07a0b246bd6&chksm=ec3cb357db4b3a41396f5a39b1e9d657008b799aed58913a81fa811a928eb4c8a3dbb8e0ccd0&scene=58&subscene=0#rd) -- 小众软件 - - [为什么那么多人非要离线？](https://mp.weixin.qq.com/s?__biz=MjM5NDMwMTI2MA==&mid=2651671683&idx=1&sn=4d0881de64fba1cdeb2a93e741d8f247&chksm=bd7038a08a07b1b6df061cd2009b2c4dd0b7bceb88492ec280a17ef0c9e3c554ce5b2771c4ce&scene=58&subscene=0#rd) -- 海边的西赛罗 - - [前首相遇刺、现首相辞职——日本和英国，刚刚各发生了一件小事](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514731&idx=1&sn=a177e95cd1fdc9fd5ca6da48b013b811&chksm=ea19415add6ec84cdac5e8d0e2e1abf75a1c4d32c6dce49394e37a14a0d9c4b822f6faa3055c&scene=58&subscene=0#rd) - - [幸好你没买空气炸锅！](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514731&idx=2&sn=ff0876fbc19645de23c719aa90928f9c&chksm=ea19415add6ec84c4e272faf84b8d5b68a67ca031325a614e540a7da3fab2a868f6809e1e28c&scene=58&subscene=0#rd) - - [冰雪奥运工厂出夏凉被啦！！100多的价格，品质绝绝子！](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514731&idx=3&sn=b5ddf46d7fa8a3c3b87307f5e2ebb3fd&chksm=ea19415add6ec84ce78948491e2c0b53cfabea9e51f0ad0fdd67e142066bf89cd432d936d74c&scene=58&subscene=0#rd) -- 三六零CERT - - [2022年6月勒索病毒态势分析](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491138&idx=1&sn=0c563147c658d101e001c02a47ca83a3&chksm=fe251b43c9529255e1dc0c1a0a66ad050d4a805bf0dcf9673358c83bd9c885b649bd9de082ea&scene=58&subscene=0#rd) - - [安全日报（2022.07.08）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491138&idx=2&sn=f5519b145568ae047a04d7e9bdbe36ac&chksm=fe251b43c9529255d5053e6072c0c2890f31ebc70df3024ca9b2f5d1523107af0f87d63e611c&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-10.md b/archive/2022/2022-07-10.md deleted file mode 100644 index 3f80b970a2..0000000000 --- a/archive/2022/2022-07-10.md +++ /dev/null @@ -1,97 +0,0 @@ -# 每日安全资讯（2022-07-10） - -- Security Boulevard - - [Security BSides Athens 2022 – Rodolpho Concurde’s ‘Workshop 1 – From SEH Overwrite With Egg Hunter To GEt A Shell!’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-rodolpho-concurdes-workshop-1-from-seh-overwrite-with-egg-hunter-to-get-a-shell/) - - [Fredo & Pidjin™ ‘Strong’](https://securityboulevard.com/2022/07/fredo-pidjin-strong/) - - [Top 10 Ways to Earn Money from Photography](https://securityboulevard.com/2022/07/top-10-ways-to-earn-money-from-photography/) - - [Security BSides Athens 2022 – Sam Stepanyan’s ‘Guest Talk 1 – OWASP Nettacker Project Presentation’](https://securityboulevard.com/2022/07/security-bsides-athens-2022-sam-stepanyans-guest-talk-1-owasp-nettacker-project-presentation/) - - [2 Easy ways to Add signature in Outlook](https://securityboulevard.com/2022/07/2-easy-ways-to-add-signature-in-outlook/) -- HackerOne Hacker Activity - - [DoS via lua_read_body() [zhbug_httpd_94]](https://hackerone.com/reports/1596252) - - [Apache HTTP Server: mod_proxy_ajp: Possible request smuggling](https://hackerone.com/reports/1594627) - - [Read beyond bounds via ap_rwrite() [zhbug_httpd_47.2]](https://hackerone.com/reports/1595299) - - [Read beyond bounds in mod_isapi.c [zhbug_httpd_41]](https://hackerone.com/reports/1595296) - - [Controllable read beyond bounds in lua_websocket_readbytes() [zhbug_httpd_126]](https://hackerone.com/reports/1595290) - - [Read beyond bounds in ap_strcmp_match() [zhbug_httpd_47.7]](https://hackerone.com/reports/1595281) -- Twitter @Nicolas Krassas - - [Pamspy - Credentials Dumper For Linux Using eBPF](https://twitter.com/Dinosn/status/1545835879876513794) - - [HTB: RouterSpace](https://twitter.com/Dinosn/status/1545835552825565184) - - [Mangatoon data breach exposes data from 23 million accounts](https://twitter.com/Dinosn/status/1545835285002551304) - - [Fortinet addressed multiple vulnerabilities in several products](https://twitter.com/Dinosn/status/1545835046518546434) - - [Hackers Exploiting Follina Bug to Deploy Rozena Backdoor](https://twitter.com/Dinosn/status/1545834953577058305) - - [Haxx - Untethered + Unsandboxed Code Execution Haxx As Root On iOS 14 - iOS 14.8.1](https://twitter.com/Dinosn/status/1545624135279284229) - - [Massive Rogers outage disrupts mobile service, payments in Canada](https://twitter.com/Dinosn/status/1545623730658988032) - - [Fake job offer leads to $600 million theft](https://twitter.com/Dinosn/status/1545623562039574528) - - [Reverse-engineering the Apollo spacecraft's FM radio](https://twitter.com/Dinosn/status/1545610356847935491) - - [Cisco fixed a critical arbitrary File Overwrite flaw in Enterprise Communication solutions](https://twitter.com/Dinosn/status/1545610068544176128) - - [CEO charged with sale of counterfeit Cisco devices to govt, health orgs](https://twitter.com/Dinosn/status/1545610025657319425) - - [New 0mega ransomware targets businesses in double-extortion attacks](https://twitter.com/Dinosn/status/1545609894702759939) - - [Microsoft Reverses Course on Blocking Office Macros by Default](https://twitter.com/Dinosn/status/1545609073160224769) - - [Understanding Pointers for Reverse Engineers - Pointer Basics in Assembly (OALABS Tutorial)](https://twitter.com/Dinosn/status/1545608959272312832) -- SecWiki News - - [SecWiki News 2022-07-09 Review](http://www.sec-wiki.com/?2022-07-09) -- Recent Commits to cve:main - - [Update Sat Jul 9 11:27:37 UTC 2022](https://github.com/trickest/cve/commit/b1b8ffd4ea7ff95f7d221e4ab51fb176af49ab91) -- Armin Ronacher's Thoughts and Writings - - [Congratulations: We Now Have Opinions on Your Open Source Contributions](http://lucumr.pocoo.org/2022/7/9/congratulations) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [利用空指针解引用LPE有可能实现吗？](https://www.4hou.com/posts/8Y1r) - - [揭露5个错误的社会工程学假设](https://www.4hou.com/posts/YX5A) - - [攻击者利用事件日志来隐藏无文件恶意软件](https://www.4hou.com/posts/mNAA) -- Twitter @bytehx - - [RT reverseame: Zero-Day Exploitation of Atlassian Confluence](https://twitter.com/reverseame/status/1545692955163430915) - - [RT Nicolas Krassas: Understanding Pointers for Reverse Engineers - Pointer Basics in Assembly (OALABS Tutorial)](https://twitter.com/Dinosn/status/1545608959272312832) -- Bug Bounty in InfoSec Write-ups on Medium - - [RouterSpace From Hackthebox](https://infosecwriteups.com/routerspace-from-hackthebox-74de4a9ba988?source=rss----7b722bfd1b8d--bug_bounty) - - [Exposing Millions of Voter ID card user’s details.](https://infosecwriteups.com/exposing-millions-of-voter-id-card-users-details-8a993c9a5d35?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [Running SAP on Amazon FSx for NetApp ONTAP](https://blogs.sap.com/2022/07/09/running-sap-on-amazon-fsx-for-netapp-ontap/) -- Reverse Engineering - - [Reverse-engineering the Apollo spacecraft's FM radio](https://www.reddit.com/r/ReverseEngineering/comments/vv6ad8/reverseengineering_the_apollo_spacecrafts_fm_radio/) -- Didier Stevens - - [simple_listener.py](https://blog.didierstevens.com/2022/07/09/simple_listener-py/) -- HAHWUL - - [How to Hack a MacOS Application](https://www.hahwul.com/cullinan/how-to-hack-macos-app/) -- 黑海洋 - WIKI - - [雷电模拟器 5.0.12 去广告版+增强镜像](https://blog.upx8.com/2896) -- Misaki's Blog - - [Unidbg运行SO](https://misakikata.github.io/2022/07/Unidbg%E8%BF%90%E8%A1%8CSO/) -- KitPloit - PenTest & Hacking Tools - - [Pamspy - Credentials Dumper For Linux Using eBPF](http://www.kitploit.com/2022/07/pamspy-credentials-dumper-for-linux.html) -- 奇客Solidot–传递最新科技情报 - - [瑞士的地下货运管道走向现实](https://www.solidot.org/story?sid=72079) - - [微软撤回默认屏蔽宏的计划](https://www.solidot.org/story?sid=72078) - - [为避免反垄断诉讼 Google 提议拆分部分业务](https://www.solidot.org/story?sid=72077) - - [马斯克终止收购 Twitter，Twitter 表示将起诉](https://www.solidot.org/story?sid=72076) -- 看雪学院 - - [Android漏洞之战——整体加壳原理和脱壳技巧详解](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458457914&idx=1&sn=1d505597b47089cbd8bdc1e6e0a2b068&chksm=b18e27b086f9aea63d4404f118b0dc4c0b87c5986f20e556a5a85c967834df0d7f3e8e6d98d6&scene=58&subscene=0#rd) - - [视频资讯|AMD因弱密码泄露450GB数据，教你如何设置密码才安全！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458457914&idx=2&sn=acb61611144ec55a5a65db25d863ce9f&chksm=b18e27b086f9aea67c517f8754cfa351296237da0f71ec1d9427c267a6f2e1fcf144404e79ab&scene=58&subscene=0#rd) - - [『新课预售』基构网络构建与防护](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458457914&idx=3&sn=77ccf5ba7ad5b13cd5d60d1ab21ee774&chksm=b18e27b086f9aea6bb33fea9609fbf170a07d95d9de5a5517540f3c73bd4653b52e39343fd32&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [促流动、保安全 –《数据出境安全评估办法》规范数据出境活动安全有序](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528633&idx=1&sn=c91d5d052cfb73286729519be27bb892&chksm=c1e9fce8f69e75feda7ca8abd1c89c13230f2862a6d69bb3d5aa3369de9e268528f146debcfe&scene=58&subscene=0#rd) -- 情报分析师 - - [安倍晋三谋杀案与日本政治暗杀历史](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510062&idx=1&sn=c031d163c0c48a8449c05339222c87e6&chksm=8716bca5b06135b31b53bc081075622325ee9f8f05b40a11ed717b11e8e3a011643b3bb68ece&scene=58&subscene=0#rd) - - [安倍晋三遇刺事件时间线复原](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510062&idx=2&sn=6d9e115be7ff7ac3d96ecfbffc6f4d51&chksm=8716bca5b06135b301600e12fd9a63296b754d95ce56b0b3d32e2f476e8f585c4b9346ca36ac&scene=58&subscene=0#rd) -- 关注米柚更新 - - [本周请个假，没有原创「日志」了。没有大的UI变化，也没有明显的Bug增减（小修复都在平板上）。 -能说的主要在小米12S系列新版“相机”上，由于泄露apk，多数人都已经上手体验，也没啥好说的... 有需要的小伙伴，请自行到酷安找安装包吧，我就不提供了（侵权警告⚠️）。 -另外，如无特殊情况，目前原创「日志」一周更新一次，更新时间为每周六晚上8点整，这个大家要适应今后只有公测的日子啦 ... -最后，想关注我最新动态的小伙伴，请关注酷安@toolazy ，咱们下周见[奸笑]。](https://mp.weixin.qq.com/s?__biz=MzA3MDU2MzQ0OA==&mid=2650308773&idx=1&sn=c47ff3c39fb0e07178d125a514df0b62&chksm=8736c3b2b0414aa4646a7595c30e206990681b7f69415432df0651cb14bda1fc14e414846d69&scene=58&subscene=0#rd) -- 海边的西赛罗 - - [狂欢个鬼？你甚至根本就不认识安倍晋三](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514869&idx=1&sn=f6cfacfeaf8d153c0c6991928c2a9b6f&chksm=ea1941c4dd6ec8d256cca0d79da0a7dbc02a4f075da904938be38c9e01a41d9413fefb5eec21&scene=58&subscene=0#rd) - - [想起了被《三国演义》漏写的那起“首相遇刺案”](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514869&idx=2&sn=0d82d146658fc0a372b290b9efe90485&chksm=ea1941c4dd6ec8d2923254ca22e2c9ae7bf7b740d5c8ff90a52b173b6f7a54140aab5715a426&scene=58&subscene=0#rd) - - [绝了！！『凉而不冰』的夏凉被，100多就能买到？？？](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514869&idx=3&sn=3b07c727fb7be2769afa86afe25b56e1&chksm=ea1941c4dd6ec8d2d21933e7f1f18cda335f3c045e75c337d80f34712292690dac0516d32407&scene=58&subscene=0#rd) -- ChaMd5安全团队 - - [内含抽奖｜ChaMd5七月征文活动开始啦！](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247506095&idx=1&sn=924146c3b3db99ddb7aa68ca406c7bf3&chksm=e89df077dfea7961d66dc8696a58e1b3df1e173fe3390b84fee8c5af0e0a9970ea17706a8bd2&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [数据出境“安检”新规——《数据出境安全评估办法》深度解读](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529285&idx=1&sn=042ee45e8ceeffbe6ad4c7dd7256b3a6&chksm=fa93c584cde44c92d271317d79d27e95b1eb2b2ab0e73effd44dc5710521c0fd3f983f1b5f04&scene=58&subscene=0#rd) -- 极客公园 - - [马斯克宣布终止收购推特，及时止血还是极限施压？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959449&idx=1&sn=ffc5e03291b25dd2fe7580d649da9bd5&chksm=7e558f6f492206797002601ed7e8f13e1cdb98d41c9224f00bb72806ddfc7d74cb6bd1ba2807&scene=58&subscene=0#rd) - - [马斯克放弃收购 Twitter；B 站回应「2 亿用户信息泄露」：完全不实；抖音推内容社区「可颂」｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959418&idx=1&sn=31f89fd87082572f6d95d31550d918b5&chksm=7e558f0c4922061abd8ca6af4ac5a2e30ea82eccc7ac25e6e67f7250dcf5b450c2a89485c006&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】微信三端登录功能被黑灰产利用](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004487&idx=1&sn=6b4079ebba76742022befcd8fbe54864&chksm=f36f4cc7c418c5d1498fb71fd5e3cd03b6a56833254851107d3e7dff3604f34658affb7c5abc&scene=58&subscene=0#rd) - - [【安全圈】5G网络被攻击，并可能导致断网](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004487&idx=2&sn=397d4c5d7a1133c0e9ada1b631ad5d6e&chksm=f36f4cc7c418c5d157dde3b6c94a93d0304d36bded099cbdf0d3677c437ebf9cfe1d54c05aa4&scene=58&subscene=0#rd) - - [【安全圈】Web3 项目已因黑客攻击损失超 20 亿美元](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004487&idx=3&sn=f2704ce6c6e5c00c4ef5e6ca584624e3&chksm=f36f4cc7c418c5d1e4d2b11f567901e344f9bc38c391f3c68184d311fb32964146e3cf10dccd&scene=58&subscene=0#rd) - - [【安全圈】在线编程 IDE 可用于发起远程网络攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652004487&idx=4&sn=f0ce84e4b7924cb704d8e0dab4eb4da1&chksm=f36f4cc7c418c5d1a52e63c58765a7ea04dcdf6ffbda64463656dca2ed7642ce2e5066bba6a7&scene=58&subscene=0#rd) -- 小众软件 - - [这样处理国内流氓软件](https://mp.weixin.qq.com/s?__biz=MjM5NDMwMTI2MA==&mid=2651671692&idx=1&sn=461347571a28b9980b02f33b477f90db&chksm=bd7038af8a07b1b93c0f5a8731e7bf1394b716f873c1f68971574b17c7dbbe86ca3c2ca76ffc&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-11.md b/archive/2022/2022-07-11.md deleted file mode 100644 index 9ed3ee00a7..0000000000 --- a/archive/2022/2022-07-11.md +++ /dev/null @@ -1,96 +0,0 @@ -# 每日安全资讯（2022-07-11） - -- Security Boulevard - - [Security BSides Athens 2022 – Live Stream Part 2](https://securityboulevard.com/2022/07/security-bsides-athens-2022-live-stream-part-2/) - - [Rust CLI For Apple’s WeatherKit REST API](https://securityboulevard.com/2022/07/rust-cli-for-apples-weatherkit-rest-api/) - - [XKCD ‘Meta-Alternating Current’](https://securityboulevard.com/2022/07/xkcd-meta-alternating-current/) - - [Security BSides Athens 2022 – Live Stream Part 1](https://securityboulevard.com/2022/07/security-bsides-athens-2022-live-stream-part-1/) - - [North Korea Attacks Health Sector With Maui Ransomware](https://securityboulevard.com/2022/07/north-korea-attacks-health-sector-with-maui-ransomware/) - - [3 Access Security Lessons Learned from the Marriott Data Breach](https://securityboulevard.com/2022/07/3-access-security-lessons-learned-from-the-marriott-data-breach/) -- Twitter @Nicolas Krassas - - [French telephone operator La Poste Mobile suffered a ransomware attack](https://twitter.com/Dinosn/status/1546215362794078208) - - [Experts demonstrate how to unlock several Honda models via Rolling-PWN attack](https://twitter.com/Dinosn/status/1546215280354988041) - - [Compromising a Domain With the Help of a Spooler](https://twitter.com/Dinosn/status/1546101139610935297) - - [CVE-2022-32212: Node.js arbitrary code execution vulnerability](https://twitter.com/Dinosn/status/1546086367620481024) - - [Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie Infinity](https://twitter.com/Dinosn/status/1545979976289325056) -- HackerOne Hacker Activity - - [Homograph attack bypass cause redirection](https://hackerone.com/reports/1285245) - - [Blind SSRF at packagist.maximum.nl](https://hackerone.com/reports/1538056) -- Recent Commits to cve:main - - [Update Sun Jul 10 11:28:35 UTC 2022](https://github.com/trickest/cve/commit/06d5fc50e80d86da32ae3ca548903e9461be729b) -- SecWiki News - - [SecWiki News 2022-07-10 Review](http://www.sec-wiki.com/?2022-07-10) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [NIST第3轮后量子密码算法进展](https://www.4hou.com/posts/PJQA) - - [Flubot演变史（上）](https://www.4hou.com/posts/ZX0Q) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Exploit mktba 4.2 Arbitrary File Upload](https://cxsecurity.com/issue/WLB-2022070028) - - [Magnolia CMS 6.2.19 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022070027) - - [ผู้วิเคราะห์ : ปัณฑารีย์ นงนุช Admin Login Bypass](https://cxsecurity.com/issue/WLB-2022070026) -- unSafe.sh - 不安全 - - [分享 | 蚁剑RCE反制复现](https://buaq.net/go-116721.html) - - [渗透测试|[rust]shellcode免杀加载器【vt查杀1/67】|TRY博客](https://buaq.net/go-116713.html) - - [TryHello/DogCs4.4: cs4.4修改去特征狗狗版(美化ui,去除特征,自带bypass核晶截图等..)](https://buaq.net/go-116712.html) - - [fangzesheng/free-api: 收集免费的接口服务,做一个api的搬运工](https://buaq.net/go-116709.html) - - [各国开发者薪资水平：中国排名第19位](https://buaq.net/go-116775.html) - - [Secretflow - A Unified Framework For Privacy-Preserving Data Analysis And Machine Learning](https://buaq.net/go-116756.html) - - [[AHK＃52] 1.1.28新功能：Function Hotstring](https://buaq.net/go-116707.html) -- gynvael.coldwind//vx.log (en) - - [Debug Log: Why is my M.2 SSD so slow?](https://gynvael.coldwind.pl/?id=749) -- MaskRay - - [RISC-V linker relaxation in lld](https://maskray.me/blog/2022-07-10-riscv-linker-relaxation-in-lld) -- SAP Blogs - - [SAP IBP Explained](https://blogs.sap.com/2022/07/10/sap-ibp-explained/) - - [SAP IBP Settings for TS Supply Planning – An Use Case](https://blogs.sap.com/2022/07/10/sap-ibp-settings-for-ts-supply-planning-an-use-case/) - - [SAP PP: Lot size Selection using Rounding Profile during MRP Run](https://blogs.sap.com/2022/07/10/sap-pp-lot-size-selection-using-rounding-profile-during-mrp-run/) - - [SAP S/4HANA Embedded Analytics – The End of Conventional Reporting and Analysis?](https://blogs.sap.com/2022/07/10/sap-s-4hana-embedded-analytics-the-end-of-conventional-reporting-and-analysis/) - - [Everything You Need to Know about the App Manage Payment Plans](https://blogs.sap.com/2022/07/10/everything-you-need-to-know-about-the-app-manage-payment-plans/) - - [SAP Cloud ALM – Integration & Exception Monitoring 機能概要・エラー分析方法について](https://blogs.sap.com/2022/07/10/sap-cloud-alm-integration-exception-monitoring-%e6%a9%9f%e8%83%bd%e6%a6%82%e8%a6%81%e3%83%bb%e3%82%a8%e3%83%a9%e3%83%bc%e5%88%86%e6%9e%90%e6%96%b9%e6%b3%95%e3%81%ab%e3%81%a4%e3%81%84%e3%81%a6/) - - [End to End AI/ML Scenario Configuration in SAP DMC](https://blogs.sap.com/2022/07/10/end-to-end-ai-ml-scenario-configuration-in-sap-dmc/) - - [How Can the Right Services and Support Help Achieve a Successful Digital HR Transformation?](https://blogs.sap.com/2022/07/10/how-can-the-right-services-and-support-help-achieve-a-successful-digital-hr-transformation/) - - [Introduction to Basic building blocks of SAP IBP](https://blogs.sap.com/2022/07/10/introduction-to-basic-building-blocks-of-sap-ibp/) - - [Difference between Role, Authorization Object/s, and Profile](https://blogs.sap.com/2022/07/10/difference-between-role-authorization-object-s-and-profile/) -- Sploitus.com Exploits RSS Feed - - [Exploit for Unrestricted Upload of File with Dangerous Type in Brandexponents Tatsu exploit](https://sploitus.com/exploit?id=C760F361-A0DB-5254-9F88-39953A9D4EDE&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Msi Dragon Center exploit](https://sploitus.com/exploit?id=5D99DEDA-7057-57E9-81AC-15FF40B62289&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-33980 exploit](https://sploitus.com/exploit?id=6D13552B-CA74-5F84-BC21-EFC2BB59FB93&utm_source=rss&utm_medium=rss) -- Malwarebytes Labs - - [4 ways businesses can save money on cyber insurance](https://blog.malwarebytes.com/business/2022/07/4-ways-businesses-can-save-money-on-cyber-insurance/) - - [North Korean APT targets US healthcare sector with Maui ransomware](https://blog.malwarebytes.com/ransomware/2022/07/north-korean-apt-targets-us-healthcare-sector-with-maui-ransomware/) - - [How the FBI quietly added itself to criminals’ instant message conversations](https://blog.malwarebytes.com/reports/2022/07/how-the-fbi-quietly-added-itself-to-criminals-instant-message-conversations/) -- Reverse Engineering - - [Compromising a Domain With the Help of a Spooler](https://www.reddit.com/r/ReverseEngineering/comments/vvp5rq/compromising_a_domain_with_the_help_of_a_spooler/) -- KitPloit - PenTest & Hacking Tools - - [Secretflow - A Unified Framework For Privacy-Preserving Data Analysis And Machine Learning](http://www.kitploit.com/2022/07/secretflow-unified-framework-for.html) -- HAHWUL - - [[Cullinan #40] How to Hack a X Series](https://www.hahwul.com/2022/07/10/cullinan-40/) -- 微步在线研究响应中心 - - [安全威胁情报周报（7.4~7.10）](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247494236&idx=1&sn=09eec49c171f09d3d53059adbc2d99ec&chksm=cfca8948f8bd005e49d25fb858728229be9d5978dff87357f1dd6fe06a54af87dca9040e9c3d&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [网络安全行业视角论——论质量既“品牌”（第二季）](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247490021&idx=1&sn=91803c03eba66e5e3cb5ebd4e361e73e&chksm=96f40688a1838f9e278a0c8ae5b8eac803861b3681973ddc878589f15d9c19d40ae06b6a5f14&scene=58&subscene=0#rd) -- ChaMd5安全团队 - - [从黑灰产活动中学到的XSS技巧](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247506364&idx=1&sn=664dfaae84676e086febe73bc38b8859&chksm=e89df164dfea787286c0083f65f3fa19d7d0294da5b4ef7c28e3946e550b5b58e7f8679a470b&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [墨西哥提议终止夏令时](https://www.solidot.org/story?sid=72082) - - [微软推迟执行禁止第三方对免费的开源软件收费的政策](https://www.solidot.org/story?sid=72081) -- 黑海洋 - WIKI - - [Apktool M v2.4.0-220709 | 安卓反编译神器](https://blog.upx8.com/2900) - - [Win系统提权工具NSudo v8.2](https://blog.upx8.com/2898) - - [Google Chrome 奔跑的奶酪定制版（103.0 稳定版）](https://blog.upx8.com/2897) -- 情报分析师 - - [【实战技法】如何使用OSINT根据旧来源判断地点的地理位置](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510088&idx=1&sn=e403917087367579d17de6ee215a3993&chksm=8716bd43b0613455380e5656fdeca202c9233a140bc56bcdbd9af1e595af9a809c5844c3834b&scene=58&subscene=0#rd) - - [【智库报告】俄罗斯军事预测与分析](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510088&idx=2&sn=0ac717abaf103db1feea7b8e7789885f&chksm=8716bd43b06134553680aafb8f3aa2eee0889c049b3324b15c98582453a341ee6c42f90ffdba&scene=58&subscene=0#rd) - - [【反恐巨著1312页】恐怖主义预防和战备手册（后果篇）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510088&idx=3&sn=bdcde6e32a55bdb26d5741c49771231f&chksm=8716bd43b06134558517934d1fccc46ad0aac888cb368e72ad41a69e3372b68f5940a97dafad&scene=58&subscene=0#rd) -- 网安寻路人 - - [尘埃终落定，对我国数据出境安全评估制度的观察和理解](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495515&idx=1&sn=e105412932077b973b0e9cc0b02167c0&chksm=97e952b1a09edba73855fab9240086f703bb5bb8d4b015f6119951e928afbb18a5f25d0c5ff1&scene=58&subscene=0#rd) - - [也谈《数据出境安全评估办法》涉及到的几个问题](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495507&idx=1&sn=de522cda22bcc95584df966b927da88f&chksm=97e952b9a09edbaf0ec628b7e6857ee7463aa0702f858ceab4096db0d3c39644b7fded515a34&scene=58&subscene=0#rd) -- 中国信息安全 - - [招聘 | 《中国信息安全》杂志新媒体 期待你的加入！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161655&idx=1&sn=2ec69aa7c6c81c1368b58a7dec83740c&chksm=8b5ee38ebc296a98b76f40ea094013df51b8114ff49424631ea289e1e3777bcb70d73d3270c3&scene=58&subscene=0#rd) -- 落日间 - - [Julian Klein 什么是用艺术的方法做研究？ What is Artistic Research? (2011)](https://mp.weixin.qq.com/s?__biz=MzIzMjM0NDk1NQ==&mid=2247487921&idx=1&sn=9041018f7bf3f2b35731fef10a9bf63d&chksm=e8970da5dfe084b3d8359c29378647abd2252c11243e3ff0b1436071365b2640a918c9e174f4&scene=58&subscene=0#rd) -- 海边的西赛罗 - - [你有幸灾乐祸的权利，我有删你好友的权利](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514968&idx=1&sn=71bdfa6fd905303f609a7edbddc3e460&chksm=ea194069dd6ec97faca2ccff962635d527f3f1dc3fd83ac6bd3d16064dfe9a5c21a2bf181d1b&scene=58&subscene=0#rd) - - [30集BBC，看完英语水平或超越大多数国人！](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514968&idx=2&sn=eaed7ef2a856fa7df5bc128ff631bbb4&chksm=ea194069dd6ec97fb6d71cc5e6b0bfd50153fe6c91abb38a11b6a3699d8090faea80cfdcb132&scene=58&subscene=0#rd) - - [我们对于未来的不安，20世纪早有答案](https://mp.weixin.qq.com/s?__biz=MzI1NzE1ODc1MA==&mid=2247514968&idx=3&sn=e2d6fa4edba9b5778c2187d89d69e480&chksm=ea194069dd6ec97fa4ae3089324c3846c3217dfeb30b55019a3b84816a92344d6c5cd431a472&scene=58&subscene=0#rd) -- 且听安全 - - [CVE-2022-26135 Atlassian Jira Mobile Plugin SSRF 漏洞](https://mp.weixin.qq.com/s?__biz=Mzg3MTU0MjkwNw==&mid=2247491168&idx=1&sn=a60329486e0d46ac9d23639e734013d0&chksm=cefda774f98a2e623b90c03ae35f4d8048450f2c6877d1379339e7ed061f2a9c900ae089a04d&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-12.md b/archive/2022/2022-07-12.md deleted file mode 100644 index 289b4c82ca..0000000000 --- a/archive/2022/2022-07-12.md +++ /dev/null @@ -1,263 +0,0 @@ -# 每日安全资讯（2022-07-12） - -- HackerOne Hacker Activity - - [[h1-2102] HTML injection in packing slips can lead to physical theft](https://hackerone.com/reports/1087122) - - [[h1-2102] Stored XSS in product description via `productUpdate` GraphQL query leads to XSS at handshake-web-internal.shopifycloud.com/products/[ID]](https://hackerone.com/reports/1085546) - - [[h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserTfaEnforcement](https://hackerone.com/reports/1085042) - - [Improper deep link validation](https://hackerone.com/reports/1087744) - - [Collaborators and Staff members without all necessary permissions are able to create, edit and install custom apps](https://hackerone.com/reports/1555502) - - [Theme editor `oseid` parameter is leaked to third-party services through the `Referer` header which leads to somekind of storefront password bypass.](https://hackerone.com/reports/1262434) - - [Able to view hackerone reports attachments](https://hackerone.com/reports/979787) - - [Mass Account Takeover at https://app.taxjar.com/ - No user Interaction](https://hackerone.com/reports/1581240) - - [Getting a free delivery by singing up from "admin_@glovoapp.com"](https://hackerone.com/reports/1296584) - - [Server Side Template Injection on Name parameter during Sign Up process](https://hackerone.com/reports/1104349) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5507-1](https://packetstormsecurity.com/files/167729/USN-5507-1.txt) - - [Ubuntu Security Notice USN-5479-3](https://packetstormsecurity.com/files/167728/USN-5479-3.txt) - - [Ubuntu Security Notice USN-5506-1](https://packetstormsecurity.com/files/167727/USN-5506-1.txt) - - [GNU Privacy Guard 2.3.7](https://packetstormsecurity.com/files/167725/gnupg-2.3.7.tar.bz2) - - [GNU Privacy Guard 2.2.36](https://packetstormsecurity.com/files/167726/gnupg-2.2.36.tar.bz2) - - [Falco 0.32.1](https://packetstormsecurity.com/files/167724/falco-0.32.1.tar.gz) - - [3DES Shellcode Crypter](https://packetstormsecurity.com/files/167723/3des_crypter.c) - - [WordPress Visual Slide Box Builder 3.2.9 SQL Injection](https://packetstormsecurity.com/files/167722/wpvsbb329-sql.txt) - - [Sashimi Evil OctoBot Tentacle](https://packetstormsecurity.com/files/167721/Sashimi-Evil-OctoBot-Tentacle-master.zip) - - [Nginx 1.20.0 Denial Of Service](https://packetstormsecurity.com/files/167720/nginx1200-dos.txt) - - [Chrome PaintImage Deserialization Out-Of-Bounds Read](https://packetstormsecurity.com/files/167719/GS20220711141406.tgz) - - [Xen TLB Flush Bypass](https://packetstormsecurity.com/files/167718/GS20220711141006.tgz) - - [Mutt mutt_decode_uuencoded() Memory Disclosure](https://packetstormsecurity.com/files/167717/GS20220711140800.txt) -- Security Boulevard - - [Secure Your Distributed Medical Devices with Robust Machine Identity Management](https://securityboulevard.com/2022/07/secure-your-distributed-medical-devices-with-robust-machine-identity-management/) - - [Hackers Get Ready for Amazon Prime Days Shoppers with Thousands of Live Phishing Sites](https://securityboulevard.com/2022/07/hackers-get-ready-for-amazon-prime-days-shoppers-with-thousands-of-live-phishing-sites/) - - [Securing the Future: Helping Companies Innovate at the Edge](https://securityboulevard.com/2022/07/securing-the-future-helping-companies-innovate-at-the-edge/) - - [BSidesSF 2022 – Jackie Bow’s ‘Keynote: We Need More Mediocre Security Engineers’](https://securityboulevard.com/2022/07/bsidessf-2022-jackie-bows-keynote-we-need-more-mediocre-security-engineers/) - - [Can Behavioral Analytics Help Secure APIs?](https://securityboulevard.com/2022/07/can-behavioral-analytics-help-secure-apis/) - - [HIGH OpenSSL Vulnerability Causes Stir](https://securityboulevard.com/2022/07/high-openssl-vulnerability-causes-stir/) - - [Build a holistic AppSec program](https://securityboulevard.com/2022/07/build-a-holistic-appsec-program/) - - [Microsoft Office Macro Policy Reversal: A Legacy Of Incompetent Security Management](https://securityboulevard.com/2022/07/microsoft-office-macro-policy-reversal-a-legacy-of-incompetent-security-management/) - - [US Gov’t Flip-Flops on NSO Group Sale to L3Harris](https://securityboulevard.com/2022/07/us-govt-flip-flops-on-nso-group-sale-to-l3harris/) - - [Exploiting Authentication in AWS IAM Authenticator for Kubernetes](https://securityboulevard.com/2022/07/exploiting-authentication-in-aws-iam-authenticator-for-kubernetes/) -- Microsoft Security Blog - - [Introducing security for unmanaged devices in the Enterprise network with Microsoft Defender for IoT](https://www.microsoft.com/security/blog/2022/07/11/introducing-security-for-unmanaged-devices-in-the-enterprise-network-with-microsoft-defender-for-iot/) -- Twitter @Nicolas Krassas - - [hijagger: Checks all maintainers of all NPM and Pypi packages for hijackable packages through domain re-registration](https://twitter.com/Dinosn/status/1546558528441257986) - - [MimiKatz for Pentester: Kerberos](https://twitter.com/Dinosn/status/1546552582243553284) - - [Hackers Say They Can Unlock And Start Honda Cars Remotely](https://twitter.com/Dinosn/status/1546552409832529921) - - [Cloud-based Cryptocurrency Miners Targeting GitHub Actions and Azure VMs](https://twitter.com/Dinosn/status/1546552362797514757) - - [RT floyd: #ServiceTweet if you are a Pentester, have a customer hosting at Swisscom and sign the Swisscom auditor NDA, you're (legally) fucked. NDA st...](https://twitter.com/floyd_ch/status/1546499952158842880) - - [BlackCat (aka ALPHV) Ransomware is Increasing Stakes up to $2,5M in Demands](https://twitter.com/Dinosn/status/1546484502641479682) - - [Europe threatens to ban Facebook over data transfers to the US](https://twitter.com/Dinosn/status/1546484423478190084) - - [The Poor Man's Obfuscator](https://twitter.com/Dinosn/status/1546484352330211329) - - [Experts warn of the new 0mega ransomware operation](https://twitter.com/Dinosn/status/1546484240740671488) - - [Tofu - Windows Offline Filesystem Hacking Tool For Linux](https://twitter.com/Dinosn/status/1546484175414378497) - - [US military contractor moves to buy Israeli spy-tech company NSO Group](https://twitter.com/Dinosn/status/1546483945868500993) - - [Anubis Networks is back with new C2 server](https://twitter.com/Dinosn/status/1546483487942889472) - - [Hackers Used Fake Job Offer to Hack and Steal $540 Million from Axie Infinity](https://twitter.com/Dinosn/status/1546483456070262787) - - [waymore: find even more links from the Wayback Machine](https://twitter.com/Dinosn/status/1546372571305746433) -- paper - Last paper - - [RCE 宝典！](https://paper.seebug.org/1928/) -- unSafe.sh - 不安全 - - [AbuseCH Intelligence 2.0 Package](https://buaq.net/go-116923.html) - - [Introducing the New Singularity XDR Process Graph](https://buaq.net/go-116925.html) - - [从 The Saudis NFT 事件浅析 EIP-2535 钻石协议](https://buaq.net/go-116913.html) - - [分享个浏览器插件，网页上的八门神器/金山游侠~ - V2EX](https://buaq.net/go-116912.html) - - [eBPF网络程序新手指南 By Liz Rice](https://buaq.net/go-116906.html) - - [[开源项目推广] ZFile 4.0 发布，在线网盘，支持文件上传，删除，重命名等操作，全新 UI 和功能！ - V2EX](https://buaq.net/go-116901.html) - - [Defence Artificial Intelligence Strategy](https://buaq.net/go-116911.html) - - [Reflecting on Gartner’s Cybersecurity Predictions](https://buaq.net/go-116907.html) -- 安全客-有思想的安全新媒体 - - [安全事件周报 (07.04-07.10)](https://www.anquanke.com/post/id/276250) - - [一次直达工控区的"简单"渗透](https://www.anquanke.com/post/id/276076) - - [孔松（信通院）-数字化时代云安全能力建设及趋势](https://www.anquanke.com/post/id/275656) - - [欧盟或因隐私法与Facebook分道扬镳](https://www.anquanke.com/post/id/276178) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Plumcloud Image Browser File Upload](https://cxsecurity.com/issue/WLB-2022070033) - - [Nginx 1.20.0 Denial Of Service](https://cxsecurity.com/issue/WLB-2022070032) - - [WordPress Visual Slide Box Builder 3.2.9 SQL Injection](https://cxsecurity.com/issue/WLB-2022070031) - - [Mutt mutt_decode_uuencoded() Memory Disclosure](https://cxsecurity.com/issue/WLB-2022070030) - - [Design by Afireweb Admin Login Bypass](https://cxsecurity.com/issue/WLB-2022070029) -- 先知安全技术社区 - - [Android Webview漏洞初探](https://xz.aliyun.com/t/11505) - - [CVE-2022-28219 ZOHO ManageEngine ADAudit Plus XXE到RCE](https://xz.aliyun.com/t/11506) - - [细谈CS分离式shellcode的加载之旅](https://xz.aliyun.com/t/11508) -- 安全脉搏 - - [“狼来了”！某黑产团伙套壳“大灰狼远控”发起攻击](https://www.secpulse.com/archives/182870.html) - - [进击的“8220”！深信服捕获8220挖矿团伙使用最新Confluence高危漏洞发起攻击](https://www.secpulse.com/archives/182869.html) - - [断剑重铸？Kaiji僵尸网络正在重构](https://www.secpulse.com/archives/182856.html) - - [vivotek 栈溢出漏洞复现](https://www.secpulse.com/archives/182895.html) - - [Badusb实战——hid_Digispark](https://www.secpulse.com/archives/182836.html) -- 跳跳糖 - 安全与分享社区 - - [从CICD漏洞靶场中学习持续集成安全](https://tttang.com/archive/1650/) -- 先知安全技术社区 - - [Android Webview漏洞初探](https://xz.aliyun.com/t/11505) - - [CVE-2022-28219 ZOHO ManageEngine ADAudit Plus XXE到RCE](https://xz.aliyun.com/t/11506) - - [细谈CS分离式shellcode的加载之旅](https://xz.aliyun.com/t/11508) -- The DFIR Report - - [SELECT XMRig FROM SQLServer](https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [“狼来了”！某黑产团伙套壳“大灰狼远控”发起攻击](https://www.4hou.com/posts/jJ8y) - - [9月1日起开始施行！《数据出境安全评估办法》解读](https://www.4hou.com/posts/pVzQ) - - [海云安入选2021年度深圳市“专精特新”中小企业名单](https://www.4hou.com/posts/mXER) - - [《嘶吼2022网络安全产业图谱》线上发布会即将开始，直播通道预约开启！](https://www.4hou.com/posts/zlXq) - - [什么是撞库及撞库攻击的基本原理](https://www.4hou.com/posts/l67j) - - [中国日报专访IDC中国区总裁霍锦洁：以数据安全护航企业数字化优先战略](https://www.4hou.com/posts/oJOY) - - [参数化导致的WAF绕过研究](https://www.4hou.com/posts/8YEj) - - [权威报告发布：国内网络威胁检测与响应权威市场规模同比增长36.6%](https://www.4hou.com/posts/nJz5) - - [数据隐私治理最佳实践（下）](https://www.4hou.com/posts/r72L) - - [大黄蜂：新装载机迅速在网络犯罪生态系统中占据中心位置](https://www.4hou.com/posts/GK8K) -- Cerbero Blog - - [AbuseCH Intelligence 2.0 Package](https://blog.cerbero.io/?p=2435) -- Forcepoint - - [Reflecting on (One of) Gartner’s Cybersecurity Predictions](https://www.forcepoint.com/blog/insights/gartner-cybersecurity-predictions-2023) -- cloud world - - [OpenKruise 源码分析之 ResourceDistribution](https://cloudsjhan.github.io/2022/07/11/OpenKruise-%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E4%B9%8B-ResourceDistribution/) -- Twitter @bytehx - - [RT THREAT CON: ‼️Early bird registration for #THREATCON2022 ends on July 15📅. Hurry up and grab your tickets🎟️ 🎉Follow us, like & Retweet ...](https://twitter.com/THREAT_CON/status/1546440334321651715) -- Sploitus.com Exploits RSS Feed - - [Nginx 1.20.0 Denial Of Service exploit](https://sploitus.com/exploit?id=PACKETSTORM:167720&utm_source=rss&utm_medium=rss) - - [Nginx 1.20.0 - Denial of Service (DOS) exploit](https://sploitus.com/exploit?id=EDB-ID:50973&utm_source=rss&utm_medium=rss) - - [WordPress Visual Slide Box Builder 3.2.9 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37836&utm_source=rss&utm_medium=rss) - - [Mutt mutt_decode_uuencoded() Memory Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:167717&utm_source=rss&utm_medium=rss) - - [Nginx 1.20.0 - Denial of Service Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37837&utm_source=rss&utm_medium=rss) - - [WordPress Visual Slide Box Builder 3.2.9 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167722&utm_source=rss&utm_medium=rss) -- CCC Event Blog - - [Komm mit auf die Intergalaktische Erfahrungsreise!](https://events.ccc.de/2022/07/11/erste-intergalaktische-erfahrungsreise/) -- blog.avast.com EN - - [Avast Pride 2022](https://blog.avast.com/avast-pride-month) -- Securelist - - [Text-based fraud: from 419 scams to vishing](https://securelist.com/mail-text-scam/106926/) -- SAP Blogs - - [Integration of SAP Ariba Sourcing with Qualtrics XM for Suppliers, part 2: HANA Cloud Database](https://blogs.sap.com/2022/07/11/integration-of-sap-ariba-sourcing-with-qualtrics-xm-for-suppliers-part-2-hana-cloud-database/) - - [Dynamic Authentication in UDF Mapping to Use Token in REST Receiver Channel](https://blogs.sap.com/2022/07/11/dynamic-authentication-in-udf-mapping-to-use-token-in-rest-receiver-channel/) - - [How to Speed Up Reports and Prevent Memory Crashes in Crystal](https://blogs.sap.com/2022/07/11/how-to-speed-up-reports-and-prevent-memory-crashes-in-crystal/) - - [The SAP Geoenablement Framework (GEF) now authenticates with ArcGIS Enterprise](https://blogs.sap.com/2022/07/11/the-sap-geoenablement-framework-gef-now-authenticates-with-arcgis-enterprise/) - - [Planner Overrides in SAP IBP with Adjusted Key Figures – Part 1](https://blogs.sap.com/2022/07/11/planner-overrides-in-sap-ibp-with-adjusted-key-figures-part-1/) - - [SAP Analytics Cloud planning with Microsoft Excel](https://blogs.sap.com/2022/07/11/sap-analytics-cloud-planning-with-microsoft-excel/) - - [Join the “SAP Portal & New-Generation Products“ Trivia Summer Quiz 2022](https://blogs.sap.com/2022/07/11/join-the-sap-portal-new-generation-products-trivia-summer-quiz-2022/) - - [Interviews mit EdTech Startups auf der LEARNTEC 2022](https://blogs.sap.com/2022/07/11/interviews-mit-edtech-startups-auf-der-learntec-2022/) - - [Call for Questions – SAP Community Call – Delivering on the Promise of the Intelligent, Sustainable Enterprise – Powered by SAP BTP on July 13th](https://blogs.sap.com/2022/07/11/call-for-questions-sap-community-call-delivering-on-the-promise-of-the-intelligent-sustainable-enterprise-powered-by-sap-btp-on-july-13th/) -- Application Security Blog - - [Build a holistic AppSec program](https://www.synopsys.com/blogs/software-security/build-holistic-appsec-program/) -- CFC4N的博客 - - [eBPF网络程序新手指南 By Liz Rice](https://www.cnxct.com/a-guide-to-ebpf-programming-for-networking/) -- Malwarebytes Labs - - [A week in security (July 4 – July 10)](https://blog.malwarebytes.com/a-week-in-security/2022/07/a-week-in-security-july-4-july-10/) - - [Europe threatens to ban Facebook over data transfers to the US](https://blog.malwarebytes.com/privacy-2/2022/07/europe-threatens-to-ban-facebook-over-data-transfers-to-the-us/) - - [Microsoft appears to be rolling back Office Macro blocking](https://blog.malwarebytes.com/business/2022/07/microsoft-appears-to-be-rolling-back-office-macro-blocking/) - - [Tech support scammers caught by their own cameras](https://blog.malwarebytes.com/tech-support-scams/2022/07/tech-support-scammers-get-caught-on-camera/) -- SentinelOne - - [Introducing the New Singularity XDR Process Graph](https://www.sentinelone.com/blog/introducing-the-new-singularity-xdr-process-graph/) -- Sick Codes – Security Research, Hardware & Software Hacking, Consulting, Linux, IoT, Cloud, Embedded, Arch, Tweaks & Tips! - - [CVE-2022-35414 – QEMU 4.1.50 through QEMU 7.0.0 – address_space_translate_for_iotlb allows a guest user to crash a host resulting in a denial of service.](https://sick.codes/sick-2022-113/) -- The Daily Swig | Cybersecurity news and views - - [PyPI repo to distribute 4,000 security keys to maintainers of ‘critical projects’ in 2FA drive](https://portswigger.net/daily-swig/pypi-repo-to-distribute-4-000-security-keys-to-maintainers-of-critical-projects-in-2fa-drive) - - [Post-quantum cryptography hits standardization milestone](https://portswigger.net/daily-swig/post-quantum-cryptography-hits-standardization-milestone) - - [‘Dirty dancing’ in OAuth: Researcher discloses how cyber-attacks can lead to account hijacking](https://portswigger.net/daily-swig/dirty-dancing-in-oauth-researcher-discloses-how-cyber-attacks-can-lead-to-account-hijacking) -- Hacking Articles - - [MimiKatz for Pentester: Kerberos](https://www.hackingarticles.in/mimikatz-for-pentester-kerberos/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/vwc716/rreverseengineerings_weekly_questions_thread/) - - [Finally Obtaining the Triforce in Ocarina of Time: Triforce Percent Explained [YouTube, explanation of exploiting an arbitrary code execution vulnerability]](https://www.reddit.com/r/ReverseEngineering/comments/vwrb1f/finally_obtaining_the_triforce_in_ocarina_of_time/) - - [The Poor Man's Obfuscator](https://www.reddit.com/r/ReverseEngineering/comments/vwd7jy/the_poor_mans_obfuscator/) - - [Stream Archive of Summercon Reverse Engineering Conference 2022](https://www.reddit.com/r/ReverseEngineering/comments/vw90yj/stream_archive_of_summercon_reverse_engineering/) -- Exploit-DB.com RSS Feed - - [[remote] Nginx 1.20.0 - Denial of Service (DOS)](https://www.exploit-db.com/exploits/50973) -- 看雪学院 - - [CTF反序列化入门](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458064&idx=1&sn=6541093cd487ee990960b6c1ce658890&chksm=b18e275a86f9ae4c8653f44428c63fa20c283c541f22f4d88acb897b38f827c9193295f3148f&scene=58&subscene=0#rd) - - [直播预告|安心办公，全力守护-腾讯零信任iOA解决方案](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458064&idx=2&sn=ac59c75e68f6097952f05180c7a9535e&chksm=b18e275a86f9ae4cec046d00e4d3d735820af2b116967dbf8f315f38aaae8cb8513f0c644479&scene=58&subscene=0#rd) - - [影响所有本田车型！Rolling-PWN漏洞可使攻击者远程解锁、启动汽车](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458064&idx=3&sn=1b8ab858cf9d7668f008cb6e6117f9d8&chksm=b18e275a86f9ae4c2af7fe1f01f10e631b264b69afb1b0c4ae8b6edeaaba28a21d9889939eb0&scene=58&subscene=0#rd) - - [《物联网安全入门》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458064&idx=4&sn=3bf202a97514c8f71d65b5f06402b0c3&chksm=b18e275a86f9ae4c7026641903e31be4833cc6f4082cd26a7488d3bf102a3b8488bcddf84169&scene=58&subscene=0#rd) -- Security Uncorked - - [Wireless Segmentation and Filtering Deep Dive](https://securityuncorked.com/2022/07/wireless-segmentation-and-filtering-deep-dive/) -- 雷神众测 - - [论大型闪电式红蓝对抗战术方法论——上篇：攻](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498587&idx=1&sn=08e5c5eecfcc40705e5cc03f0d49dade&chksm=f2584928c52fc03ec79545f0a674484a6a0629a3059f7a4bfb35bd83a0390812230336faa0b5&scene=58&subscene=0#rd) -- 互联网安全内参 - - [迈向“真·零信任”！美国白宫计划开发实时信任评分系统](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504280&idx=1&sn=9decc9f3d709df89ce46456d305fd5e0&chksm=ebfa96b8dc8d1fae0550e7f4a4db7808279fb3d14f5b19a2725af13666c5f81c6db2fc38c573&scene=58&subscene=0#rd) - - [Gartner发布当前至2024年的五大隐私趋势](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504280&idx=2&sn=501a4600bc9877cdb10ba5843b1ffd45&chksm=ebfa96b8dc8d1faeef0413bfe204c6409ba59a2016f02f49be2a42171041b7c26ea5c4b1def6&scene=58&subscene=0#rd) - - [加拿大发生大面积断网，数百万用户生活“被打乱”](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504280&idx=3&sn=2185539f1b65db4d670f6915e9720a53&chksm=ebfa96b8dc8d1faeceae2f8103d4abba861b63d79fde2305e718ef87a166b21d14e75b76eece&scene=58&subscene=0#rd) - - [美国FBI用于钓鱼的加密通信平台代码被公开](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504280&idx=4&sn=29faf0f69a4b7637928d5da652b33089&chksm=ebfa96b8dc8d1faeadd827d4c9d35de4ccce4c9b087d07abd9970c53e1a8190279aa2ec80579&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(07-11)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958582&idx=1&sn=0529935bbe0535ae066212c2d0f13c6e&chksm=8baecda9bcd944bfda793c7309342d11059cde1502b8a82fdbb7ad947b9e56b3d15a73b1f328&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】2021 蓝帽杯初赛 PWN WriteUp](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773620&idx=1&sn=d486671417e16d094422c6ea4ccc6bc7&chksm=8893665bbfe4ef4db266393322e1a23b19695d0d71ba2b47f6c902ca2e3756a39b806dfd0963&scene=58&subscene=0#rd) - - [【安全头条】欧盟或因隐私法与Facebook分道扬镳](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773620&idx=2&sn=0246ca65fb88d8f92a762b0dc72fcd3f&chksm=8893665bbfe4ef4dbdbd1ba3ee5454626d08662361f705139f2752d8503da350a6cbc83ee1ac&scene=58&subscene=0#rd) -- 暗影安全 - - [【直播预告】如何高效“临阵磨枪”，快速完善安全防御体系？](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163041&idx=1&sn=53fb9078b1728d87f8614e37e56f4ff4&chksm=f1d4e5c4c6a36cd2779b4728132d60797fdb14e178ca63b974855a9cb29fb1f8bf8cfb8d19d5&scene=58&subscene=0#rd) -- 代码卫士 - - [Node.js 修复多个漏洞，可导致RCE和HTTP请求走私](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512799&idx=1&sn=4c911268f2a7aa2fa486878c0d088a2b&chksm=ea9483b5dde30aa34eecfb2769cecc53e133885f12e381c6c1827d5a3d3dfa4f8e4e0edd9506&scene=58&subscene=0#rd) - - [PyPI 强制要求对关键项目部署2FA机制，遭一些开发人员反对](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512799&idx=2&sn=5b3221e3ed829c40f39f95b4c15934c9&chksm=ea9483b5dde30aa3c3d61b38ad4f74ca430ee9bd62d545894dfffaac82be81fb2f32dcde0e88&scene=58&subscene=0#rd) - - [思科修复企业通信解决方案中的严重漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512799&idx=3&sn=cf09134cb420304564ce779f73681d85&chksm=ea9483b5dde30aa399ffec055342fed6659cf6636ee189076567fb2b40cf6d02796785ce7ca1&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (07.04-07.10)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491142&idx=1&sn=ca30a3ca0261f5d615838cdff130ea53&chksm=fe251b47c95292516e5b93657e6b8e797172c483f497b37eaad9a0bed045f5e5f7276f6d1da3&scene=58&subscene=0#rd) - - [安全日报（2022.07.11）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491142&idx=2&sn=d7e5dd4b0a3cc0ea6d8740787bf74662&chksm=fe251b47c9529251271f579b377d2ff4b8b10ad7d665b58cdd48dde3d4b2746e2bd3e7444511&scene=58&subscene=0#rd) -- 数世咨询 - - [人机合智：安全运营中的人工智能](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494191&idx=1&sn=7b4d492df64a51be2d0aea77fa87d598&chksm=c1449892f6331184525e573c8c3066bc86a11048c3bbdb0562f1d2e7b8e5e489a21b32c7b52b&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [高清有码！守城将士们，有话这里说](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502012&idx=1&sn=9b0858d83bd13ba2573a2e82e8676327&chksm=ea663fcbdd11b6dd6fef4cff6cec0d6b36e2d0139893edcd1c3548582ac59ef3e3d4b591382d&scene=58&subscene=0#rd) -- 君哥的体历 - - [海通证券数据中心安全团队：构建邮件纵深安全体系，提升互联网重要入口安全运营水平](https://mp.weixin.qq.com/s?__biz=MzI2MjQ1NTA4MA==&mid=2247488621&idx=1&sn=5e96881eac00e06f9e41278dedb37b16&chksm=ea4bbe2add3c373cb01bc8509645fd0d721753c9cc512457089249a454e32ab9dfc33e08d195&scene=58&subscene=0#rd) -- Checkmarx.com - - [Introducing Checkmarx New Documentation Experience](https://checkmarx.com/blog/introducing-checkmarx-new-documentation-experience/) -- 极客公园 - - [重新认识九号](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959532&idx=1&sn=e15e1e27d7e430a6a8ab97a571a4a0f2&chksm=7e558e9a4922078ce8474077778e807e8ab9459d1505ace1314ec8070ffd209df9530dce13f4&scene=58&subscene=0#rd) - - [罗永浩公布新公司「细红线」，官网曝光；中国新能源车突破千万大关；新专辑曝光后，周杰伦账号堆满粉丝「差评」｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959513&idx=1&sn=b0cc16cc73a1ada4c13e0e13ed939efb&chksm=7e558eaf492207b906e45dde9ac3d9659338669760fb56136bbcccea1724b0552a13496544aa&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [第十届全球云计算大会长亭演讲实录：云原生安全的困境与技术实践](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247490072&idx=1&sn=9b40c667ca7d79e06b5d8243608da299&chksm=96f40575a1838c638e93080dc734e04a0573808291418f05e2092896943cf8b8fdd51f2a634a&scene=58&subscene=0#rd) -- 星阑科技 - - [回顾篇之小阑6月那些事～](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494061&idx=1&sn=d3e7c238871d875851241dfe27ee2135&chksm=c0074431f770cd27e573618a0edd6c5a2475a9458858f8031e5e2d1f950fa0114d7b9f41a684&scene=58&subscene=0#rd) -- 奇安信CERT - - [安全热点周报|第二百五十二期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496427&idx=1&sn=e6352b426041ee07a30f2ab30b2d55f3&chksm=fe79d673c90e5f655758021ba0a9e06c8c6c7de498d2cc0a26bf93ef5819bf6373d3b06d0c18&scene=58&subscene=0#rd) -- 小米安全中心 - - [《基于位置服务的个人信息保护思考》邵华](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247513898&idx=1&sn=fe9d65f8e11113a67dc69e359285355c&chksm=ea8391bfddf418a97823ed33587ca8c0f1f49972805cca76f231deeb410c28a60be1fed845f9&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [密码学系列｜ 3.4 素数测试](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494595&idx=1&sn=62b184a84ec63f5fc6f050008fa958b3&chksm=fa523e7dcd25b76b83e0e9cdc890f57ab634a244dcc8d86b0eadb109860e327cde24376c8783&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [【攻防演练专题】为业务系统注入“疫苗”](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529335&idx=1&sn=8843ed1a96ff122700f2079ef6b0ef88&chksm=fa93c5b6cde44ca0def59673a72462b814a00dd7dcc04d67da24ce84629be17fba235244bc31&scene=58&subscene=0#rd) - - [国家工程研究中心安全资讯周报20220711期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529335&idx=2&sn=b7a23d1b79ea36b5d934f66b6dabbb0c&chksm=fa93c5b6cde44ca021b6ae03b1938009676f84a53b84d1c6dfd9bae844a9e823901788ce8ec1&scene=58&subscene=0#rd) - - [Chrome被爆严重零日漏洞，谷歌督促用户尽快更新](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529335&idx=3&sn=e429a31a4e9ba1488b2dd79d1a28652d&chksm=fa93c5b6cde44ca0bf4f1f3c91dec333c077dd4f91fa994ea7cac29dd0c15336f7cc49aa227a&scene=58&subscene=0#rd) - - [加密通信监控套路深！美国FBI用来窃听世界的代码正在公开！](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529335&idx=4&sn=6b4ede64631541c41c9d94edc4b7a090&chksm=fa93c5b6cde44ca045be729de7c196f65f179ecb09733ebda80d4815a431b4a90fa3f172de19&scene=58&subscene=0#rd) -- 补天平台 - - [校园守护者计划第二期报名开始啦~](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494475&idx=1&sn=5057a104c73e28f0058da47ff6f57444&chksm=eaf9a307dd8e2a119fc21310529adf9d46e969ab68e1699c11351eae11ec0efa9abb16eaaceb&scene=58&subscene=0#rd) -- 东软网络安全 - - [【网络知识科普小课堂】OSI参考模型应用实例解读](https://mp.weixin.qq.com/s?__biz=MjM5NTAyODkxNw==&mid=2649212425&idx=1&sn=970967c6bcd6ae2e8aacb3590587a70b&chksm=beedacd3899a25c5b2836df461c57ab5ff211135092de5aee668fb63e0d1b5712d0aee0565ce&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [Tofu - Windows Offline Filesystem Hacking Tool For Linux](http://www.kitploit.com/2022/07/tofu-windows-offline-filesystem-hacking.html) -- 字节跳动技术团队 - - [Go 1.18 的那些事——工作区、模糊测试、泛型](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496369&idx=1&sn=b537e63b482baa7912b1efdb76f1dfcf&chksm=e9d33953dea4b045d3c1b0d4c965da97dc645a76d5da8abe842f4e222d4f4f929a6af1567961&scene=58&subscene=0#rd) -- 中国信息安全 - - [专家解读｜防范数据出境安全风险 保护国家数据安全](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161726&idx=1&sn=3222f34ebac3fb6c52844c20f407cd40&chksm=8b5ee347bc296a514206b9e04bfb38d24e2d57237f77cf68a485e8d730b1679a90b7244aeee8&scene=58&subscene=0#rd) - - [专题·云安全将来时 | 云安全的未来是云原生安全](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161726&idx=2&sn=61b22c3924ac585ddf2373f216babced&chksm=8b5ee347bc296a51e1bc18fcc88a0a017897d28e09504d2455ecec831a0cf770a892045c9223&scene=58&subscene=0#rd) - - [观点 | 数据安全与效率不能“二选一”](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161726&idx=3&sn=e03b3aa5b5340abe7f79b0d74d003f87&chksm=8b5ee347bc296a519433efa7be8a34f274dd3c1b2aca341f91e7a59473695d9c1f4d6cfc38b2&scene=58&subscene=0#rd) - - [前沿 | 全球网络犯罪急需强化协同打击](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161726&idx=4&sn=525c8dabaf0686a6bc41bb6e34bfb125&chksm=8b5ee347bc296a511d85221498604e856be52022d9d77d04393dc5d908b2dfa0de1554189772&scene=58&subscene=0#rd) -- 火线Zone - - [对泄露的Azure存储密钥的挖掘和利用](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247495971&idx=1&sn=35cf5c2bd02664d94dac501b419d90d0&chksm=eaa97903dddef015e0d8d5676e46e7d2def990c49184f0e83f6b0acfa50afac2e66aa09032bc&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [《嘶吼2022网络安全产业图谱》线上发布会即将开始，直播通道预约开启！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545293&idx=1&sn=95bc0047f0545537ed17d2ef29489008&chksm=e915e1f7de6268e193cf37d19d8472b08d257a1a39095ca2936c30e650c4e7b8b8024b23030f&scene=58&subscene=0#rd) - - [大黄蜂：新装载机迅速在网络犯罪生态系统中占据中心位置](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545293&idx=2&sn=d54c525711bafb674287d01f9e942603&chksm=e915e1f7de6268e15d084f0b58ed6ecb2b83c2f805697eba390ee863c38ae46dcb7aeaa36b76&scene=58&subscene=0#rd) - - [数据隐私治理最佳实践（下）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545293&idx=3&sn=0552fadc7d52effa200de3a65f0e5a97&chksm=e915e1f7de6268e17f60923b8c2900744e409c6c80fcf34c2d3684be1a9b45bfe40d5fb60cc8&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220711期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528688&idx=1&sn=7dc397fcc6ea2857c4e0b5588c933e94&chksm=c1e9fca1f69e75b78c356cb7f9ef025e14f1aeac6fc894538a4b2a0d5b0c4da400e56e5017c1&scene=58&subscene=0#rd) - - [【攻防演练专题】为业务系统注入“疫苗”](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528688&idx=2&sn=e872489939e2c418a086d6dba8c15e09&chksm=c1e9fca1f69e75b7ac2d5914bc25e8d3ed474757f33183d9e3e37a43e04b1c44883f5f86cb72&scene=58&subscene=0#rd) - - [5G容易遭受对抗性攻击：可拖慢手机网速甚至断网](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528688&idx=3&sn=5139854ea9d4bbb1c46e787860f19118&chksm=c1e9fca1f69e75b72dae07a5abd124c355ceb52f2df1a2b623b0864aeab7479efe3f9abeee45&scene=58&subscene=0#rd) - - [攻击者利用事件日志来隐藏无文件恶意软件](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528688&idx=4&sn=e10c30aeaa7081ac4f76d8173f555df7&chksm=c1e9fca1f69e75b70ee16a0ba18c022e6768216ddfd4a174289bd4a1ed2e546e52c3d867c373&scene=58&subscene=0#rd) -- 安全牛 - - [做好安全运营并没有你想的那么难](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115884&idx=1&sn=f70824a716ecff90e22a939c9adf9f18&chksm=bd1461bf8a63e8a9e2e17b9a42419aea65d054a2f6456f1d37d1f8a58c3ba0b8ccc5a991f94b&scene=58&subscene=0#rd) - - [安全头条|《数据出境安全评估办法》公布；《欺骗式防御技术应用指南》报告调研启动](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115884&idx=2&sn=785e49bdf43f82df9fe498016c489251&chksm=bd1461bf8a63e8a9f20588a3753e8e048ae08fa1bf891a5607a5bea61ba13be2d9ee467d36a8&scene=58&subscene=0#rd) - - [2022年首届金融科技安全高级研修班顺利举行](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115884&idx=3&sn=3a761cfc6659f9c1fc9c49d689831c03&chksm=bd1461bf8a63e8a9a620cc4d449771b9565e08400a41b44fd881f975474738c48caa9415fa92&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】WPS被曝会删除用户本地文件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652005056&idx=1&sn=6d376f366992ee8a38e5b5d5f88b8634&chksm=f36f4e80c418c7960b582ef2f40c62bf73ed4d38ebf9d17acbcd0e34f0f4d0fa70fb4993597d&scene=58&subscene=0#rd) - - [【安全圈】豆瓣又崩了](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652005056&idx=2&sn=5c9a0a70d6862d1b0761f11663c5b6d7&chksm=f36f4e80c418c79615a6e92202b9e5976390203537d422e595f3626f6b5a385c655c34fdeb1f&scene=58&subscene=0#rd) - - [【安全圈】博士生非正常下载2578篇文献，高校IP遭永久封禁](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652005056&idx=3&sn=8221981b4e53f56bbb628c10249c68a2&chksm=f36f4e80c418c7963bb921ea39853dc60897f0e0b91a60229c30fb44377c41da9dfde0edc2ce&scene=58&subscene=0#rd) - - [【安全圈】比特币大跌：这 9 种MEME和元宇宙币已经跳涨！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652005056&idx=4&sn=1e13ae7d68e36608f48a3fbc842d9feb&chksm=f36f4e80c418c796e9091caef55ed044f26b02a574a68bb8b0350d88acd404f217c4d2f93be2&scene=58&subscene=0#rd) - - [【安全圈】世界上最活跃的勒索病毒又一次升级变种出现](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652005056&idx=5&sn=6ce54dfee3a17adca048dc91e7d67065&chksm=f36f4e80c418c7966c9e21df3b13bbadecdeb500364d902918149a6bda43901419307048d759&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [数据出境安全迎来新规，企业如何应对数据出境合规风险？](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493761&idx=1&sn=9692d1540d4454d5d6ab16c97199399b&chksm=eb12cebadc6547ac00c8930842510046d0765c927b5d92d414260bbd66a3311c144daee5abda&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第27期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491964&idx=1&sn=d461299f3e39c74b20e33b9dcaf3e281&chksm=fd74d1b5ca0358a3abbb18681b5319c622681d4308c9379ba45b6acb6397fb243f6e0bfc0f15&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220704-20220710)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491964&idx=2&sn=80a4f255978a971050a0010f0766ef95&chksm=fd74d1b5ca0358a369d10b1560f9bc64fe886d63ccaa74d39d63569f4214d4d6022796133273&scene=58&subscene=0#rd) -- 情报分析师 - - [涉及俄乌相关资料汇总](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510134&idx=1&sn=1d3475e2f8b868399bec7fd0e86cc3ce&chksm=8716bd7db061346bcd35bbfbed7d1094f5b6aa0618f18080167b5bde7e9ce8043b16a0613846&scene=58&subscene=0#rd) - - [如何使用 Snapchat 监视突发事件](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510134&idx=2&sn=dcb8cd80458858a62e26987f7c7831da&chksm=8716bd7db061346b73c05ebc2feb0416394bb02b0ae3adbcc045651bceefdd5c474d5fee93b5&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [【直播预告】如何高效“临阵磨枪”，快速完善安全防御体系？](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485586&idx=1&sn=441b0340da4c0ab7b2b3971ba4ac9623&chksm=fa5aa67fcd2d2f693607ba92a4b9b0b8a85056352cc39ffde1b423fe254b316d17bc533e0406&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜自动化API漏洞Fuzz实战](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135026&idx=1&sn=8c72045fe8a6eca860273815f68c11c9&chksm=f2c11d52c5b69444b0015b0d528f1479dc67347dad7d56d7f7b0d2b022709a3ac372c26061ed&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-13.md b/archive/2022/2022-07-13.md deleted file mode 100644 index c004344b2d..0000000000 --- a/archive/2022/2022-07-13.md +++ /dev/null @@ -1,213 +0,0 @@ -# 每日安全资讯（2022-07-13） - -- Security Boulevard - - [Arkose Labs Industry-Leading 59 Net Promoter Score](https://securityboulevard.com/2022/07/arkose-labs-industry-leading-59-net-promoter-score/) - - [Why is it important to be the first female member of R&D?](https://securityboulevard.com/2022/07/why-is-it-important-to-be-the-first-female-member-of-rd/) - - [Rise in Qakbot attacks traced to evolving threat techniques](https://securityboulevard.com/2022/07/rise-in-qakbot-attacks-traced-to-evolving-threat-techniques/) - - [RiskLens Fast Facts on Cyber Risk in the Accommodations Industry](https://securityboulevard.com/2022/07/risklens-fast-facts-on-cyber-risk-in-the-accommodations-industry/) - - [BSidesSF 2022 – Leif Dreizler’s And Rachel Landers’ ‘An Unlikely Friendship: Why Security Engineers And Product Managers Should Be Working Together’](https://securityboulevard.com/2022/07/bsidessf-2022-leif-dreizlers-and-rachel-landers-an-unlikely-friendship-why-security-engineers-and-product-managers-should-be-working-together/) - - [Infected WordPress Site Reveals Malicious C&C Script](https://securityboulevard.com/2022/07/infected-wordpress-site-reveals-malicious-cc-script/) - - [Anti-virus certification and ELAM](https://securityboulevard.com/2022/07/anti-virus-certification-and-elam/) - - [6 Hidden Costs to Consider Before Investing in On-Prem Infrastructure](https://securityboulevard.com/2022/07/6-hidden-costs-to-consider-before-investing-in-on-prem-infrastructure/) - - [Three Reasons Why CSOs Can Stake Their Claim to Digital Executive Protection](https://securityboulevard.com/2022/07/three-reasons-why-csos-can-stake-their-claim-to-digital-executive-protection/) -- Microsoft Security Blog - - [From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud](https://www.microsoft.com/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/) -- HackerOne Hacker Activity - - [Github base action takeover which is used in `github.com/Shopify/unity-buy-sdk`](https://hackerone.com/reports/1439355) -- Tenable Blog - - [Microsoft’s July 2022 Patch Tuesday Addresses 84 CVEs (CVE-2022-22047)](https://www.tenable.com/blog/microsofts-july-2022-patch-tuesday-addresses-84-cves-cve-2022-22047) - - [Introducing Nessus Expert, Now Built for the Modern Attack Surface](https://www.tenable.com/blog/introducing-nessus-expert-now-built-for-the-modern-attack-surface) -- Sec-News 安全文摘 - - [攻防演练之域控加固篇](https://wiki.ioin.in/url/dNYW) -- Sploitus.com Exploits RSS Feed - - [JBOSS EAP/AS 6.x Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167730&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=F42BF447-C1A3-5795-8343-D71F096AFF52&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Vmware Spring Cloud Gateway exploit](https://sploitus.com/exploit?id=A1656477-2AD0-5B09-B359-576D08CBF918&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [WebView2-Cookie-Stealer - Attacking With WebView2 Applications](https://twitter.com/Dinosn/status/1546930842672545792) - - [Pump-and-Dump Schemes](https://twitter.com/Dinosn/status/1546930701718749184) - - [New ‘Luna Moth’ hackers breach orgs via fake subscription renewals](https://twitter.com/Dinosn/status/1546930608886120449) - - [TikTok Postpones Privacy Policy Update in Europe After Italy Warns of GDPR Breach](https://twitter.com/Dinosn/status/1546930579962306563) - - [Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs](https://twitter.com/Dinosn/status/1546930228387368960) - - [From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud](https://twitter.com/Dinosn/status/1546930076272451585) - - [RT GovCERT.ch: Security researchers from the @ETH Zurich have discovered a serious security vulnerability in Intel and AMD microprocessors. The NCSC h...](https://twitter.com/GovCERT_CH/status/1546929058394554369) - - [Security Vulnerabilities in Honda’s Keyless Entry System](https://twitter.com/Dinosn/status/1546834308253585411) - - [cervantes: open-source collaborative platform for pentesters or red teams](https://twitter.com/Dinosn/status/1546810999592067073) - - [CVE-2022-2385: AWS IAM Authenticator for Kubernetes Privilege Escalation flaw](https://twitter.com/Dinosn/status/1546810957762002944) - - [RT Swissky @ Home : The more predictable you are, the less you get detected - hiding malicious shellcodes via Shannon encoding](https://twitter.com/pentest_swissky/status/1546785686740672512) - - [GoogleCTF 2022 筆記](https://twitter.com/Dinosn/status/1546769923384512513) - - [Insecure Deserialization in JavaScript: GoogleCTF 2022 Web/HORKOS Writeup](https://twitter.com/Dinosn/status/1546769716127096835) - - [Researching Crestron WinCE Devices](https://twitter.com/Dinosn/status/1546768055430221824) - - [Ransomware gang now lets you search their stolen data](https://twitter.com/Dinosn/status/1546767999163662336) - - [Popular NFT Marketplace Phished for $540M](https://twitter.com/Dinosn/status/1546767901016956928) - - [Massive Rogers outage caused by a maintenance update](https://twitter.com/Dinosn/status/1546767764295237632) - - [Cloud-Based Cryptocurrency mining attacks abuse GitHub Actions and Azure VM](https://twitter.com/Dinosn/status/1546767480592416768) - - [Microsoft Windows Autopatch is Now Generally Available for Enterprise Systems](https://twitter.com/Dinosn/status/1546767397947953154) - - [RT reecDeep: Hi folks, I've just released my #Hive #ransomware v5 keystream decryption tool publicly available. 👇 #infosec #malware #reverseenginee...](https://twitter.com/reecdeep/status/1546766063223857152) -- 先知安全技术社区 - - [PHP变量流量层面WAF绕过](https://xz.aliyun.com/t/11512) - - [记一次实战之若依SSTI注入绕过玄某盾](https://xz.aliyun.com/t/11509) -- paper - Last paper - - [nRF52 平台芯片电压毛刺注入绕过调试保护](https://paper.seebug.org/1929/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [国内唯一 | 派拉软件连续入选Gartner AM和IGA报告](https://www.4hou.com/posts/gXkk) - - [亚信安全信桨中标某省石油石化公司工控安全项目](https://www.4hou.com/posts/l6pM) - - [一汽解放与腾讯云达成战略合作，共筑智能网联汽车信息安全防线](https://www.4hou.com/posts/kMo6) - - [Kaiser医疗集团泄露了近7万份医疗记录](https://www.4hou.com/posts/EQ8l) - - [Flubot演变史（下）](https://www.4hou.com/posts/174Z) - - [断剑重铸？Kaiji僵尸网络正在重构](https://www.4hou.com/posts/03L5) - - [2022重大勒索攻击事件汇总](https://www.4hou.com/posts/q827) -- Files ≈ Packet Storm - - [Suricata IDPE 6.0.6](https://packetstormsecurity.com/files/167738/suricata-6.0.6.tar.gz) - - [Ubuntu Security Notice USN-5510-1](https://packetstormsecurity.com/files/167737/USN-5510-1.txt) - - [Ubuntu Security Notice USN-5503-2](https://packetstormsecurity.com/files/167736/USN-5503-2.txt) - - [Ubuntu Security Notice USN-5508-1](https://packetstormsecurity.com/files/167735/USN-5508-1.txt) - - [Ubuntu Security Notice USN-5509-1](https://packetstormsecurity.com/files/167734/USN-5509-1.txt) - - [VMware Security Advisory 2022-0025.2](https://packetstormsecurity.com/files/167733/VMSA-2022-0025-2.txt) - - [VMware Security Advisory 2022-0020](https://packetstormsecurity.com/files/167732/VMSA-2022-0020.txt) - - [VMware Security Advisory 2022-0018](https://packetstormsecurity.com/files/167731/VMSA-2022-0018.txt) - - [JBOSS EAP/AS 6.x Remote Code Execution](https://packetstormsecurity.com/files/167730/jboss_remoting_unified_invoker_rce.rb.txt) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [July 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities with 4 Critical, plus 2 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 27 Vulnerabilities with 18 Critical.](https://blog.qualys.com/category/vulnerabilities-threat-research) -- 跳跳糖 - 安全与分享社区 - - [零基础入门V8——理解通用利用链原理](https://tttang.com/archive/1653/) -- Sucuri Blog - - [Infected WordPress Site Reveals Malicious C&C Script](https://blog.sucuri.net/2022/07/infected-wordpress-site-reveals-malicious-cc-script.html) -- Envato Tuts+ Code - Mobile Development - - [12 Best iOS App Templates of 2022](https://code.tutsplus.com/articles/best-ios-app-templates--cms-29163) -- 安全脉搏 - - [绕过接口参数签名验证](https://www.secpulse.com/archives/182997.html) - - [来和安识一起工作|安识科技诚聘安全人才](https://www.secpulse.com/archives/182992.html) - - [对小绵羊的轰炸APP逆向分析](https://www.secpulse.com/archives/182973.html) - - [Advanced Windows Task Scheduler Playbook – Part.2 （下） | 高级攻防09](https://www.secpulse.com/archives/182953.html) - - [Advanced Windows Task Scheduler Playbook – Part.2 （上） | 高级攻防08](https://www.secpulse.com/archives/182945.html) -- Blog & What's New | Offensive Security - - [Start Studying Security with SQLi](https://www.offensive-security.com/offsec/start-studying-security-with-sqli/) -- unSafe.sh - 不安全 - - [The Jargon Free Guide to Computer and Internet Security](https://buaq.net/go-117068.html) - - [Cobalt Strike快乐星球](https://buaq.net/go-117067.html) - - [Start Studying Security with SQLi](https://buaq.net/go-117079.html) - - [移动要推类似 CN2 的精品网，叫 CMIN2，各位如何看待 - V2EX](https://buaq.net/go-117066.html) - - [PHP变量流量层面WAF绕过](https://buaq.net/go-117076.html) - - [Fake streamed cricket matches knocks victims for six](https://buaq.net/go-117078.html) -- 先知安全技术社区 - - [PHP变量流量层面WAF绕过](https://xz.aliyun.com/t/11512) - - [记一次实战之若依SSTI注入绕过玄某盾](https://xz.aliyun.com/t/11509) -- Recent Commits to cve:main - - [Update Tue Jul 12 13:03:21 UTC 2022](https://github.com/trickest/cve/commit/a06d6333beb65e24fd3fd1e00293251764e45edf) - - [Update Tue Jul 12 10:49:29 UTC 2022](https://github.com/trickest/cve/commit/283e1d01a36019a07af56823dad252aa510906cb) - - [[Tue Jul 12 09:17:27 UTC 2022] Updating README Hottest CVEs csv log](https://github.com/trickest/cve/commit/31a881c035815b516e496bac81723da937a10cde) - - [[Tue Jul 12 09:16:37 UTC 2022] Updating README Hottest CVEs section](https://github.com/trickest/cve/commit/2b377150c7be80878505023c66d73dbdd2bf4c04) -- 安全客-有思想的安全新媒体 - - [404 Paper精粹发布新刊，还可领KCon周边！](https://www.anquanke.com/post/id/276296) - - [linux权限维持](https://www.anquanke.com/post/id/276174) - - [CVE-2022-32532 Apache Shiro RegExPatternMatcher 认证绕过漏洞](https://www.anquanke.com/post/id/276094) - - [PyPI设立关键包制度遭部分开发抗议](https://www.anquanke.com/post/id/276235) -- Hack Inn - - [2022 CIS夏日版](https://www.hackinn.com/index.php/archives/792/) -- Didier Stevens - - [Quickpost: Standby Power Consumption Of My USB Chargers](https://blog.didierstevens.com/2022/07/12/quickpost-standby-power-consumption-of-my-usb-chargers/) -- Twitter @bytehx - - [RT Z-winK: The first (5) episodes of "Bug Bounty Bootcamp" are live, sponsored by @Intigriti! If you want to understand what #bugbounty is and how to ...](https://twitter.com/_zwink/status/1546656248497668097) -- SAP Blogs - - [Developers Digest July Episode #2207 is here!](https://blogs.sap.com/2022/07/12/developers-digest-july-episode-2207-is-here/) - - [Beyond the SAP certification: Quality as a culture](https://blogs.sap.com/2022/07/12/beyond-the-sap-certification-quality-as-a-culture/) - - [Consume UI5 Library in Local Development via Local Approuter](https://blogs.sap.com/2022/07/12/consume-ui5-library-in-local-development-via-local-approuter/) - - [SAP Screen Personas roadmap update 2022 July – SAP S/4HANA-ready](https://blogs.sap.com/2022/07/12/sap-screen-personas-roadmap-update-2022-july-sap-s-4hana-ready/) - - [SAP Champion Spotlight Interview: Michelle Crapo](https://blogs.sap.com/2022/07/12/sap-champion-spotlight-interview-michelle-crapo/) - - [SAP Profitability and Performance Management What’s Inside Visual Modeler SP19 SAP Note 3211293](https://blogs.sap.com/2022/07/12/sap-profitability-and-performance-management-whats-inside-visual-modeler-sp19-sap-note-3211293/) - - [Understanding Interpolate and Step business goals calculations in Variable Pay](https://blogs.sap.com/2022/07/12/understanding-interpolate-and-step-business-goals-calculations-in-variable-pay/) - - [SAP S/4HANA Business Partner Field Status Analysis](https://blogs.sap.com/2022/07/12/sap-s-4hana-business-partner-field-status-analysis/) - - [Pipeline procurement process](https://blogs.sap.com/2022/07/12/pipeline-procurement-process/) -- Malwarebytes Labs - - [Fake streamed cricket matches knocks victims for six](https://blog.malwarebytes.com/scams/2022/07/fake-streamed-cricket-matches-knocks-victims-for-six/) - - [PyPI starts rolling out required 2FA for important projects](https://blog.malwarebytes.com/reports/2022/07/pypi-starts-rolling-out-required-2fa-for-important-projects/) - - [Insecure password leads to Mangatoon data breach](https://blog.malwarebytes.com/privacy-2/2022/07/insecure-password-leads-to-mangatoon-data-breach/) -- Sucuri Blog - - [Infected WordPress Site Reveals Malicious C&C Script](https://blog.sucuri.net/2022/07/infected-wordpress-site-reveals-malicious-cc-script.html) -- Reverse Engineering - - [Infogrames Silver (RPG Game, 1999) scripting file format reversed (with pictures)](https://www.reddit.com/r/ReverseEngineering/comments/vx7psd/infogrames_silver_rpg_game_1999_scripting_file/) -- KitPloit - PenTest & Hacking Tools - - [WebView2-Cookie-Stealer - Attacking With WebView2 Applications](http://www.kitploit.com/2022/07/webview2-cookie-stealer-attacking-with.html) -- Microsoft Security Response Center - - [Microsoft Mitigates Azure Site Recovery Vulnerabilities](https://msrc-blog.microsoft.com/2022/07/12/microsoft-mitigates-azure-site-recovery-vulnerabilities/) -- 丁爸情报分析师的工具箱 - - [【资料】美国太空部队想要新的商业图像工具来提高应变能力](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651130342&idx=1&sn=4e9fb800cbb00c45dba7a3f1a2c6e867&chksm=f1af7edcc6d8f7ca4381c12287e7e9e2416af3c8d45a42f2dc19be7a4d615ebd30973bd08ebc&scene=58&subscene=0#rd) -- 汉客儿 - - [一种特别的禁止Windows自动更新的方法](https://mp.weixin.qq.com/s?__biz=MzI1NTUzMjUzMQ==&mid=2247484632&idx=1&sn=64361fe65f58c655cdc9e6e3013613e5&chksm=ea35c844dd42415257258121f9496ba49696051f2f3f74a72a031402d36189325a6bbea8dc17&scene=58&subscene=0#rd) -- 黑奇士 - - [说的全是真话，却得出错误的结论，丁香园是怎么误导读者的？](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247487042&idx=1&sn=43712ef2a0ddad34847cea20fa0ac9f8&chksm=eca201aedbd588b8070734712d20efd855975ef72b00d7bc83d9d3de77b11222c25040cc8408&scene=58&subscene=0#rd) -- 锦行信息安全 - - [【深度合作】锦行科技与公安部第三研究所网研基地签订合作协议，被授权为“广东省技术服务站”](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247489982&idx=1&sn=f27b0d0835cc6f92308d57d15376f66d&chksm=9799e21ba0ee6b0dd8fcc2bc143bdf5f1b292d8f16cc10958f35a5f0884dd375288a6874af13&scene=58&subscene=0#rd) -- Seebug漏洞平台 - - [招募新刊发布见证官，免费赠404Paper精粹](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650962325&idx=1&sn=8dacc6820f4f7633bd6661587f94dc0e&chksm=80793ba7b70eb2b1192dec70e51ff57e662d69f2b8a31fcf48ffa5d2797b93ecf6c8d3e78edc&scene=58&subscene=0#rd) -- daniel.haxx.se - - [predef is our friend](https://daniel.haxx.se/blog/2022/07/13/predef-is-our-friend/) -- 关键基础设施安全应急响应中心 - - [企业数据出境风险自评估服务的探索实践](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528725&idx=1&sn=994d7ebb85461942c691c45ab143ac71&chksm=c1e9fd44f69e7452b07e24f963883ed05319f097b570e7f06536472afd9285b923be46cf5310&scene=58&subscene=0#rd) - - [【攻防演练专题】快速开展应急处置与分析取证](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528725&idx=2&sn=1ab6db8f6a8f2cc8893550b48e620456&chksm=c1e9fd44f69e7452cc047f9409f2f3b4ff869b8dc83f8b6f113d75d593816507ac694af4f309&scene=58&subscene=0#rd) - - [防范数据出境安全风险 保护国家数据安全](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528725&idx=3&sn=8bcba974489535f0e797658d0ec4035c&chksm=c1e9fd44f69e74523bd7952dcbefc97f74e67f29c660a068782c730705eb94dec78ed0869e11&scene=58&subscene=0#rd) - - [迈向“真·零信任”！美国白宫计划开发实时信任评分系统](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528725&idx=4&sn=474c64d474904c7aa482183e41d75fe2&chksm=c1e9fd44f69e74526da768ca7d98d11d9e88f7fc3009d4f00c442be00c29cdb43ae64414bcea&scene=58&subscene=0#rd) - - [网络空间大国竞争新动向-白宫支持的基金AFF承诺加速网络安全的“深度技术”创新发展](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528725&idx=5&sn=58b5f3cb22727c36540e3c115822d789&chksm=c1e9fd44f69e7452f1f0e003ed4daa4cf7b212af2a8bdcd1516422e24b582912e5feb60a17d4&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [浅谈数据安全治理](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491368&idx=1&sn=9726b2f03099d0080aec556b7c042596&chksm=feb59e3bc9c2172d39be257da4eec9997276f8fa610385e35df65a91df30235fa74f5f7497fa&scene=58&subscene=0#rd) - - [什么是撞库及撞库攻击的基本原理](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491368&idx=2&sn=ca964ebb34d9b48e6763d585d9eef65e&chksm=feb59e3bc9c2172d24314c10a06f024e38c0763cdc2b4a4a80dc1e3e7abc2bc49312c527b3eb&scene=58&subscene=0#rd) -- 中国信息安全 - - [习近平向世界互联网大会国际组织成立致贺信](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161793&idx=1&sn=206a1b100517e177592b18a465f864e9&chksm=8b5ee0f8bc2969eeea4a1802b0b3fbbb0846dc432b07c14198adee51dd8857f00b7ff094a283&scene=58&subscene=0#rd) - - [习言道 | “维护网络安全不应有双重标准”](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161793&idx=2&sn=efebd5b32fa5198523ccc6360ef1606a&chksm=8b5ee0f8bc2969eecdd79a2a5bcfa2a0104e15e7bd41b9399dea6333b0ff408c8ad2fc96773c&scene=58&subscene=0#rd) - - [专家解读｜数据安全治理的中国智慧](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161793&idx=3&sn=7c8099462cbc64e606369371d5d693e6&chksm=8b5ee0f8bc2969ee167e694ec9907bce5a390782409707ad71f573c80a4e0b2df294a28768d1&scene=58&subscene=0#rd) - - [观点 | 加快构建数据基础制度体系](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161793&idx=4&sn=6b5637e24e2c47893f6602d9c527bb4d&chksm=8b5ee0f8bc2969ee3e5d2c8c77784c86d4484af8ac94532e5ed6f696489f9e70bb4acba54e87&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报指南】152页《战略网络空间作战指南》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510144&idx=1&sn=148d14d2fa88f5448ed967b5ec083ece&chksm=8716bd0bb061341d5316a1dcb055ab2d3185434ea0d459846a8a9425cecf350edeae4b90839a&scene=58&subscene=0#rd) - - [美国AI 新算法提前预测犯罪](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510144&idx=2&sn=060e2a59d2fac6b823a93bea39c8b363&chksm=8716bd0bb061341d5bd7d4575265279d2b6e2f46459fac6422c8bf6188765fd3f4f107e455b8&scene=58&subscene=0#rd) - - [伊斯兰堡- 巴基斯坦塔利班会谈中值得关注的五件事](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510144&idx=3&sn=97b8fc81282d1bd2d0c96f1f7aace895&chksm=8716bd0bb061341de48f22d84f3cdc19b5b48a7d1800b93cd2aacda921e744189595566bdde7&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】NCTF/NJUPTCTF 2021 部分 WriteUp](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773696&idx=1&sn=7732121b4e1822f996d8d7c36fefbdc3&chksm=889366efbfe4eff9563eca559b97917dfc295facf002c3aec1b3c44f633872f4b167cd687194&scene=58&subscene=0#rd) - - [【安全头条】PyPI设立关键包制度遭部分开发抗议](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773696&idx=2&sn=c1d007778f175fd57425078fc259f8cd&chksm=889366efbfe4eff9067caef69abc0ff01628ecbb034e64f464674c34c6ad8bf3532ca2322bad&scene=58&subscene=0#rd) -- 补天平台 - - [众测新玩法，百万奖金激励！补天妙挖在线实验室内测启动！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494579&idx=1&sn=84cd9a761265fb571fe915ffa4741169&chksm=eaf9a3ffdd8e2ae904c2705f8096eddfd20c116b9ab96656a310df7cf4946b932ef54e535b1e&scene=58&subscene=0#rd) - - [校园守护者计划第二期报名开始啦~](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494579&idx=2&sn=a319b98b22e48e896ac751e03834587c&chksm=eaf9a3ffdd8e2ae969de5f328a48652d0ae53ba0b47358c32b55ceded6355ed3e3395265d74e&scene=58&subscene=0#rd) -- 安全威胁情报 - - [你见过吗？ATT&CK攻击覆盖面超91%获得的证书长这样](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650172932&idx=1&sn=92895ce43e6024884ccf3c0bebacae2e&chksm=f44895b8c33f1cae30e07134733b491c50872ce472bacc74c844f78f6ca72e10f75590f61166&scene=58&subscene=0#rd) -- 安全牛 - - [从《银行业金融机构数据治理指引》监管要求看商业银行数据能力建设](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115949&idx=1&sn=6d3deb9ce64e545031154e619f1f19b5&chksm=bd14617e8a63e86845336a3fff8b3b44daec523c88d59d7346e8cefe084106019a04e23ce697&scene=58&subscene=0#rd) - - [我们需要零信任网络访问2.0吗？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115949&idx=2&sn=f245083fc3eafbd68a2ef4549918ba92&chksm=bd14617e8a63e8681fd052e6a3b56cd9a2125506c97e7c92dc8ad05e901b0081ac19ac798b1a&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（31期）：两部委“关于开展数据安全管理认证工作的公告”文件解读与建议](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651115949&idx=3&sn=aad6758c5dfb8c7c1d9a315accee0bb3&chksm=bd14617e8a63e8689decdc7c12a2e9b4ec6905035a90b77db9b23cc7c93b5253188894907b87&scene=58&subscene=0#rd) -- Checkmarx.com - - [JetBrains Leverages Checkmarx to Power Bundled Dependency Checker](https://checkmarx.com/blog/jetbrains-leverages-checkmarx-to-power-bundled-dependency-checker/) -- PeiQi文库 - - [招募新刊发布见证官，免费赠404Paper精粹](https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247493563&idx=1&sn=51cedc56f9f38c9f8289a31ff498c93d&chksm=cecc4fe2f9bbc6f45c43667b333f74724edb48515d5697a1e9019309c9e1dbbf61e4308e496a&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jul.12th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495673&idx=1&sn=32e67b5e7c9240aac228a0954511ee30&chksm=ce96a2c7f9e12bd1aa59b56ff098f226f40b49ff76ff398ab2619c21d050d65fede1aa0f2e16&scene=58&subscene=0#rd) -- 星阑科技 - - [定位——安全团队破局之路](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494112&idx=1&sn=ba72031022af0384c0a576678326d53a&chksm=c007447cf770cd6aed4fe06e3ebd7e27ebe444bebe98099f6291858cc3ece043f6cb3a727823&scene=58&subscene=0#rd) -- 青藤云安全 - - [攻防实战 | 蓝队“一招制敌”的底牌是什么？](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650836069&idx=1&sn=131623f6198b3a028c2da15b0cafea6d&chksm=80dbefc0b7ac66d6afef3617de35cfb90cdd1e2b17729e1d60e46e404ba5ec2c47bfa1bada81&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [Kaiser医疗集团泄露了近7万份医疗记录](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545349&idx=1&sn=049b955fdc6850436e1705ae9a367dc1&chksm=e915e23fde626b297976430280dd19e85b64c57a1a21f93d960bd6ac9319685ba7b3263cd278&scene=58&subscene=0#rd) - - [Flubot演变史（下）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545349&idx=2&sn=a0b521c862652ecab76f70e0b9860429&chksm=e915e23fde626b29ca01196f4f456a9b07546e2544e49c7b3bf7e9e3f7d7245ae588721e709a&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [密码学系列｜ 3.5 Pollard’s − 1 分解算法](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494610&idx=1&sn=480d982bc3d8eb051dd8faab9068f32d&chksm=fa523e6ccd25b77a87b085e1c3c889a7f0b3d1d3905d442f64786915bc78afa1a77a3c6664e7&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [CNVD漏洞周报2022年第27期](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496937&idx=1&sn=c63b8a7ad9c8a3491127886ce9c7d135&chksm=973ac78ba04d4e9da35c75e838a4d6e88a328bab331ecc565d8c9f8682cab55dcd9244ab1e62&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220704-20220710)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496937&idx=2&sn=9a695ffd2858f54045c35a1d43d01c21&chksm=973ac78ba04d4e9d888fcc0030e51da4184beb9d7e79ecff26ff05a9a07d64e49e5faa96e288&scene=58&subscene=0#rd) - - [每周移动恶意程序传播渠道安全监测报告（2022年07月04日—2022年07月10日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496937&idx=3&sn=155ae05802c723b5780ed9b0ab6c71b0&chksm=973ac78ba04d4e9dc8e9a849fed772748e0a38582c003890391ac9ada1b44ec16f7c8ba2de81&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 企业数据出境风险自评估服务的探索实践](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529370&idx=1&sn=5dce4687ca58198c62340c066a13f046&chksm=fa93c55bcde44c4d8b713d6096a8dc53c00009c17815c6c11678e1ba762624f2451e8b73297f&scene=58&subscene=0#rd) - - [【攻防演练专题】快速开展应急处置与分析取证](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529370&idx=2&sn=40be6cb3ac54f06970580c27b6db0ada&chksm=fa93c55bcde44c4db81d91a44bf6ca9ff502491b9dcca343716b9b5fb75b05bebf3ad0f4bf00&scene=58&subscene=0#rd) - - [人机合智：安全运营中的人工智能](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529370&idx=3&sn=8226dbd8ed4a0d0cf8c61875acac6c5e&chksm=fa93c55bcde44c4d9cb9e3c2ae189ee50fde7d85dbf9f25520bb5af448c18afa9e922e493069&scene=58&subscene=0#rd) - - [多款本田车型存在漏洞，车辆可被远程控制](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529370&idx=4&sn=5d288dfc2b83e3cc2d3b88ca3cd063f5&chksm=fa93c55bcde44c4d529075048bf3053db7133cb4dfba028369ca0fe946f6d4acf9e2815b0740&scene=58&subscene=0#rd) - - [身份访问管理（IAM）将迎来爆发式增长](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529370&idx=5&sn=04140de8ea38e162fc996b365cb04c09&chksm=fa93c55bcde44c4d0fb8291f453bb0b517545abdae0b49e828497ed11bdf244759d737c996c3&scene=58&subscene=0#rd) -- Tide安全团队 - - [初探逻辑分析仪](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247499499&idx=1&sn=8fb80066b62c6e0062b939ae65d11146&chksm=ce5ddc8af92a559c0bc62d29a0e6ce11be5ab353ba135d898ee1ebfff196e9c3fa42617d2fff&scene=58&subscene=0#rd) -- PaiSecTeam - - [Uniswap 盗币事件分析：钓鱼攻击威力显现](https://mp.weixin.qq.com/s?__biz=MzU3MTU3NDk4Mw==&mid=2247485111&idx=1&sn=93236a0bced1d2de5c3784e1f9eec915&chksm=fcdf591fcba8d009873eb71ff37b7ac9e882e1123933c3517002805fcdf1baeebe24089738ed&scene=58&subscene=0#rd) -- 天书奇坛TFT - - [安全可“铐”：暗网犯罪的实践新样态](https://mp.weixin.qq.com/s?__biz=MzkwNjM0NDg1MQ==&mid=2247484652&idx=1&sn=ec86c72b42855fd479fa1a3ad337c525&chksm=c0e8a410f79f2d06d0288eb64e623488320b44ef6f83311999e2a6a363295a85c412b882e484&scene=58&subscene=0#rd) -- The Daily Swig | Cybersecurity news and views - - [Take threats against machine learning systems seriously, security firm warns](https://portswigger.net/daily-swig/take-threats-against-machine-learning-systems-seriously-security-firm-warns) - - [UK NCSC and ICO urge legal sector to discourage businesses from paying ransomware demands](https://portswigger.net/daily-swig/uk-ncsc-and-ico-urge-legal-sector-to-discourage-businesses-from-paying-ransomware-demands) -- 极客公园 - - [为什么硅谷巨头，都想弄一个「微信」出来？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959588&idx=1&sn=11d418714f524bcc11fe70f27ed39eaa&chksm=7e558ed2492207c45f27f095ad50f874fd40b1072342bcad3e2f6b1349e74f3c8f58c9c3e0a8&scene=58&subscene=0#rd) - - [救灾、炒股、玩期货……还有什么是遥感卫星不能做的？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959588&idx=2&sn=931bded30aa7dfc65c72da20037d32a3&chksm=7e558ed2492207c43ed80ab5360beaad9ffa59a4e40d0ff180ccefc883ec98638c5a24bbdce9&scene=58&subscene=0#rd) - - [上海：不得歧视新冠阳性康复者；苹果发 iOS 16公开测试版；NASA 公布韦伯太空望远镜首张全彩照片｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959557&idx=1&sn=da7ffdf0327402e9d3912ca2c9ca7450&chksm=7e558ef3492207e5f9eeb120c0132ea5aea5c05974895ce3cd7e26b8548f37dee75d01dbaf6a&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-14.md b/archive/2022/2022-07-14.md deleted file mode 100644 index 1f7651be8a..0000000000 --- a/archive/2022/2022-07-14.md +++ /dev/null @@ -1,246 +0,0 @@ -# 每日安全资讯（2022-07-14） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [phpAnalyzer v2.0.4 Backdoor Account Vulnerability](https://cxsecurity.com/issue/WLB-2022070037) - - [ผู้วิเคราะห์ : ปัณฑารีย์ นงนุช Admin Login Bypass](https://cxsecurity.com/issue/WLB-2022070036) - - [JBOSS EAP/AS 6.x Remote Code Execution](https://cxsecurity.com/issue/WLB-2022070035) - - [MktbaGold 6.4 Arbitrary File Upload](https://cxsecurity.com/issue/WLB-2022070034) -- NOSEC 安全讯息平台 - 漏洞预警 - - [【安全通报】2022年7月微软漏洞补丁日修复多个高危漏洞](https://nosec.org/home/detail/5028.html) -- HackerOne Hacker Activity - - [Stored XSS for Grafana dashboard URL](https://hackerone.com/reports/684268) - - [Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy](https://hackerone.com/reports/1583680) - - [Undici ProxyAgent vulnerable to MITM](https://hackerone.com/reports/1599063) - - [One Click XSS in [www.shopify.com]](https://hackerone.com/reports/1563334) - - [rubygems.org Batching attack to `confirmation_token` by bypass rate limit](https://hackerone.com/reports/1559262) - - [CVE-2021-40438 on cp-eu2.acronis.com](https://hackerone.com/reports/1370731) - - [[CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-day](https://hackerone.com/reports/1425474) -- Sploitus.com Exploits RSS Feed - - [JBOSS EAP/AS 6.x Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37838&utm_source=rss&utm_medium=rss) - - [Sourcegraph gitserver sshCommand Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167741&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Djangoproject Django exploit](https://sploitus.com/exploit?id=762A0A85-5425-57A8-8116-B532F6D7BDD8&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [](https://twitter.com/Dinosn/status/1547260604976701441) - - [Uncovering a macOS App Sandbox escape vulnerability: A deep dive into CVE-2022-26706](https://twitter.com/Dinosn/status/1547260494142226432) - - [$8 million stolen in large-scale Uniswap airdrop phishing attack](https://twitter.com/Dinosn/status/1547230782141390850) - - [Bypass-Url-Parser - Tool That Tests Many URL Bypasses To Reach A 40X Protected Page](https://twitter.com/Dinosn/status/1547208491298918400) - - [Microsoft Teams — Cross Site Scripting (XSS) Bypass CSP ($6,000 Bug Bounty)](https://twitter.com/Dinosn/status/1547208362596732930) - - [New UEFI Firmware Vulnerabilities Impact Several Lenovo Notebook Models](https://twitter.com/Dinosn/status/1547191927786950657) - - [U.S. FTC Vows to Crack Down on illegal Use and Sharing of Citizens' Sensitive Data](https://twitter.com/Dinosn/status/1547191876041728002) - - [QuickBooks Vishing Scam Targets Small Businesses](https://twitter.com/Dinosn/status/1547191833108922370) - - [Researchers Uncover New Variants of the ChromeLoader Browser Hijacking Malware](https://twitter.com/Dinosn/status/1547176771216441344) - - [peetch: bypass TLS protocol protections](https://twitter.com/Dinosn/status/1547175483300790273) - - [Large-scale AiTM phishing campaign targeted +10,000 orgs since 2021](https://twitter.com/Dinosn/status/1547103687918723072) - - [Researchers Uncover New Attempts by Qakbot Malware to Evade Detection](https://twitter.com/Dinosn/status/1547103640351031296) - - [Hackers impersonate cybersecurity firms in callback phishing attacks](https://twitter.com/Dinosn/status/1547084586454335491) - - [CVE: Exploratory Analysis](https://twitter.com/Dinosn/status/1547072402634539008) - - [From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud](https://twitter.com/Dinosn/status/1547072154784743424) - - [Microsoft Azure Site Recovery DLL Hijacking ($10,000 Bug Bounty)](https://twitter.com/Dinosn/status/1547072041467117568) - - [How to secure Kubernetes deployment with signature verification – Cosign and Connaisseur](https://twitter.com/Dinosn/status/1547072001340219393) - - [Retbleed: Arbitrary Speculative Code Execution with Return Instructions](https://twitter.com/Dinosn/status/1547071953105723393) - - [CVE-2022-22047: Windows CSRSS Elevation of Privilege 0-day Vulnerability](https://twitter.com/Dinosn/status/1547070100951502848) -- Recent Commits to cve:main - - [Update Wed Jul 13 11:36:55 UTC 2022](https://github.com/trickest/cve/commit/0fa983c150ccdcdb1aa2ae9df2580eea76f6d4ae) -- Sec-News 安全文摘 - - [Account hijacking using "dirty dancing" in sign-in OAuth-flows](https://wiki.ioin.in/url/pDv2) - - [RCE宝典！(补档+答疑)](https://wiki.ioin.in/url/jd1J) - - [$7.5k Google services mix-up](https://wiki.ioin.in/url/NMvq) - - [探寻 Java 文件上传流量层面 waf 绕过](https://wiki.ioin.in/url/x8AK) -- 安全客-有思想的安全新媒体 - - [容器安全建设最佳实践系列-使用Kubernetes Audit日志发现集群风险与入侵](https://www.anquanke.com/post/id/276426) - - [勒索组织对窃取数据搜索功能进行了跟进开发](https://www.anquanke.com/post/id/276301) -- unSafe.sh - 不安全 - - [[有手就行]Log4j打点后与管理员斗智斗勇](https://buaq.net/go-117243.html) - - [某次钓鱼邮件分析（Emotet木马）](https://buaq.net/go-117244.html) -- paper - Last paper - - [Pocsuite3 入门教程](https://paper.seebug.org/1931/) - - [探寻 Java 文件上传流量层面 waf 绕过](https://paper.seebug.org/1930/) -- 先知安全技术社区 - - [[有手就行]Log4j打点后与管理员斗智斗勇](https://xz.aliyun.com/t/11524) - - [某次钓鱼邮件分析（Emotet木马）](https://xz.aliyun.com/t/11519) - - [docker未授权漏洞蜜罐模拟与捕获分析](https://xz.aliyun.com/t/11521) - - [第二次挖edusrc与人生的第一个edusrc](https://xz.aliyun.com/t/11504) -- SecWiki News - - [SecWiki News 2022-07-13 Review](http://www.sec-wiki.com/?2022-07-13) -- 跳跳糖 - 安全与分享社区 - - [codeql with JNDI injection](https://tttang.com/archive/1660/) -- Trustwave Blog - - [Decade Retrospective: The State of Vulnerabilities](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/decade-retrospective-the-state-of-vulnerabilities/) -- Microsoft Security Blog - - [Microsoft recognized as a Leader in UEM Software 2022 IDC MarketScape reports](https://www.microsoft.com/security/blog/2022/07/13/microsoft-recognized-as-a-leader-in-uem-software-2022-idc-marketscape-reports/) - - [Uncovering a macOS App Sandbox escape vulnerability: A deep dive into CVE-2022-26706](https://www.microsoft.com/security/blog/2022/07/13/uncovering-a-macos-app-sandbox-escape-vulnerability-a-deep-dive-into-cve-2022-26706/) -- 先知安全技术社区 - - [[有手就行]Log4j打点后与管理员斗智斗勇](https://xz.aliyun.com/t/11524) - - [某次钓鱼邮件分析（Emotet木马）](https://xz.aliyun.com/t/11519) - - [docker未授权漏洞蜜罐模拟与捕获分析](https://xz.aliyun.com/t/11521) - - [第二次挖edusrc与人生的第一个edusrc](https://xz.aliyun.com/t/11504) -- Security Boulevard - - [Join Lightspin at fwd:cloudsec and AWS re:Inforce](https://securityboulevard.com/2022/07/join-lightspin-at-fwdcloudsec-and-aws-reinforce/) - - [Why Security Teams Need to Patch Faster to Stay Ahead of Exploitation](https://securityboulevard.com/2022/07/why-security-teams-need-to-patch-faster-to-stay-ahead-of-exploitation/) - - [New Research: SOC Modernization and the Role of XDR](https://securityboulevard.com/2022/07/new-research-soc-modernization-and-the-role-of-xdr/) - - [Offensive Security – Elite Bundle Datasheet](https://securityboulevard.com/2022/07/offensive-security-elite-bundle-datasheet/) - - [BSidesSF 2022 – Ryan Robinson’s And Nicole Fishbein’s ‘Go With The (Work)flow’](https://securityboulevard.com/2022/07/bsidessf-2022-ryan-robinsons-and-nicole-fishbeins-go-with-the-workflow/) - - [Enter Through the Gift Shop: Door Controls, Phones & Rootkits](https://securityboulevard.com/2022/07/enter-through-the-gift-shop-door-controls-phones-rootkits/) - - [The Cost of Ownership Demands Attention: Choosing the Right Tool for IRM](https://securityboulevard.com/2022/07/the-cost-of-ownership-demands-attention-choosing-the-right-tool-for-irm/) - - [10 Years Journey into API Security Vulnerabilities with Ivan, the CEO of Wallarm](https://securityboulevard.com/2022/07/10-years-journey-into-api-security-vulnerabilities-with-ivan-the-ceo-of-wallarm/) - - [FAIR Fatigue: A Deeper Dive](https://securityboulevard.com/2022/07/fair-fatigue-a-deeper-dive/) -- 安全脉搏 - - [论大型闪电式红蓝对抗战术方法论——上篇：攻](https://www.secpulse.com/archives/183054.html) - - [网络安全行业视角论——论双赢即“客户”（第四季）](https://www.secpulse.com/archives/183051.html) - - [网络安全行业视角论——论“事前”企业信息安全建设（第三季）](https://www.secpulse.com/archives/183044.html) - - [网络安全行业视角论——论质量既“品牌”（第二季）](https://www.secpulse.com/archives/183031.html) - - [网络安全行业视角论——论服务既“销售”（第一季）](https://www.secpulse.com/archives/183025.html) -- Files ≈ Packet Storm - - [Sourcegraph gitserver sshCommand Remote Command Execution](https://packetstormsecurity.com/files/167741/sourcegraph_gitserver_sshcmd.rb.txt) - - [Ubuntu Security Notice USN-5256-1](https://packetstormsecurity.com/files/167740/USN-5256-1.txt) - - [Ubuntu Security Notice USN-5510-2](https://packetstormsecurity.com/files/167739/USN-5510-2.txt) -- NowSecure - - [NowSecure Completes SOC 2 Audit for Security](https://www.nowsecure.com/blog/2022/07/13/nowsecure-completes-soc-2-audit-for-security-2/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [嘶吼2022网络安全产业图谱正式发布](https://www.4hou.com/posts/r7Y2) - - [创新“零事故”之路：2022年北京网络安全大会开幕](https://www.4hou.com/posts/wgk8) - - [BCS 2022大会开幕 奇安信发布全新终端安全产品矩阵](https://www.4hou.com/posts/vJj5) - - [反垃圾邮件网关工作原理-Coremail带你杰创智能如何使用邮件网关安全升级](https://www.4hou.com/posts/q82p) - - [BCS齐向东：网络安全“零事故”要求联合作战、精准防护、深度运营](https://www.4hou.com/posts/r7Yp) -- 128 nops and counting - - [Eat my shorts](https://carstein.github.io/2022/07/13/eat-my-shorts.html) -- Envato Tuts+ Code - Mobile Development - - [Android SDK: Creating Custom Views](https://code.tutsplus.com/tutorials/android-sdk-creating-custom-views--mobile-14548) -- Binary Ninja - - [Introducing Decompiler Explorer](https://binary.ninja/2022/07/13/introducing-decompiler-explorer.html) -- root@cyberworld:~# Noah Lab - - [云沙箱流量识别技术剖析](http://noahblog.360.cn/yun-sha-xiang-liu-liang-shi-bie-ji-zhu-pou-xi/) -- SentinelOne - - [How Attackers Exploit Security Support Provider (SSP) for Credential Dumping](https://www.sentinelone.com/blog/how-attackers-exploit-security-support-provider-ssp-for-credential-dumping/) -- Forcepoint - - [Forcepoint Cloud Network Firewall Receives AAA Rating from CyberRatings.org](https://www.forcepoint.com/blog/insights/cloud-network-firewall-receives-aaa-rating-cyberratings-org) -- blog.avast.com EN - - [Digital break-up kit: Raising tech abuse awareness](https://blog.avast.com/digital-break-up-kit) -- SAP Blogs - - [Enhancements in SAP S/4 HANA Project Manufacturing Management and Optimization (PMMO)](https://blogs.sap.com/2022/07/13/enhancements-in-sap-s-4-hana-project-manufacturing-management-and-optimization-pmmo/) - - [What is Data Analyzer in SAP Analytics Cloud and how to add it as a hyperlink to a table in a Story?](https://blogs.sap.com/2022/07/13/what-is-data-analyzer-in-sap-analytics-cloud-and-how-to-add-it-as-a-hyperlink-to-a-table-in-a-story/) - - [Leveraging BTP services in Microsoft Power Platform](https://blogs.sap.com/2022/07/13/leveraging-btp-services-in-microsoft-power-platform/) - - [Get ready for the 2208 SAP Ariba Early Release Series](https://blogs.sap.com/2022/07/13/get-ready-for-the-2208-sap-ariba-early-release-series/) - - [SPRINT1 for Utilities Industry Cloud](https://blogs.sap.com/2022/07/13/sprint1-for-utilities-industry-cloud/) - - [Customize default layout of Fiori App Balance Sheet/Income Statement – Multidimensional Report in S/4HANA](https://blogs.sap.com/2022/07/13/customize-default-layout-of-fiori-app-balance-sheet-income-statement-multidimensional-report-in-s-4hana/) - - [Query on CMIS Repository #2](https://blogs.sap.com/2022/07/13/query-on-cmis-repository-2/) - - [Guided Sourcing: a simple solution for complex sourcing](https://blogs.sap.com/2022/07/13/guided-sourcing-a-simple-solution-for-complex-sourcing/) - - [Thailand: Guidelines on Transferring SAP generated text file to RD Prep (VAT & Withholding Tax)](https://blogs.sap.com/2022/07/13/thailand-guidelines-on-transferring-sap-generated-text-file-to-rd-prep-vat-withholding-tax/) -- Malwarebytes Labs - - [Ransomware rolled through business defenses in Q2 2022](https://blog.malwarebytes.com/business/2022/07/ransomware-rolled-through-business-defenses-in-q2-2022/) - - [Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign](https://blog.malwarebytes.com/threat-intelligence/2022/07/cobalt-strikes-again-uac-0056-continues-to-target-ukraine-in-its-latest-campaign/) - - [WhatsApp warns users: Fake versions of WhatsApp are trying to steal your personal info](https://blog.malwarebytes.com/cybercrime/2022/07/whatsapp-warns-users-fake-versions-of-whatsapp-are-trying-to-steal-your-personal-info/) - - [Update now—July Patch Tuesday patches include fix for exploited zero-day](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/07/update-now-july-patch-tuesday-patches-include-fix-for-exploited-zero-day/) -- Reverse Engineering - - [Introducing Decompiler Explorer](https://www.reddit.com/r/ReverseEngineering/comments/vydv1d/introducing_decompiler_explorer/) -- Current Posts - Red Team Journal - - [The Survivors Exceeded the Minimum](https://www.redteamjournal.com/blog/survivors-exceeded-minimum) -- Application Security Blog - - [Top open source licenses and legal risk for developers](https://www.synopsys.com/blogs/software-security/top-open-source-licenses/) -- Microsoft Security Response Center - - [All Hands-on Deck: A Whole-of-Society Approach for Cybersecurity](https://msrc-blog.microsoft.com/2022/07/13/all-hands-on-deck-a-whole-of-society-approach-for-cybersecurity/) -- The Daily Swig | Cybersecurity news and views - - [Vulnerability in AWS IAM Authenticator for Kubernetes could allow user impersonation, privilege escalation attacks](https://portswigger.net/daily-swig/vulnerability-in-aws-iam-authenticator-for-kubernetes-could-allow-user-impersonation-privilege-escalation-attacks) - - [Vivaldi browser founder Jon von Tetzchner puts privacy at the center of development](https://portswigger.net/daily-swig/vivaldi-browser-founder-jon-von-tetzchner-puts-privacy-at-the-center-of-development) -- KitPloit - PenTest & Hacking Tools - - [Bypass-Url-Parser - Tool That Tests Many URL Bypasses To Reach A 40X Protected Page](http://www.kitploit.com/2022/07/bypass-url-parser-tool-that-tests-many.html) -- Wallarm - - [10 Years Journey into API Security Vulnerabilities with Ivan, the CEO of Wallarm](https://lab.wallarm.com/10-years-journey-into-api-security-vulnerabilities-with-ivan-the-ceo-of-wallarm/) -- 虎符智库 - - [“零事故”之路——齐向东在BCS2022战略峰会上的演讲](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247487825&idx=1&sn=685527a7d0da37ecc600be295beacb24&chksm=971e7c53a069f545395c5bd4a4204870d5427c26c3f4dada138c6b12462ff708a103f83d1805&scene=58&subscene=0#rd) -- 雷神众测 - - [从劫持的角度看权限维持](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498599&idx=1&sn=0257fdb9c4683dafb552547e9b715fdc&chksm=f2584914c52fc0020d3b81c480459e4908a681ad1dbf7cffb518765d42106bdfe7aa952e4fda&scene=58&subscene=0#rd) -- Seebug漏洞平台 - - [Pocsuite3 入门教程](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650963075&idx=1&sn=31d9dd7f02ea26d6ae0f77e6d8271c0b&chksm=80793eb1b70eb7a709e4445827f22ddc20efea9918714fd5c1ab30865b4581113b1dbe47b085&scene=58&subscene=0#rd) -- Checkmarx.com - - [APIs Are Great – But Only If You Manage API Sprawl and Security Risks](https://checkmarx.com/blog/apis-are-great-but-only-if-you-manage-api-sprawl-and-security-risks/) -- 奇安信CERT - - [微软2022年7月补丁日多产品安全漏洞风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496437&idx=1&sn=ea73f7efe0954c9ab9dea943c2b8666d&chksm=fe79d66dc90e5f7be42d2cec4604c6aecdcf028060bf774432e59acde813b60fd709ebc237c2&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [BCS2022|齐向东：“零事故”将成为网络安全建设新目标](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502145&idx=1&sn=abfcc511135b2ce6b7427289703d60d6&chksm=ea663e36dd11b7200742b7d57b430d7fe4790a71e4ed807fa40755d39d2d65be94b1a1c6b12f&scene=58&subscene=0#rd) - - [BCS2022|创新“零事故”之路：2022年北京网络安全大会开幕](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502145&idx=2&sn=595cfc88a308ca492ed93859d3164072&chksm=ea663e36dd11b72043b1f0dd923f0461451996dd841e22a9186434b354d5bd565614d514fa2f&scene=58&subscene=0#rd) - - [预告BCS2022|共享全球视野，安全战略峰会明日精彩继续](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502145&idx=3&sn=07dcc69534ba40bfcc66303c637e1fa6&chksm=ea663e36dd11b7202e711ea4deb8bbba5b19f1896f0199684c911e3422eeb2b0815a4d85a281&scene=58&subscene=0#rd) -- 威努特工控安全 - - [威努特，中国工控安全领域双第一！](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651086072&idx=1&sn=8d7072d15e35c9124809dc8dd8f5691e&chksm=80e64648b791cf5e67be2f7a009980f2845b43a62d531a6fbf5b1b139a044b3ac98e1716670b&scene=58&subscene=0#rd) -- 360Quake空间测绘 - - [种草ICON](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247485994&idx=1&sn=372694eb7e69f564c74c1f6d8817a1f6&chksm=c37b8dc1f40c04d729f947a96ab6c03c9a9b8102f8296f9b4be0b367028c065bcb49eae6493b&scene=58&subscene=0#rd) -- 安全牛 - - [洞察新形势，建设业务安全防护新体系](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116026&idx=1&sn=0a6e774bd0ea98a7d579b2ad1e5fef82&chksm=bd1461298a63e83f08722745af02a863067a5413a72a7fd4538ff05244f51d3d2891fa8cc825&scene=58&subscene=0#rd) - - [从真实事件看软件供应链攻击的常见手法与防护](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116026&idx=2&sn=73cb9aaee28666f79c1516c6720aab28&chksm=bd1461298a63e83f5ad90deb2538549a85db455e99b12ea66b666f7faa50bed8aff10cd6fb4b&scene=58&subscene=0#rd) - - [全国信安标委对2项信息安全技术标准征求意见](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116026&idx=3&sn=1b4afe8d16564922a73c737f6064e13b&chksm=bd1461298a63e83fb41e242696170b62162c4897df885ba5e391507c0c255c5e1538b9ca8712&scene=58&subscene=0#rd) -- 极客公园 - - [韦布空间望远镜，100 亿美金到底值不值？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959637&idx=1&sn=314e101e9f5dc1c0c382b0e3060c1d98&chksm=7e558e2349220735f3a6d81b28a32082b9a2654bec01e9f57319ad83136e1afc7d9f1c54053a&scene=58&subscene=0#rd) - - [尼康回应「停止研发单反」：会继续生产；苹果与 Jony Ive 「彻底分手」；乐视：400 员工不靠《甄嬛传》存活｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959614&idx=1&sn=813d1b25966697b32772bb025fe0c698&chksm=7e558ec8492207dec69c002e4cc9c6671767592c97f9a1672cca5b82d20b06baec6b1a1f3ec6&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [2022 CWE Top 25年度常见软件漏洞榜单](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494626&idx=1&sn=8e5c14866789c5c0390d87650d72b7d5&chksm=fa523e5ccd25b74ad1d76c79e837718502e0bb27a00122547f9341d37d40b93f213baf349921&scene=58&subscene=0#rd) -- SecIN技术平台 - - [原创 | CVE-2019-0808](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494467&idx=1&sn=6188bd48221567077d761d469d56cea7&chksm=eb84b617dcf33f01566c397e682fe4dfc34c0da21f026f5c723d38c73a7e94db582ea965f4b2&scene=58&subscene=0#rd) -- Tide安全团队 - - [动态防护技术](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247499500&idx=1&sn=c05ce7eb38e059b4f4928094f2a76cc9&chksm=ce5ddc8df92a559b15e3a477ea54bd5bd47b0715bc1d5d0ba8a7adf2b9bebf5303cf338abf24&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [Win10剪贴板失灵(未解决)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486024&idx=1&sn=9031baab90d9c93e2fbf4f1d51baa6a5&chksm=fab2c977cdc540611cc65a4094ec544f2d7fb9696a9591ca6cac76e99afe61637f699b156c85&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [物联网安全威胁情报（2022年6月）](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528812&idx=1&sn=758b407d4958291b9c853b54ddee62de&chksm=c1e9fd3df69e742b82bad58304a1d0df178ee94c60690c531c08ab14e305c636a0f30d3ad9b2&scene=58&subscene=0#rd) - - [数据出境风险自评估要点解析](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528812&idx=2&sn=bb8d7d2720b4064c8ef7988f6080e13c&chksm=c1e9fd3df69e742b745f67cf7cc0b9da728bbbdf078b9182f5d10b56973c30dc8096fa8cafba&scene=58&subscene=0#rd) - - [数据安全治理的中国智慧](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528812&idx=3&sn=c75be49556cde8e9245d592ab087f6b4&chksm=c1e9fd3df69e742b99ac9dcb43b68743d51261a23d91e34b347706e66b31b2df75093cb1bbac&scene=58&subscene=0#rd) - - [印度洪水监测系统遭勒索软件攻击，水文数据全部被加密](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528812&idx=4&sn=0dd797e287a9c2510b423d5a252d13c8&chksm=c1e9fd3df69e742b16845c7f8a17e51c1926f8ee44df66a9cc568b0de6fc67ec7d577c43da6c&scene=58&subscene=0#rd) - - [经济衰退和不确定性大背景下网络安全堪称最安全行业之一！风投如何在充满挑战的时代投资网络安全创业公司？](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247528812&idx=5&sn=01fd8d4a7b16ced186ce94e111e095a1&chksm=c1e9fd3df69e742b58951ec08d1d6cb717369efeab0f6fa4856d21c233f7de0b7314f7001954&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [物联网安全威胁情报（2022年6月）](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529450&idx=1&sn=2500e7d44df31ef242dcb0c5d7889ae9&chksm=fa93c52bcde44c3d23338074957a2bedaa0e6c20be84b65a4f812de11c91c9b1ff49b8fe7a74&scene=58&subscene=0#rd) - - [数据出境风险自评估要点解析](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529450&idx=2&sn=e15ff3a35a64ffb0f1b7f10eacd40db5&chksm=fa93c52bcde44c3db15cfcbb7861e7829473ea68a75a0cd31fea3665a511ab162ee7617dc62b&scene=58&subscene=0#rd) - - [Kaiser医疗集团泄露了近7万份医疗记录](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529450&idx=3&sn=d39000f688f29858a18190badd12a4e9&chksm=fa93c52bcde44c3dad5d93e2549f10020c64058795595b76f8bb6c921138584fa5f04269ef75&scene=58&subscene=0#rd) - - [警惕Google更新，可能是勒索软件伪装](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529450&idx=4&sn=0663c8b752177ca8bc872108e9fb8875&chksm=fa93c52bcde44c3d3205120d31be7d646f0dadf8502a653e17370182bd9830da04ca80797b13&scene=58&subscene=0#rd) - - [执法部门成为网络攻击热门目标](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529450&idx=5&sn=8418c82029b5674217ab5f93fe4e8a1b&chksm=fa93c52bcde44c3d2d26d2dc1516b7528c2c8c2295b675411ffccaec743634a2a03db6a19b9b&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [Microsoft发布2022年7月安全更新](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491968&idx=1&sn=e84a394cce2ef2a4bfabc2e87809652e&chksm=fd74d149ca03585fc14f42b4bcfe26ccf0159d823b06f220f91db600ce2ff78b8dcccbb84015&scene=58&subscene=0#rd) -- 安全威胁情报 - - [如何利用X/S打好攻防演习](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173097&idx=1&sn=7e7d97f5cef42a07f923e1d01ba8e000&chksm=f4489515c33f1c033be95008a3a986126c9c38793a9cde7e49646bd94d1626b51ed48637d4ff&scene=58&subscene=0#rd) - - [网络安全行业视角论——论双赢即“客户”（第四季）](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173097&idx=2&sn=5bbba6ad6f7d4502602032246c480c7c&chksm=f4489515c33f1c03ea4dad8ff6b7705349aa9974206b93ef5fa11985d4394a4300a5169e5963&scene=58&subscene=0#rd) -- 盘古实验室 - - [BCS2022|齐向东：“零事故”将成为网络安全建设新目标](https://mp.weixin.qq.com/s?__biz=MzI2MDA0MTYyMQ==&mid=2654403506&idx=1&sn=4d44f26466e73eb8c24a9dcf0a38fb2a&chksm=f1ade548c6da6c5e6a8bffd947c8fe7b8eee0c23ce3e42216bc7b162713972a16f6bdd969559&scene=58&subscene=0#rd) - - [BCS2022|创新“零事故”之路：2022年北京网络安全大会开幕](https://mp.weixin.qq.com/s?__biz=MzI2MDA0MTYyMQ==&mid=2654403506&idx=2&sn=fe6f038106e69a388ea436507943f876&chksm=f1ade548c6da6c5ebe9f5d7c3b3d6b07ba4b731ddc8841a18bb7366202b7a6a3d8c585e351be&scene=58&subscene=0#rd) - - [方滨兴出席2022北京网络安全大会 解析“四蜜”对冬奥防护实践成效](https://mp.weixin.qq.com/s?__biz=MzI2MDA0MTYyMQ==&mid=2654403506&idx=3&sn=c94a8aaa55ca0b44f4b0c11d0da4d8b9&chksm=f1ade548c6da6c5ea8be77f6a520fe57b62a37ae7c122e77ef00401a52e92650e17a2086f8a0&scene=58&subscene=0#rd) - - [BCS2022|重大活动网络安保的“零事故”之路](https://mp.weixin.qq.com/s?__biz=MzI2MDA0MTYyMQ==&mid=2654403506&idx=4&sn=3938946aa07322f9e13b14003d99aa1f&chksm=f1ade548c6da6c5e54e231ec371874a9ee7c7cb29cd5a8a3aa817c276f75235936b2231f907e&scene=58&subscene=0#rd) - - [BCS2022|“体系化防御，数字化运营” 奇安信终端安全能力再升级](https://mp.weixin.qq.com/s?__biz=MzI2MDA0MTYyMQ==&mid=2654403506&idx=5&sn=cd32730754e98d421be2e4124844e9ec&chksm=f1ade548c6da6c5e93f27a22c0c7f0ab14950b8649ed12e6108d95a904402c7332850cfecdd9&scene=58&subscene=0#rd) - - [预告BCS2022|共享全球视野，安全战略峰会明日精彩继续](https://mp.weixin.qq.com/s?__biz=MzI2MDA0MTYyMQ==&mid=2654403506&idx=6&sn=477aa7cc616cf50d36a5f75892ec0867&chksm=f1ade548c6da6c5ee00eec09622fc23859ba3de053ee1e73c0cad38e76469c718bfcc60a4086&scene=58&subscene=0#rd) -- PeiQi文库 - - [【直播预告】如何高效“临阵磨枪”，快速完善安全防御体系？](https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247493567&idx=1&sn=d9b801187c29f1d022c17979d6fbe542&chksm=cecc4fe6f9bbc6f04605fa992b0f6c007cf6d1ed8dc55c7a1cc4141da6353c566f8186fe7cd1&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [安全通告 | 疑似PurpleFox多手段持续实施攻击活动](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247490216&idx=1&sn=a71038b3ae1908e68b09d74f541d7ab2&chksm=ec1bfb7bdb6c726d47ca0f30517a399206be0f06e4611f33e987f4de6d4bb6757f8fbc12a7b9&scene=58&subscene=0#rd) -- 中国信息安全 - - [BCS2022 | 齐向东：“零事故”将成为网络安全建设新目标](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161871&idx=1&sn=2f3dad83f61390a273d0b960b2d3151e&chksm=8b5ee0b6bc2969a0c493b526553b93febd8ff658b0c27e4a2ad0c948789b01909e31f67e7e85&scene=58&subscene=0#rd) - - [专家解读｜数据出境安全制度的新探索](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161871&idx=2&sn=a95d5b9a4acf06576e7ce34ef03a2fff&chksm=8b5ee0b6bc2969a04eb7ef0ba7be3ee6827099fce1fc288abc9e56cf9cbbe772f8e4274a6d06&scene=58&subscene=0#rd) - - [通知 | 《信息安全技术 电子发现 第1部分：概述和概念》（征求意见稿）等2项国家标准公开征求意见](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161871&idx=3&sn=a9ae1757f0097f8addd9c2f352708c6c&chksm=8b5ee0b6bc2969a05aa145c2763f9c8e00823edddddc3e9cdd097cdb0698fa75b8ce85fa87ed&scene=58&subscene=0#rd) - - [关注 | 中央网信办召开提升全民数字素养与技能工作推进会议](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161871&idx=4&sn=892d058c15a62193a79732f1e35d8902&chksm=8b5ee0b6bc2969a00862a9ca01035a8a90aa2acff88cb8090d6b225079f8ff3086bf4b34dd1d&scene=58&subscene=0#rd) - - [《2021年中国互联网安全报告》：API威胁暴涨超200%，软件供应链安全风险加剧](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161871&idx=5&sn=37086051e74838028706f25d964c50d3&chksm=8b5ee0b6bc2969a0dd3f27ffd59a6c46d2092c978d5ba2519d20ea793137ca4d434919bc344a&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于微软7月补丁日多个产品高危漏洞风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495677&idx=1&sn=2e448ec89b1370080c4a63b64f4249b1&chksm=ce96a2c3f9e12bd52ace7863ddae973a1f99dd1de6fcaf7bfa5c4011f802feca48d36d773873&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Jul.13th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495677&idx=2&sn=d67198c4fcc7c3da82a09f3d3fcca895&chksm=ce96a2c3f9e12bd55e5714bdd87df78e9b12f2d32660d6e984b4fd4757d3e86b8a0e761e00be&scene=58&subscene=0#rd) -- 补天平台 - - [BCS2022|齐向东：“零事故”将成为网络安全建设新目标](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494686&idx=1&sn=6f29ad4169fd94170975199d3d4f2d78&chksm=eaf9a452dd8e2d44673ed5aed06042a038ba29769a3d8b058cb8ca5c1fe726d0200cfb697dd8&scene=58&subscene=0#rd) - - [BCS2022|创新“零事故”之路：2022年北京网络安全大会开幕](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494686&idx=2&sn=a6b4dc8a57d28bfada7760d3d5d34f5d&chksm=eaf9a452dd8e2d4460295069f7c36c8875374a44ecbcbbf773a065edd117316d9a66ab44dad0&scene=58&subscene=0#rd) - - [预告BCS2022|共享全球视野，安全战略峰会明日精彩继续](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494686&idx=3&sn=8a47e9964dd551433aa7992df97aea17&chksm=eaf9a452dd8e2d44be17a0d4476c1efc84d0e139da10c947852c09b46507188013c41053c8de&scene=58&subscene=0#rd) -- 网安寻路人 - - [数据出境风险自评估要点解析](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495546&idx=1&sn=c9a73b781279f2fb2f28b6f578d56284&chksm=97e95290a09edb86adfcf07f877c20fd2d76073769b0bba63416cf345bd5745cec1d66d6b21d&scene=58&subscene=0#rd) -- 酒仙桥六号部队 - - [JARM指纹随机化技术实现 | 高级攻防10](https://mp.weixin.qq.com/s?__biz=MzAwMzYxNzc1OA==&mid=2247500476&idx=1&sn=d2fee8f6751bf197ada1d3318ce6cec3&chksm=9b3ae40dac4d6d1b91032774330b6914dca2f9a142021e80b8f693770092cbd8d011030bdba9&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [速览智能设备的OTA升级](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247488788&idx=1&sn=31389ac006cd2325c757face05cec51b&chksm=e9b93378deceba6ea46ca811e64d43c86af658c23e20c29bdcddf3f69ecc17efac082b83c8c2&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [车主信息泄露事件频现，智慧停车平台数据安全建设刻不容缓](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493770&idx=1&sn=192f3a3a09d6b3b2ef83370cc1c67b20&chksm=eb12ceb1dc6547a7815297cb4542da1286d4ef473608d5f404e98d2359c561328e93bdd2be62&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [可防！AutoCAD木马病毒再度出山，肆虐江湖](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262684&idx=1&sn=c4264582a6729b59c29e8dd900d49f7a&chksm=f3e276e8c495fffea62d975a6b90b662147098f3d0a44731d338ed99132ff2c4483d9ce5f08f&scene=58&subscene=0#rd) - - [【安全公告】微软补丁日安全通告|7月份](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262684&idx=2&sn=887507ec0168eb464b4f21b67fbc18c1&chksm=f3e276e8c495fffe7bc6bbae0e331c80ca21bf2e220c2f4a3f4b3f3ebcdb5b009b723713c819&scene=58&subscene=0#rd) - - [【漏洞通告】Windows CSRSS本地提权漏洞CVE-2022-22047](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650262684&idx=3&sn=e0c924a0c706911c17e29904cd56670e&chksm=f3e276e8c495fffee2212357d976dff632b7775fc4969f3421c9ec089b83b9c338f2746fd13b&scene=58&subscene=0#rd) -- 情报分析师 - - [【370页必读书】开源情报方法和工具：在线情报实用指南](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510275&idx=1&sn=4663c6290f811c4f62b33f79208731aa&chksm=8716bd88b061349ee421907652faf76aac215651e48ae0e6475e0c02424973bf2c1faf9789f5&scene=58&subscene=0#rd) - - [【情报百科】日本宗教分析](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510275&idx=2&sn=62a76255cb4efffdabffac74f43c5d21&chksm=8716bd88b061349e5f7115bbc004e5b1b2363fc25816abf57a354a0a815ffcd3202827f73ff1&scene=58&subscene=0#rd) -- 三六零CERT - - [2022-07 补丁日: 微软多个漏洞安全更新通告](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491154&idx=1&sn=dcf4dc8b7a21a1ffa81b99d8442ed7d9&chksm=fe251b53c95292456a0773e2c8798411f95c3a4493b6fdb9649486467254ee43648a0ad6e9b4&scene=58&subscene=0#rd) - - [安全日报（2022.07.13）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491154&idx=2&sn=7f41c6e14debf517f9351c79ac10bd52&chksm=fe251b53c9529245996afe393d6114bf5558adcb63ea751251a547a559d7a7dc0a0332a66669&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [嘶吼2022网络安全产业图谱正式发布](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545515&idx=1&sn=9816a959eb2cc21d99dec7d09e736296&chksm=e915e291de626b87baa152389c2dbff01c1f94951082e00e7e4a786a9344b79fddf2f85c22d7&scene=58&subscene=0#rd) - - [“几乎不可能被检测到”的Linux恶意软件](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545515&idx=2&sn=235629174090f0c5c500ac91a6e6da56&chksm=e915e291de626b87856dbdb65d99bcafd8d68d83e71bb44995b3782167f7a42c6f906bc13645&scene=58&subscene=0#rd) - - [滥用 Tyk 的 API 网关提供的 API 路由转发能力隐藏恶意 C2 流量](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545515&idx=3&sn=2bace4a43a984f06bac5652c497edb7d&chksm=e915e291de626b87966b96779bda0750e537efa9691ae6680584126f2554a96527ca37272d14&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜返璞归真：重新审视物理安全与近源渗透](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135030&idx=1&sn=cc6d0aa06776532b689301bc40d5ff66&chksm=f2c11d56c5b6944098ab649d53f9252eea743383f89efaa9997c33a249e4e02744c9b66cb0ba&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-15.md b/archive/2022/2022-07-15.md deleted file mode 100644 index 427fe9b78f..0000000000 --- a/archive/2022/2022-07-15.md +++ /dev/null @@ -1,216 +0,0 @@ -# 每日安全资讯（2022-07-15） - -- Sploitus.com Exploits RSS Feed - - [WordPress 6.0 - Visual Slide Box Builder 3.2.9 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37840&utm_source=rss&utm_medium=rss) - - [Sourcegraph gitserver sshCommand Remote Command Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37839&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5519-1](https://packetstormsecurity.com/files/167753/USN-5519-1.txt) - - [Ubuntu Security Notice USN-5520-1](https://packetstormsecurity.com/files/167752/USN-5520-1.txt) - - [Ubuntu Security Notice USN-5518-1](https://packetstormsecurity.com/files/167751/USN-5518-1.txt) - - [Ubuntu Security Notice USN-5517-1](https://packetstormsecurity.com/files/167750/USN-5517-1.txt) - - [Ubuntu Security Notice USN-5516-1](https://packetstormsecurity.com/files/167749/USN-5516-1.txt) - - [Ubuntu Security Notice USN-5515-1](https://packetstormsecurity.com/files/167748/USN-5515-1.txt) - - [Ubuntu Security Notice USN-5514-1](https://packetstormsecurity.com/files/167747/USN-5514-1.txt) - - [Ubuntu Security Notice USN-5513-1](https://packetstormsecurity.com/files/167746/USN-5513-1.txt) - - [Ubuntu Security Notice USN-5473-2](https://packetstormsecurity.com/files/167745/USN-5473-2.txt) - - [Ubuntu Security Notice USN-5511-1](https://packetstormsecurity.com/files/167744/USN-5511-1.txt) - - [WordPress Kaswara Modern WPBakery Page Builder 3.0.1 File Upload](https://packetstormsecurity.com/files/167743/wpkaswara301-upload.txt) - - [PrestaShop 1.7.6.7 Cross Site Scripting](https://packetstormsecurity.com/files/167742/prestashop1767-xssupload.pdf) -- Sec-News 安全文摘 - - [Exploiting Arbitrary Object Instantiations in PHP without Custom Classes](https://wiki.ioin.in/url/KrOa) - - [CVE-2022-32223 Discovery: DLL Hijacking via npm CLI](https://wiki.ioin.in/url/Xrqj) -- Der Flounder - - [Customizing Terminal behavior for documentation needs](https://derflounder.wordpress.com/2022/07/14/customizing-terminal-behavior-for-documentation-needs/) -- Microsoft Security Blog - - [North Korean threat actor targets small and midsize businesses with H0lyGh0st ransomware](https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/) -- Security Boulevard - - [The Power of Machine Learning to Fight Fraud](https://securityboulevard.com/2022/07/the-power-of-machine-learning-to-fight-fraud/) - - [Survey Shows Cyber Insurance Marketplace Badly Needs Risk Quantification](https://securityboulevard.com/2022/07/survey-shows-cyber-insurance-marketplace-badly-needs-risk-quantification/) - - [Changes Coming to OV Code Signing Certificates & Keys Starting Nov. 15](https://securityboulevard.com/2022/07/changes-coming-to-ov-code-signing-certificates-keys-starting-nov-15/) - - [BSidesSF 2022 – Breanne Boland’s ‘Read The Fantastic Manual: Writing Security Docs People Will Actually Read’](https://securityboulevard.com/2022/07/bsidessf-2022-breanne-bolands-read-the-fantastic-manual-writing-security-docs-people-will-actually-read/) - - [OpenCredo Venafi-Vault Wizard: Bringing InfoSec and Developers One Step Closer](https://securityboulevard.com/2022/07/opencredo-venafi-vault-wizard-bringing-infosec-and-developers-one-step-closer/) - - [SOC 2 Compliance and Your Cybersecurity: An Everything Compliance Webinar](https://securityboulevard.com/2022/07/soc-2-compliance-and-your-cybersecurity-an-everything-compliance-webinar/) - - [Fredo and Pidjin™ ‘HODL’](https://securityboulevard.com/2022/07/fredo-and-pidjin-hodl/) - - [GUEST ESSAY: Advanced tools, tactics required to defend latest attack variant — ‘DeepSea phishing’](https://securityboulevard.com/2022/07/guest-essay-advanced-tools-tactics-required-to-defend-latest-attack-variant-deepsea-phishing/) - - [AppSec Decoded: Get the most out of your open source software](https://securityboulevard.com/2022/07/appsec-decoded-get-the-most-out-of-your-open-source-software/) - - [The Great Resignation – Revised](https://securityboulevard.com/2022/07/the-great-resignation-revised/) -- 安全客-有思想的安全新媒体 - - [初探逻辑分析仪](https://www.anquanke.com/post/id/276280) - - [CVE-2022-22980 Spring​ Data MongoDB SpEL表达式注入漏洞分析](https://www.anquanke.com/post/id/276313) - - [Lazarus再整新活 虚假招聘骗得6亿美元加密货币](https://www.anquanke.com/post/id/276354) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [雾帜智能入围《嘶吼2022网络安全产业图谱》“安全自动化/协作（SOAR)”领域](https://www.4hou.com/posts/O9Zr) - - [奇安信总裁吴云坤：关键信息基础设施保护的六个当务之急](https://www.4hou.com/posts/KE6x) - - [信创建设进入“快车道”，信端ESM实现金融安全自主可控](https://www.4hou.com/posts/AOml) - - [蔓灵花（BITTER）APT组织近期针对孟加拉国攻击活动的分析](https://www.4hou.com/posts/9XgJ) - - [【报告发布】因可势・求易道 嘶吼2022网络安全产业图谱研究报告详解](https://www.4hou.com/posts/vJj8) -- Trustwave Blog - - [Trustwave: A Great Place to Start Your Cybersecurity Career](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-a-great-place-to-start-your-cybersecurity-career/) -- paper - Last paper - - [Lazarus 黑客组织使用的 YamaBot 恶意软件分析](https://paper.seebug.org/1932/) -- 安全脉搏 - - [「漏洞分析」Drupal 远程代码执行「CVE-2017-6920」](https://www.secpulse.com/archives/183128.html) - - [TCP/IP协议常见漏洞类型](https://www.secpulse.com/archives/183038.html) - - [基于某商产品WeblogicT3反序列化告警流量分析](https://www.secpulse.com/archives/183094.html) - - [初探逻辑分析仪](https://www.secpulse.com/archives/183072.html) -- 跳跳糖 - 安全与分享社区 - - [从 data 段中加载 PE Executable —— 2022-蓝帽杯-Reverse-Loader Writeup](https://tttang.com/archive/1661/) -- ArthurChiao's Blog - - [Cracking Kubernetes Authentication (AuthN) Model](https://arthurchiao.github.io/blog/cracking-k8s-authn/) -- Twitter @Nicolas Krassas - - [DNS Tunneling: DNS Tunneling using powershell to download and execute a payload](https://twitter.com/Dinosn/status/1547663071631380484) - - [Trufflehog - Find Credentials All Over The Place](https://twitter.com/Dinosn/status/1547662790042693635) - - [Let’s talk about buffer overflow](https://twitter.com/Dinosn/status/1547662258813120515) - - [Predatory Sparrow massively disrupts steel factories while keeping workers safe](https://twitter.com/Dinosn/status/1547662136700051456) - - [Lenovo issues firmware updates after UEFI vulnerabilities disclosed](https://twitter.com/Dinosn/status/1547661846714257410) - - [Exploiting Arbitrary Object Instantiations in PHP without Custom Classes](https://twitter.com/Dinosn/status/1547661763960643584) - - [PayPal phishing kit added to hacked WordPress sites for full ID theft](https://twitter.com/Dinosn/status/1547661683086086144) - - [Ransomware attack on US healthcare debt collector exposes 1.9m patient records](https://twitter.com/Dinosn/status/1547661559366684677) - - [New Browser De-anonymization Technique](https://twitter.com/Dinosn/status/1547655852475052034) - - [Journalists Emerge as Favored Attack Target for APTs](https://twitter.com/Dinosn/status/1547638374344732673) - - [New variant of Android SpyJoker malware removed from Play Store after 3 million+ installs](https://twitter.com/Dinosn/status/1547638250625323009) - - [A very good friend started an amazing concept of 365 days of Jazz @oyecomova66 's channel at youtube, One new song every day for 365 days.](https://twitter.com/Dinosn/status/1547617868484751360) - - [CoinPayments to shut down in US — 5 days left to withdraw funds](https://twitter.com/Dinosn/status/1547537868360409089) - - [Former CIA employee Joshua Schulte was convicted of Vault 7 massive leak](https://twitter.com/Dinosn/status/1547537799678771200) - - [Microsoft Details App Sandbox Escape Bug Impacting Apple iOS, iPadOS, macOS Devices](https://twitter.com/Dinosn/status/1547537728463683590) - - [File Upload Vulnerability Scenarios](https://twitter.com/Dinosn/status/1547504289605632000) - - [The Long Tail of Log4Shell Exploitation](https://twitter.com/Dinosn/status/1547443411871055873) - - [Affinis - Subdomain Discovery Through RNN (Recurrent Neural Network)](https://twitter.com/Dinosn/status/1547443179791831041) - - [From Prototype Pollution to Remote Code Execution in Blitz.js](https://twitter.com/Dinosn/status/1547443126536753152) -- SecWiki News - - [SecWiki News 2022-07-14 Review](http://www.sec-wiki.com/?2022-07-14) -- Sucuri Blog - - [Security Lessons Learned from 2021](https://blog.sucuri.net/2022/07/security-lessons-learned-from-2021.html) -- Recent Commits to cve:main - - [Update Thu Jul 14 11:28:28 UTC 2022](https://github.com/trickest/cve/commit/1ffac48244e6e78f71ba654165ca6576ecb14ca5) -- Forcepoint - - [Forcepoint Classification powered by Getvisibility combines AI-enhanced classification with award-winning DLP](https://www.forcepoint.com/blog/insights/forcepoint-classification-getvisibility-artificial-intelligence) -- Bug Bounty in InfoSec Write-ups on Medium - - [Let’s talk about buffer overflow](https://infosecwriteups.com/lets-talk-about-buffer-overflow-54764101030b?source=rss----7b722bfd1b8d--bug_bounty) -- Twitter @bytehx - - [RT sailay(valen): I just recently found out the way XSS tag without user action autofocusonfocus=alert(0) href>valen href="#"autofocus...](https://twitter.com/404death/status/1547603274647638016) -- Malwarebytes Labs - - [Elden Ring maker Bandai Namco hit by ransomware and data leaks](https://blog.malwarebytes.com/ransomware/2022/07/elden-ring-maker-bandai-namco-hit-by-ransomware-and-data-leaks/) - - [Predatory Sparrow massively disrupts steel factories while keeping workers safe](https://blog.malwarebytes.com/hacking-2/2022/07/predatory-sparrow-massively-disrupts-steel-factories-while-keeping-workers-safe/) - - [New variant of Android SpyJoker malware removed from Play Store after 3 million+ installs](https://blog.malwarebytes.com/android/2022/07/new-variant-of-android-spyjoker-malware-removed-from-play-store-after-3-million-installs/) - - [China’s Tonto Team increases espionage activities against Russia](https://blog.malwarebytes.com/hacking-2/2022/07/chinas-tonto-team-increases-espionage-activities-against-russia/) - - [Endpoint security for Mac: 3 best practices](https://blog.malwarebytes.com/business/2022/07/endpoint-security-for-mac-3-best-practices/) - - [Low-income consumers preyed on by fake ISP during pandemic, FCC says](https://blog.malwarebytes.com/scams/2022/07/low-income-consumers-preyed-on-by-fake-isp-during-pandemic-fcc-says/) -- Reverse Engineering - - [CVE-2022-30136: Microsoft Windows NFS v4 Remote Code Execution Vulnerability](https://www.reddit.com/r/ReverseEngineering/comments/vyzvu5/cve202230136_microsoft_windows_nfs_v4_remote_code/) -- SAP Blogs - - [More than 2250 data products ready to pimp your analytics](https://blogs.sap.com/2022/07/14/more-than-2250-data-products-ready-to-pimp-your-analytics/) - - [SAP Enterprise Support Advisory Council – Kickoff Session](https://blogs.sap.com/2022/07/14/sap-enterprise-support-advisory-council-kickoff-session/) - - [SAP Data Intelligence, trial edition 3.2](https://blogs.sap.com/2022/07/14/sap-data-intelligence-trial-edition-3.2/) - - [Migrate SAP Fiori projects from SAP Web IDE to SAP Business Application Studio (BAS)](https://blogs.sap.com/2022/07/14/migrate-sap-fiori-projects-from-sap-web-ide-to-sap-business-application-studio-bas/) - - [高级公司间转储（5HP）](https://blogs.sap.com/2022/07/14/%e9%ab%98%e7%ba%a7%e5%85%ac%e5%8f%b8%e9%97%b4%e8%bd%ac%e5%82%a8%ef%bc%885hp%ef%bc%89/) - - [How Low-Code is Changing Enterprise Application Development](https://blogs.sap.com/2022/07/14/how-low-code-is-changing-enterprise-application-development/) - - [SAP.iO Foundry Latin America is looking for startups to drive sustainability in agriculture](https://blogs.sap.com/2022/07/14/sap.io-foundry-latin-america-is-looking-for-startups-to-drive-sustainability-in-agriculture/) - - [Expanding SAP SuccessFactors Platform Capabilities with SAP SuccessFactors Employee Central](https://blogs.sap.com/2022/07/14/expanding-sap-successfactors-platform-capabilities-with-sap-successfactors-employee-central/) - - [Question Answering in eCommerce Search](https://blogs.sap.com/2022/07/14/question-answering-in-ecommerce-search/) -- Sucuri Blog - - [Security Lessons Learned from 2021](https://blog.sucuri.net/2022/07/security-lessons-learned-from-2021.html) -- The Daily Swig | Cybersecurity news and views - - [Microsoft Teams security vulnerability left users open to XSS via flawed stickers feature](https://portswigger.net/daily-swig/microsoft-teams-security-vulnerability-left-users-open-to-xss-via-flawed-stickers-feature) -- Application Security Blog - - [AppSec Decoded: Get the most out of your open source software](https://www.synopsys.com/blogs/software-security/appsec-decoded-open-source-software-ossra/) -- Wallarm - - [Open-Source API Firewall Unveils New Feature: Default Deny Lists for Compromised API Tokens and Cookies](https://lab.wallarm.com/open-source-api-firewall-unveils-new-feature-default-deny-lists-for-compromised-api-tokens-and-cookies/) -- 威努特工控安全 - - [态势分析与安全运营平台（SASOC）问答系列（一）——威胁分析篇](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651086392&idx=1&sn=f1212436afa46cf5de46d9a48826e7a1&chksm=80e64488b791cd9e341dfc0b4bcddad8559420c24e58c8472a4afe2883b9579a7a85e2a99c8d&scene=58&subscene=0#rd) -- rtl-sdr.com - - [Rolling-Pwn: Wireless rolling code security completely defeated on all Honda vehicles since 2012](https://www.rtl-sdr.com/rollingpwn-wireless-rolling-code-security-completely-defeated-on-all-honda-vehicles-since-2012/) - - [SelfieStick: Combining noisy signals from multiple NOAA APT satellites for clean imagery](https://www.rtl-sdr.com/selfiestick-combining-noisy-signals-from-multiple-noaa-apt-satellites-for-clean-imagery/) - - [TechMinds: Using a LEO Bodnar GPSDO with a PlutoSDR](https://www.rtl-sdr.com/techminds-using-a-leo-bodnar-gpsdo-with-a-plutosdr/) -- qz安全情报分析 - - [救治企业安全的三颗灵丹](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907790&idx=1&sn=27ec2946f17ded4c3456511b01c27f69&chksm=f18eeb48c6f9625e8331f8d6ddde6cc209901c79c458cdcdd11b3cf56ec3f23fbd1dd542a3f1&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [Trufflehog - Find Credentials All Over The Place](http://www.kitploit.com/2022/07/trufflehog-find-credentials-all-over.html) -- 虎符智库 - - [“零事故”的中国方案——吴云坤在BCS2022上的演讲](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247487850&idx=1&sn=b823cb29877ffe6b2c789ea4976c1027&chksm=971e7c68a069f57e2482f2b6cb30b060dd9f75acef94e4b60bf20b2398333e1266f50f28c3fd&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.07.14）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491157&idx=1&sn=d1e1d0707d399c5db97cc9985caf0c9c&chksm=fe251b54c95292425f68f327b5cbf102e3c60cb3e0ee2a83a20d760c964be9f650da6c5a0f62&scene=58&subscene=0#rd) -- 中国信息安全 - - [专题·漏洞治理 | 践行总体国家安全观，推动网络安全漏洞治理体系建设](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161952&idx=1&sn=2a43bef037c0aa0f85047bc756f39852&chksm=8b5ee059bc29694f1f56f41f6adafb913da72db2ad5463d73169e6eb581f4c3cef01cc56ab54&scene=58&subscene=0#rd) - - [精华观点 | 数安先锋行第一期：“数据安全合规与治理”主题沙龙](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161952&idx=2&sn=14f8e6d90694be33ef0ac9d4932edd46&chksm=8b5ee059bc29694fe39f528a803cf64745d478bc0ec8074127dcce44f8db92d7fbb1b73d04ce&scene=58&subscene=0#rd) - - [专家解读｜​中国为规范数据安全出境作出重要制度安排](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161952&idx=3&sn=891d1f3f38eebbb5a347204a3fab495d&chksm=8b5ee059bc29694fc8248447434028637868b014a8c58c32c1edf793576406e37c1f2c709784&scene=58&subscene=0#rd) - - [观点 | 推广“隐私面单”，以源头之治护航信息安全](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664161952&idx=4&sn=542abdabfdf932c2a45bde5ae4325317&chksm=8b5ee059bc29694f0f2b3b1bd3b0b8cd6ccd634c3a18f9fabf29a9711131acedb048371a5f55&scene=58&subscene=0#rd) -- Tide安全团队 - - [CommonCollections1 Gadget分析](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247499592&idx=1&sn=9e5eee3828cdce1914fa242631e2962d&chksm=ce5ddd29f92a543fedd65137ac41a0ec3eb1f46bdecb9f4d568a41c233c31fee8ec67bc95f13&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [预告BCS2022|共享全球视野，安全战略峰会明日精彩继续](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247490172&idx=1&sn=648485520c501fca990cf202759f430b&chksm=ec6a6a54db1de3424c144fb57b6ddbb8d4798602c4aeef28c951fcfa10171ed804d8774541a0&scene=58&subscene=0#rd) -- 看雪学院 - - [直播倒计时1天！腾讯零信任iOA解决方案](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458347&idx=1&sn=b57dd097db7cfa79dda70dfa3cd278ad&chksm=b18e286186f9a17751071593f5d270a9a141140b209e5a9afc8a57a23db60684a14caeb77ba2&scene=58&subscene=0#rd) - - [House of apple 一种新的glibc中IO攻击方法](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458347&idx=2&sn=4f598ec1856e4da71332e9b8fe023b66&chksm=b18e286186f9a17758eb61b40a25abbd34f5a78dd45d121e15e26bb23bc5c1197f9c77c6262c&scene=58&subscene=0#rd) - - [联想修复影响70多种产品型号中的三个UEFI固件漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458347&idx=3&sn=d3e0d370c062b65c8c50655d80f7a612&chksm=b18e286186f9a177cd808c7a35d0723724e5c1e02dfd974442b606a6168705218008b640f07f&scene=58&subscene=0#rd) - - [『新课预售』基构网络构建与防护](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458347&idx=4&sn=8c03f6aa91082acd773a1261db398568&chksm=b18e286186f9a177a90b94544e1d17fceab86e2c15341c7b545d10a366a7a5a9fb3e22557fd6&scene=58&subscene=0#rd) -- 数世咨询 - - [[调研]智慧工厂未做好网络攻击应对准备](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494219&idx=1&sn=438d1119b0c6ec3c0bb1f3401eef1e65&chksm=c14498f6f63311e0fc056ac59f17ef861e3373fe929eaee694c802ab7613ce5f8ca15a0f461d&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jul.14th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495679&idx=1&sn=e9eace50e0ae5ea505ba024d085b0c90&chksm=ce96a2c1f9e12bd71b4ee78c203e7f8d74b9074a43ae3d891ec6d1b5ce42c95c5796c84bb4ad&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [【报告发布】因可势・求易道 嘶吼2022网络安全产业图谱研究报告详解](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545667&idx=1&sn=85ecec1a65bebd1e0c5624574fbc3826&chksm=e915e379de626a6ff1b44e69f5954a36f815fa1129ca4c9c10156722be614541e2c30c6abfec&scene=58&subscene=0#rd) - - [蔓灵花（BITTER）APT组织近期针对孟加拉国攻击活动的分析](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545667&idx=2&sn=ff8e14a55ff9e8b7cd6f93db2a2a4dc3&chksm=e915e379de626a6f85a00ec2a51fe279469420aacffaa01a9f01525254f3287e996c749bfb32&scene=58&subscene=0#rd) -- 补天平台 - - [BCS2022|奇安信总裁吴云坤：用四个创新模式应对网络安全产业的四大转变](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494781&idx=1&sn=0b4484fc43f6220f814c07f331561003&chksm=eaf9a431dd8e2d273736067f94c2add437306ebd2d789068b3bd4756659b5705ee342d1f91a2&scene=58&subscene=0#rd) - - [BCS2022|技术升级、理念更新、全球合作——国际网安巨头共论未来网络安全之道](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494781&idx=2&sn=b554797ee324b6020361ad06283873a7&chksm=eaf9a431dd8e2d2764afbdfa6a30253aacce7c7280bb5faa58f634838ca2a99f2b7ab3c2aa64&scene=58&subscene=0#rd) - - [卡巴斯基出席BCS2022：关基设施成为攻击目标 要共建“网络免疫系统”](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494781&idx=3&sn=c778e7c7271f3d3be221142575003e0e&chksm=eaf9a431dd8e2d27d83ec457cbff39af30d31b28fc563831f89acace079b21ed6fafb9e68572&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】CVE-2021-3490 eBPF 32位边界计算错误漏洞利用分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773970&idx=1&sn=b7968724cef926328cc5a195d7b21088&chksm=889367fdbfe4eeeb4f462c9b9b549517c0a77755ae8d7668ff3c71ac6cfa31554a2f2d67812b&scene=58&subscene=0#rd) - - [【安全头条】万代南梦宫披露BlackCat勒索攻击事件](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773970&idx=2&sn=11e7778258d7932b0d1a36e253d9d93a&chksm=889367fdbfe4eeebb72998cedbc83eec2661a74b78c6012261720c0f83605fbe9d88502e6812&scene=58&subscene=0#rd) - - [【技术分享】从Java反序列化漏洞题看CodeQL数据流](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773925&idx=1&sn=2fe5ba6b1353a79616b2662b4ca42de1&chksm=8893670abfe4ee1cc652913e58621225042e5dba33453e2102188fcc6842c35d31b431f2a4aa&scene=58&subscene=0#rd) - - [【安全头条】Lazarus再整新活 虚假招聘骗得6亿美元加密货币](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649773925&idx=2&sn=235f68d43bd9bef111a2e9901dd57ff2&chksm=8893670abfe4ee1c840df8de38f0c0fd801ea26906a0378deae3a29546d96fd0c59ec9aafa32&scene=58&subscene=0#rd) -- 情报分析师 - - [【实战技法】使用健身应用程序识别和跟踪军事与安全人员](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510413&idx=1&sn=e7c500bd98d76e6e9dba2724337ce640&chksm=8716ba06b0613310bee5dd2fba8f9a007b16aeb7d0566831e30ba74820c0e264e4dee1b14caf&scene=58&subscene=0#rd) - - [参谋部联合战略多层评估：俄罗斯的战略意图（171页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510413&idx=2&sn=0e058860c99b5550032d2fee8d70560f&chksm=8716ba06b06133108353b72500a51cf7a54465a449617e22819cdc8a1b491bfdaffa354776b7&scene=58&subscene=0#rd) - - [【情报预测】如果朝鲜进行第七次核试验会怎样？美韩联盟可能的回应](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510413&idx=3&sn=6a2015981d612b0d7629d91d4c0b4283&chksm=8716ba06b061331092dc775443e1d7ae063a73ffd98c8c4d8215050a635e47eeb92f35e73f01&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [DDoS攻击的无情演变](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529478&idx=1&sn=74a3dda7ec9228517899c3e00a1bb4de&chksm=fa93c2c7cde44bd16bc33fdcbf6a15517238284af26092ad7967b81fb1badc097eb7a7fe1d11&scene=58&subscene=0#rd) - - [打击网络犯罪的新武器：隔离和清零](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529478&idx=2&sn=3510e931da712389aa64d428702e3ecb&chksm=fa93c2c7cde44bd17bd7a3b7004aff44c2f93b9d3f0fb7c896486c735e0012a1c3fb5ce80f66&scene=58&subscene=0#rd) - - [美正悄悄押注“深度技术”，加速网络安全进步](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529478&idx=3&sn=d2ecdac275aefc27db01c202752c71ee&chksm=fa93c2c7cde44bd1692660d9e1a12ca3a2af889ae8febb7aea994c04fb7355edd9ee84e38b76&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [火绒安全入选CCIA“2022年中国网安产业成长之星”榜单](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247506239&idx=1&sn=d8be29b0cad300f3541fcf52b347e3fd&chksm=eb700700dc078e16aea7767e6883df8b70f65f43c252dde5a79a63b2d1180bde939410f533ee&scene=58&subscene=0#rd) -- 安全牛 - - [从CISO到CIRO，未来安全领导者的核心价值是什么？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116070&idx=1&sn=02bb91c5798165958dd8b5dc6a0f4cdf&chksm=bd1462f58a63ebe3948877b2f0318d3b8a3ddbe24df854dc0d1ac25e6c57485c4143bbe23c39&scene=58&subscene=0#rd) - - [《商用密码产品认证目录（第二批）》发布](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116070&idx=2&sn=c130010c4e4525f57607e532f759d15b&chksm=bd1462f58a63ebe364e5acbd6abb0b0732f089bf2971a4eaeacb18eb26c5b8c66837e028b30a&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（32期）：如何构建满足企业数字化转型需求的IDAAS服务](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116070&idx=3&sn=16fb50332093b487e2180855c8dcf9ef&chksm=bd1462f58a63ebe3aa6b6a43aa1a2b43f2606c31e91d2343cb7542a6b5c9722f72b3db106c42&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [网络安全信息与动态周报2022年第28期（7月4日-7月10日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496947&idx=1&sn=2d7272f11e8e0b5fb4490862f80ca906&chksm=973ac791a04d4e87be355597871e2e525874b1d5d2f90ab10f69f1f6aa3f845c2d31013d4821&scene=58&subscene=0#rd) - - [Microsoft发布2022年7月安全更新](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496947&idx=2&sn=347d926e3c66458cd5676e2cb905089a&chksm=973ac791a04d4e87b40af6ecd27ffaf17198027b41908860c7b7f8168b6d1630245de64bc9cc&scene=58&subscene=0#rd) -- 美团技术团队 - - [工程效能CI/CD之流水线引擎的建设实践](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651769938&idx=1&sn=6f6456ff0642815571e426639ef3af90&chksm=bd12151f8a659c09d273dd5e8d35bd915ee382d323329f3b0e6724139509723f32be359d26a7&scene=58&subscene=0#rd) -- PaiSecTeam - - [Discord钓鱼攻击案例分析](https://mp.weixin.qq.com/s?__biz=MzU3MTU3NDk4Mw==&mid=2247485129&idx=1&sn=59b75e19df78d594d6c2d7d3aff6842c&chksm=fcdf5961cba8d077d71b1ac5b5187f89774be3b581c3fbf28bb4c4e563c990bb38112f33663e&scene=58&subscene=0#rd) -- 互联网安全内参 - - [美国众议院2023财年拟为网络安全拨款超1000亿元](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504360&idx=1&sn=9848966e50e7dc7a062f3a9514841770&chksm=ebfa96c8dc8d1fdebbfcf7aa7fed2a616a00fdda79a3b8bac941f28b988b578098acbf7fa4e2&scene=58&subscene=0#rd) - - [上海网信办和通管局分别启动2022年度网络安全检查工作](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504360&idx=2&sn=e5ee730249bc2477ededf75ef8cb7f72&chksm=ebfa96c8dc8d1fdef9ef2908955ae3f261f83694811a5510109dfacad6bc91e79809f475a91e&scene=58&subscene=0#rd) - - [一图读懂车联网网络与数据安全专项检查](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504360&idx=3&sn=20801846d56208b4ac4064914a06f442&chksm=ebfa96c8dc8d1fde861d2ca926c76ebce0c7bc8fe61cf73f54f8ae60a4675f1c67de84590e78&scene=58&subscene=0#rd) - - [Nodejs dll劫持漏洞 (CVE-2022-32223) 安全风险通告](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504360&idx=4&sn=cccabea3d064a32e9bbdfd14df83b822&chksm=ebfa96c8dc8d1fde3d64af2ec1649d6ccd8d7b5b4af3d40a95830f68fa042077bc17af9593d0&scene=58&subscene=0#rd) -- 奇安信CERT - - [【已复现】Nodejs Dll 劫持漏洞(CVE-2022-32223)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496453&idx=1&sn=bb1d672b440f09b242aeff4474aa7074&chksm=fe79d79dc90e5e8b1817458c24ae97997725ed65ef04878a422ccd82f9c9e1201d4ef57c7d36&scene=58&subscene=0#rd) - - [奇安信集团2022年07月补丁库更新通告第一次更新](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496453&idx=2&sn=2a590f4c5e03730bf66947278d3c1533&chksm=fe79d79dc90e5e8ba81d66d57bb09d4002eeba8626d6bd08c3a36b60ef61f50cf49edc5177dc&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜击败SOTA反混淆方法](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135031&idx=1&sn=7ad81447e5140f69a1b6ced754e5203e&chksm=f2c11d57c5b69441894d81cd5a131252d580fe0383573016e28fa0d59604bb6ebe086208e2fd&scene=58&subscene=0#rd) -- 锦行信息安全 - - [多领域实力上榜！锦行科技入选《嘶吼2022网络安全产业图谱》](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247490038&idx=1&sn=2100b54914b5d60468db7fc0a1bf6b9f&chksm=9799e253a0ee6b45355b1789db3ca8d0e8f0ee948028daa1ace9779a23dc34566bddc93d4520&scene=58&subscene=0#rd) -- 青藤云安全 - - [100+企业调研 | 洞察云原生安全趋势，详解DevSecOps建设](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650836231&idx=1&sn=63614de66eb28db2920289121df818a7&chksm=80dbeea2b7ac67b4d41e466bf7361b6b4e4a6375b5c04649f2640cb9dc4d44f1a3b316a2c281&scene=58&subscene=0#rd) - - [解决方案 | 企业DevSecOps最佳落地实践方案](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650836231&idx=2&sn=440bdd7de2ebee9cd7484fe788fc22c2&chksm=80dbeea2b7ac67b4a7fecf4c8a9f41ab65b62e9772448e3f5658badbfc6a6fadea9923bd7c9a&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [BCS2022|奇安信总裁吴云坤：用四个创新模式应对网络安全产业的四大转变](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502239&idx=1&sn=00020d12cb24bb22a6f8c93300059030&chksm=ea663ee8dd11b7fec20a935ab409b99afbf8f46e0bbd0642288bdf086ab5f19ca912ff8110ac&scene=58&subscene=0#rd) - - [BCS2022|技术升级、理念更新、全球合作——国际网安巨头共论未来网络安全之道](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502239&idx=2&sn=cde816cc93d1d145f7ce55556484e918&chksm=ea663ee8dd11b7fe2b4cac8525e9fb9d9a28a306c93b24b7f6e417e4f355876d959178aa7445&scene=58&subscene=0#rd) -- 极客公园 - - [后疫情时代启示录：是时候重新审视数字化了](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960153&idx=1&sn=b1bea811d306f600897be4cd4d99dbd2&chksm=7e55882f492201394dad678b8a112a348c749c06974b7b09dee4af74ca273c315004c9e8ea02&scene=58&subscene=0#rd) - - [对于苹果 AR，罗老师这波点评会不会「草率」了？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959957&idx=1&sn=7d7eb51a4105d39c2ec5a6ddd574b104&chksm=7e558963492200755db1a3ee12b405dc2943d9b09b393fe515048c1648ac1aedbec51793046f&scene=58&subscene=0#rd) - - [阿里和 Google 都在布局的图数据库，会如何改变世界？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959957&idx=2&sn=2c8ea52ad65b6acd5d51a9b4413cb488&chksm=7e558963492200755256a2056510a95011d6e688199e10709d9275529cb41970c4335e036da4&scene=58&subscene=0#rd) - - [字节从高通、华为挖芯片人才；特斯拉自动驾驶 AI 负责人离职；欧元 20 年来首次跌至与美元平价｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652959667&idx=1&sn=4ff8dddfb29af4214d5c1dfebc379a4d&chksm=7e558e0549220713a6563130d90f9c1048c7eb863c65bd21d789a54541bc46eac92b7fdafa98&scene=58&subscene=0#rd) -- 雷神众测 - - [Cobaltstrike狩猎与对抗](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498708&idx=1&sn=b607ba43b6c82e3b4bb1953b16acf063&chksm=f25848a7c52fc1b1e461087df178a70cc9f3c6e3c90389d4ec2cb55f723fc0b141a6da890cdd&scene=58&subscene=0#rd) -- 代码卫士 - - [BCS2022|奇安信总裁吴云坤：用四个创新模式应对网络安全产业的四大转变](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512889&idx=1&sn=5f14b5f393ea17185ad74a3fc23437ab&chksm=ea948253dde30b45b748c5e50e25d4164c1c0a2168c3f88228f3261cc436d9469ed947b76988&scene=58&subscene=0#rd) - - [BCS2022|技术升级、理念更新、全球合作——国际网安巨头共论未来网络安全之道](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512889&idx=2&sn=f510505d31609685742180966c83b849&chksm=ea948253dde30b45a6d83ce06017bd88ca9b9e24561309a826ca7c4059399f0346a890e16322&scene=58&subscene=0#rd) - - [Retbleed：针对英特尔和AMD处理器的推断性执行攻击](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512889&idx=3&sn=645a6adc37050f76571e2cf1043659e9&chksm=ea948253dde30b45023fc8b066c2420844a7cfd7b7197f46be2df789dea706f9e2ec61674969&scene=58&subscene=0#rd) - - [适用于Kubernetes 的AWS IAM 验证器中存在漏洞，导致提权等攻击](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247512889&idx=4&sn=bd3623a8d3f38a4206124b8681f1c510&chksm=ea948253dde30b457da57e1cfc42ab6fc1b7c06335250b93b2f6b89654f0b83884057e98fbd5&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [习近平为何说“网络空间关乎人类命运”？](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491410&idx=1&sn=c66f4f146f80a12e65f23d5d9296b842&chksm=feb59e41c9c21757dd9823cc8887ee36f7f7f6710b0d7ca361d40744ed3e71cc5936439632c5&scene=58&subscene=0#rd) - - [专家解读｜数据安全治理的中国智慧](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491410&idx=2&sn=b4347a342cfe43b4849d6b37b325f129&chksm=feb59e41c9c21757835dc988410d593b5661fa971d7fd77abcd7e9fa798bf79fc028ef6b06d0&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-16.md b/archive/2022/2022-07-16.md deleted file mode 100644 index 0910b8a79f..0000000000 --- a/archive/2022/2022-07-16.md +++ /dev/null @@ -1,141 +0,0 @@ -# 每日安全资讯（2022-07-16） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Sourcegraph gitserver sshCommand Remote Command Execution](https://cxsecurity.com/issue/WLB-2022070042) - - [WordPress Kaswara Modern WPBakery Page Builder 3.0.1 File Upload](https://cxsecurity.com/issue/WLB-2022070041) - - [Designed by VITECH IT Solutions - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070040) - - [Developed By : SOFTMAART - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070039) - - [Akaal WebSoft Pvt - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070038) -- Der Flounder - - [Specifying shell commands to run when opening new Terminal windows from macOS’s Terminal settings](https://derflounder.wordpress.com/2022/07/15/specifying-shell-commands-to-run-when-opening-new-terminal-windows-from-macoss-terminal-settings/) -- Files ≈ Packet Storm - - [Windows Kernel nt!MiRelocateImage Invalid Read](https://packetstormsecurity.com/files/167755/GS20220715145905.tgz) - - [Windows LSA Service LsapGetClientInfo Impersonation Level Check Privilege Escalation](https://packetstormsecurity.com/files/167754/GS20220715145633.tgz) -- Twitter @Nicolas Krassas - - [Password recovery tool infects industrial systems with Sality malware](https://twitter.com/Dinosn/status/1548029960207470594) - - [Tenet Health Sued Over Health Data Theft Impacting 1.2M](https://twitter.com/Dinosn/status/1548029542731694080) - - [Netwrix Auditor Bug Could Lead to Active Directory Domain Compromise](https://twitter.com/Dinosn/status/1548029059770114053) - - [Windows Network File System flaw results in arbitrary code execution as SYSTEM](https://twitter.com/Dinosn/status/1548028997161717765) - - [Attackers scan 1.6 million WordPress sites for vulnerable plugin](https://twitter.com/Dinosn/status/1548021897283063813) - - [How Hackers Create Fake Personas for Social Engineering](https://twitter.com/Dinosn/status/1548007653871259648) - - [Tor Browser now bypasses internet censorship automatically](https://twitter.com/Dinosn/status/1548007604009324545) - - [An unconventional Windows reverse shell, currently undetected by Microsoft Defender and other AV solutions, solely based on http(s) traffic.](https://twitter.com/Dinosn/status/1548000080942092288) - - [CVE-2022-32224: Ruby on Rails Remote Code Execution Vulnerability](https://twitter.com/Dinosn/status/1547902946720894981) - - [RedAlert, LILITH, and 0mega, 3 new ransomware in the wild](https://twitter.com/Dinosn/status/1547895200663490561) - - [Knowledge Base for Cybersecurity Practitioners](https://twitter.com/Dinosn/status/1547829007537754115) - - [Re @floyd_ch Hehehe, it's the google translation sorry :)](https://twitter.com/Dinosn/status/1547827475408752642) - - [Introduction to Smart Contract Security and Decentralized Web Applications](https://twitter.com/Dinosn/status/1547826259857534984) - - [Mantis Botnet Behind the Largest HTTPS DDoS Attack Targeting Cloudflare Customers](https://twitter.com/Dinosn/status/1547826155868131330) - - [The modified version of ysoserial focuses on modifying ysoserial.payloads.util.Gadgets.createTemplatesImpl so that it can execute commands, memory hor...](https://twitter.com/Dinosn/status/1547825645807230976) - - [RT 张惠倩: CVE-2022-32119 - Arox-Unrestricted-File-Upload](https://twitter.com/momika233/status/1547809344200540160) - - [RT Daniel Küffer: Day 23 of 365 🎷🎸 Join us at the #365jazzgarage! A song a day. For one year. Featuring Daniel Küffer (saxophone) and Dani Sol...](https://twitter.com/oyecomova66/status/1547797511233945600) - - [API testing mindmap,](https://twitter.com/Dinosn/status/1547793737442463747) - - [A collection of awesome API Security tools and resources. The focus goes to open-source tools and resources that benefit all the community.](https://twitter.com/Dinosn/status/1547793308658724866) - - [RT Numen Cyber Technology: We detected that #SpaceGodzilla, a #BSC on-chain project ,was attacked by hackers on 14th July. The hacker gained $25K from...](https://twitter.com/numencyber/status/1547789912136503302) -- Security Boulevard - - [Email Attack via a Recycled Domain](https://securityboulevard.com/2022/07/email-attack-via-a-recycled-domain/) - - [A Brief History of AWS S3](https://securityboulevard.com/2022/07/a-brief-history-of-aws-s3/) - - [SP 800-53 Makes Supply Chain and Firmware a Priority – But Are You Listening?](https://securityboulevard.com/2022/07/sp-800-53-makes-supply-chain-and-firmware-a-priority-but-are-you-listening/) - - [Why 8kun Went Offline During the January 6 Hearings](https://securityboulevard.com/2022/07/why-8kun-went-offline-during-the-january-6-hearings/) - - [Join us at Black Hat 2022](https://securityboulevard.com/2022/07/join-us-at-black-hat-2022/) - - [BSidesSF 2022 – Tony Loehr’s ‘Emerging Best Practices In Software Supply Chain Security: What We Can Learn From Google, The White House, OWASP And Gartner’](https://securityboulevard.com/2022/07/bsidessf-2022-tony-loehrs-emerging-best-practices-in-software-supply-chain-security-what-we-can-learn-from-google-the-white-house-owasp-and-gartner/) - - [What’s New in Q3 ’22?](https://securityboulevard.com/2022/07/whats-new-in-q3-22/) - - [Reap the Benefits of Data Classification & Tagging](https://securityboulevard.com/2022/07/reap-the-benefits-of-data-classification-tagging/) - - [Fake cricket, real betting – story of a not so deep fake](https://securityboulevard.com/2022/07/fake-cricket-real-betting-story-of-a-not-so-deep-fake/) - - [Offensive Security – Essentials Bundle Datasheet](https://securityboulevard.com/2022/07/offensive-security-essentials-bundle-datasheet/) -- SecWiki News - - [SecWiki News 2022-07-15 Review](http://www.sec-wiki.com/?2022-07-15) -- unSafe.sh - 不安全 - - [Specifying shell commands to run when opening new Terminal windows from macOS’s Terminal settings](https://buaq.net/go-117625.html) - - [反-反蜜罐：以三个反蜜罐插件的缺陷为例](https://buaq.net/go-117632.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 29](https://buaq.net/go-117630.html) - - [Lockdown Mode: Apple is shutting down spyware](https://buaq.net/go-117605.html) - - [为天链二号03星打造太空通信“扩音器”](https://buaq.net/go-117698.html) - - [中央企业系统（在京）选举产生出席党的二十大代表](https://buaq.net/go-117700.html) - - [中国电科召开2022年财务工作会议](https://buaq.net/go-117699.html) - - [不光没用，这次竟然完全没有意义...开发者算你狠](https://buaq.net/go-117604.html) - - [PortSwigginar - 13 July](https://buaq.net/go-117590.html) - - [子芽做客《安全说》：洞察DevSecOps发展新态势，探秘领航者背后的故事](https://buaq.net/go-117591.html) - - [徒手撸了个极简Golang ORM框架，体验了把sql如丝般顺滑](https://buaq.net/go-117637.html) - - [本周看什么丨最近值得一看的 8 部作品](https://buaq.net/go-117584.html) - - [空气投篮 – 一件完全没有意义的事情[Apple Watch]](https://buaq.net/go-117593.html) - - [【漏洞预警】Node.js DLL劫持漏洞](https://buaq.net/go-117587.html) -- Sploitus.com Exploits RSS Feed - - [Exploit for OS Command Injection in Part-Db Project Part-Db exploit](https://sploitus.com/exploit?id=B1C625CB-B219-568A-B1E5-CE6F390C68EA&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=C8C50EDF-39F5-5103-AC79-A8C7FA6A4B60&utm_source=rss&utm_medium=rss) -- 跳跳糖 - 安全与分享社区 - - [CobaltStrike Malleable PE](https://tttang.com/archive/1662/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [子芽做客《安全说》：洞察DevSecOps发展新态势，探秘领航者背后的故事](https://www.4hou.com/posts/50l8) - - [漏洞预警|Django框架SQL注入漏洞](https://www.4hou.com/posts/ZXW5) - - [邮件安全网关品牌有哪些？选择Coremail邮件安全，实力上榜嘶吼图谱13大赛道](https://www.4hou.com/posts/YXM2) - - [通过远程控制层检测和防御系统攻击](https://www.4hou.com/posts/DWVk) - - [Rolling-PWN 攻击可远程解锁Honda汽车](https://www.4hou.com/posts/oJOX) - - [十强出炉！ISC 2022创新独角兽沙盒大赛初审顺利收官](https://www.4hou.com/posts/XVMg) - - [海云安入围《2022网络安全产业图谱》九大细分领域](https://www.4hou.com/posts/WB8x) -- Jiajun的编程随想 - - [权限模型(RBAC/ABAC)](https://jiajunhuang.com/articles/2022_07_15-access_control.md.html) -- 先知安全技术社区 - - [记一次某系统的渗透测试](https://xz.aliyun.com/t/11526) - - [CPP 异常处理机制初探](https://xz.aliyun.com/t/11525) - - [某企业邮箱攻击面之密码喷洒](https://xz.aliyun.com/t/11529) -- 安全脉搏 - - [【漏洞预警】Node.js DLL劫持漏洞](https://www.secpulse.com/archives/183448.html) - - [JARM指纹随机化技术实现 | 高级攻防10](https://www.secpulse.com/archives/183370.html) -- HackerOne Hacker Activity - - [Insecure Object Permissions for Guest User leads to access to internal documents!](https://hackerone.com/reports/1089583) - - [Add me email address Authentication bypass](https://hackerone.com/reports/1607645) - - [POST BASED REFLECTED XSS IN dailydeals.mtn.co.za](https://hackerone.com/reports/1451394) - - [[h1-2102] shopApps query from the graphql at /users/api returns all existing created apps, including private ones](https://hackerone.com/reports/1085332) -- ElcomSoft blog - - [Building an Efficient Password Recovery Workstation: Power Savings and Waste Heat Management](https://blog.elcomsoft.com/2022/07/building-an-efficient-password-recovery-workstation-power-savings-and-waste-heat-management/) -- 先知安全技术社区 - - [记一次某系统的渗透测试](https://xz.aliyun.com/t/11526) - - [CPP 异常处理机制初探](https://xz.aliyun.com/t/11525) - - [某企业邮箱攻击面之密码喷洒](https://xz.aliyun.com/t/11529) -- paper - Last paper - - [JARM 指纹混淆随机化技术实现](https://paper.seebug.org/1934/) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-july-15) -- SAP Blogs - - [Fiori App For Breakdown Analysis F2812: EAM KPI App overview](https://blogs.sap.com/2022/07/15/fiori-app-for-breakdown-analysis-f2812-eam-kpi-app-overview/) - - [Synthetic User Monitoring (SUM) in SAP Cloud ALM in action](https://blogs.sap.com/2022/07/15/synthetic-user-monitoring-sum-in-sap-cloud-alm-in-action/) - - [SAPRouter Connectivity using AWS Site to Site VPN](https://blogs.sap.com/2022/07/15/saprouter-connectivity-using-aws-site-to-site-vpn/) - - [SAP 3D Visual Enterprise Generator Config File Best Practice](https://blogs.sap.com/2022/07/15/sap-3d-visual-enterprise-generator-config-file-best-practice/) - - [SAP BTP SuccessFactors Work Zone Setup with SuccessFactors Sales4Demo Instance Part 1](https://blogs.sap.com/2022/07/15/sap-btp-successfactors-work-zone-setup-with-successfactors-sales4demo-instance-part-1/) - - [Material price flow into the PO](https://blogs.sap.com/2022/07/15/material-price-flow-into-the-po/) - - [Environmental, Social and Governance and the Role of FP&A](https://blogs.sap.com/2022/07/15/environmental-social-and-governance-and-the-role-of-fpa/) - - [Path to SAP on AWS Specialty Certification](https://blogs.sap.com/2022/07/15/path-to-sap-on-aws-specialty-certification/) - - [ODATA API ‘Attachments’ Service in SAP S/4HANA Cloud](https://blogs.sap.com/2022/07/15/odata-api-attachments-service-in-sap-s-4hana-cloud/) - - [Provisioning and Scaling of the SAP Kyma Runtime](https://blogs.sap.com/2022/07/15/provisioning-and-scaling-of-the-sap-kyma-runtime/) -- 安全客-有思想的安全新媒体 - - [数字安全观察-每周简报 （2022.07.08 -2022.07.13）](https://www.anquanke.com/post/id/276588) - - [记一次失败的打点](https://www.anquanke.com/post/id/276425) - - [JARM指纹随机化技术实现](https://www.anquanke.com/post/id/276546) - - [基于主机的云原生安全建设-(Elkeid) 真实对抗案例分享](https://www.anquanke.com/post/id/276469) - - [代码审计实战](https://www.anquanke.com/post/id/276353) - - [万代南梦宫披露BlackCat勒索攻击事件](https://www.anquanke.com/post/id/276474) -- Reverse Engineering - - [IDA Plugin to reconstruct .proto files used in the analyzed binary](https://www.reddit.com/r/ReverseEngineering/comments/vzipv6/ida_plugin_to_reconstruct_proto_files_used_in_the/) -- PortSwigger Blog - - [PortSwigginar - 13 July](https://portswigger.net/blog/portswigginar-13-july) -- PortSwigger Blog - - [PortSwigginar - 13 July](https://portswigger.net/blog/portswigginar-13-july) -- The Daily Swig | Cybersecurity news and views - - [More than 4,000 individuals’ medical data left exposed for 16 years](https://portswigger.net/daily-swig/more-than-4-000-individuals-medical-data-left-exposed-for-16-years) - - [Fantasy Premier League football app introduces 2FA to tackle account takeover hacks](https://portswigger.net/daily-swig/fantasy-premier-league-football-app-introduces-2fa-to-tackle-account-takeover-hacks) - - [Crunch time for EU web authentication plan as Mozilla launches campaign to protect status quo](https://portswigger.net/daily-swig/crunch-time-for-eu-web-authentication-plan-as-mozilla-launches-campaign-to-protect-status-quo) -- blog.avast.com EN - - [Lockdown Mode: Apple is shutting down spyware](https://blog.avast.com/lockdown-mode-apple-is-shutting-down-spyware) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 29](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-29-4/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 7/11/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-7-11-2022/) -- Checkmarx.com - - [Unverified Commits: Are You Unknowingly Trusting Attackers’ Code?](https://checkmarx.com/blog/unverified-commits-are-you-unknowingly-trusting-attackers-code/) -- KitPloit - PenTest & Hacking Tools - - [Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats](http://www.kitploit.com/2022/07/dumpscan-tool-to-extract-and-dump.html) -- 极客公园 - - [传直播禁提微信快手，抖音：不实消息；阿里「战投」裁员三分之一；盖茨向个人基金会捐出 200 亿美元｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960179&idx=1&sn=85aeb0ab391982578aa620c4d99845dd&chksm=7e55880549220113be1681f2fb2b163e54519509bb549f87c42958f26149ea150b87acf6485c&scene=58&subscene=0#rd) -- Driver Tom's Blog - - [反-反蜜罐：以三个反蜜罐插件的缺陷为例](https://drivertom.blogspot.com/2022/07/blog-post.html) diff --git a/archive/2022/2022-07-17.md b/archive/2022/2022-07-17.md deleted file mode 100644 index d381643ca4..0000000000 --- a/archive/2022/2022-07-17.md +++ /dev/null @@ -1,83 +0,0 @@ -# 每日安全资讯（2022-07-17） - -- Recent Commits to cve:main - - [Update Sat Jul 16 11:27:53 UTC 2022](https://github.com/trickest/cve/commit/f5e27a1168b09c21762092edea26f0bb07292810) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Backdoor.Win32.HoneyPot.a / Weak Hardcoded Password](https://cxsecurity.com/issue/WLB-2022070046) - - [Builder XtremeRAT v3.7 / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022070045) - - [Builder XtremeRAT v3.7 / Insecure Crypto Bypass](https://cxsecurity.com/issue/WLB-2022070044) - - [Developed by: web3creations.com - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070043) -- HackerOne Hacker Activity - - [Can use the Reddit android app as usual even though revoking the access of it from reddit.com](https://hackerone.com/reports/1632186) -- Twitter @Nicolas Krassas - - [HTB: Acute](https://twitter.com/Dinosn/status/1548410023058976768) - - [Famm - 535,240 breached accounts](https://twitter.com/Dinosn/status/1548409905530281988) - - [RT AIL Project: AIL Framework version 4.2 released including typo squatting tracker, improved AIL2AIL sync, zerobinz fetcher and many bugs fixed. #Thr...](https://twitter.com/ail_project/status/1548231597219930114) - - [Hackers Targeting VoIP Servers By Exploiting Digium Phone Software](https://twitter.com/Dinosn/status/1548212034499592194) - - [A tool to kill antimalware protected processes](https://twitter.com/Dinosn/status/1548207543976992768) - - [A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.](https://twitter.com/Dinosn/status/1548185886151413762) - - [Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats](https://twitter.com/Dinosn/status/1548160298745352194) - - [CISA pulls the fire alarm on Juniper Networks bugs](https://twitter.com/Dinosn/status/1548144597187973128) - - [New Cache Side Channel Attack Can De-Anonymize Targeted Online Users](https://twitter.com/Dinosn/status/1548144489302175748) - - [Tainted password-cracking software for industrial systems used to spread P2P Sality bot](https://twitter.com/Dinosn/status/1548144412214960128) -- SecWiki News - - [SecWiki News 2022-07-16 Review](http://www.sec-wiki.com/?2022-07-16) -- unSafe.sh - 不安全 - - [【荐书】特工训练手册：危急时刻如何绝处逢生](https://buaq.net/go-117783.html) - - [北京一民警被妻子实名举报收受巨额贿赂 包养多名情妇长期家暴还疯狂嫖娼](https://buaq.net/go-117761.html) - - [[Obs＃92] Obsidian彙編文章的簡單方法：2個外掛＋1個CSS片段](https://buaq.net/go-117762.html) - - [招生！《安卓高级研修班》2022年夏季班](https://buaq.net/go-117780.html) - - [有用！给你的 AirPods 添加一点魔法](https://buaq.net/go-117767.html) - - [MagicPods – 为 Windows 提供魔法般的 AirPods 体验](https://buaq.net/go-117749.html) - - [把握浏览器的「门面」：少数派作者们都在用什么启动页？](https://buaq.net/go-117728.html) - - [陈北雁的日常(before 2022.6.15)](https://buaq.net/go-117781.html) - - [Process Injection using QueueUserAPC Technique in Windows](https://buaq.net/go-117722.html) - - [Kubeaudit - Tool To Audit Your Kubernetes Clusters Against Common Security Controls](https://buaq.net/go-117760.html) - - [暑假开放注册微信抽奖活动，先送20个账号注册码或300论坛币，今天两点开奖，详见【开放注册公告】吾爱破解论坛2022年7月21日暑假开放注册公告](https://buaq.net/go-117779.html) - - [我最喜欢的10个机器学习公众号](https://buaq.net/go-117752.html) - - [Python生成图文并茂的PDF报告](https://buaq.net/go-117753.html) - - [WordPress主题中的漏洞可能会导致网站被接管](https://buaq.net/go-117718.html) - - [对渗透测试工具的利用](https://buaq.net/go-117719.html) - - [真正的新生力量：从金曲奖最佳新人入围者看乐坛新风向](https://buaq.net/go-117717.html) - - [Can someone help me Solve the Hash, i sent the screenshot to understand the context , this is the hash - 0c30750cqr7ihaiv9sr8mpbkt1og5is8qlalp0jhern6hudug4js8qpctobn](https://buaq.net/go-117696.html) - - [wps是怎么欺负用户的](https://buaq.net/go-117758.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [WordPress主题中的漏洞可能会导致网站被接管](https://www.4hou.com/posts/AKj7) - - [对渗透测试工具的利用](https://www.4hou.com/posts/jJnv) -- No Headback - - [为什么大公司讲的效率如此虚伪](http://xargin.com/what-they-say-is-not-true/) -- GT's Blog - - [KeyCloak docker-compose import realm file](http://blog.gtiwari333.com/2022/07/keycloak-docker-compose-import-realm.html) -- Security Boulevard - - [BSidesSF 2022 – Sharon Goldberg’s ‘Avoiding Insidious Points Of Compromise In Infrastructure Access Systems’](https://securityboulevard.com/2022/07/bsidessf-2022-sharon-goldbergs-avoiding-insidious-points-of-compromise-in-infrastructure-access-systems/) - - [Fredo & Pidjin™ ‘Easily Offended’](https://securityboulevard.com/2022/07/fredo-pidjin-easily-offended/) - - [BSidesSF 2022 – Jeevan Singh’s ‘Redefining Threat Modeling: Security Team Goes On Vacation’](https://securityboulevard.com/2022/07/bsidessf-2022-jeevan-singhs-redefining-threat-modeling-security-team-goes-on-vacation/) -- Reverse Engineering - - [Adding new features to an old game with Frida, Part I](https://www.reddit.com/r/ReverseEngineering/comments/w0kt59/adding_new_features_to_an_old_game_with_frida/) -- SAP Blogs - - [S/4HANA Q2C Sales Flexibility – Determine Business Partner and Sales Area in B2B EDI Integration](https://blogs.sap.com/2022/07/16/s-4hana-q2c-sales-flexibility-determine-business-partner-and-sales-area-in-b2b-edi-integration/) -- KitPloit - PenTest & Hacking Tools - - [Kubeaudit - Tool To Audit Your Kubernetes Clusters Against Common Security Controls](http://www.kitploit.com/2022/07/kubeaudit-tool-to-audit-your-kubernetes.html) -- 黑奇士 - - [wps是怎么欺负用户的](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247487049&idx=1&sn=1f652d776ea2db2972e29f2e45c51ce2&chksm=eca201a5dbd588b3af7229e585bb9e9f13f56ca07eab2fe738a364339f9be9a09dc5df044ce8&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [陈北雁的日常(before 2022.6.15)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486033&idx=1&sn=e05ecfaecf6fe5ac56ffc622a8bf837f&chksm=fab2c96ecdc54078c0629bafa94736ccd74b2e1b6a9c68ca127b68f98f3df94cf6cb61a6024e&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [起底国家级APT组织：金刚象（APT-Q-43)](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247490437&idx=1&sn=73b071ca1c167e3ca731cc7f50291c18&chksm=ec6a6baddb1de2bb4f156ae566e73d67c7730248e489352522d1efc244b64f0e34f86ed9e267&scene=58&subscene=0#rd) -- 数世咨询 - - [[调研]人人都面临ICS攻击风险](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494229&idx=1&sn=f568a6042c526d43165dd5070351c795&chksm=c14498e8f63311fe1afd09f0aacd4bb2e861ce6d868e9586dc9d09903c0f5f67ae5fba0fa594&scene=58&subscene=0#rd) -- 看雪学院 - - [2022新款定制速干衣-Reverse everything](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458449&idx=1&sn=e98c59bd54c14d3b06c08f3cdacb5241&chksm=b18e29db86f9a0cd2004fedf486fb3d0d93e846e277ce4c9a5f67cc852e4c1db3bb2db23ea1a&scene=58&subscene=0#rd) - - [用uboot“操控”某路由器设备](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458449&idx=2&sn=fd2da67f56d2975c6a7ebc4e2ac25dae&chksm=b18e29db86f9a0cd9cfb797483a1dd4adcaa4d6f59bb7a9f7fbc6e2743a1ef91a0db3c366902&scene=58&subscene=0#rd) - - [招生！《安卓高级研修班》2022年夏季班](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458449&idx=3&sn=6e629febf380d0ecf3c79dc4fcb7e902&chksm=b18e29db86f9a0cd7c17ee7a44b7f87ad6af872d615f1eb90a611183f737f1969b4c047e2891&scene=58&subscene=0#rd) -- 中国信息安全 - - [关注 | 网络数据安全管理条例等纳入国务院2022年度立法工作计划](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162070&idx=1&sn=5f78c0326ad9fc1b0599211eddbf9151&chksm=8b5ee1efbc2968f9446c42f6c8c0f4fbc64d318cc5f24f16f2fa0705eb23fbcfa97da2946fae&scene=58&subscene=0#rd) - - [关注 | 公安机关网安部门重拳打击窃听窃照及偷拍偷窥违法犯罪](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162070&idx=2&sn=1ddddf21b4c2d1a73122d597f56f8357&chksm=8b5ee1efbc2968f9c6c2d45e01545b56176dcf3edb954e6a917bf27f3b01628b98867e6d4f53&scene=58&subscene=0#rd) - - [专家解读 | 规范数据安全出境 促进数据依法有序流动](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162070&idx=3&sn=68ec4d17d31cd5582c348adc5a7980b2&chksm=8b5ee1efbc2968f9e6b78825f211149c46a4ff052128f86e814956afd2e18534a4c2d68a7469&scene=58&subscene=0#rd) - - [CNNVD | 关于微软多个安全漏洞的通报](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162070&idx=4&sn=9371db36c1a1f42fd42e123e290c723f&chksm=8b5ee1efbc2968f94f93c2bce60ba734c5c4dc45892255aa0fff0f457f0efbeb547824335684&scene=58&subscene=0#rd) - - [发布 | 《上海市数字经济发展“十四五”规划》（全文）](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162070&idx=5&sn=e14c2e66871b1ad7083eed6a8010939a&chksm=8b5ee1efbc2968f9de4bb00f14d7fdaa36efebcfb62c1956f87ff5838374503e1878e8d92047&scene=58&subscene=0#rd) -- 极客公园 - - [监管发文整治「雪糕刺客」；微信测试朋友圈「共同回忆」功能；史蒂芬・金：新冠战胜了人类｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960213&idx=1&sn=681d8e6f1a87d4fd0bc0bfe3906beab9&chksm=7e558863492201755cb9bb4242a4fc6ee34477c83bd74d9ecafacc1a2aab7510f67893004a8f&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报课堂】OSINT — 新手指南](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510833&idx=1&sn=50f5612326cada1cae22db8b5396448a&chksm=8716bbbab06132ace81f3bd75991101770c9dd9210e5545944c5393c56f819c91313fa087f93&scene=58&subscene=0#rd) - - [【实战技法】如何研究和调查美国电话号码](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510833&idx=2&sn=01298400c77e2c6516e8b1444ab8b1a5&chksm=8716bbbab06132ac9630829f4486349d677f58d801070be2dd2877edf69a9d600a5d852bed10&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-18.md b/archive/2022/2022-07-18.md deleted file mode 100644 index 6969f859bd..0000000000 --- a/archive/2022/2022-07-18.md +++ /dev/null @@ -1,105 +0,0 @@ -# 每日安全资讯（2022-07-18） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [CSZ CMS 1.3.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022070052) - - [Designed With by HOME SALON - SQL Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070051) - - [Online Discussion Forum Site 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022070050) - - [Websyte mit vor webSchmitte.ch - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070049) - - [dhamdhama anchalik college - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070048) - - [Yahweh Touch - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070047) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [现代IT安全团队对高级漏洞管理存在必然需求](https://www.4hou.com/posts/O9gE) - - [【技术原创】渗透基础——获得域用户的登录信息](https://www.4hou.com/posts/N1xN) -- HackerOne Hacker Activity - - [Open Redirect ███.8x8.com](https://hackerone.com/reports/1637571) - - [Information disclosure ( Google Sales Channel )](https://hackerone.com/reports/1584718) -- Security Boulevard - - [BSidesSF 2022 – Justin Bui’s ‘Red Teaming macOS Environments With Hermes The Swift Messenger’](https://securityboulevard.com/2022/07/bsidessf-2022-justin-buis-red-teaming-macos-environments-with-hermes-the-swift-messenger/) - - [XKCD ‘Minkowski Space’](https://securityboulevard.com/2022/07/xkcd-minkowski-space/) - - [BSidesSF 2022 – Pedro Fortuna’s, Jasvir Nagra’s ‘Achieving The Web Isolation Nirvana – How Far Along Are We?’](https://securityboulevard.com/2022/07/bsidessf-2022-pedro-fortunas-jasvir-nagras-achieving-the-web-isolation-nirvana-how-far-along-are-we/) - - [How Can I Get a Job in Cybersecurity?](https://securityboulevard.com/2022/07/how-can-i-get-a-job-in-cybersecurity/) -- unSafe.sh - 不安全 - - [2022西湖论剑·网络安全大会](https://buaq.net/go-117881.html) - - [售价 30 元，卖了 100 万份，能挣多少钱？](https://buaq.net/go-117879.html) - - [PeakFinder – 群山在召唤，超过 95 万座山峰，360°全景显示[iPhone/Android]](https://buaq.net/go-117880.html) - - [笔记本电脑太烫了？收下这份指南，你也可以清理它内部的灰尘](https://buaq.net/go-117878.html) - - [本月玩什么 | 异度神剑 3、数码宝贝 绝境求生、时空勇士](https://buaq.net/go-117875.html) - - [【开放注册公告】吾爱破解论坛2022年7月21日暑假开放注册公告](https://buaq.net/go-117877.html) - - [Zenbuster - Multi-threaded URL Enumeration/Brute-Forcing Tool](https://buaq.net/go-117882.html) - - [Access Checking Active Directory](https://buaq.net/go-117852.html) - - [Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime](https://buaq.net/go-117849.html) - - [新课首发！Windows内核漏洞分析与EXP编写技巧（文末抽奖）](https://buaq.net/go-117876.html) - - [【技术原创】渗透基础——获得域用户的登录信息](https://buaq.net/go-117851.html) - - [现代IT安全团队对高级漏洞管理存在必然需求](https://buaq.net/go-117850.html) - - [复盘：我的九年运营之路](https://buaq.net/go-117950.html) - - [行业调研方法论教程：准备工作](https://buaq.net/go-117952.html) - - [大数据，算不准老天爷](https://buaq.net/go-117951.html) -- Recent Commits to cve:main - - [Update Sun Jul 17 11:27:46 UTC 2022](https://github.com/trickest/cve/commit/e54b49a336ef886ef1fcc4d5efb9e6f4d8d6b0ef) -- SecWiki News - - [SecWiki News 2022-07-17 Review](http://www.sec-wiki.com/?2022-07-17) -- Twitter @Nicolas Krassas - - [RT AidenPearce369: AMSI Bypass - Memory Patching amsi.dll](https://twitter.com/aidenpearce369/status/1548686266702524416) - - [Re @TXVsdQ @Eliza_MayAustin Thank you for the kind words :)](https://twitter.com/Dinosn/status/1548666885260058627) - - [Another meterpreter injection technique using C# that attempts to bypass WD.](https://twitter.com/Dinosn/status/1548666304978190339) - - [Zenbuster - Multi-threaded URL Enumeration/Brute-Forcing Tool](https://twitter.com/Dinosn/status/1548656258391105537) - - [Build your first LLVM Obfuscator](https://twitter.com/Dinosn/status/1548656215688851457) - - [JukinMedia - 314,290 breached accounts](https://twitter.com/Dinosn/status/1548655622127845376) - - [Bypassing Antivirus Payload Detection](https://twitter.com/Dinosn/status/1548528733966909440) - - [CVE-2022-31107: Grafana OAuth Account Takeover Vulnerability](https://twitter.com/Dinosn/status/1548504464314679297) - - [Massive campaign hits Elastix VoIP systems with 500,000 unique malware samples](https://twitter.com/Dinosn/status/1548504268864307200) - - [Hackers pose as journalists to breach news media org’s networks](https://twitter.com/Dinosn/status/1548504120645918723) - - [Elastix VoIP systems hacked in massive campaign to install PHP web shells](https://twitter.com/Dinosn/status/1548500857104187394) - - [Critical flaw in Netwrix Auditor application allows arbitrary code execution](https://twitter.com/Dinosn/status/1548499698033385473) - - [Eskimi - 1,197,620 breached accounts](https://twitter.com/Dinosn/status/1548499611609808898) - - [RT Shodan: The Shodan Membership is on sale now for $5 until the end of Sunday, July 17th (GMT):](https://twitter.com/shodanhq/status/1548472517731311620) -- Sploitus.com Exploits RSS Feed - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=23528F1E-CDCF-55BF-BE95-F887FF5EB2A6&utm_source=rss&utm_medium=rss) -- Bug Bounty in InfoSec Write-ups on Medium - - [Finding 0-days in Enterprise Application](https://infosecwriteups.com/finding-0-days-in-enterprise-application-471a409ade8d?source=rss----7b722bfd1b8d--bug_bounty) - - [FFUF-ing RECON](https://infosecwriteups.com/ffuf-ing-recon-1ee4e79b3256?source=rss----7b722bfd1b8d--bug_bounty) -- Hack Inn - - [2022西湖论剑·网络安全大会](https://www.hackinn.com/index.php/archives/796/) -- Tyranid's Lair - - [Access Checking Active Directory](https://www.tiraniddo.dev/2022/07/access-checking-active-directory.html) -- SAP Blogs - - [SAP Business Technology Platform Innovation stories – Part 1](https://blogs.sap.com/2022/07/17/sap-business-technology-platform-innovation-stories-part-1/) - - [Tightly Versus Loosely Extensions](https://blogs.sap.com/2022/07/17/tightly-versus-loosely-extensions/) - - [Using transport of copies and deploy several features to production with SAP Cloud ALM in conjunction with CTS](https://blogs.sap.com/2022/07/17/using-transport-of-copies-and-deploy-several-features-to-production-with-sap-cloud-alm-in-conjunction-with-cts/) - - [Deleting CBTA configuration for a given System Under Test in SAP SOLMAN 7.2](https://blogs.sap.com/2022/07/17/deleting-cbta-configuration-for-a-given-system-under-test-in-sap-solman-7.2/) - - [Connecting to SAP BTP Object Store running on Microsoft Azure Platform using NodeJS](https://blogs.sap.com/2022/07/17/connecting-to-sap-btp-object-store-running-on-microsoft-azure-platform-using-nodejs/) -- Reverse Engineering - - [Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime](https://www.reddit.com/r/ReverseEngineering/comments/w0yndv/deoptfuscator_defeating_advanced_controlflow/) -- Twitter @bytehx - - [RT Shodan: The Shodan Membership is on sale now for $5 until the end of Sunday, July 17th (GMT):](https://twitter.com/shodanhq/status/1548472517731311620) -- KitPloit - PenTest & Hacking Tools - - [Zenbuster - Multi-threaded URL Enumeration/Brute-Forcing Tool](http://www.kitploit.com/2022/07/zenbuster-multi-threaded-url.html) -- qz安全情报分析 - - [渗透测试面试问题指南](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907824&idx=1&sn=fedfe11225e69c501f6c2aaf0ed430b2&chksm=f18eeb76c6f962603a74b20b3265cd6f5c6ea9a1e718b641c3ff35eee68ad89c616b22d11ce5&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [安全威胁情报周报（7.11~7.17）](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247494492&idx=1&sn=3736e50631c4853581432d8f283a31d3&chksm=cfca8848f8bd015eec6cfb12775b1a436d57a2481d17886d75308b465f1dc0629ef6cf7e92a7&scene=58&subscene=0#rd) -- ChaMd5安全团队 - - [Tenda AC9 SetSystime 命令注入漏洞分析](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247506402&idx=1&sn=824c75aa9238dda793cbd635a67f8a64&chksm=e89df13adfea782c8e9a701f13dad1f7e7bddce0d4a539cca52c762d13e76c58b991a5119f30&scene=58&subscene=0#rd) -- 吾爱破解论坛 - - [【开放注册公告】吾爱破解论坛2022年7月21日暑假开放注册公告](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651137854&idx=1&sn=1774f0b2c7f8f586807595aa70788200&chksm=bd50b76a8a273e7c90fa48da3eaaaeb0ac6245d019174f1caafc5089d830882e70dc34ddece8&scene=58&subscene=0#rd) -- 看雪学院 - - [新课首发！Windows内核漏洞分析与EXP编写技巧（文末抽奖）](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458466&idx=1&sn=8c742be24415dc2fa50fb6296118882f&chksm=b18e29e886f9a0fe716047ad32b8eb915f206165ff87036b424364216f532142860e7db2dd0d&scene=58&subscene=0#rd) - - [Seccomp BPF与容器安全](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458466&idx=2&sn=54f6dd4c7549e9455b23023203985e78&chksm=b18e29e886f9a0fec111aaeea73aaf3b9919da596bf9c17bfd372b01dced81899f657aad8828&scene=58&subscene=0#rd) -- 极客公园 - - [估值缩水 70%，这个烧了 40 亿美元的独角兽还有机会吗？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960258&idx=1&sn=91d8f45c3c92b99a8824f88cb063d502&chksm=7e558bb4492202a26e3191ebfb88568c92e258053742706cb8214c8779efad71e57f6bd798f5&scene=58&subscene=0#rd) - - [新 iPhone 相机凸起厚度将超两枚硬币；华为合作车企小康定增 71 亿元；《艾尔登法环》成上半年美国最畅销游戏｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960241&idx=1&sn=d2384e98a0731f6d9c7369a595a1514e&chksm=7e55884749220151044351cccd9d08d008decb6856a5d500d4c4691c939b4df423dbb3e6c984&scene=58&subscene=0#rd) -- 云鼎实验室 - - [每周云安全资讯-2022年第29周](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494589&idx=1&sn=da2082ab035435b8d532cb5653e31c2c&chksm=fd79173bca0e9e2dcbb1bf938db7259b43acfff899c0f311c0dff5dcde47dfde2ecdccc7b708&scene=58&subscene=0#rd) -- 互联网安全内参 - - [国务院：年内将制定《网络数据安全管理条例》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504430&idx=1&sn=fbb58ad121e09c9ab4f866018b3cdb35&chksm=ebfa950edc8d1c1874544a21144e345a41aebbe0b019c0dd97d535e30acb46fb873ba98d4ade&scene=58&subscene=0#rd) - - [荐书活动：《白话零信任》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504430&idx=2&sn=297f8a26be2c3e6e609b3ca027c91730&chksm=ebfa950edc8d1c18564b4fb4b814abda2400e68b7329e9402b7247550f8b903d04a160ba5d2c&scene=58&subscene=0#rd) -- 情报分析师 - - [【长篇报告】邪教与精神控制——理论和方法（以日本为例）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510871&idx=1&sn=d87242468d7158f22e23311c50f3679c&chksm=8716b85cb061314aba1bd71480500cbed800c5c21ff5b507ed495b0d2833af244dc44c8eb878&scene=58&subscene=0#rd) - - [【图文详解】社交媒体情报收集指南](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510871&idx=2&sn=89a5a3b78ced77d9b68a539b12e85f8c&chksm=8716b85cb061314ad5b858de0958a55d3f4025f5a6f478719e3c2ecc8a65385b33e9539904f8&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】李克强：守牢信息安全，严查！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006195&idx=1&sn=92e11604204195751925b924b1d98228&chksm=f36f4b73c418c265a7bf06189dc7652efa8124449c67f39eb964b1513c07664de651eacc7f4e&scene=58&subscene=0#rd) - - [【安全圈】WordPress主题中的漏洞可能会导致网站被接管](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006195&idx=2&sn=673cd09803f83fd346264e778e446440&chksm=f36f4b73c418c26510efacab5b7a78449aa1dc100c2dfc8eb4641345b0ffcec4891cea917022&scene=58&subscene=0#rd) - - [【安全圈】国产 EDA 新突破，东方晶源推出计算光刻云方案](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006195&idx=3&sn=fb86150610bd047a6a7a61cf8ac5f03b&chksm=f36f4b73c418c265f49cada9637a4f37a17ac80f1e4c450a641aaa6957ae3292fba637e726d1&scene=58&subscene=0#rd) - - [【安全圈】支付宝推出夜间交易和大额保护锁](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006195&idx=4&sn=26daf1885340cea0a7f6426a957735fe&chksm=f36f4b73c418c265a5382fba16b77be5a8891cbdc11136a0f3cf72daa8c7a5caa1aa22f0b903&scene=58&subscene=0#rd) - - [【安全圈】联想超70款笔记本电脑被曝新型UEFI固件漏洞](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006195&idx=5&sn=5528e9f6ff21777a5a125e504028c8a0&chksm=f36f4b73c418c2653d20e822449a98447a6c800816178c6069f8a8d30e11f014757be9ddd63d&scene=58&subscene=0#rd) - - [【安全圈】诺基亚将领导德国 6G 灯塔项目](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006195&idx=6&sn=51530bbc7c33077f7d46d7c2d25ede62&chksm=f36f4b73c418c265f5a9a838891cd9ad2a3209792484cdc8637290d3ee2721b55ac4fb347958&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-19.md b/archive/2022/2022-07-19.md deleted file mode 100644 index 3892c24b0f..0000000000 --- a/archive/2022/2022-07-19.md +++ /dev/null @@ -1,218 +0,0 @@ -# 每日安全资讯（2022-07-19） - -- HackerOne Hacker Activity - - [Without verifying email and activate account, user can perform all action which are not supposed to be done](https://hackerone.com/reports/1272305) - - [subdomain takeover at odoo-staging.exness.io](https://hackerone.com/reports/1540252) - - [unauth mosquitto ( client emails, ips, license keys exposure )](https://hackerone.com/reports/1578574) - - [Cross-site scripting (DOM-based)](https://hackerone.com/reports/1512644) - - [CVE-2019-11248 on http://█.█.█.█:9100/debug/pprof/goroutine](https://hackerone.com/reports/1607940) - - [Public Apache Tomcat /examples example directory](https://hackerone.com/reports/1622624) -- Recent Commits to cve:main - - [Update Mon Jul 18 11:31:58 UTC 2022](https://github.com/trickest/cve/commit/32b516d90ad4c6bda62b8af25a07bde93e3196cd) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Orange Station 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022070054) - - [Travel Tours Script 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022070053) -- Twitter @Nicolas Krassas - - [unRAR CVE-2022-30333 deep dive (including full exploit for Zimbra)](https://twitter.com/Dinosn/status/1549109085236256768) - - [From the Front Lines | 8220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts](https://twitter.com/Dinosn/status/1549093486145769472) - - [FBI warns of fake cryptocurrency apps used to defraud investors](https://twitter.com/Dinosn/status/1549093279706357760) - - [Russia fines Google $358 million for not removing banned info](https://twitter.com/Dinosn/status/1549093201881010177) - - [Albanian government websites go dark after cyberattack](https://twitter.com/Dinosn/status/1549056571266797568) - - [Google Boots Multiple Malware-laced Android Apps from Marketplace](https://twitter.com/Dinosn/status/1549042890516885504) - - [Hackers Distributing Password Cracking Tool for PLCs and HMIs to Target Industrial Systems](https://twitter.com/Dinosn/status/1549042609402028032) - - [FFUF-ing RECON](https://twitter.com/Dinosn/status/1548945345085931520) - - [GitHub - karimhabush/cyberowl: A daily updated summary of the most frequent types of security incidents currently being reported from different source...](https://twitter.com/Dinosn/status/1548945108002869248) - - [Crooks stole $375k from Premint NFT, it is one of the biggest NFT hacks ever](https://twitter.com/Dinosn/status/1548945050079477760) - - [Hackers can spoof commit metadata to create false GitHub repositories](https://twitter.com/Dinosn/status/1548944786350030849) - - [Alibaba execs hauled in to discuss Shanghai Police data leak](https://twitter.com/Dinosn/status/1548944676627320833) - - [Coercer: automatically coerce a Windows server to authenticate on an arbitrary machine](https://twitter.com/Dinosn/status/1548944588408332288) - - [CVE-2022-33891: Apache Spark Shell Command Injection Vulnerability](https://twitter.com/Dinosn/status/1548944536541487104) - - [Bill for US telcos to bin Chinese kit blows out by $3 billion](https://twitter.com/Dinosn/status/1548944479398264832) - - [XLL Phishing: specifically crafted for Microsoft Excel](https://twitter.com/Dinosn/status/1548944401774305281) - - [Graff paid a $7.5M ransom and sued its insurance firm for refusing to cover this payment](https://twitter.com/Dinosn/status/1548944283922743296) - - [RT Daniel Küffer: Day 27 of 365 🎷🎸 Join us at the #365jazzgarage! A song a day. For one year. Featuring Daniel Küffer (saxophone) and Dani Sol...](https://twitter.com/oyecomova66/status/1548936943605620736) -- Files ≈ Packet Storm - - [Global Socket 1.4.38](https://packetstormsecurity.com/files/167762/gsocket-1.4.38.tar.gz) - - [Builder XtremeRAT 3.7 MVID-2022-0624 Insecure Crypto Bypass](https://packetstormsecurity.com/files/167761/MVID-2022-0624.txt) - - [Builder XtremeRAT 3.7 MVID-2022-0623 Insecure Permissions](https://packetstormsecurity.com/files/167760/MVID-2022-0623.txt) - - [Backdoor.Win32.HoneyPot.a MVID-2022-0622 Weak Hardcoded Password](https://packetstormsecurity.com/files/167759/MVID-2022-0622.txt) - - [Orange Station 1.0 SQL Injection](https://packetstormsecurity.com/files/167758/orangestation10-sql.txt) - - [Property Listing Script 3.1 SQL Injection](https://packetstormsecurity.com/files/167757/pls31-sql.txt) - - [Travel Tours Script 1.0 SQL Injection](https://packetstormsecurity.com/files/167756/tts10-sql.txt) -- Security Boulevard - - [Release Bulletin: RADIUS Authentication using Azure AD](https://securityboulevard.com/2022/07/release-bulletin-radius-authentication-using-azure-ad/) - - [Cyber Warfare Future is ‘Machine on Machine’ With China, Says Biden Advisor](https://securityboulevard.com/2022/07/cyber-warfare-future-is-machine-on-machine-with-china-says-biden-advisor/) - - [Cyber Risk Quantification Use Case: Justify, Prioritize Resource Allocation](https://securityboulevard.com/2022/07/cyber-risk-quantification-use-case-justify-prioritize-resource-allocation/) - - [The Executive Board and the Virtual CISO](https://securityboulevard.com/2022/07/the-executive-board-and-the-virtual-ciso/) - - [BSidesSF 2022 – Astha Singhal’s ‘Keynote: Building Sustainable Security Programs’](https://securityboulevard.com/2022/07/bsidessf-2022-astha-singhals-keynote-building-sustainable-security-programs/) - - [What Recent ISIS Attacks in Africa Tells Us About the Terrorist Group’s Resurgence](https://securityboulevard.com/2022/07/what-recent-isis-attacks-in-africa-tells-us-about-the-terrorist-groups-resurgence/) - - [Two-Faced Facebook: Foils Privacy Plugins by Encrypting URLs](https://securityboulevard.com/2022/07/two-faced-facebook-foils-privacy-plugins-by-encrypting-urls/) - - [Joker, Facestealer and Coper banking malwares on Google Play store](https://securityboulevard.com/2022/07/joker-facestealer-and-coper-banking-malwares-on-google-play-store/) - - [Mac anti-virus](https://securityboulevard.com/2022/07/mac-anti-virus/) - - [Open Banking Forcing Prioritization of API Protection](https://securityboulevard.com/2022/07/open-banking-forcing-prioritization-of-api-protection/) -- 跳跳糖 - 安全与分享社区 - - [x64下隐藏可执行内存](https://tttang.com/archive/1589/) -- SecWiki News - - [SecWiki News 2022-07-18 Review](http://www.sec-wiki.com/?2022-07-18) -- paper - Last paper - - [websocket 新型内存马的应急响应](https://paper.seebug.org/1935/) -- 安全客-有思想的安全新媒体 - - [小菜鸡的hvv之旅](https://www.anquanke.com/post/id/276428) - - [“验证器”（Validator）木马分析](https://www.anquanke.com/post/id/276551) - - [微软认为朝鲜黑客为牟私利成立HolyGhost勒索组织](https://www.anquanke.com/post/id/276535) -- unSafe.sh - 不安全 - - [The FTC will go after companies misusing location, health, and other sensitive data](https://buaq.net/go-118079.html) - - [From the Front Lines | 8220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts](https://buaq.net/go-118061.html) - - [Data Science Squad Roadmap](https://buaq.net/go-118063.html) - - [Tas9er/ByPassBehinder: ByPassBehinder / 冰蝎WebShell免杀生成 / Code By:Tas9er](https://buaq.net/go-118056.html) - - [Roe v. Wade: How the cops can use your data: Lock and Code S03E15](https://buaq.net/go-118057.html) -- Sploitus.com Exploits RSS Feed - - [Backdoor.Win32.HoneyPot.a MVID-2022-0622 Weak Hardcoded Password exploit](https://sploitus.com/exploit?id=PACKETSTORM:167759&utm_source=rss&utm_medium=rss) - - [Microsoft Office Excel Silent Builder Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37842&utm_source=rss&utm_medium=rss) - - [Builder XtremeRAT 3.7 MVID-2022-0623 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:167760&utm_source=rss&utm_medium=rss) - - [Orange Station 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167758&utm_source=rss&utm_medium=rss) - - [Travel Tours Script 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167756&utm_source=rss&utm_medium=rss) - - [Property Listing Script 3.1 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167757&utm_source=rss&utm_medium=rss) - - [Builder XtremeRAT 3.7 MVID-2022-0624 Insecure Crypto Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:167761&utm_source=rss&utm_medium=rss) - - [Orange Station 1.0 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37841&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Symfony Twig exploit](https://sploitus.com/exploit?id=CFD127DF-B74A-5848-8930-B51487AEEB7D&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-33891 exploit](https://sploitus.com/exploit?id=3D4C065E-6E6E-5D94-A8EA-7758050396EB&utm_source=rss&utm_medium=rss) -- Blog & What's New | Offensive Security - - [Quarterly Community Updates: Student Discounts, OffSec Live, Partner Program, & Much More!](https://www.offensive-security.com/offsec/q2-update/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [360与襄阳达安汽车检测中心深化合作 打造智能网联汽车安全大脑](https://www.4hou.com/posts/mX2G) - - [如何从数据分类分级出发，精准管控持续保障数据安全运营](https://www.4hou.com/posts/l6vM) - - [利用收款二维码为网络犯罪“开绿灯“，到底是谁在为黑灰产“输血”？](https://www.4hou.com/posts/3JjR) - - [齐安科技梁猛：工业互联网安全可控是产业安全和国家安全的重要基础和保障](https://www.4hou.com/posts/VZNX) - - [广泛覆盖！安全狗荣登《嘶吼2022网络安全产业图谱》多个领域](https://www.4hou.com/posts/4Kkx) - - [TCP/IP协议常见漏洞类型及安全措施](https://www.4hou.com/posts/032L) - - [【安全玻璃盒】孝道科技入围2022 ISC沙盒大赛十强，做创新领先的数字安全践行者！](https://www.4hou.com/posts/kMw6) - - [珞安科技C轮引入6家产业资本，多引擎加速技术与业务深度融合](https://www.4hou.com/posts/gXxk) - - [《2022年嘶吼电子季刊Q2》发布](https://www.4hou.com/posts/jJvv) - - [ChromeLoader：新出现劫持用户浏览器搜索和展示广告的恶意软件活动（上）](https://www.4hou.com/posts/ykmn) - - [UNI token空投钓鱼攻击成功窃取Uniswap 800万美元](https://www.4hou.com/posts/MB9G) -- ArthurChiao's Blog - - [Linux tracing/profiling 基础：符号表、调用栈、perf/bpftrace 示例等（2022）](https://arthurchiao.github.io/blog/linux-tracing-basis-zh/) -- 先知安全技术社区 - - [简单的冰蝎流量魔改](https://xz.aliyun.com/t/11530) - - [红队开发基础-基础免杀(三)](https://xz.aliyun.com/t/11532) - - [Apache Commons Configuration 远程代码执行](https://xz.aliyun.com/t/11527) -- 先知安全技术社区 - - [简单的冰蝎流量魔改](https://xz.aliyun.com/t/11530) - - [红队开发基础-基础免杀(三)](https://xz.aliyun.com/t/11532) - - [Apache Commons Configuration 远程代码执行](https://xz.aliyun.com/t/11527) -- Misc - - [20 years of payment processing problems](https://kaimi.io/en/2022/07/20-years-of-payment-processing-problems-en/) -- SpiderLabs Blog from Trustwave - - [Decade Retrospective: The State of Vulnerabilities](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decade-retrospective-the-state-of-vulnerabilities/) -- Twitter @bytehx - - [RT 张惠倩: /?s=index/think\\Error/appError&errno=1&errstr=1&errline=1&errfile=../../../etc/passwd](https://twitter.com/momika233/status/1548852756160876544) -- Malwarebytes Labs - - [The FTC will go after companies misusing location, health, and other sensitive data](https://blog.malwarebytes.com/privacy-2/2022/07/the-ftc-will-go-after-companies-misusing-location-health-and-other-sensitive-data/) - - [Roe v. Wade: How the cops can use your data: Lock and Code S03E15](https://blog.malwarebytes.com/podcast/2022/07/roe-v-wade-how-the-cops-can-use-your-data-lock-and-code-s03e15/) - - [Extortionists target restaurants, demand money to take down bad reviews](https://blog.malwarebytes.com/social-engineering/2022/07/extortionists-target-restaurants-demand-money-to-take-down-bad-reviews/) - - [A week in security (July 11 – July 17)](https://blog.malwarebytes.com/a-week-in-security/2022/07/a-week-in-security-july-11-july-17/) -- SentinelOne - - [From the Front Lines | 8220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts](https://www.sentinelone.com/blog/from-the-front-lines-8220-gang-massively-expands-cloud-botnet-to-30000-infected-hosts/) -- Current Posts - Red Team Journal - - [Time for a New Game Board](https://www.redteamjournal.com/blog/time-for-a-new-game-board) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/w1su6b/rreverseengineerings_weekly_questions_thread/) - - [OpenSecurityTraining2 Reverse Engineering 3011: Reversing C++ Binaries](https://www.reddit.com/r/ReverseEngineering/comments/w28rph/opensecuritytraining2_reverse_engineering_3011/) - - [A Deep Dive Into ALPHV/BlackCat Ransomware](https://www.reddit.com/r/ReverseEngineering/comments/w26s4d/a_deep_dive_into_alphvblackcat_ransomware/) -- SAP Blogs - - [Wie generieren Sie Wert aus 1TB Daten?](https://blogs.sap.com/2022/07/18/wie-generieren-sie-wert-aus-1tb-daten/) - - [Change analysis on an ABAP backend system](https://blogs.sap.com/2022/07/18/change-analysis-on-an-abap-backend-system/) - - [SAP Design to Operate: If I could have real-time visibility into the entire supply chain process!](https://blogs.sap.com/2022/07/18/sap-design-to-operate-if-i-could-have-real-time-visibility-into-the-entire-supply-chain-process/) - - [Sustainability in X-as-a-Service Business Models – Analysis of Possible Enhancements of B2B E-Commerce Processes and Related SAP Standard Software](https://blogs.sap.com/2022/07/18/sustainability-in-x-as-a-service-business-models-analysis-of-possible-enhancements-of-b2b-e-commerce-processes-and-related-sap-standard-software/) - - [It’s a Wrap! International SAP Conference for Utilities 2022](https://blogs.sap.com/2022/07/18/its-a-wrap-international-sap-conference-for-utilities-2022/) - - [SAP IBP Analyze Data Volume in Calculations](https://blogs.sap.com/2022/07/18/sap-ibp-analyze-data-volume-in-calculations/) - - [How to get authenticated user information with CAP in three different ways – Using the XSUAA API](https://blogs.sap.com/2022/07/18/how-to-get-authenticated-user-information-with-cap-in-three-different-ways-using-the-xsuaa-api/) - - [How to get authenticated user information with CAP in three different ways – Using the CAP request object](https://blogs.sap.com/2022/07/18/how-to-get-authenticated-user-information-with-cap-in-three-different-ways-using-the-cap-request-object/) -- Hex Rays - - [Igor’s tip of the week #98: Analysis options](https://hex-rays.com/blog/igors-tip-of-the-week-98-analysis-options/) -- Взрывной блог - - [20 лет проблем приема платежей](https://bo0om.ru/20-years-of-payment-processing-problems) -- Microsoft Security Response Center - - [Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability](https://msrc-blog.microsoft.com/2022/07/18/mitigation-for-azure-storage-sdk-client-side-encryption-padding-oracle-vulnerability/) -- Cerbero Blog - - [Suite 5.7 and Engine 2.7 are out!](https://blog.cerbero.io/?p=2442) -- The Daily Swig | Cybersecurity news and views - - [‘Endemic’ Log4j bug set to persist in the wild for at least a decade, US government warns](https://portswigger.net/daily-swig/endemic-log4j-bug-set-to-persist-in-the-wild-for-at-least-a-decade-us-government-warns) - - [Prototype pollution in Blitz.js leads to remote code execution](https://portswigger.net/daily-swig/prototype-pollution-in-blitz-js-leads-to-remote-code-execution) -- KitPloit - PenTest & Hacking Tools - - [Koh - The Token Stealer](http://www.kitploit.com/2022/07/koh-token-stealer.html) -- text/plain - - [Edge URL Schemes](https://textslashplain.com/2022/07/18/edge-url-schemes/) -- 吾爱破解论坛 - - [暑假开放注册微信抽奖活动，再送40个账号注册码或300论坛币，周三下午两点开奖，详见【开放注册公告】吾爱破解论坛2022年7月21日暑假开放注册公告。](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651137857&idx=1&sn=104a089b660709446e98d17178d0c5a6&chksm=bd50b7158a273e037de4303a99d08a8c866d4d1adc5b92a446438f8101c5b7c13a8ef567f17b&scene=58&subscene=0#rd) -- 互联网安全内参 - - [FBI将全面升级网络基础设施，拥抱SD-WAN和SASE](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504458&idx=1&sn=3b7c9ca75c32492096981f15c971ed5a&chksm=ebfa956adc8d1c7c9d73a24080f2321e0a8da793b1c4e616a3f70d8065cdb1efb90a8f83a74c&scene=58&subscene=0#rd) - - [银行人脸识别系统被攻破：6次活检比对，近43万被盗走](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504458&idx=2&sn=63d3c5b42c0e985c2837541150ebcd17&chksm=ebfa956adc8d1c7c5f1913b7c18ee569f8a4aca7df17c59a7857da84f668598ab6cca2672618&scene=58&subscene=0#rd) - - [肆意挑衅还是巅峰对决？俄“沙虫”APT组织刻意诱捕ESET安全研究人员](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504458&idx=3&sn=f34a9be4b96a33cd830cfc4be1b4c360&chksm=ebfa956adc8d1c7cb6a8c3eb4532790f77ab93178f5eee8de5ce0b3f8506ba07cc81e72bed7a&scene=58&subscene=0#rd) - - [兰德智库发布“重大网络事件的应急计划指南”](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504458&idx=4&sn=39e2a09003fec75a42912f6a03f880a4&chksm=ebfa956adc8d1c7c30d4b088c1eba7fa84f96ca9479a7297b7f9903e6cfa34f1cb7c737f2052&scene=58&subscene=0#rd) -- 慢雾科技 - - [Premint 恶意代码注入攻击细节分析](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495882&idx=1&sn=799a75415d9449e5d143b41d65c16ad7&chksm=fdde8e4dcaa9075bd56bbd78170ee97a7f28a2852368ec2f83c462382b8b836e28db67840118&scene=58&subscene=0#rd) -- 奇安信CERT - - [安全热点周报|第二百五十三期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496458&idx=1&sn=21672f1ad236b27d50a5aaa63a79d351&chksm=fe79d792c90e5e842969d51621dc90e098839e2cddefdd1eba4bfcedba0e853fd9ff474f0b7d&scene=58&subscene=0#rd) -- 安全牛 - - [容易被忽视的5个安全环节，比想象中的更危险！](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116145&idx=1&sn=15ac0f09e7902dec83b65e66dcae0847&chksm=bd1462a28a63ebb494b55adc43383aa7d050b2e7f8b2423a47cb508455869a1cbced64b65686&scene=58&subscene=0#rd) - - [珞安科技完成C轮超5亿战略融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116145&idx=2&sn=ed2ed4877c77915b60637156f0e829d9&chksm=bd1462a28a63ebb47b6c101355461fe4627c16abf9697905545f18f8bec0413c07ebde809bda&scene=58&subscene=0#rd) - - [安全头条 | 公安机关网安部门重拳打击窃听窃照及偷拍偷窥违法犯罪；世界互联网大会成立大会在京举行](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116145&idx=3&sn=c194703804ea66120a3d570f5f16d8c3&chksm=bd1462a28a63ebb43bd4271e4b8e56d0f5aab36dbb86738e036b4b40a145b7f8d714d28abffd&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】科讯次元完成数千万A轮融资！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006432&idx=1&sn=456646885b46eb008ffbf1f00bada7ba&chksm=f36f4460c418cd76ecaa5ed46243ceac136eb9aa7d30116e95d5fa454f98b01d8c6f59f10cb6&scene=58&subscene=0#rd) - - [【安全圈】银行人脸识别系统被攻破：非本人操作，卡里的钱被转走](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006432&idx=2&sn=095ac551e6056537a263ec40ef862534&chksm=f36f4460c418cd767be539366ea7141f24e20badd9f1ad737e709c8ed8e888328f7976841e56&scene=58&subscene=0#rd) - - [【安全圈】B站：将开放“展示账号 IP 属地”功能，预计一周后全面上线](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006432&idx=3&sn=c059d0218dca8a5df161173f67cad119&chksm=f36f4460c418cd76169deafa89b682730ffe7474a8a111410269a323b470878af918e66ce334&scene=58&subscene=0#rd) - - [【安全圈】粤核酸小程序崩了？记者实测：已修复](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006432&idx=4&sn=9dd97838e0f37c1437e3af4b5ff558d9&chksm=f36f4460c418cd76462c4ee23b55a20819b12dfa386d3956e12e8146126de87d89d1076971a4&scene=58&subscene=0#rd) - - [【安全圈】受到网络攻击 阿尔巴尼亚政府网站被关闭](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006432&idx=5&sn=5661f5ceead344ad4ecb63fa72580dda&chksm=f36f4460c418cd76962dd6bb8fccd0a90c964f4b106dd3d26ffcbff46db9da2726f813934b7f&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | 关于API 安全的五个最佳实践](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494301&idx=1&sn=a069ecfa9f66cf9b57ef1d79065caa73&chksm=c0074701f770ce171aaf1e248a15c5a3c9a1a88d92cf065a3d732aaac063d1c606e276e47732&scene=58&subscene=0#rd) -- 复旦白泽战队 - - [白泽带你读论文 | Adversarial Attacks on Speaker Recognition Systems](https://mp.weixin.qq.com/s?__biz=MzU4NzUxOTI0OQ==&mid=2247485705&idx=1&sn=74625baa3ba6e271705b26eecfe17375&chksm=fdeb8d77ca9c046118eb8562285c4b583bba54ca899291d62828d95f00079b5aadf638da499c&scene=58&subscene=0#rd) -- qz安全情报分析 - - [Gartner预测未来4年的重要网络安全趋势](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907830&idx=1&sn=97935c5502934c1023cae66d80554f75&chksm=f18eeb70c6f9626653cf07ae52d99a3409d087ebe204458b1a7e6cf49a3a52ff9168fb32aebe&scene=58&subscene=0#rd) - - [《基于攻击欺骗的威胁检测》- 将权力转移给防守方](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907830&idx=2&sn=3e61063a5232caf2560290059aa39ea2&chksm=f18eeb70c6f96266e4a1a5407cd1c8d8b97cbb460e7b22d8c590170a2f0def9919d75d0a5069&scene=58&subscene=0#rd) - - [救治企业安全的三颗灵丹](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907830&idx=3&sn=95c86ed221ea9d943d25244d187ba785&chksm=f18eeb70c6f96266454357c7ecae9d62823d19b1b62079839384c0e78c88e29d1aa97905745b&scene=58&subscene=0#rd) - - [企业智能安全运营的秘密](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907830&idx=4&sn=567e1f1bf0e6b70d3b3dab2e73a4d69c&chksm=f18eeb70c6f96266cb8daef495d06f7d97d271d8c662e7d9ed82acef9d38a106022b3fa3e521&scene=58&subscene=0#rd) - - [如何看待当今的云威胁](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907830&idx=5&sn=f2fb3fd72563de54f1586f1d864a009b&chksm=f18eeb70c6f96266ea83c5398fa2b9729082d19b1fe9eb1d54927fb6769498ab801c0d5c2bee&scene=58&subscene=0#rd) - - [渗透测试面试问题指南](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907830&idx=6&sn=3ba8cffeec3cbf1015b856c722eb4491&chksm=f18eeb70c6f9626693438d60d8d9f2091110247ed0f8db9105c46e0638dd9de3729ee80f2cd1&scene=58&subscene=0#rd) - - [高级威胁网络检测响应的秘密](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907830&idx=7&sn=1199d399114da69f21cfc6debb066aad&chksm=f18eeb70c6f9626697279a7e737c71e560a9176878449ea0fb62c51c6a1cd460b5901f386308&scene=58&subscene=0#rd) -- Checkmarx.com - - [Investing in AppSec: 7 Considerations for CISO and AppSec Managers](https://checkmarx.com/blog/investing-in-appsec-7-considerations-for-ciso-and-appsec-managers/) -- 腾讯玄武实验室 - - [每日安全动态推送(07-18)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958602&idx=1&sn=5c91c10b66499f13884548589d115b8c&chksm=8baecdd5bcd944c3114bc43a5169035259eaae8dc50d7a6b1e4aa16a0240a0e0113c9f523a86&scene=58&subscene=0#rd) -- 极客公园 - - [后疫情时代启示录：那些逆势上涨的企业，都做对了什么？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960468&idx=1&sn=75bbd6dc89b01c6c1d72b6e5be9f3c1f&chksm=7e558b6249220274b169386f16320d0677109757f2bfc1e9d6ed45451fbbfa62ffadbba3500d&scene=58&subscene=0#rd) - - [对话 Web3 独角兽 STEPN：真正的「去中心化」在早期很难实现](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960331&idx=1&sn=77f22a9cbdd3a4e03260906cb9c4a50a&chksm=7e558bfd492202eb1177ca98d3382d4ac288f43173dc4fa59fc7553c2d2ef84f1b664f199914&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [详解PHP弱类型安全问题](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494684&idx=1&sn=8264be9d89d29cc3c2c493b9aaa8d35f&chksm=fa5239a2cd25b0b4b7073702768b7327b1136588b67fe0fa751cb2e781738d0096353743b47c&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜Where's My Session Pool?](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135114&idx=1&sn=bac59c131c56547bf6c3555c55f18cbf&chksm=f2c11deac5b694fc797164fda970576382e124ca36618a2c50c6b2c20caef2c8fcbed91e43bc&scene=58&subscene=0#rd) -- 情报分析师 - - [【珍贵资料】涉朝资料大集合](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510906&idx=1&sn=79f0c4bab4388f77ee30c4aa528329ea&chksm=8716b871b061316732f6cc94da1b0b21cb36abc9e09ed000f9b5901ca87498c8411056bf260e&scene=58&subscene=0#rd) - - [西方对俄罗斯的制裁5问](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510906&idx=2&sn=c232cd605caa5548444698548d36d6cb&chksm=8716b871b06131677daab564477f0e13af039651b66714096b4314ef628c9f5c769c0579cf91&scene=58&subscene=0#rd) - - [【情报工具】OpenCTI 网络威胁情报平台简介](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510906&idx=3&sn=549c28069fe846e544448059c39fbd72&chksm=8716b871b0613167167e137c918db654c0c30fa623275a1a4bebf6d5da5d1edc12111cbd375c&scene=58&subscene=0#rd) -- 360Quake空间测绘 - - [用QUAKE“看见”城市资产](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247485999&idx=1&sn=c0382e3c936afa4b7780d8ac707f3937&chksm=c37b8dc4f40c04d2368d0544564b3367dcc0ae648cac80692081edacbc94a2ee43f2e0fcff0d&scene=58&subscene=0#rd) -- 雷神众测 - - [雷神众测漏洞周报2022.7.11-2022.7.17](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498735&idx=1&sn=1387459cd998e124aa04cc7d87dde4e5&chksm=f258489cc52fc18ae479d6cdc8bbe5d694f5bf5ea398e2a6cfce1acd31fbee352b9930cfadca&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [【官宣】敲黑板，ALPHA平台开放注册啦！](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502291&idx=1&sn=3015016bc9920082a03a17ff6005928c&chksm=ea663ea4dd11b7b26332e764c75d65eef8e7a81f6246b6a14faf193379c4d7d2fae9b1350c91&scene=58&subscene=0#rd) -- 看雪学院 - - [BattlEye内核驱动检测模块深入分析](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458548&idx=1&sn=8a88bf980d83bb01eae67ab7b2267ba8&chksm=b18e293e86f9a0287e3364f3d101647da3da2a4d7235a70866a78f8719fb21041a93a3ae0520&scene=58&subscene=0#rd) - - [美国网络安全审查委员会认为Log4j漏洞的影响将持续十年以上](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458548&idx=2&sn=aeb1e215232df51c48b6de6a595d0f4f&chksm=b18e293e86f9a0281b4cf94de5dd351a145be47819ff6515a486a0034d4c42f7017b20f76d89&scene=58&subscene=0#rd) - - [【预售】CTF训练营-Web篇，全方位立体化学习！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458548&idx=3&sn=1c1facd9072d9b396bced1c78614a610&chksm=b18e293e86f9a0282039868e8c44c776ca8285b05ff8b22b12dd4de7be9ab2df4c90efbf63da&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [《2022年嘶吼电子季刊Q2》发布](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545969&idx=1&sn=6d1d920156f395ac98f4a26b1f8b704f&chksm=e915e44bde626d5da8b9356acd72f61690e38759e86b10cbc64317fbd884273727b5b65a788c&scene=58&subscene=0#rd) - - [UNI token空投钓鱼攻击成功窃取Uniswap 800万美元](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545969&idx=2&sn=f1b2073363c45e7052196cfd81df9247&chksm=e915e44bde626d5d33948bf8d22eb5658268a237905a18f8c96c1da450c22a36de42ad7fbc30&scene=58&subscene=0#rd) - - [珞安科技C轮引入6家产业资本，多引擎加速技术与业务深度融合](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545969&idx=3&sn=94f662d6c193c34a70eaef62387a1377&chksm=e915e44bde626d5df6b6cb625dcb9b31c829cdb3a42bf65273d9f1d239a3e5595d9857d05de3&scene=58&subscene=0#rd) - - [ChromeLoader：新出现劫持用户浏览器搜索和展示广告的恶意软件活动（上）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247545969&idx=4&sn=f6f6011859b03339b6b6981bcf4796ec&chksm=e915e44bde626d5ddd87464cc0efea2126c9442f51250e02093022a67700e64b260863874c65&scene=58&subscene=0#rd) -- 网安寻路人 - - [“健康码”数据安全和个人信息保护措施与建议](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495590&idx=1&sn=232a4de8b8c9702be3fc974dbbf77927&chksm=97e9524ca09edb5aef761dbbab2f0f172552d09aa08da56fb4c34ba4b6321660252facecfe36&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第28期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492073&idx=1&sn=70c0a792e8be9e4e30c54ab15a35847e&chksm=fd74d120ca0358365777c2ff8d6a8a2af9b789c6921f3ea8013f9617931543d5f112c2df13db&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220711-20220717)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492073&idx=2&sn=f28c1ec84d499387f9946b06893b33d9&chksm=fd74d120ca03583669520769b65d2dc8ffee808ee881ee9b6d2dd5347f1579ab6a79a36f2552&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [国家工程研究中心安全资讯周报20220718期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529604&idx=1&sn=31e4141d296535012670d02f95f8df00&chksm=fa93c245cde44b53fee18969ce92290f64583f86c16d3a92b75075401e3297a51d868725aba5&scene=58&subscene=0#rd) - - [小型僵尸网络发起史上最强DDoS攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529604&idx=2&sn=bb750ee97250b2fdbb96c564fc7eae68&chksm=fa93c245cde44b53cc13753155ab45e4e692e49544e366ae588e39a403be28b86466f7d9b45d&scene=58&subscene=0#rd) - - [遭受大规模DDOS 攻击，立陶宛能源公司业务被迫中断](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529604&idx=3&sn=cc63cc96e8b76b7358cb5ad2ac6a681b&chksm=fa93c245cde44b533fcc113717b7333f8f08edcf7fcbbf3539809da7d8509a3c496e0267a374&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-20.md b/archive/2022/2022-07-20.md deleted file mode 100644 index 3512e6ef4b..0000000000 --- a/archive/2022/2022-07-20.md +++ /dev/null @@ -1,221 +0,0 @@ -# 每日安全资讯（2022-07-20） - -- Twitter @Nicolas Krassas - - [Okta Exposes Passwords in Clear Text for Possible Theft](https://twitter.com/Dinosn/status/1549453943146676224) - - [Servers Running Digium Phones VoIP Software Are Getting Backdoored](https://twitter.com/Dinosn/status/1549447477371326464) - - [On Detection: Tactical to Functional](https://twitter.com/Dinosn/status/1549428061308960769) - - [New Attack Technique Makes It Easy to Identify Web Users](https://twitter.com/Dinosn/status/1549428003364560896) - - [Pinecone - A WLAN Red Team Framework](https://twitter.com/Dinosn/status/1549426761364037632) - - [Calls For Cryptocurrency Regulation](https://twitter.com/Dinosn/status/1549426701670797317) - - [Unpatched GPS Tracker Security Bugs Threaten 1.5M Vehicles with Disruption](https://twitter.com/Dinosn/status/1549426610159456258) - - [Authentication Risks Discovered in Okta Platform](https://twitter.com/Dinosn/status/1549419165844381697) - - [Belgium says Chinese hackers attacked its Ministry of Defense](https://twitter.com/Dinosn/status/1549419115655356416) - - [NSO Group’s Pegasus Spyware Used against Thailand Pro-Democracy Activists and Leaders](https://twitter.com/Dinosn/status/1549415824640937987) - - [50k credit cards stolen from 300 U.S. restaurants using skimmers](https://twitter.com/Dinosn/status/1549415772258127873) - - [Experts Uncover New CloudMensis Spyware Targeting Apple macOS Users](https://twitter.com/Dinosn/status/1549415729140752386) - - [Air-gapped systems leak data via SATA cable WiFi antennas](https://twitter.com/Dinosn/status/1549415593987784705) - - [Russian SVR hackers use Google Drive, Dropbox to evade detection](https://twitter.com/Dinosn/status/1549374095372042240) - - [Busting browser fails: What attackers see when they hack your employees’ browser](https://twitter.com/Dinosn/status/1549368173006299136) - - [Walmart-controlled flight booking service suffers substantial data leak](https://twitter.com/Dinosn/status/1549367935592005632) - - [Warning for WordPress admins: uninstall the Modern WPBakery plugin immediately!](https://twitter.com/Dinosn/status/1549367716888313856) - - [Roblox breached: Internal documents posted online by unknown attackers](https://twitter.com/Dinosn/status/1549366974110699520) - - [Several New Play Store Apps Spotted Distributing Joker, Facestealer and Coper Malware](https://twitter.com/Dinosn/status/1549366559491112960) - - [RT HTTPVoid: Grafana published a high severity security advisory - "Grafana account takeover via OAuth vulnerability" This was recently discovered & d...](https://twitter.com/httpvoid0x2f/status/1549342976568180747) -- HackerOne Hacker Activity - - [HTML Injection in E-mail Not Resolved ()](https://hackerone.com/reports/1600720) -- Security Boulevard - - [Patch Tuesday Update – July 2022](https://securityboulevard.com/2022/07/patch-tuesday-update-july-2022/) - - [The Life Sciences Supply Chain: Managing Risk to Achieve Greater Cyber Resiliency](https://securityboulevard.com/2022/07/the-life-sciences-supply-chain-managing-risk-to-achieve-greater-cyber-resiliency/) - - [How to Address the Third-Party Cybersecurity Conundrum](https://securityboulevard.com/2022/07/how-to-address-the-third-party-cybersecurity-conundrum/) - - [Slack for Security – User Risk Surveys in Slack](https://securityboulevard.com/2022/07/slack-for-security-user-risk-surveys-in-slack/) - - [The Hacker Mind: G-Men in Cyberspace](https://securityboulevard.com/2022/07/the-hacker-mind-g-men-in-cyberspace/) - - [BSidesSF 2022 – Shobhit Mehta’s ‘Achieving HITRUST On A Budget’](https://securityboulevard.com/2022/07/bsidessf-2022-shobhit-mehtas-achieving-hitrust-on-a-budget/) - - [How TCO Helps You Optimize Your Strategic Initiatives](https://securityboulevard.com/2022/07/how-tco-helps-you-optimize-your-strategic-initiatives/) - - [PrestaShop Skimmer Concealed in One Page Checkout Module](https://securityboulevard.com/2022/07/prestashop-skimmer-concealed-in-one-page-checkout-module/) - - [XKCD ‘Capri Suns’](https://securityboulevard.com/2022/07/xkcd-capri-suns/) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5524-1](https://packetstormsecurity.com/files/167769/USN-5524-1.txt) - - [Ubuntu Security Notice USN-5523-1](https://packetstormsecurity.com/files/167768/USN-5523-1.txt) - - [Ubuntu Security Notice USN-5520-2](https://packetstormsecurity.com/files/167767/USN-5520-2.txt) - - [Ubuntu Security Notice USN-5522-1](https://packetstormsecurity.com/files/167766/USN-5522-1.txt) - - [Spryker Commerce OS Remote Command Execution](https://packetstormsecurity.com/files/167765/SCHUTZWERK-SA-2022-003.txt) - - [2nd International Workshop On Cyber Forensics And Threat Investigations Challenges Call For Papers](https://packetstormsecurity.com/files/167764/CFTIC2022-CFP.txt) - - [Asus GameSDK 1.0.0.4 Unquoted Service Path](https://packetstormsecurity.com/files/167763/asusgamesdk1004-unquotedpath.txt) -- unSafe.sh - 不安全 - - [TTD历史回顾](https://buaq.net/go-118276.html) - - [Appsec Decoded: Application security orchestration and correlation](https://buaq.net/go-118244.html) - - [[有手就行]Log4j打点后与管理员斗智斗勇](https://buaq.net/go-118241.html) - - [Riding the InfoRail to Exploit Ivanti Avalanche: Multiple bugs detailed in the popular MDM tool](https://buaq.net/go-118243.html) - - [Riding the InfoRail to Exploit Ivanti Avalanche](https://buaq.net/go-118245.html) - - [Fraudulent cryptocurrency investment apps are duping investors](https://buaq.net/go-118219.html) - - [PayPal phishing campaign goes after more than just your login credentials](https://buaq.net/go-118220.html) - - [JARM 指纹混淆随机化技术实现](https://buaq.net/go-118215.html) - - [websocket新型内存马的应急响应](https://buaq.net/go-118216.html) -- 信息安全知识库 - - [全球网络安全趋势预测](https://vipread.com/library/topic/3740) - - [SaaS云产品安全之道及实践分享](https://vipread.com/library/topic/3741) - - [零信任SASE 建立数字化企业多云安全访问体系的建设经验分享](https://vipread.com/library/topic/3742) - - [疫情笼罩的背景下-云上远程办公安全的思考与实践](https://vipread.com/library/topic/3743) - - [字节跳动云安全思考与实践](https://vipread.com/library/topic/3744) - - [云原生DevSecOps建设实践](https://vipread.com/library/topic/3745) - - [基础设施代码化触发 新一代云安全态势管理](https://vipread.com/library/topic/3746) - - [聊聊代码保护](https://vipread.com/library/topic/3747) - - [大数据和AI加持下的社交反欺诈](https://vipread.com/library/topic/3748) - - [滑动验证码协议通用解决方案](https://vipread.com/library/topic/3749) - - [Frida辅助安卓SO算法还原和自动化黑盒调用](https://vipread.com/library/topic/3750) - - [Android App网络漏洞挖掘技巧](https://vipread.com/library/topic/3751) - - [IoT设备调试实战：基于UART串口命令构造调试功能](https://vipread.com/library/topic/3752) - - [WEB前端安全之同源策略](https://vipread.com/library/topic/3753) - - [物理安全与近源渗透威胁分析](https://vipread.com/library/topic/3754) - - [rida在抓包中的应用](https://vipread.com/library/topic/3755) - - [以数据和人员为中心的数据安全治理及技术体系](https://vipread.com/library/topic/3756) - - [终端数据防泄漏开发实战](https://vipread.com/library/topic/3757) - - [基于全链路的数据隐私治理](https://vipread.com/library/topic/3758) - - [行业常见数据安全风险和解决之道—数据在流动，可见才安全](https://vipread.com/library/topic/3759) -- Trustwave Blog - - [Trustwave SpiderLabs: The Power Behind MailMarshal](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-spiderlabs-the-power-behind-mailmarshal/) -- 先知安全技术社区 - - [ThinkPHP6.0.12LTS反序列化（getshell的poc链挖掘）](https://xz.aliyun.com/t/11531) - - [linux下进程隐藏的一些研究](https://xz.aliyun.com/t/11536) - - [CVE-2019-13954 之MikroTik RouterOS memory exhaustion](https://xz.aliyun.com/t/11541) -- 先知安全技术社区 - - [ThinkPHP6.0.12LTS反序列化（getshell的poc链挖掘）](https://xz.aliyun.com/t/11531) - - [linux下进程隐藏的一些研究](https://xz.aliyun.com/t/11536) - - [CVE-2019-13954 之MikroTik RouterOS memory exhaustion](https://xz.aliyun.com/t/11541) -- Sploitus.com Exploits RSS Feed - - [Property Listing Script 3.1 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37843&utm_source=rss&utm_medium=rss) - - [Spryker Commerce OS Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167765&utm_source=rss&utm_medium=rss) - - [Asus GameSDK 1.0.0.4 Unquoted Service Path exploit](https://sploitus.com/exploit?id=PACKETSTORM:167763&utm_source=rss&utm_medium=rss) - - [Travel Tours Script 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37844&utm_source=rss&utm_medium=rss) - - [Exploit for Deserialization of Untrusted Data in Apache Log4J exploit](https://sploitus.com/exploit?id=B09C4EFC-2C66-5CA8-910F-E21D17B89608&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-33891 exploit](https://sploitus.com/exploit?id=EDC0B42E-E725-52B7-B540-67B115500C93&utm_source=rss&utm_medium=rss) -- Google Online Security Blog - - [DNS-over-HTTP/3 in Android](http://security.googleblog.com/2022/07/dns-over-http3-in-android.html) -- Sucuri Blog - - [PrestaShop Skimmer Concealed in One Page Checkout Module](https://blog.sucuri.net/2022/07/prestashop-skimmer-concealed-in-one-page-checkout-module.html) -- paper - Last paper - - [简单理解 V8 Turbofan](https://paper.seebug.org/1936/) - - [Pocsuite3 Tutorial for beginners](https://paper.seebug.org/1933/) -- 安全脉搏 - - [Flask send_file函数导致的绝对路径遍历](https://www.secpulse.com/archives/183820.html) - - [干货 | SRC和漏洞挖掘中的隐藏参数测试手法和工具总结](https://www.secpulse.com/archives/183811.html) - - [干货 | 记一次CVE申请之旅](https://www.secpulse.com/archives/183793.html) - - [干货 | 无视杀软使用远控横向小技巧](https://www.secpulse.com/archives/183767.html) -- Microsoft Security Blog - - [How Microsoft Security partners are helping customers do more with less](https://www.microsoft.com/security/blog/2022/07/19/how-microsoft-security-partners-are-helping-customers-do-more-with-less/) -- Recent Commits to cve:main - - [Add banner](https://github.com/trickest/cve/commit/67399b39120278acdfec2f5017b6cf654b03bd62) - - [Update Tue Jul 19 12:14:22 UTC 2022](https://github.com/trickest/cve/commit/93b2752f1b27b6cee723c52b574d0b9ccb37bf74) -- SecWiki News - - [SecWiki News 2022-07-19 Review](http://www.sec-wiki.com/?2022-07-19) -- Sec-News 安全文摘 - - [[有手就行]Log4j打点后与管理员斗智斗勇](https://wiki.ioin.in/url/Wbry) - - [JARM 指纹混淆随机化技术实现](https://wiki.ioin.in/url/ydrN) - - [websocket新型内存马的应急响应](https://wiki.ioin.in/url/Rn2m) - - [CVE-2020-8558-跨主机访问127.0.0.1](https://wiki.ioin.in/url/VOAX) - - [Microsoft SharePoint Server WizardConnectToDataStep4 Deserialization Of Untrusted Data RCE](https://wiki.ioin.in/url/QbDD) -- Bug Bounty in InfoSec Write-ups on Medium - - [Good things takes time | Story of my first “valid” critical bug!](https://infosecwriteups.com/story-of-my-first-valid-critical-bug-22029115f8d7?source=rss----7b722bfd1b8d--bug_bounty) - - [Hacking Facebook Invoice: How I could’ve bought anything for Free from Facebook Business Pages](https://infosecwriteups.com/hacking-facebook-invoice-how-i-couldve-bought-anything-for-free-from-facebook-business-pages-42bcfaa73ec4?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [Common performance issues with the inline declarations](https://blogs.sap.com/2022/07/19/common-performance-issues-with-the-inline-declarations/) - - [Build an integral SAP Integration Suite project and consume it from a SAP AppGyver custom app – Tutorial Blog Post Series Introduction](https://blogs.sap.com/2022/07/19/build-an-integral-sap-integration-suite-project-and-consume-it-from-a-sap-appgyver-custom-app-tutorial-blog-post-series-introduction/) - - [SAP Inside Track DFW](https://blogs.sap.com/2022/07/19/sap-inside-track-dfw/) - - [Creating End to End Synchronous Supply Chain Plans with SAP Supply Chain Planning Suite](https://blogs.sap.com/2022/07/19/creating-end-to-end-synchronous-supply-chain-plans-with-sap-supply-chain-planning-suite/) - - [RISE with SAP – The current trend & market offering by SAP](https://blogs.sap.com/2022/07/19/rise-with-sap-the-current-trend-market-offering-by-sap/) - - [SAP Mentors Spotlight Interview: Paul Modderman](https://blogs.sap.com/2022/07/19/sap-mentors-spotlight-interview-paul-modderman/) - - [SAP Global Trade Services is Named a Market Share Leader Once Again](https://blogs.sap.com/2022/07/19/sap-global-trade-services-is-named-a-market-share-leader-once-again/) - - [Three Ways SAP BTP Helps Our Customers Achieve Their Sustainability Goals](https://blogs.sap.com/2022/07/19/three-ways-sap-btp-helps-our-customers-achieve-their-sustainability-goals/) -- Malwarebytes Labs - - [Fraudulent cryptocurrency investment apps are duping investors](https://blog.malwarebytes.com/scams/2022/07/fraudulent-cryptocurrency-investment-apps-are-duping-investors/) - - [PayPal phishing campaign goes after more than just your login credentials](https://blog.malwarebytes.com/social-engineering/2022/07/paypal-phishing-campaign-goes-after-more-than-just-your-login-credentials/) - - [Warning for WordPress admins: uninstall the Modern WPBakery plugin immediately!](https://blog.malwarebytes.com/malwarebytes-news/2022/07/warning-for-wordpress-admins-uninstall-the-modern-wpbakery-plugin-immediately/) - - [Roblox breached: Internal documents posted online by unknown attackers](https://blog.malwarebytes.com/cybercrime/2022/07/roblox-breached-internal-documents-posted-online-by-unknown-attackers/) -- Twitter @bytehx - - [RT Dzmitry Lukyanenko: React debug.keystore key was trusted by Meta(Facebook) which caused to Instagram account takeover by malicious apps. More infor...](https://twitter.com/vulnano/status/1549378780564803585) -- Sucuri Blog - - [PrestaShop Skimmer Concealed in One Page Checkout Module](https://blog.sucuri.net/2022/07/prestashop-skimmer-concealed-in-one-page-checkout-module.html) -- Didier Stevens - - [Update: base64dump.py Version 0.0.23](https://blog.didierstevens.com/2022/07/19/update-base64dump-py-version-0-0-23/) -- Reverse Engineering - - [Microcode Decryptor: recovered format of microcode updates, algorithm and the encryption key used to protect the microcode for Intel CPUs](https://www.reddit.com/r/ReverseEngineering/comments/w2kco2/microcode_decryptor_recovered_format_of_microcode/) - - [Riding the InfoRail to Exploit Ivanti Avalanche: Multiple bugs detailed in the popular MDM tool](https://www.reddit.com/r/ReverseEngineering/comments/w2tkwu/riding_the_inforail_to_exploit_ivanti_avalanche/) -- KitPloit - PenTest & Hacking Tools - - [Pinecone - A WLAN Red Team Framework](http://www.kitploit.com/2022/07/pinecone-wlan-red-team-framework.html) -- 博客园 - sevck - - [[转]python执行系统命令，怎么就卡死了？ - sevck](https://www.cnblogs.com/sevck/p/16494222.html) -- The Daily Swig | Cybersecurity news and views - - [‘Password extraction risk’ in identity provider Okta disputed](https://portswigger.net/daily-swig/password-extraction-risk-in-identity-provider-okta-disputed) - - [Tor Browser 11.5 release enables users to automatically circumvent censorship](https://portswigger.net/daily-swig/tor-browser-11-5-release-enables-users-to-automatically-circumvent-censorship) - - [LDAP Account Manager bug poses unauthenticated remote code execution risk](https://portswigger.net/daily-swig/ldap-account-manager-bug-poses-unauthenticated-remote-code-execution-risk) -- - - [终章](https://4ra1n.love/post/yJLFt2hiK/) -- HAHWUL - - [간단하게 ZAP Scripting 배워보기](https://www.hahwul.com/2022/07/19/zap-scripting-for-noob/) -- Microsoft Security Response Center - - [Congratulations to the Top MSRC 2022 Q2 Security Researchers!](https://msrc-blog.microsoft.com/2022/07/19/congratulations-to-the-top-msrc-2022-q2-security-researchers/) -- Wallarm - - [Wallarm extends AWS API security with the official Terraform module](https://lab.wallarm.com/wallarm-extends-aws-api-security/) -- Application Security Blog - - [Appsec Decoded: Application security orchestration and correlation](https://www.synopsys.com/blogs/software-security/appsec-decoded-asoc-benefits/) -- 三六零CERT - - [CVE-2022-33891：Apache Spark 命令注入漏洞通告](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491169&idx=1&sn=1efa2d5412ce1462699b6c0c72d3d887&chksm=fe251b60c9529276a16f3e2025e09b4b172a1628112eaf6d56bdf26b6a6286f2d136f3dd253a&scene=58&subscene=0#rd) - - [安全日报（2022.07.19）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491169&idx=2&sn=dfea07c5e63ca03807286013072bae5b&chksm=fe251b60c9529276141ed096f6c4c920b103c999a49ca96248d97a2591eaad43579c1958b809&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [黑产对抗监测：全局暗链植入！对IIS劫持进行暗链植入的病毒样本分析](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247489381&idx=1&sn=3420a4c86c743db865f2455a945dbce0&chksm=f9ee7bdace99f2cc11777209f00d70949775e3bccfdbf1dbbe46147c4c1435992ab4cb088ac5&scene=58&subscene=0#rd) -- XCTF联赛 - - [Vidar-Team战队专访：AS WE DO, AS YOU KNOW.](https://mp.weixin.qq.com/s?__biz=MjM5NDU3MjExNw==&mid=2247507287&idx=1&sn=960f524d4064e1a0ebf5d501f0d77c97&chksm=a6872f6d91f0a67bf19000602fe889ee2e7b325d2fa4608ae3e6351a8f013a8d13537eaca3ef&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [近期网络安全事件盘点](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491432&idx=1&sn=3f8c2b6ca8092f97ce619f5c7406ad6a&chksm=feb59e7bc9c2176d373349cde0a613533d288bffa93a6d02983bf8cd968009fe8f79fd50cf3c&scene=58&subscene=0#rd) - - [数据安全与效率不能“二选一”](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491432&idx=2&sn=9a5bdb5c90ac16ad3280846a168adb67&chksm=feb59e7bc9c2176d89fea5c0d666b52aa2e2f19d3ad3beef3b750a30e88dad22d323c4b600c9&scene=58&subscene=0#rd) -- 安全牛 - - [安卓恶意软件威胁的识别与应对](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116183&idx=1&sn=fbdc2c98a830049d1c270ab9de499106&chksm=bd1462448a63eb5249b318192e16725fdaa39551ecb45a0527cabe6851dd9d56df383dbee3c7&scene=58&subscene=0#rd) - - [浅谈网络资产探测技术与常用方法](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116183&idx=2&sn=e5b2b26db288859cf512c1dd593505f9&chksm=bd1462448a63eb5225c88b1331dcf506b83a2c9417e1ce0a6ae2084837ab0afeabaa6b6e4e57&scene=58&subscene=0#rd) - - [中央网信办启动“清朗·2022年暑期未成年人网络环境整治”专项行动](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116183&idx=3&sn=ba122621585b2adbbb6d131b0abf8d02&chksm=bd1462448a63eb52408e0d20acce96d4621c65bb297fc88eed91d339241bcc8fa4a7c40bd508&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】黑客狱中相识，出狱联手作案，五天狂捞200万！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006887&idx=1&sn=9918b5af9f9fea71c1d7ab0203631ce8&chksm=f36f45a7c418ccb13d9d3a609d6a9ba71e92b71e3258d63063541f4aecb9260544c4ce968043&scene=58&subscene=0#rd) - - [【安全圈】我馆驳斥比利时政府：反对凭空指责中方恶意网络攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006887&idx=2&sn=07cf886bd83e535d456b991f4612f05d&chksm=f36f45a7c418ccb19e273f5ad803b820590038427849323d0c18aaa2fc1f9f5dac39ac0ac1c7&scene=58&subscene=0#rd) - - [【安全圈】国内病毒作者利用“吃鸡”外挂传播新型勒索病毒](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006887&idx=3&sn=68c58ac4fc2af2a0ce1c3c9c2a04c52f&chksm=f36f45a7c418ccb15b281f02a6f13f6befe99716dbc33cc833b00ee09c42c5c75ade93b5633f&scene=58&subscene=0#rd) - - [【安全圈】工控系统谨防PLC和HMI的密码破解软件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006887&idx=4&sn=2be5214a2e31064b3b7db200999e1c30&chksm=f36f45a7c418ccb18ee6bdc3f4bb38ff7d5a58cf8c0e6c1c4cab1c8316b97143729e744c59cf&scene=58&subscene=0#rd) - - [【安全圈】攻击者利用伪造时间戳等方式在 GitHub 上传播恶意代码](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006887&idx=5&sn=d147381ba32b61a0fb79ed0d5a6ff740&chksm=f36f45a7c418ccb1a76d8ab144db3ed01eb206e1ea6aa6b641807069389037b6e953b27a7f45&scene=58&subscene=0#rd) - - [【安全圈】NFT 艺术家的推特帐户被黑，超 15 万美元的 NFT 被盗](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652006887&idx=6&sn=21f475c47ed0c754dd4ba38fc43984f8&chksm=f36f45a7c418ccb1c0981d57a2948367fd07613cbf6d6e70312c8681a2b2b286d2c197a5d6da&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [虚拟化安全｜从一道CTF题目学习KVM](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494743&idx=1&sn=2f3bede3835ac1874f4fc556df1603f4&chksm=fa5239e9cd25b0ff2894214c6521cfee39445286b0d4938e7e9c4fb411a271cfb80ecddeaf8f&scene=58&subscene=0#rd) -- 黑奇士 - - [今日八卦：佳缘高管集体被抓，美团员工工作时间约炮](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247487054&idx=1&sn=9d6c81ba14128e7dea389c366c797897&chksm=eca201a2dbd588b4eeb6680344f29d00b0a0a8ae8b37107f8573458e1ee5e739eb4ced054780&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-07-19](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490839&idx=1&sn=5d7a7f2c053272499ba73615880ada01&chksm=c06033cef717bad8d3a9dcf31c5bcd132bc53b6622f991382497a71d28dded5d2f9b1df283ff&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jul.19th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495685&idx=1&sn=b7f6f97a5e8075b615abfd524b7da990&chksm=ce96bd3bf9e1342d78eaabb28025307ec85d997ee969f925a4007412a70651c4424df1c6cffe&scene=58&subscene=0#rd) -- 星阑科技 - - [实力认可+13｜星阑科技多领域入选《嘶吼2022网络安全产业图谱》](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494329&idx=1&sn=0035dc2e1d99ccaff8a11aa1c67b48cd&chksm=c0074725f770ce3356b4a7e4a9819749e464490bbd0ab5dcd598ad21fe5e2d669d58819b05e5&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [医疗行业屡遭攻击，火绒安全提供专项安防方案](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247506750&idx=1&sn=7b461e4f9e3d5073d0316313860906d2&chksm=eb700501dc078c175699849dbb0c2305c7e307aeff2f2a18aedadaab52d0bcdc84f03be052a9&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜名侦探的下午茶：Hunting with Provenance](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135271&idx=1&sn=e46fdce3389d376636aa20fbab5c7393&chksm=f2c11c47c5b69551b300ec8f97635e65944f60e1ea1259714d842645e7475043e4023885634a&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [刷量产业链不断进化升级，新型“高级账号”刷量悄然出现](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493803&idx=1&sn=ce52f63c03c6c606f7dfa815f4a3e1de&chksm=eb12ce90dc654786aa437b046224209de916010cc456a82098b8e7ddaa8beeee8f7c2ccee608&scene=58&subscene=0#rd) -- 暗影安全 - - [【红蓝对抗】一次直达工控区的"简单"渗透](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163057&idx=1&sn=ccda06d499b773f35ff1142cf5e1e4b3&chksm=f1d4e5d4c6a36cc2bf94a058adc493fe85da0105b9da45ed7c0c4a1b4f5add22057e033e786a&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [Log4Shell漏洞的长期影响](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546070&idx=1&sn=b7870a98cce3167f4b3304a641e7366f&chksm=e915e4ecde626dfab5013813fab5509d733deb5fa14d1db5d241a683af2077a57d75abefc12c&scene=58&subscene=0#rd) - - [效果拔群：安全基础知识提升是防御威胁攻击的有效方式](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546070&idx=2&sn=0f616664420fd8a11ff166eeb8baa75e&chksm=e915e4ecde626dfa769f33aba91a696f4219ba116611ef2fb12dc019adf44d9a7b6839b40376&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 三菱PLC MELSOFT通信协议浅析](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529710&idx=1&sn=35fef1aef81f4bba0ef31808d05f0740&chksm=fa93c22fcde44b3992d1bdc63cfeb4e17b6102c4c47add5f8200c78ea1ee6d70a2d701075019&scene=58&subscene=0#rd) - - [全球工控系统面临“木马危机”](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529710&idx=2&sn=98bb3dcb9c0ab550a080c3b8e6fc3779&chksm=fa93c22fcde44b390e52b10895798a081848ae422c2d129af3a7c526eab646f8b76101cf10fa&scene=58&subscene=0#rd) - - [小型企业CISO的五个关键要点](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529710&idx=3&sn=7e1cbdec5f79aa22217d4e8ae8284119&chksm=fa93c22fcde44b39b8f771252fe1eca32d33b69f11b7eb29874c74b9bffd774071d6fcda96f7&scene=58&subscene=0#rd) - - [容易被忽视的5个安全环节，比想象中的更危险！](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529710&idx=4&sn=2c7f302c0426528786972129c0105858&chksm=fa93c22fcde44b397fbb6555db861b80902779230f093a66005a3056287f8b80e526668184f1&scene=58&subscene=0#rd) -- 极客公园 - - [视频号原生广告上线；抖音关闭「圈子」功能；《沙丘 2》正式开机，明年上映 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960492&idx=1&sn=446bd1bc0ac59a18c0769022b4892d30&chksm=7e558b5a4922024c2a9128ca5513507232aab2210011ee4a7300e425d790b9b9c0a9cad3c758&scene=58&subscene=0#rd) -- Seebug漏洞平台 - - [简单理解 V8 Turbofan](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650963153&idx=1&sn=d99f63941dacff1f1c889779b6a8970a&chksm=80793ee3b70eb7f5017a4c71c7847588998bc8b0e8050e9621d24758b30745277dec0edb82e8&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [起底国家级APT组织：金刚象（APT-Q-43)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502293&idx=1&sn=bc192e97dee55b136fcc4b10218f2c4b&chksm=ea663ea2dd11b7b46e4de1feeaa8af6e18f991472134dde5f1ac3155c4665bc935bfbc94b3cd&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [CNVD漏洞周报2022年第28期](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496949&idx=1&sn=3bf4566bf80aef54b0dc687f12811f30&chksm=973ac797a04d4e816cff077406c43eac712f78b4df7f78a5fd846810a99dedb96afedf62d23b&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220711-20220717)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496949&idx=2&sn=7b0be2eda6b68372ca73959ac58413cd&chksm=973ac797a04d4e817a7b93b0fb0135c454cff8011bf5dec2360f29527f16e682ea20bff4375b&scene=58&subscene=0#rd) - - [每周移动恶意程序传播渠道安全监测报告（2022年07月11日—2022年07月17日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247496949&idx=3&sn=064d7dba184bc28f17c043b80a47a1ab&chksm=973ac797a04d4e81f0f217d98a1b27cafd51a41dd39fc76fb67ced955ed2da2d0f4b98c112b6&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报经典】电子书《情报分析的应用思维》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510908&idx=1&sn=3d6705df34f7440feb5a366f9287f712&chksm=8716b877b0613161f31cea553e7ba6d89c8e5f8a5ca76d768cbaf9e2cdbb447e1c6f33198375&scene=58&subscene=0#rd) - - [通过谷歌的眼睛看世界](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510908&idx=2&sn=c9a57fa6b7a876241d1eb1b521a113db&chksm=8716b877b0613161ccf01177983276fd09b568b3030c5746cd9ba4758cec45bb9c7a25a3ce39&scene=58&subscene=0#rd) - - [【开源情报工具】mindat.org](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650510908&idx=3&sn=a411b7fedb7e2033104b58756a5d5de9&chksm=8716b877b06131611cbc0898697d4df7010b25a3043efd7659d89337388d714be22ccd86a415&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-21.md b/archive/2022/2022-07-21.md deleted file mode 100644 index a5ab094baf..0000000000 --- a/archive/2022/2022-07-21.md +++ /dev/null @@ -1,281 +0,0 @@ -# 每日安全资讯（2022-07-21） - -- Security Boulevard - - [SafeBreach Enhances ATT&CK Coverage with Industry Scenarios Focused on Top-16 MITRE TTPs](https://securityboulevard.com/2022/07/safebreach-enhances-attck-coverage-with-industry-scenarios-focused-on-top-16-mitre-ttps/) - - [Sifting Through Digital Exhaust](https://securityboulevard.com/2022/07/sifting-through-digital-exhaust/) - - [BSidesSF 2022 – Amol Sarwate’s ‘Threat Hunting: Using MITRE ATT&CK Against Carbanak Malware’](https://securityboulevard.com/2022/07/bsidessf-2022-amol-sarwates-threat-hunting-using-mitre-attck-against-carbanak-malware/) - - [Ask the CEO: Dynamically Speaking live Q&A highlights – Part 2](https://securityboulevard.com/2022/07/ask-the-ceo-dynamically-speaking-live-qa-highlights-part-2/) - - [Top three tips for ensuring software supply chain security](https://securityboulevard.com/2022/07/top-three-tips-for-ensuring-software-supply-chain-security/) - - [ICYMI: Top 5 Blogs on Securing the Atomized Network](https://securityboulevard.com/2022/07/icymi-top-5-blogs-on-securing-the-atomized-network/) - - [Penetration Testing Vs Vulnerability Scanning: What’s the Difference?](https://securityboulevard.com/2022/07/penetration-testing-vs-vulnerability-scanning-whats-the-difference/) - - [The Best Way to Detect Threats In the Cloud?](https://securityboulevard.com/2022/07/the-best-way-to-detect-threats-in-the-cloud/) - - [Emerging Tech Report Highlights CIEM Providers](https://securityboulevard.com/2022/07/emerging-tech-report-highlights-ciem-providers/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Active eCommerce Laravel CMS 5.x to 6.1.2 - Cross Site request forgery (CSRF) to Cross-site Scripting (XSS) (Authenticated)](https://cxsecurity.com/issue/WLB-2022070059) - - [eShop - Multipurpose Ecommerce / Store Website 3.0.4 - Cross Site Scripting (XSS)](https://cxsecurity.com/issue/WLB-2022070058) - - [Spryker Commerce OS Remote Command Execution](https://cxsecurity.com/issue/WLB-2022070057) - - [Asus GameSDK 1.0.0.4 Unquoted Service Path](https://cxsecurity.com/issue/WLB-2022070056) - - [Emporium eCommerce Online Shopping CMS 1.2 SQL Injection](https://cxsecurity.com/issue/WLB-2022070055) -- NOSEC 安全讯息平台 - 漏洞预警 - - [【安全通报】Weblogic 七月份更新多个高危漏洞](https://nosec.org/home/detail/5032.html) -- HackerOne Hacker Activity - - [DOM XSS on ads.tiktok.com](https://hackerone.com/reports/1549451) - - [Internal Employee informations Disclosure via TikTok Athena api](https://hackerone.com/reports/1575560) - - [Can access the job name, creator name and can report any draft/under review/rejected job](https://hackerone.com/reports/1581528) - - [LFI via Jolokia at https://█.█.█.█:1293](https://hackerone.com/reports/1641661) -- 安全客-有思想的安全新媒体 - - [有俄罗斯背景的黑客组织骚操作：伪装为反俄应用来传播恶意软件](https://www.anquanke.com/post/id/276764) - - [Pocsuite3 入门教程](https://www.anquanke.com/post/id/276460) - - [新公布文件显示美国政府手机监控规模异乎寻常](https://www.anquanke.com/post/id/276671) -- paper - Last paper - - [CVE-2020-8558-跨主机访问127.0.0.1](https://paper.seebug.org/1938/) - - [Linux 内核 nftables 子系统研究与漏洞分析](https://paper.seebug.org/1937/) -- SecWiki News - - [SecWiki News 2022-07-20 Review](http://www.sec-wiki.com/?2022-07-20) -- 先知安全技术社区 - - [CVE-2022-0540: Jira身份验证绕过分析](https://xz.aliyun.com/t/11543) - - [某次红蓝对抗之Solr-RCE实战绕过](https://xz.aliyun.com/t/11546) -- 跳跳糖 - 安全与分享社区 - - [关于微信数据库的解密以及取证](https://tttang.com/archive/1665/) -- 信息安全知识库 - - [从网络安全态势洞察关基安全防护落地思路 助力安全中国，助推数字经济](https://vipread.com/library/topic/3809) - - [SOCaaS 在OT环境下的实践](https://vipread.com/library/topic/3810) - - [数字化改革背景下浙江大学 大安全运营实践](https://vipread.com/library/topic/3811) - - [安全运营ABC](https://vipread.com/library/topic/3812) - - [“天地人机”深度融合，探索安全服务未来发展方向](https://vipread.com/library/topic/3813) - - [以智慧蓉城为牵引精心打造智慧大运](https://vipread.com/library/topic/3814) - - [亚运网络安全总体策略](https://vipread.com/library/topic/3815) -- unSafe.sh - 不安全 - - [Another ransomware payment recovered by the Justice Department](https://buaq.net/go-118479.html) - - [反-反蜜罐：以三个反蜜罐插件的缺陷为例](https://buaq.net/go-118464.html) - - [EDR for Cloud Workloads Running on AWS Graviton](https://buaq.net/go-118483.html) - - [自用过的海外独服情况总结 | 初行博客](https://buaq.net/go-118460.html) -- Twitter @Nicolas Krassas - - [Will new EU crypto rules change how ransomware is played?](https://twitter.com/Dinosn/status/1549835594569752604) - - [Instagram App Access Token](https://twitter.com/Dinosn/status/1549835375111184385) - - [Atlassian fixes critical Confluence hardcoded credentials flaw](https://twitter.com/Dinosn/status/1549835085377159171) - - [Cisco fixes bug that lets attackers execute commands as root](https://twitter.com/Dinosn/status/1549822369203634178) - - [SATAn: Air-Gap Exfiltration Attack via Radio Signals From SATA Cables](https://twitter.com/Dinosn/status/1549766341204316164) - - [Encrypting Strings at Compile Time](https://twitter.com/Dinosn/status/1549766272535117824) - - [Singapore distances itself from local crypto companies](https://twitter.com/Dinosn/status/1549757096450727938) - - [New Rust-based Ransomware Family Targets Windows, Linux, and ESXi Systems](https://twitter.com/Dinosn/status/1549755594197835777) - - [Cdb - Automate Common Chrome Debug Protocol Tasks To Help Debug Web Applications From The Command-Line And Actively Monitor And Intercept HTTP Request...](https://twitter.com/Dinosn/status/1549755262587863042) - - [ROADtools is a framework to interact with Azure AD. It currently consists of a library (roadlib) and the ROADrecon Azure AD exploration tool.](https://twitter.com/Dinosn/status/1549749302100168706) - - [RT PT SWARM: 🥳 We have reproduced an Arbitrary File Read for an internal site of Skype for Business / MS Lync! CVE: CVE-2022-26911 Subdomains: dial...](https://twitter.com/ptswarm/status/1549744638193541122) - - [Ethical Hacking & Penetration Testing Course](https://twitter.com/Dinosn/status/1549716560834609152) - - [New Luna ransomware encrypts Windows, Linux, and ESXi systems](https://twitter.com/Dinosn/status/1549699877910843393) - - [RT Quang Vo: I just published a blog post analyze .Net deserialization TypeConfuseDelegate gadget chain which is one of the simplest gadget chain in ....](https://twitter.com/mr_r3bot/status/1549661787351437312) - - [Building materials giant Knauf hit by Black Basta ransomware gang](https://twitter.com/Dinosn/status/1549654502848057344) - - [Riding the InfoRail to Exploit Ivanti Avalanche: Multiple bugs detailed in the popular MDM tool](https://twitter.com/Dinosn/status/1549654446531088386) - - [UK heat wave causes Google and Oracle cloud outages](https://twitter.com/Dinosn/status/1549654252825477121) - - [Amazon sues 10,000 Facebook Group admins for offering fake reviews](https://twitter.com/Dinosn/status/1549653918329835520) - - [Russian Hackers Using DropBox and Google Drive to Drop Malicious Payloads](https://twitter.com/Dinosn/status/1549651763820625921) - - [GraphCrawler: GraphQL automated testing tookit](https://twitter.com/Dinosn/status/1549651606911827969) -- Tenable Blog - - [Oracle July 2022 Critical Patch Update Addresses 188 CVEs](https://www.tenable.com/blog/oracle-july-2022-critical-patch-update-addresses-188-cves) - - [Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group](https://www.tenable.com/blog/brazen-unsophisticated-and-illogical-understanding-the-lapsus-extortion-group) -- Recent Commits to cve:main - - [Update Wed Jul 20 11:53:42 UTC 2022](https://github.com/trickest/cve/commit/4aac4bb49aec866ac8f3f35269787028d85eab28) -- ElcomSoft blog - - [Apple TV 4K Keychain and Full File System Acquisition](https://blog.elcomsoft.com/2022/07/apple-tv-4k-keychain-and-full-file-system-acquisition/) -- Trustwave Blog - - [How Rugby Can Teach Cybersecurity Leaders to Build and Manage their Teams](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/how-rugby-can-teach-cybersecurity-leaders-to-build-and-manage-their-teams/) -- 安全脉搏 - - [Android网络库详解](https://www.secpulse.com/archives/183844.html) - - [ARM PWN基础教程](https://www.secpulse.com/archives/183868.html) - - [XSS 与 CSRF 攻击——有什么区别?](https://www.secpulse.com/archives/183028.html) - - [【漏洞预警】微软7月安全更新多个产品高危漏洞](https://www.secpulse.com/archives/183850.html) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5528-1](https://packetstormsecurity.com/files/167774/USN-5528-1.txt) - - [Ubuntu Security Notice USN-5525-1](https://packetstormsecurity.com/files/167773/USN-5525-1.txt) - - [Ubuntu Security Notice USN-5527-1](https://packetstormsecurity.com/files/167772/USN-5527-1.txt) - - [Ubuntu Security Notice USN-5526-1](https://packetstormsecurity.com/files/167771/USN-5526-1.txt) - - [Emporium eCommerce Online Shopping CMS 1.2 SQL Injection](https://packetstormsecurity.com/files/167770/emporiumecommcms12-sql.txt) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [技术沙龙 | 企业办公安全的SASE实操](https://www.4hou.com/posts/O9Er) - - [漏洞预警|Apache CloudStack SAML 插件存在 XXE 漏洞](https://www.4hou.com/posts/GKYJ) - - [嘶吼送书活动 | 想彻底看懂攻防演练 读这一本书就够了](https://www.4hou.com/posts/pVRV) - - [ChromeLoader：新出现劫持用户浏览器搜索和展示广告的恶意软件活动（下）](https://www.4hou.com/posts/zlny) - - [CVE-2022-26706 macOS App沙箱逃逸漏洞](https://www.4hou.com/posts/QLO9) - - [AutoCAD木马猖獗，安天智甲全面防护](https://www.4hou.com/posts/pVzV) - - [高校被盗邮箱处置的运维经验分享](https://www.4hou.com/posts/EQZg) - - [高校邮件系统盗号问题处置经验-复旦大学](https://www.4hou.com/posts/AOQl) - - [活跃的Hezb挖矿木马分析](https://www.4hou.com/posts/2JWM) - - [定时破坏Linux系统的攻击事件分析报告](https://www.4hou.com/posts/BE8Y) - - [【福利】学网安，上云演，VIP终身会员上线](https://www.4hou.com/posts/zlBy) -- NowSecure - - [What You Need to Know About Google Play Data Safety & MASA Independent Review](https://www.nowsecure.com/blog/2022/07/20/what-you-need-to-know-about-google-play-data-safety-masa-independent-review/) -- 先知安全技术社区 - - [CVE-2022-0540: Jira身份验证绕过分析](https://xz.aliyun.com/t/11543) - - [某次红蓝对抗之Solr-RCE实战绕过](https://xz.aliyun.com/t/11546) -- Microsoft Security Blog - - [How Microsoft Purview and Priva support the partner ecosystem](https://www.microsoft.com/security/blog/2022/07/20/how-microsoft-purview-and-priva-support-the-partner-ecosystem/) -- Forcepoint - - [The Evolution of Cybersecurity](https://www.forcepoint.com/blog/insights/cybersecurity-evolution) -- NVISO Labs - - [Analysis of a trojanized jQuery script: GootLoader unleashed](https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed/) -- Current Posts - Red Team Journal - - [Popski’s Planning](https://www.redteamjournal.com/blog/popskis-planning) -- Didier Stevens - - [Update: sortcanon Version 0.0.2](https://blog.didierstevens.com/2022/07/20/update-sortcanon-version-0-0-2/) -- blog.avast.com EN - - [Avast SecureLine VPN keeps Indian users safe, preserves privacy](https://blog.avast.com/avast-secureline-vpn-india) -- Securelist - - [Luna and Black Basta — new ransomware for Windows, Linux and ESXi](https://securelist.com/luna-black-basta-ransomware/106950/) -- Sploitus.com Exploits RSS Feed - - [Asus GameSDK 1.0.0.4 Unquoted Service Path Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37845&utm_source=rss&utm_medium=rss) - - [Emporium eCommerce Online Shopping CMS 1.2 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167770&utm_source=rss&utm_medium=rss) - - [Spryker Commerce OS Remote Command Execution Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37846&utm_source=rss&utm_medium=rss) - - [Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root Exploit exploit](https://sploitus.com/exploit?id=ZSL-2022-5710&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Ejs exploit](https://sploitus.com/exploit?id=C937FF46-9C71-511D-A9D1-ADA539B4C489&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Gitlab exploit](https://sploitus.com/exploit?id=9CD2575C-CFA0-50A4-8AEC-4BE620162F81&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-33891 exploit](https://sploitus.com/exploit?id=88648F19-72F6-5813-88A1-0C86ADF70C75&utm_source=rss&utm_medium=rss) -- Reverse Engineering - - [XPEViewer 0.04 PE file viewer/editor for Windows, Linux and macOS.](https://www.reddit.com/r/ReverseEngineering/comments/w3yzs0/xpeviewer_004_pe_file_viewereditor_for_windows/) - - [Qakbot Dropper Analysis](https://www.reddit.com/r/ReverseEngineering/comments/w3hovp/qakbot_dropper_analysis/) - - [Reverse engineerd BLE RGB leds so I can controll them when not home. Or make custom triggers.](https://www.reddit.com/r/ReverseEngineering/comments/w3wis7/reverse_engineerd_ble_rgb_leds_so_i_can_controll/) -- SAP Blogs - - [What’s New in SAP Analytics Cloud Release 2022.15](https://blogs.sap.com/2022/07/20/whats-new-in-sap-analytics-cloud-release-2022.15/) - - [Automation for Everyone: How Different Lines of Business Put Hyperautomation into Action](https://blogs.sap.com/2022/07/20/automation-for-everyone-how-different-lines-of-business-put-hyperautomation-into-action/) - - [Moving Forward – SAP BusinessObjects BI 2024 Statement of Direction](https://blogs.sap.com/2022/07/20/moving-forward-sap-businessobjects-bi-2024-statement-of-direction/) - - [SAP Fiori SAP Business Role Activation using Task-List: SAP_FIORI_FCM_CONTENT_ACTIVATION](https://blogs.sap.com/2022/07/20/sap-fiori-sap-business-role-activation-using-task-list-sap_fiori_fcm_content_activation/) - - [Touchless Deployment 🚀- Automate through sFTP via CPI](https://blogs.sap.com/2022/07/20/touchless-deployment-%f0%9f%9a%80-automate-through-sftp-via-cpi/) - - [TM Transportation Management (Raw Material PO with capitalizable cost + Integration with Material Ledger CCS) – ML Custo](https://blogs.sap.com/2022/07/20/tm-transportation-management-raw-material-po-with-capitalizable-cost-integration-with-material-ledger-ccs-ml-custo/) - - [Track the performance of your pfunctions](https://blogs.sap.com/2022/07/20/track-the-performance-of-your-pfunctions/) - - [Energy Firm Supports Growth and Sustainability Using Digitalized Procurement](https://blogs.sap.com/2022/07/20/energy-firm-supports-growth-and-sustainability-using-digitalized-procurement/) - - [SAP S/4HANA Key User Extensibility powered by Embedded Steampunk: How to debug Key User Extensibility extensions (e.g. Cloud BAdI’s) in client 100](https://blogs.sap.com/2022/07/20/sap-s-4hana-key-user-extensibility-powered-by-embedded-steampunk-how-to-debug-key-user-extensibility-extensions-e.g.-cloud-badis-in-client-100/) - - [Consume a Stripe service from SAP Open Connectors and SAP Cloud Integration to create payment transactions](https://blogs.sap.com/2022/07/20/consume-a-stripe-service-from-sap-open-connectors-and-sap-cloud-integration-to-create-payment-transactions/) -- Twitter @bytehx - - [Re @jkana101 @mgthuramoemyint sir👀](https://twitter.com/bytehx343/status/1549751854917386241) - - [Re @Spy0x7 @mgthuramoemyint Thanks](https://twitter.com/bytehx343/status/1549694870553772034) - - [I feel always great having @mgthuramoemyint as friends and collaborator. This guy is XSS beast.](https://twitter.com/bytehx343/status/1549693965758517248) -- Malwarebytes Labs - - [Google ads lead to major malvertising campaign](https://blog.malwarebytes.com/threat-intelligence/2022/07/google-ads-lead-to-major-malvertising-campaign/) - - [Another ransomware payment recovered by the Justice Department](https://blog.malwarebytes.com/ransomware/2022/07/another-ransomware-payment-recovered-by-the-justice-department/) - - [Facebook gets round tracking privacy measure by encrypting links](https://blog.malwarebytes.com/privacy-2/2022/07/facebook-gets-round-tracking-privacy-measure-by-encrypting-links/) - - [Ring shares data with police without consent (but it’s in good faith), says Amazon](https://blog.malwarebytes.com/privacy-2/2022/07/ring-shares-data-with-police-without-consent-but-its-in-good-faith-says-amazon/) -- SentinelOne - - [EDR for Cloud Workloads Running on AWS Graviton](https://www.sentinelone.com/blog/edr-for-cloud-workloads-running-on-aws-graviton/) -- Intigriti - - [5 considerations when choosing a bug bounty platform](https://blog.intigriti.com/2022/07/20/5-considerations-choosing-bug-bounty-platform/) -- Application Security Blog - - [Interview-based due diligence or software audits?](https://www.synopsys.com/blogs/software-security/interview-based-due-diligence-vs-software-audits/) -- The Daily Swig | Cybersecurity news and views - - [Zero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles](https://portswigger.net/daily-swig/zero-day-flaws-in-gps-tracker-pose-surveillance-fuel-cut-off-risks-to-vehicles) - - [W3C launches Decentralized Identifiers as a web standard](https://portswigger.net/daily-swig/w3c-launches-decentralized-identifiers-as-a-web-standard) -- Black Hills Information Security - - [Talkin’ About Infosec News – 7/18/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-7-18-2022/) -- daniel.haxx.se - - [I don’t know who uses my code](https://daniel.haxx.se/blog/2022/07/21/i-dont-know-who-uses-my-code/) - - [curl is 8888 days old](https://daniel.haxx.se/blog/2022/07/20/curl-is-8888-days-old/) -- 小草窝博客 - - [go-strip 更新了 v3.0](https://x.hacking8.com/post-444.html) -- - - [补充](https://4ra1n.love/post/-D4lm2Aa4/) -- KitPloit - PenTest & Hacking Tools - - [Cdb - Automate Common Chrome Debug Protocol Tasks To Help Debug Web Applications From The Command-Line And Actively Monitor And Intercept HTTP Requests And Responses](http://www.kitploit.com/2022/07/cdb-automate-common-chrome-debug.html) -- 安全客 - - [【技术分享】如何保护深度学习系统-后门防御](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774225&idx=1&sn=6ca6f64934a4d4bc5c05856f413c5656&chksm=889368febfe4e1e890911644ac48f80012e8776be7aa5525f732e5cb0dde3b61984d8fdc95a0&scene=58&subscene=0#rd) - - [【安全头条】新公布文件显示美国政府手机监控规模异乎寻常](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774225&idx=2&sn=e746777df6436eb8c0e36ab9fc3eee58&chksm=889368febfe4e1e85996e7d0b76f034a63c75e8c9a1f88cbb136c9d7470bc42768895622ad77&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [案例分享 | 绿盟科技助力四川省农村信用社联合社安全态势感知平台建设](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247491998&idx=1&sn=cf6e3a74740c37b44f34c88d9db05951&chksm=eaac72d9dddbfbcf62cef48b58bb0ee7d59bf26c32b43d1d235fa980a02b0376554583a09a81&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(07-20)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958606&idx=1&sn=3ae6ebbb79fd16e077eeea9466e7dd24&chksm=8baecdd1bcd944c73e27d5121de8df23ab8904ab7ad246f4bc3ab40ef1957568b796d4c7a680&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [Win10 Mitigation Policies简介(未解决)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486048&idx=1&sn=b761f919db6d1b6d4407781f7bb57e05&chksm=fab2c95fcdc5404954eafb60e229e8092fa76b24d4812d98d5db607566b3bf5d0000ab249e20&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【工具】英国开源情报工具-i3](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651130576&idx=1&sn=9126abd1e9671591d7e4045df20c1145&chksm=f1af7deac6d8f4fc2883cb0d6579e5f7894e2e7ec404e996ce152c11b5e3d836a371e05317b4&scene=58&subscene=0#rd) -- 吾爱破解论坛 - - [暑假开放注册微信抽奖活动，再送40个账号注册码或300论坛币，今天周三下午两点开奖，详见【开放注册公告】吾爱破解论坛2022年7月21日暑假开放注册公告。](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651137861&idx=1&sn=9ec24ecf118029f290befd323cd96889&chksm=bd50b7118a273e07df52926ba23af8645e313d9acf54d1f259005d0c95694eec90bcd4829b85&scene=58&subscene=0#rd) -- Twitter @Keiran Smith (Affix) - - [Re @ypsuk are a total disgrace of a company, Can't provide contact details for the actual car park operators, Doesn't understand the law in Scotland a...](https://twitter.com/cli/status/1549748411011940356) -- HAHWUL - - [ZAP Alert Filters로 Risk 가지고 놀기](https://www.hahwul.com/2022/07/21/zap-alert-filters/) -- Hacking就是好玩 - - [go-strip 更新了 v3.0](https://mp.weixin.qq.com/s?__biz=MzU2NzcwNTY3Mg==&mid=2247484549&idx=1&sn=c8b239dd32332fc3b7ebd984552d6d25&chksm=fc986da2cbefe4b48da03a3ea71d2b1056771f79143aa58ee3c0dd09a10f3ff186e8e410e31b&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-07-20](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247490853&idx=1&sn=003b294efd8481ce8391b12009c4c4d4&chksm=c06033fcf717baea6c709d187e71f48b78ac4b198a3ab00290d1d48bed095e4bca917d9ef2a6&scene=58&subscene=0#rd) -- 奇安信CERT - - [Oracle 多个产品漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496472&idx=1&sn=1c5dde52d4da3f12f89c9615f66f0fd5&chksm=fe79d780c90e5e96c67aff44179782d75959c58b83ab63cd75d28df80671e7ea4dd138d3fb04&scene=58&subscene=0#rd) -- 火线安全平台 - - [精选用户故事|洞态在聚水潭的误报率几乎为0，如何做到？](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247491745&idx=1&sn=1728e4a0eed31c8b16aa8000f1e98e95&chksm=fdbfc90acac8401c38fffa746fd880ff4d934e282e607978a51639e2f1760f88e7dc359c8cf6&scene=58&subscene=0#rd) - - [DongTai 社区 | v1.8.2 版本发布，新增定时清理堆积数据功能](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247491745&idx=2&sn=e729a6b4dfc8da4815e35c4a68e696f3&chksm=fdbfc90acac8401c2b60648e91f68be4f5a1ff884a96abb15ded2246a1023aac3d77258fce90&scene=58&subscene=0#rd) -- 补天平台 - - [【限时查看全端口资产】鹰图平台喊你来领福利啦！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494816&idx=1&sn=c3c32b62e56105ad0003984189eb6abf&chksm=eaf9a4ecdd8e2dfa47bfc2cca7139ee668a568533e5ee9ad0864e2bb5a29cc5125e7fd395beb&scene=58&subscene=0#rd) - - [七月积分回馈活动，瓜分百万权益积分！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494816&idx=2&sn=22763e9f6828b9758c14ad18dc49d57b&chksm=eaf9a4ecdd8e2dfa6a13d7d4d9469b3ce24209df124366bc9be7a492e00bf6ce0014aaecf2a1&scene=58&subscene=0#rd) -- 数世咨询 - - [降低误报的9条建议](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494253&idx=1&sn=99b270daee13b1e34c0733a26c5d520c&chksm=c14498d0f63311c6a445a87e95844cf83728273e61aa13a2e21d54ce252dea1b3209606d7700&scene=58&subscene=0#rd) -- 网安寻路人 - - [中国个人信息跨境认证机制与BCRs和AC的比较分析：个人数据跨境流动的未决之路](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495613&idx=1&sn=b905eae6cb68f2def3eaadaf8bec4a44&chksm=97e95257a09edb41cdc2c2c487ab883f3f42c2d6e1404abd8952de24594b9795652ec5bd6816&scene=58&subscene=0#rd) -- 网安杂谈 - - [会议7.21|取证与涉网犯罪论坛](https://mp.weixin.qq.com/s?__biz=MzAwMTMzMDUwNg==&mid=2650886629&idx=1&sn=0b7fdff0878531267b49ecd9d30f0942&chksm=812eadc0b65924d600f5bb6eea8592a9dc05a06b952bad1b6d0dfd81030d55b66ecb161b6e2c&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [Bluesky勒索病毒爆发 对SQL Server数据库渗透攻击](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247506810&idx=1&sn=4f17f4a433aa06e4b588f7214e0fe00d&chksm=eb700545dc078c53da3c621fbe57ae4c76f2dc1c757d40baa260a098d6fd5ab338ea73e35ba9&scene=58&subscene=0#rd) -- 赵武的自留地 - - [我认为网络安全工具的未来：资产篇](https://mp.weixin.qq.com/s?__biz=MjM5NDQ5NjM5NQ==&mid=2651626332&idx=1&sn=15e11422fb93c33fccc8861c80a64899&chksm=bd7ed1b88a0958aed32d48d73e2e23e8118799fa5d3a7f0e97d97f707a9531ee5476c085c00e&scene=58&subscene=0#rd) -- 极客公园 - - [下一个 5 年，中国创业者的全球地图会是什么样？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960686&idx=1&sn=c8014fb937a2bb0b2b709fd2a71ff653&chksm=7e558a184922030e54c30db9dc4c2c1af152db56aa567ac0a8a9eaf451e189357f9452263c0e&scene=58&subscene=0#rd) - - [对话 Soul 张璐：我是在互联网红海抓住了一个小机会](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960584&idx=1&sn=1801beec8ac445512fbf0cc7002244d1&chksm=7e558afe492203e8b2758ad7ef01fafc71d0785fc03c314cb3957cecba5cce27add2cb8cfcac&scene=58&subscene=0#rd) - - [马斯克：已将大脑上传云端；抖音合作爱奇艺，推动「二创」规范化；B 站上线「防网暴」功能｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960582&idx=1&sn=a249823e0f7b0455993f9399160d3733&chksm=7e558af0492203e6c64675129a8a00072f67379a3f45422a405bac05ba131b84aecbb0398f0e&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于Oracle 2022年第三季度安全更新风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495689&idx=1&sn=56004f5dbf399a1f071e1e9f0058d2f5&chksm=ce96bd37f9e13421272f36d4307842b3eaddb931f02cfa2a17cab37376eee1c638aa17280cdc&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Jul.20th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495689&idx=2&sn=47f2bc4008cf7d791ace22e970cc2423&chksm=ce96bd37f9e13421995cc74ffaf29b19d564a1a6440980c6b31bc57804f2e198ac2b1d817378&scene=58&subscene=0#rd) -- 绿盟科技CERT - - [【安全更新】Oracle全系产品7月关键补丁更新通告](https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247487369&idx=1&sn=d1e58ea9bdce45d391c2fa6017afcdf0&chksm=c2c65882f5b1d194538b9acf2f4b80cc2fc2160318b09e743d24cf39ed8cd0537013438b24f7&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [MemoryThrashing：抖音直播解决内存抖动实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496677&idx=1&sn=fd17b7c49f976b71ed894e4ada623eb9&chksm=e9d33807dea4b111b5dde3a2d241dedbf32e95a172b1bd1c7b4d7b53b325c558f64de5b09129&scene=58&subscene=0#rd) -- KCon黑客大会 - - [演讲议题巡展｜浅谈零信任环境下攻击场景](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135273&idx=1&sn=b7316988143e281c0498f28e2f3bc286&chksm=f2c11c49c5b6955f2af89097807d3d26bbfcdaf0ea44cb47d2ef6b98f46fa775e7bbd85c167e&scene=58&subscene=0#rd) -- 安全牛 - - [GitOps对安全事件调查取证的影响和实践](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116199&idx=1&sn=9b5174dbd82f54629762c183186ae36e&chksm=bd1462748a63eb62b1f23101e3a22aa586569312251b883cfa71176fd654ffbc675c136b451f&scene=58&subscene=0#rd) - - [如何实现等级保护管理工作的体系化、标准化和规范化](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116199&idx=2&sn=2e1100cbd8f3c86dee5a6a0ac4a7ceaf&chksm=bd1462748a63eb62b0c099a613ad8468fa8b32f869e8fa3a0d88a64b5155a935f8c340f1e10e&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（34期）：XDR的过去、现状与未来](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116199&idx=3&sn=4af9e4ffcb7fcbd1f9319ba4544fc612&chksm=bd1462748a63eb62f9b8c2bac3e6598f1cd4c00c991239337e11e9cb45abf556ac877b3e8311&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [活动 | 呼朋唤友来挖洞，你是我的好朋友](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247490267&idx=1&sn=b5a4ccc5135fdf968d9ba6ea4ffa4c76&chksm=ec1bfb08db6c721e995c8800d3b22f4894e04e711492160a9c63d810e46219b1885edc3a39d6&scene=58&subscene=0#rd) -- 网安国际 - - [【InForSec论坛预告】InForSec互联网基础设施安全论坛将于7月27日下午举办](https://mp.weixin.qq.com/s?__biz=MzA4ODYzMjU0NQ==&mid=2652311035&idx=1&sn=197f87d08effa95aff33abf262f0dce4&chksm=8bc49075bcb319633a943d7a78074a4f93aed906bf63a28590556aae52b46328eef6bd75762f&scene=58&subscene=0#rd) - - [DataCon特训营｜助你下一站，上岸！](https://mp.weixin.qq.com/s?__biz=MzA4ODYzMjU0NQ==&mid=2652311035&idx=2&sn=eeac64a654c5fd2c5f61a493e948bea6&chksm=8bc49075bcb319636bb5e340d72ea59197a0a7c57c097bf646ea67b8fbed7295f42bddba823d&scene=58&subscene=0#rd) -- Checkmarx.com - - [What Is Your API Attack Surface?](https://checkmarx.com/blog/what-is-your-api-attack-surface/) -- 威胁棱镜 - - [样本相似分析新尝试：通过音频实现](https://mp.weixin.qq.com/s?__biz=MzkyMzE5ODExNQ==&mid=2247485458&idx=1&sn=ea1d12b73c085b5640bfe2acd95172bf&chksm=c1e9ffdef69e76c822f4ae1cd1b45ef4eaa56d9783278cada6757a797508f47fa30e95ac5174&scene=58&subscene=0#rd) -- 情报分析师 - - [【专业报告】法国陆军的网络战方法](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511051&idx=1&sn=b395a5ded016054c5f8c6d365020d010&chksm=8716b880b0613196115d28bc1d1afff8e71579cb7a78e22561094e40acf85154a29b0bc81a16&scene=58&subscene=0#rd) - - [全球开放数据集的开源工具（可以查询GIS、法律、科研、交通等）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511051&idx=2&sn=e7441682ae35b4eb8e1fb3da53c5d9ca&chksm=8716b880b0613196ed60d20f86c07ec20f5f10a92e85d41020ae43fae94ef197f86ef7d9578b&scene=58&subscene=0#rd) - - [关于斯里兰卡危机的五件事](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511051&idx=3&sn=d9d884302ea668a0eb61c814ee63985a&chksm=8716b880b0613196819f0961dc76ca8547ac0e2094acd291bfd44983c3407f9ec172d527fcb2&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 平衡安全与发展：数据出境风险自评估](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529742&idx=1&sn=56e5e5f1f365e6f9e9d984bcc0233bf9&chksm=fa93c3cfcde44ad966fade1e506c58bb5e77d0649b4d3fd615e65ed9360264247e7fe845ca46&scene=58&subscene=0#rd) - - [智能连接系统 想象空间有多大？](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529742&idx=2&sn=c82339bd070dc7c5f79f462761ae1815&chksm=fa93c3cfcde44ad93c400769a7dbc1466ffb0cc042a0950b7d7311c7290980025e1f831b0b10&scene=58&subscene=0#rd) - - [网络安全审查第一案将终结！外媒称中国网约车巨头将被处以逾10亿美元巨额罚款](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529742&idx=3&sn=ce5c78c75410f4bc1e50cb2ca5aa1334&chksm=fa93c3cfcde44ad98630fc116981cdde99c7ed09f2c739fe69f1ebfa69132fd35c09959025dc&scene=58&subscene=0#rd) - - [针对WordPress插件漏洞的攻击数量激增](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529742&idx=4&sn=e4549250fb4e2e70d51067e4aeaf51eb&chksm=fa93c3cfcde44ad91277c0384c08cf1b9a358aa6326b6e368355617565fbfc3ac6e086a8e736&scene=58&subscene=0#rd) - - [如何用纵深防御应对勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247529742&idx=5&sn=1803f8c9edc4212df05cedbc049bdca7&chksm=fa93c3cfcde44ad9b608f0f1bcdc24e4070c613b708104fbb4475e17ed982fcd25b96dbf9dec&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [RedlineStealer——新型免杀木马背后的获利产业链揭秘](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247490513&idx=1&sn=f11985e369d03f6d8fa613e5270d507a&chksm=ec6a6bf9db1de2ef9748cf735332d3936b8a3f65a056fdae51dd8f7b481926f9708c1c1d1e07&scene=58&subscene=0#rd) - - [BCS2022预告|2022北京网络安全大会技术日即将开启](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247490513&idx=2&sn=cb591b659f9d7221f779733db4828756&chksm=ec6a6bf9db1de2efdfe3a924d517e3e868cd8e5ec34bfe68b3cf4c52074e3e29ca8eb988b1b3&scene=58&subscene=0#rd) -- 360Quake空间测绘 - - [对全网上一些JSONP蜜罐探索与识别](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247486039&idx=1&sn=e74f1fc01decc97e6f75a8831e79a816&chksm=c37b8dbcf40c04aa4e9e18ae665dce21acf6d292dea162b5cf66ca5e7c5634160244f6782249&scene=58&subscene=0#rd) -- leveryd - - [https://containerjournal.com/features/sysdig-adds-ability-to-make-container-runtimes-immutable 提到sysdig提供了一个能力，能让"容器只运行白名单程序"。 - -在 https://github.com/falcosecurity/falco/blob/35db0b4a24344bc6c24022555f7d8531ad925136/rules/falco_rules.yaml#L3018 可以看到规则 - -包括两种告警策略： -* 发现chmod时 -* 发现open创建的文件有执行权限时](https://mp.weixin.qq.com/s?__biz=MzkyMDIxMjE5MA==&mid=2247485097&idx=1&sn=b7a2f3b21e3afc6bf74e7a23d8aa7b34&chksm=c1970118f6e0880e75a90ff81e05a416d4886333361cac3c6cd380b9da57918550e7c265c64d&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [武汉大学暑假《网络对抗演练》课程圆满结束](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247494772&idx=1&sn=b440ddcf67442fae5b9c806c790c1b03&chksm=fa5239cacd25b0dcbee81c5a92048cd3410b225b4eac43cdc8152090e3606f0d71c9584421ae&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [平衡安全与发展：数据出境风险自评估](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529228&idx=1&sn=18bdadf3e7c5d9262b20cbaf8e74d4d4&chksm=c1e9ff5df69e764b40fb0f5be4bd3e6593a49ad5972f23442e1dd37bd8827bcf6a502f8dc680&scene=58&subscene=0#rd) - - [智能连接系统 想象空间有多大？](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529228&idx=2&sn=d246b061b26bd856971c66cc14bd7554&chksm=c1e9ff5df69e764bb16bad806c90e5d663948ef0587fa3fa3b7131e3f7812047bb694c080b79&scene=58&subscene=0#rd) - - [工业控制系统信息安全漏洞管理思考与实践](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529228&idx=3&sn=338b1b3666b9f905c4fc18754df53a23&chksm=c1e9ff5df69e764be3c7ae2b7dd65698126ed7489db8499e7dc75ede0d17f0091dfa8e752c74&scene=58&subscene=0#rd) - - [Log4Shell漏洞的长期影响](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529228&idx=4&sn=52211608c1db5b9356e1e9e71796621f&chksm=c1e9ff5df69e764bdaab1a5a9b08dae2d04d71b4de52e5352ac633c298796cb9e94c168b07dd&scene=58&subscene=0#rd) - - [因遭遇大规模网络攻击，这个国家政务网络被迫关闭](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529228&idx=5&sn=b1bfdf94333499118f026769bad7c11e&chksm=c1e9ff5df69e764bb9b4191740b069491cbcd977021abb8e2645e661eb58a76a4381953c739a&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [被滥用的Slack服务：APT29针对意大利的攻击活动分析](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502367&idx=1&sn=496a161e838851ca1bc9b06abf372335&chksm=ea663d68dd11b47ec75ebc560bbecb06c3c068e37f3ba3ec0bbd1d0a40242e7fd9faaf61373a&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [嘶吼送书活动 | 想彻底看懂攻防演练 读这一本书就够了](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546167&idx=1&sn=ecf75d3902a5b7772947fd77898fd8cf&chksm=e915e50dde626c1b55866f5367d2660d4bfbbaf9a827b97bf95f0b49b7434239a773cc0cb4d8&scene=58&subscene=0#rd) - - [CVE-2022-26706 macOS App沙箱逃逸漏洞](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546167&idx=2&sn=a2253870abc25db5f8cbdd60e1ddb435&chksm=e915e50dde626c1b1771b162d40b31083443b5c077e92dfd54442772d720e6a4dbd511d62d57&scene=58&subscene=0#rd) - - [ChromeLoader：新出现劫持用户浏览器搜索和展示广告的恶意软件活动（下）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546167&idx=3&sn=9f04ffac1e7a52a12d271e32146cd0ce&chksm=e915e50dde626c1b218849dcd9cd2220ab899118d2577d6edaa4c3932ee5ce2b0caa51b024e5&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [最流行的 .NET 反编译工具合集](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485673&idx=1&sn=a10564d229adc25a5711850a68e4db92&chksm=fa5aa604cd2d2f127e43ae9aac93a9faae3b500129c1be3acb5bd81983e33bbd13c8be000310&scene=58&subscene=0#rd) - - [.NET 预编译上传文件绕过(3)](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485673&idx=2&sn=152bcb511467c6d9ced386356b4689d6&chksm=fa5aa604cd2d2f12239c9ee8712b716fa734a52a15dbe7f71e7f21c8d8d0350fe34b9fe7cebc&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-22.md b/archive/2022/2022-07-22.md deleted file mode 100644 index 1459842c0e..0000000000 --- a/archive/2022/2022-07-22.md +++ /dev/null @@ -1,244 +0,0 @@ -# 每日安全资讯（2022-07-22） - -- Recent Commits to cve:main - - [Update Thu Jul 21 12:07:48 UTC 2022](https://github.com/trickest/cve/commit/857fc26a0370bf60b3ff77a86be4f84d82af9d6a) -- HackerOne Hacker Activity - - [fix(cmd-socketio-server): mitigate cross site scripting attack #2068](https://hackerone.com/reports/1638984) -- Sploitus.com Exploits RSS Feed - - [IOTransfer 4.0 - Remote Code Execution (RCE) exploit](https://sploitus.com/exploit?id=EDB-ID:50974&utm_source=rss&utm_medium=rss) - - [CodoForum v5.1 - Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37851&utm_source=rss&utm_medium=rss) - - [Emporium eCommerce Online Shopping CMS 1.2 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37847&utm_source=rss&utm_medium=rss) - - [Kite 1.2021.610.0 - Unquoted Service Path Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37849&utm_source=rss&utm_medium=rss) - - [Kite 1.2021.610.0 - Unquoted Service Path exploit](https://sploitus.com/exploit?id=EDB-ID:50975&utm_source=rss&utm_medium=rss) - - [Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50976&utm_source=rss&utm_medium=rss) - - [CodoForum v5.1 - Remote Code Execution (RCE) exploit](https://sploitus.com/exploit?id=EDB-ID:50978&utm_source=rss&utm_medium=rss) - - [Dr. Fone 4.0.8 - 'net_updater32.exe' Unquoted Service Path exploit](https://sploitus.com/exploit?id=EDB-ID:50977&utm_source=rss&utm_medium=rss) - - [IOTransfer 4.0 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167775&utm_source=rss&utm_medium=rss) - - [OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE) exploit](https://sploitus.com/exploit?id=EDB-ID:50979&utm_source=rss&utm_medium=rss) - - [Kite 1.2021.610.0 Unquoted Service Path exploit](https://sploitus.com/exploit?id=PACKETSTORM:167779&utm_source=rss&utm_medium=rss) - - [Dr. Fone 4.0.8 Unquoted Service Path exploit](https://sploitus.com/exploit?id=PACKETSTORM:167776&utm_source=rss&utm_medium=rss) - - [Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root exploit](https://sploitus.com/exploit?id=PACKETSTORM:167783&utm_source=rss&utm_medium=rss) - - [OctoBot WebInterface 0.4.3 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167780&utm_source=rss&utm_medium=rss) - - [IOTransfer 4.0 - Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37848&utm_source=rss&utm_medium=rss) - - [Dr. Fone 4.0.8 - (net_updater32.exe) Unquoted Service Path Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37850&utm_source=rss&utm_medium=rss) - - [OctoBot WebInterface 0.4.3 - Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37852&utm_source=rss&utm_medium=rss) - - [CodoForum 5.1 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167782&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=E51E8D61-BAA6-5098-9EEE-50DD18427F87&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-32832 exploit](https://sploitus.com/exploit?id=84E2D1AF-A777-566C-B293-27ED87F2C35C&utm_source=rss&utm_medium=rss) - - [Exploit for Type Confusion in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=BE6625E5-8275-5164-A251-2EF421A388EC&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5529-1](https://packetstormsecurity.com/files/167785/USN-5529-1.txt) - - [Chrome Scope Break](https://packetstormsecurity.com/files/167784/GS20220721203759.tgz) - - [Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root](https://packetstormsecurity.com/files/167783/ZSL-2022-5710.txt) - - [CodoForum 5.1 Remote Code Execution](https://packetstormsecurity.com/files/167782/codoforum51-exec.txt) - - [AIEngine 2.2.0](https://packetstormsecurity.com/files/167781/aiengine-2.2.0.tar.gz) - - [OctoBot WebInterface 0.4.3 Remote Code Execution](https://packetstormsecurity.com/files/167780/octobotwi043-exec.txt) - - [Kite 1.2021.610.0 Unquoted Service Path](https://packetstormsecurity.com/files/167779/kite120216100-unquotedpath.txt) - - [Red Hat Security Advisory 2022-5673-01](https://packetstormsecurity.com/files/167778/RHSA-2022-5673-01.txt) - - [Dr. Fone 4.0.8 Unquoted Service Path](https://packetstormsecurity.com/files/167776/drfone408-unquotedpath.txt) - - [IOTransfer 4.0 Remote Code Execution](https://packetstormsecurity.com/files/167775/iotransfer40-exec.txt) - - [DASDEC Cross Site Scripting / HTML Injection](https://packetstormsecurity.com/files/167777/DASDEC-XSS.pdf) -- paper - Last paper - - [云沙箱流量识别技术剖析](https://paper.seebug.org/1939/) -- 信息安全知识库 - - [企业实战攻防能力成熟度建设与实践](https://vipread.com/library/topic/3816) - - [CISO 必备核心技能](https://vipread.com/library/topic/3817) - - [构建低延时、高并发处理能力的应用安全架构](https://vipread.com/library/topic/3818) - - [研发安全治理实践](https://vipread.com/library/topic/3819) - - [数字企业的零信任SASE落地最佳实践](https://vipread.com/library/topic/3820) - - [零信任的攻与防](https://vipread.com/library/topic/3821) - - [投资机构的零信任实战](https://vipread.com/library/topic/3822) - - [关于零信任架构在金融企业中应用的思路探讨](https://vipread.com/library/topic/3823) - - [高科技制造企业从0开始安全建设分享](https://vipread.com/library/topic/3824) - - [传统集团型企业零信任试水](https://vipread.com/library/topic/3825) - - [零信任与密码-从美国联邦政府看零信任落地实践要点](https://vipread.com/library/topic/3826) - - [企业数字化转型与信息安全能力](https://vipread.com/library/topic/3827) - - [58集团办公零信任实践](https://vipread.com/library/topic/3828) - - [攻防实战—邮件钓鱼实践](https://vipread.com/library/topic/3829) - - [网络安全攻防演习及发展态势](https://vipread.com/library/topic/3830) - - [改变 从人防到技防](https://vipread.com/library/topic/3831) - - [企业网络安全精细化治理](https://vipread.com/library/topic/3832) - - [入侵模拟攻击演练平台建设](https://vipread.com/library/topic/3833) - - [WMI攻守之道](https://vipread.com/library/topic/3834) - - [SRC漏洞挖掘必备技巧](https://vipread.com/library/topic/3835) - - [金融云安全解决方案](https://vipread.com/library/topic/3836) - - [CodeQL 漏洞挖掘分享](https://vipread.com/library/topic/3837) - - [内存中的数据安全](https://vipread.com/library/topic/3838) -- 先知安全技术社区 - - [WebSocket 内存马，一种新型内存马技术](https://xz.aliyun.com/t/11549) - - [从多个基础CMS中入坑代码审计](https://xz.aliyun.com/t/11553) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [滴滴被罚80.26亿元，官方回应：诚恳接受，全面自查，认真整改](https://www.4hou.com/posts/17Ym) - - [BCS2022技术峰会：高对抗环境下网络新攻防](https://www.4hou.com/posts/YXQ2) - - [金融网络安全风险管理指南（四）：数据泄露成本的费用估算](https://www.4hou.com/posts/q8Qy) - - [身份和访问管理（IAM）策略失败的6个迹象及缓解策略](https://www.4hou.com/posts/6V9O) - - [网信办公布《数据出境安全评估办法》 云集至已为多客户完成数据出境安全服务](https://www.4hou.com/posts/QLN9) - - [高校账号盗用监控及钓鱼邮件检测](https://www.4hou.com/posts/DEYK) -- unSafe.sh - 不安全 - - [记一次某市停车收费系统的渗透实战](https://buaq.net/go-118688.html) - - [WebSocket 内存马，一种新型内存马技术](https://buaq.net/go-118689.html) - - [从多个基础CMS中入坑代码审计](https://buaq.net/go-118690.html) - - [Tag Blending Obfuscation In Property-Based Payloads](https://buaq.net/go-118694.html) - - [整理了一下浏览器书签，发现收藏了挺多蛮实用的网站 - V2EX](https://buaq.net/go-118664.html) - - [Keep your finger on the pulse of the most critical software vulnerabilities in the market](https://buaq.net/go-118679.html) - - [Burp Suite roadmap update: July 2022](https://buaq.net/go-118657.html) -- 先知安全技术社区 - - [WebSocket 内存马，一种新型内存马技术](https://xz.aliyun.com/t/11549) - - [从多个基础CMS中入坑代码审计](https://xz.aliyun.com/t/11553) -- 安全脉搏 - - [攻防实战之如何识别钓鱼邮件](https://www.secpulse.com/archives/183933.html) - - [攻防实战之蓝队视角下的战前准备](https://www.secpulse.com/archives/183928.html) - - [红蓝对抗之PC端wechat信息窃取](https://www.secpulse.com/archives/183912.html) -- Sucuri Blog - - [Cryptominers & WebAssembly in Website Malware](https://blog.sucuri.net/2022/07/cryptominers-webassembly-in-website-malware.html) -- 安全客-有思想的安全新媒体 - - [Android网络库详解](https://www.anquanke.com/post/id/276706) - - [2022-07 补丁日: Oracle多个产品漏洞安全风险通告](https://www.anquanke.com/post/id/276742) - - [汽车GPS漏洞或导致数百万用户信息泄露](https://www.anquanke.com/post/id/276712) -- Security Boulevard - - [Post-Quantum Cryptography: Lessons Learned from SHA-1 Deprecation](https://securityboulevard.com/2022/07/post-quantum-cryptography-lessons-learned-from-sha-1-deprecation/) - - [Out-of-band application security with Intelligent Orchestration](https://securityboulevard.com/2022/07/out-of-band-application-security-with-intelligent-orchestration/) - - [Account takeover fraud: 5 steps for protecting your customers](https://securityboulevard.com/2022/07/account-takeover-fraud-5-steps-for-protecting-your-customers/) - - [Data Loss Planning for Layoffs](https://securityboulevard.com/2022/07/data-loss-planning-for-layoffs/) - - [SOC 2 Controls: Regular User Access Reviews](https://securityboulevard.com/2022/07/soc-2-controls-regular-user-access-reviews/) - - [BSidesSF 2022 – Erik Heskes’ ‘Don’t Turn Your Back On Ransomware!’](https://securityboulevard.com/2022/07/bsidessf-2022-erik-heskes-dont-turn-your-back-on-ransomware/) - - [Webhooks Explained: What Are Webhooks? How Do They Work?](https://securityboulevard.com/2022/07/webhooks-explained-what-are-webhooks-how-do-they-work/) - - [The Future of Executive Protection is Digital](https://securityboulevard.com/2022/07/the-future-of-executive-protection-is-digital/) - - [Four features of modern AppSec that help curb cybersecurity burnout](https://securityboulevard.com/2022/07/four-features-of-modern-appsec-that-help-curb-cybersecurity-burnout/) - - [SOC 2 Compliance Controls and Business Policies: A Critical Connection](https://securityboulevard.com/2022/07/soc-2-compliance-controls-and-business-policies-a-critical-connection/) -- 跳跳糖 - 安全与分享社区 - - [Tomcat WebSocket内存马原理浅析](https://tttang.com/archive/1673/) -- Twitter @Nicolas Krassas - - [Chrome zero-day used to infect journalists with Candiru spyware](https://twitter.com/Dinosn/status/1550198457645809665) - - [New Linux Malware Framework Lets Attackers Install Rootkit on Targeted Systems](https://twitter.com/Dinosn/status/1550165402814222337) - - [RT Paolo Stagno (VoidSec): After a lot of effort, I thought to share my browser exploitation journey of an old Firefox Integer Overflow bug:](https://twitter.com/Void_Sec/status/1550133749479661568) - - [Boffins release tool to decrypt Intel microcode. Have at it, x86 giant says](https://twitter.com/Dinosn/status/1550112722158620673) - - [Google ads lead to major malvertising campaign](https://twitter.com/Dinosn/status/1550110713636499456) - - ['AIG' Threat Group Launches With Unique Business Model](https://twitter.com/Dinosn/status/1550110613644292097) - - [US Seizes Stolen Funds From Suspected North Korean Hackers](https://twitter.com/Dinosn/status/1550110544819994626) - - [New Redeemer ransomware version promoted on hacker forums](https://twitter.com/Dinosn/status/1550094119762120705) - - [Microsoft resumes default blocking of Office macros after updating docs](https://twitter.com/Dinosn/status/1550093926211719168) - - [New ‘Lightning Framework’ Linux malware installs rootkits, backdoors](https://twitter.com/Dinosn/status/1550092695409934336) - - [Outlook email users alerted to suspicious activity from Microsoft-owned IP address](https://twitter.com/Dinosn/status/1550090523217694725) - - [Windows 11 now blocks RDP brute-force attacks by default](https://twitter.com/Dinosn/status/1550090461305606146) - - [RT Janggggg: Successfully reproduced the Gitlab Project Import RCE (CVE-2022-2185) Got headache while reading Ruby for last 2 weeks, but it worth defi...](https://twitter.com/testanull/status/1550089562349015042) - - [RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.](https://twitter.com/Dinosn/status/1550083318351290368) - - [A list of lists involving IoT in general](https://twitter.com/Dinosn/status/1550083244091183105) - - [A projectdiscovery driven ASM bot! Using subfinder, httpx, dnsx, nuclei and notify!](https://twitter.com/Dinosn/status/1550082543898222592) - - [restler-fuzzer: first stateful REST API fuzzing tool](https://twitter.com/Dinosn/status/1550079745483837440) - - [Neopets data breach exposes personal data of 69 million members](https://twitter.com/Dinosn/status/1550079679285043200) - - [WhiteShADrk is a Beta simple tool that enumerates the Active Directory environment to identify possible attack vectors](https://twitter.com/Dinosn/status/1550069368259858432) -- Flexera Blog - Feed - - [Keep your finger on the pulse of the most critical software vulnerabilities in the market](https://www.flexera.com/blog/vulnerability-management/software-vulnerability-report/) -- SecWiki News - - [SecWiki News 2022-07-21 Review](http://www.sec-wiki.com/?2022-07-21) -- Malwarebytes Labs - - [The Wren Eleanor story: Why you should keep your kids’ images off social media](https://blog.malwarebytes.com/personal/2022/07/the-wren-eleanor-story-why-you-should-keep-your-kids-off-social-media/) - - [The winding road to compliance](https://blog.malwarebytes.com/business/2022/07/the-winding-road-to-compliance/) - - [Vulnerabilities in GPS tracker could have “life-threatening” implications](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/07/vulnerabilities-in-gps-tracker-could-have-life-threatening-implications/) -- Hexacorn - - [Week of Data Dumps, Part 1 – device names](https://www.hexacorn.com/blog/2022/07/21/week-of-data-dumps-part-1-device-names/) -- Reverse Engineering - - [Kaitai Struct, declarative binary format reverse engineering framework, releases v0.10. Many performance optimizations, JavaScript Web Workers and modules, full 64-bit support for C++ and Java, robust KSY error validation, style warnings, dozens of bugfixes and much more!](https://www.reddit.com/r/ReverseEngineering/comments/w4vg38/kaitai_struct_declarative_binary_format_reverse/) - - [unlicense 0.3.0 - A dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x. Now with support for virtualized entry points and Delphi executables!](https://www.reddit.com/r/ReverseEngineering/comments/w4v3pw/unlicense_030_a_dynamic_unpacker_and_import_fixer/) - - [The Return of Candiru: Zero-days in the Middle East](https://www.reddit.com/r/ReverseEngineering/comments/w4fhio/the_return_of_candiru_zerodays_in_the_middle_east/) - - [Reverse Engineering Shape Security's Javascript Virtual Machine](https://www.reddit.com/r/ReverseEngineering/comments/w4muef/reverse_engineering_shape_securitys_javascript/) -- blog.avast.com EN - - [Patching: Why it's important for businesses](https://blog.avast.com/patching-systems-business) -- Blog Archives - VoidSec - - [Browser Exploitation: Firefox Integer Overflow – CVE-2011-2371](https://voidsec.com/browser-exploitation-firefox-cve-2011-2371/) -- Application Security Blog - - [Out-of-band application security with Intelligent Orchestration](https://www.synopsys.com/blogs/software-security/out-of-band-appsec-intelligent-orchestration/) -- The Daily Swig | Cybersecurity news and views - - [Atlassian patches batch of critical vulnerabilities across multiple products](https://portswigger.net/daily-swig/atlassian-patches-batch-of-critical-vulnerabilities-across-multiple-products) - - [WordPress plugin security audit unearths dozens of vulnerabilities impacting 60,000 websites](https://portswigger.net/daily-swig/wordpress-plugin-security-audit-unearths-dozens-of-vulnerabilities-impacting-60-000-websites) -- Brute XSS - - [Tag Blending Obfuscation In Property-Based Payloads](https://brutelogic.com.br/blog/tag-blending-obfuscation/?utm_source=rss&utm_medium=rss&utm_campaign=tag-blending-obfuscation) -- PortSwigger Blog - - [Burp Suite roadmap update: July 2022](https://portswigger.net/blog/burp-suite-roadmap-update-july-2022) -- KitPloit - PenTest & Hacking Tools - - [RESim - Reverse Engineering Software Using A Full System Simulator](http://www.kitploit.com/2022/07/resim-reverse-engineering-software.html) -- Sucuri Blog - - [Cryptominers & WebAssembly in Website Malware](https://blog.sucuri.net/2022/07/cryptominers-webassembly-in-website-malware.html) -- SAP Blogs - - [SAP Business Network: FAQ for New Buyer Portal](https://blogs.sap.com/2022/07/21/sap-business-network-faq-for-new-buyer-portal/) - - [FIFO Based Customer Automatic Clearing](https://blogs.sap.com/2022/07/21/fifo-based-customer-automatic-clearing/) - - [Integration Helps Bridge HR Across an Intelligent, Sustainable Enterprise](https://blogs.sap.com/2022/07/21/integration-helps-bridge-hr-across-an-intelligent-sustainable-enterprise/) - - [SAP S/4 Hana Conversion – III – Realize](https://blogs.sap.com/2022/07/21/sap-s-4-hana-conversion-iii-realize/) - - [Scheduling report to external email (Non BizX user) in SuccessFactors](https://blogs.sap.com/2022/07/21/scheduling-report-to-external-email-non-bizx-user-in-successfactors/) - - [XaaS Digital Assets with SAP S/4HANA Public Cloud](https://blogs.sap.com/2022/07/21/xaas-digital-assets-with-sap-s-4hana-public-cloud/) - - [REHAU China’s Intelligent Transformation Journey with SAP](https://blogs.sap.com/2022/07/21/rehau-chinas-intelligent-transformation-journey-with-sap/) - - [SAP Training: SAP Integration Suite Day, 04. Aug 2022 [GERMAN]](https://blogs.sap.com/2022/07/21/sap-training-sap-integration-suite-day-04.-aug-2022-german/) -- 安全分析与研究 - - [LockBit3.0勒索病毒利用PowerShell无文件攻击技术](https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247487460&idx=1&sn=9bca4bf4c8e72ac68a2746a56459df21&chksm=902fa0cca75829dab05b54779510723e53979ea1fcfb1437ce82340dab786988fb64d62b6b2d&scene=58&subscene=0#rd) -- Blog - Praetorian - - [Part 2 – Adapting Security Strategy to the Rise of Opportunistic Attacks](https://www.praetorian.com/blog/part-2-adapting-to-a-rise-in-opportunistic-attacks/) -- 看雪学院 - - [Flutter APP逆向实践](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458802&idx=1&sn=d2b5e89ad8a819c164d9cdfaa7fa8353&chksm=b18e2a3886f9a32e6b4547aa7286c2e69895a3695d092f63995db0d1d4c498332acb7a8565a2&scene=58&subscene=0#rd) - - [80.26亿元罚款！网信办对滴滴作出网络安全审查相关行政处罚](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458802&idx=2&sn=1112b3d38d42a477e61e43d301ddbbb9&chksm=b18e2a3886f9a32e823945b56aa093db87dbd929709e1bb318b705cead7c5c8f3d0b75473212&scene=58&subscene=0#rd) - - [【为期30天】论坛夏日“作战”计划，送好礼！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458802&idx=3&sn=5f01561549385dd356bee0f65fc3a11b&chksm=b18e2a3886f9a32e29312cb703d506bbae16f3b5e676858efdd1e2f516aff756babcf56b3b75&scene=58&subscene=0#rd) - - [反勒索软件开发实战篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458802&idx=4&sn=469a28d3e5efd85a554037463d4ece1e&chksm=b18e2a3886f9a32e79d3c46fdf0272c231eacc336eebf09bdf5d3173410d9d2c6ee35ec761fd&scene=58&subscene=0#rd) -- 雷神众测 - - [CS的流量行为特征](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498824&idx=1&sn=c418de5a2293749ffd33b037a1152cea&chksm=f258483bc52fc12dede9e3f301a00542bd016499af8bfd5987b29805e6ab06f803626f78fb14&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [绿盟科技战略解决方案系列介绍--金融行业威胁和漏洞管理方案](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247492024&idx=1&sn=853745893eb6a55bc425d7ca6f0bc516&chksm=eaac72ffdddbfbe9bbd00503ced91b792af7bf617399e57e0aeed957fa72f249bd4d74981379&scene=58&subscene=0#rd) -- Twitter @hakivvi - - [RT 🇪🇨: I just published: How I Test For Web Cache Vulnerabilities + Tips And Tricks](https://twitter.com/bxmbn/status/1550173080676360195) -- 互联网安全内参 - - [跨国巨头遭勒索软件攻击：所有工厂正常运转，所有业务离线进行](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504552&idx=1&sn=90346b8900cbe596f411a00243ccc82b&chksm=ebfa9588dc8d1c9ea5989c663a5bb7d1677e37f9c960ea6ad5aed27982719afa68c95df1d26d&scene=58&subscene=0#rd) - - [网信办：滴滴给关基安全和数据安全带来严重安全风险隐患](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504552&idx=2&sn=347310874e862eeee1d19b7d015f238f&chksm=ebfa9588dc8d1c9eb3919b0d24d4a1e51206fb54d3a74f392ab01bdc7850619d799cc96d6f3b&scene=58&subscene=0#rd) - - [国家漏洞库CNNVD：关于Oracle 316个安全漏洞的通报](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504552&idx=3&sn=cdd1be2f2e6fa007ee86be88f29b968f&chksm=ebfa9588dc8d1c9ed761079bb169582ae705356362500dd943b634f60794d7d2b26aac56d21c&scene=58&subscene=0#rd) - - [白宫“全国网络劳动力和教育峰会”：聚焦日益扩大的网络安全人才缺口](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504552&idx=4&sn=d31b085e7dc6d356fb66df5b42cc7e9c&chksm=ebfa9588dc8d1c9e60afe6dbcf28c6eedad4427c9c5ccb46c84e9054688f11a85acd4c6975c4&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [Intent安全中的一点事儿](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247489102&idx=1&sn=8c33bdc412fade648fe19a174e112cc8&chksm=e9b93022deceb93409f1f6f6bfdd9165754b1f298ace4a538fb1b1c3b626b775b9dcd9e41006&scene=58&subscene=0#rd) -- 腾讯代码安全检查Xcheck - - [Xcheck通过中国信通院SAST能力评估，体验环境正式开放！](https://mp.weixin.qq.com/s?__biz=Mzg2ODQ3ODE1NA==&mid=2247486380&idx=1&sn=d2ab503ab41e6d3434b1140a142d3357&chksm=ceaaf609f9dd7f1f20626cebedffbb5d6009e73ea33473074a7b090ff8cabbca95ffabeb1ffb&scene=58&subscene=0#rd) -- PortSwigger Blog - - [Burp Suite roadmap update: July 2022](https://portswigger.net/blog/burp-suite-roadmap-update-july-2022) -- 黑奇士 - - [知识直播火爆出圈，张朝阳的物理课被联合国点赞——互联网重拾对知识的信仰](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247487070&idx=1&sn=937e8e8d017efd329793e4fb063238d0&chksm=eca201b2dbd588a443c083dc98a9b9268471de62ff1576addbd9c55cb23bb911b8a349717472&scene=58&subscene=0#rd) -- Checkmarx.com - - [Powering Developer Productivity and Reducing AppSec Risk: Checkmarx and Seemplicity Team Up to Give Security Teams an Edge](https://checkmarx.com/blog/powering-developer-productivity-and-reducing-appsec-risk-checkmarx-and-seemplicity-team-up-to-give-security-teams-an-edge/) -- 腾讯玄武实验室 - - [每日安全动态推送(07-21)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958610&idx=1&sn=3c8134f31e5ed500988a325e844720f3&chksm=8baecdcdbcd944db7e97cce61a3716a0be04efed9f2f480d6c8720e0dfdc678b07ae321bf3ca&scene=58&subscene=0#rd) -- 极客公园 - - [百度智能云将给实体经济带来多少生命力？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960883&idx=1&sn=4acb5af146b8ce5a3b8ac0be7d726648&chksm=7e5585c549220cd370a6912297a75caef06e2e5733c63c0367cd9c699f35355dfc1ab4404eef&scene=58&subscene=0#rd) - - [80.26 亿元，滴滴收到一张历史级罚单](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960883&idx=2&sn=23cd8a3cfd54d20ab00959d9bf2e3657&chksm=7e5585c549220cd3aede27bb977ef513ae45bbf90375ffb4595eb3d809cd83db571a54ce6c28&scene=58&subscene=0#rd) - - [四天暴涨 180 亿美金，《怪奇物语》暂时拯救了奈飞](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960810&idx=1&sn=716a0931eaaf005a6fdc5bf45c15b656&chksm=7e55859c49220c8a2710e61cd55133dc171949ee8c52c932da83589da96ddad23ce307c3a196&scene=58&subscene=0#rd) - - [如何开辟一条 SpaceX 的国产商业化之路？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960810&idx=2&sn=cbfb3123c407e9fd05ae8a4880bb03ad&chksm=7e55859c49220c8a4cf166da01ece4a9f1bde0edc4ec322d1d99c8565566959702783ba898f1&scene=58&subscene=0#rd) - - [特斯拉卖出比特币，套现 10 亿美元；腾讯关停数字藏品应用「幻核」；TikTok 用户平均时长超 YouTube｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960769&idx=1&sn=8e1de04ab9839d50b572f8c29fac9118&chksm=7e5585b749220ca11530b898ec343190fde73d417edd40870c2ee49d8953e228a4dc9ab7e675&scene=58&subscene=0#rd) - - [TikTok 在壮大，各国政府对它的警惕也在增长](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652960769&idx=2&sn=390fbf6f54a7c8beca767080430a9c00&chksm=7e5585b749220ca150332f31dc3ebe1c00ec2dc452bbd58e410d73fbf7f7422ef3a3c473030c&scene=58&subscene=0#rd) -- 火线Zone - - [k8s攻防之etcd数据库篇](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247496067&idx=1&sn=67f1a094c7e628c9bcb1b733841474d3&chksm=eaa979a3dddef0b5fb92dc567ec0ec102bef091dea13bce5a07a25dd25b49f8b331986fa3994&scene=58&subscene=0#rd) -- 情报分析师 - - [【韩国智库】2020-21 年朝鲜的外部趋势和影响](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511076&idx=1&sn=54106822bcf1a4a3c3b02b89eff1d6cd&chksm=8716b8afb06131b925bacae2a280724cf6d4e53a4987f03cec79105ae31e534208648df8349b&scene=58&subscene=0#rd) - - [【情报工具】最全的武器装备鉴定资源](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511076&idx=2&sn=53459d82314429aa95ab128769f571af&chksm=8716b8afb06131b9625ce7175f9f5ba4970ba5e9b86052bf2622b41bdc14f39c0a340d36fc0e&scene=58&subscene=0#rd) - - [国土安全部公报：针对美国最高法院关于堕胎的裁决，国内暴力极端主义活动可能](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511076&idx=3&sn=59a31e36d879733d2be8ef1378a83331&chksm=8716b8afb06131b9e013cfeebefde251b269bad64b739242de9b295468b789a22fb6f286170e&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [用过期证书对PE签名](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486049&idx=1&sn=d71334e24f040c229651af00dd93c3c6&chksm=fab2c95ecdc540485128063e8be6b58f5391338c8bc1486de202fac5bc5e93e64fb1afd8ce24&scene=58&subscene=0#rd) -- GeekPwn - - [国家网信办：滴滴存16项违法事实，处80.26亿元罚款](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650345001&idx=1&sn=f6f1a79282f0966333bb6c1fe04e58bd&chksm=8740b5ecb0373cfa1c362344496f114ea80d5c985f046866cd1bb4a084548afc15e0b330cd49&scene=58&subscene=0#rd) - - [糟糕的上半年过去了，这会是未来网络安全里最好的半年吗？](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650345001&idx=2&sn=68acdb69a28f1328b9d50ec7d1996b3f&chksm=8740b5ecb0373cfa01a3055cb34701fe9f5c3d7b3802613eb1466f331de442b7f0a6ac60583d&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [身份和访问管理（IAM）策略失败的6个迹象及缓解策略](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546245&idx=1&sn=f0e8cd09bdbdc14c5f1f3caff7e748b6&chksm=e915e5bfde626ca93768a61d68a17f8193485f1ca67758d24c48651f09faa31e615bb0a13a08&scene=58&subscene=0#rd) - - [金融网络安全风险管理指南（四）：数据泄露成本的费用估算](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546245&idx=2&sn=c76cefed3158085ad6d65d7d70021ac6&chksm=e915e5bfde626ca91b653560b1669bd8a240fdbb1d7c3eb1ea864ffc32fe08d3dd1c147ef11b&scene=58&subscene=0#rd) -- 且听安全 - - [CVE-2022-26138 Confluence 应用程序身份认证硬编码漏洞分析与复现](https://mp.weixin.qq.com/s?__biz=Mzg3MTU0MjkwNw==&mid=2247491363&idx=1&sn=ac664d6b3fd391319cb8386a4225620b&chksm=cefda637f98a2f21f9bfcf82837773d77bc94922361fd92d2bff81dcb26c2ad7d46874389f36&scene=58&subscene=0#rd) -- 零鉴科技 - - [Unstable Stablecoins（上）](https://mp.weixin.qq.com/s?__biz=MzkzODE2NjgyNQ==&mid=2247495003&idx=1&sn=666b057bbef80321da916c81dfcad5d5&chksm=c286f21df5f17b0b28c72d2639ff2b08321dfb93d90427effb0fbefb2d25e4cffa1081d5b385&scene=58&subscene=0#rd) -- 美团技术团队 - - [可视化全链路日志追踪](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651770155&idx=1&sn=03437e5e67bb971f96cd698139c71fcf&chksm=bd1214668a659d7079bdcaabef696bcfd0f17add2f71303e7a7fce76997631eba2629e9a669c&scene=58&subscene=0#rd) - - [ACM SIGIR 2022 | 美团技术团队精选论文解读](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651770155&idx=2&sn=75aeaa85851bd8f153e64890bcc087b6&chksm=bd1214668a659d70c8989ed7ac1e96fa106c5f0ac5a03f24bfa4d23688fbb7ab5e85c947ea29&scene=58&subscene=0#rd) -- 网安寻路人 - - [美国《保护美国人数据免受外国监视法案》（中译本）](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495672&idx=1&sn=a943cfa38c11efe9d54613f56759be10&chksm=97e95212a09edb047ce849e17a81cc6148fc4c8fc4721b57dc1b3f5e223c63ea278fd0f95977&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [永安在线API安全研究报告（2022年Q2）](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247493884&idx=1&sn=734725171760255e289bbd9034dcdef2&chksm=eb12cec7dc6547d16dfe3b2e5a747786bb99c0610f27b3d75888cec955391ee21525571941c7&scene=58&subscene=0#rd) -- 中国信息安全 - - [滴滴被罚80.26亿！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162363&idx=1&sn=a08f39f1adce797e754e34cca017b1c7&chksm=8b5ee6c2bc296fd40215c74678c534db175aac4c0b5bd16914ee53f9cd98dc0f75e5a9946378&scene=58&subscene=0#rd) - - [专题·云安全将来时 | 云安全的新阶段：云上暴露面的风险发现与治理](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162363&idx=2&sn=76d27eecc839d1d000ca7a2df7d9f96a&chksm=8b5ee6c2bc296fd41b17c37cb4bc8ebde557310844cb12241185278be09ff7bc7bd276429f8e&scene=58&subscene=0#rd) - - [CNNVD | 关于Oracle多个安全漏洞的通报](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162363&idx=3&sn=d105f469617cbd73cb6d2cddcdce879b&chksm=8b5ee6c2bc296fd417dfed5f2ed994e9155184fbe15275b95dc876bfdc4e885da62a83a9f981&scene=58&subscene=0#rd) - - [看特大跨国电信诈骗集团如何被K.O！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162363&idx=4&sn=7966cf415ae77eadd8bb30e02271e461&chksm=8b5ee6c2bc296fd43bccfc28ca8cba353ff3e61d9a051fcc70a906fd49e8c199a53de44ed099&scene=58&subscene=0#rd) -- 安全牛 - - [从数字化业务发展看零信任身份安全治理](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116249&idx=1&sn=4860aa53229eb6d762bf43990e881b73&chksm=bd14620a8a63eb1ca2922de8b7981f2896a16ceb5557d47330561823c5db8cff4a5810dd1aee&scene=58&subscene=0#rd) - - [实现自动化安全还需装好护栏](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116249&idx=2&sn=e43e45543b6b1084c92820b5d16c614d&chksm=bd14620a8a63eb1c65679ad9d01c5bc1d5477fb78200f2938daeeeeb6d28e5765256e106dc42&scene=58&subscene=0#rd) - - [公安部网安局召开全国网安部门“百日行动”推进会](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116249&idx=3&sn=beaeb4ce7f8d0ba1710b8e3d1fceb0c2&chksm=bd14620a8a63eb1c54d5604c854ff84275fe1e1ae35bfe71aeab642b963c6f60de28b131e347&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-23.md b/archive/2022/2022-07-23.md deleted file mode 100644 index c85a065ef0..0000000000 --- a/archive/2022/2022-07-23.md +++ /dev/null @@ -1,189 +0,0 @@ -# 每日安全资讯（2022-07-23） - -- SecWiki News - - [SecWiki News 2022-07-22 Review](http://www.sec-wiki.com/?2022-07-22) -- Trustwave Blog - - [The Trustwave Fusion Platform: A Window Into Your Penetration Test](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/the-trustwave-fusion-platform-a-window-into-your-penetration-test/) -- HackerOne Hacker Activity - - [IDOR in report download functionality on ads.tiktok.com](https://hackerone.com/reports/1559739) - - [CVE-2022-32214 - HTTP Request Smuggling Due To Improper Delimiting of Header Fields](https://hackerone.com/reports/1630669) - - [CVE-2022-32213 - HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding](https://hackerone.com/reports/1630668) - - [CVE-2022-32215 - HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding](https://hackerone.com/reports/1630667) -- Security Boulevard - - [The Cybersecurity Dark Threat Facing Universities](https://securityboulevard.com/2022/07/the-cybersecurity-dark-threat-facing-universities/) - - [Perception Point Makes Securing Browsers Simpler](https://securityboulevard.com/2022/07/perception-point-makes-securing-browsers-simpler/) - - [BSidesSF 2022 – Avigayil Mechtinger’s And Ryan Robinson’s ‘Rise Of The Vermilion: Cross-Platform Cobalt Strike Beacon Targeting Linux And Windows’](https://securityboulevard.com/2022/07/bsidessf-2022-avigayil-mechtingers-and-ryan-robinsons-rise-of-the-vermilion-cross-platform-cobalt-strike-beacon-targeting-linux-and-windows/) - - [Fredo & Pidjin™ ‘Make Mars Great Again’](https://securityboulevard.com/2022/07/fredo-pidjin-make-mars-great-again/) - - [Honey Trapping Baddies (or just nosey people)](https://securityboulevard.com/2022/07/honey-trapping-baddies-or-just-nosey-people/) - - [BSidesSF 2022 – Ashish Patel’s ‘Metabadger: Automating IMDS Protection At Scale In AWS’](https://securityboulevard.com/2022/07/bsidessf-2022-ashish-patels-metabadger-automating-imds-protection-at-scale-in-aws/) - - [Orgs Struggling to Balance Security and End-User Experience](https://securityboulevard.com/2022/07/orgs-struggling-to-balance-security-and-end-user-experience/) - - [HP Wolf Security and the Industrialization of Cybercrime](https://securityboulevard.com/2022/07/hp-wolf-security-and-the-industrialization-of-cybercrime/) - - [A Day In the Life with Quality Analyst, Jorge Montero](https://securityboulevard.com/2022/07/a-day-in-the-life-with-quality-analyst-jorge-montero/) - - [Defending the Edge Data Center](https://securityboulevard.com/2022/07/defending-the-edge-data-center/) -- Der Flounder - - [Privileges.app and time-limited admin](https://derflounder.wordpress.com/2022/07/22/privileges-app-and-time-limited-admin/) -- Tenable Blog - - [NSTAC Aces Zero Trust Recommendations for Protecting Government Entities](https://www.tenable.com/blog/nstac-aces-zero-trust-recommendations-for-protecting-government-entities) -- Recent Commits to cve:main - - [Update Fri Jul 22 11:33:39 UTC 2022](https://github.com/trickest/cve/commit/775d4f698e8efa69eb0888959bd3521dff1a0a24) -- Sploitus.com Exploits RSS Feed - - [Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37853&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Eclipse.h MVID-2022-0625 Hardcoded Credential exploit](https://sploitus.com/exploit?id=PACKETSTORM:167793&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Rarlab Unrar exploit](https://sploitus.com/exploit?id=2AB84274-77B4-5551-8047-C6DEE2425EFF&utm_source=rss&utm_medium=rss) - - [Exploit for Authentication Bypass by Spoofing in Zabbix exploit](https://sploitus.com/exploit?id=2240B3DE-E782-5C49-B3D0-D20FCA3ED158&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Apache Http Server exploit](https://sploitus.com/exploit?id=9CEA663C-6236-5F45-B207-A873B971F988&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-32832 exploit](https://sploitus.com/exploit?id=37393B8B-A626-5459-AD36-69EB66654B35&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [SonicWall: Patch critical SQL injection bug immediately](https://twitter.com/Dinosn/status/1550569042875908098) - - [Don’t let evil hackers abuse this simple Flask/Jinja2 mistake](https://twitter.com/Dinosn/status/1550565281591869440) - - [The repository tries to gather an information about Windows persistence mechanisms to make the protection/detection more efficient.](https://twitter.com/Dinosn/status/1550538264947625985) - - [Didi Slapped With $1.1B Fine For Breaching China Data Security Laws](https://twitter.com/Dinosn/status/1550537729897025536) - - [Microsoft warns that new Windows updates may break printing](https://twitter.com/Dinosn/status/1550536975219798016) - - [Elon Musk's Tesla Sells Most Of Its Bitcoin Holdings](https://twitter.com/Dinosn/status/1550536406904233984) - - [LiveTargetsFinder - Generates Lists Of Live Hosts And URLs For Targeting, Automating The Usage Of MassDNS, Masscan And Nmap To Filter Out Unreachable ...](https://twitter.com/Dinosn/status/1550493299223547905) - - [Golang implementation similar to JSFinder, faster, more complete and more comfortable](https://twitter.com/Dinosn/status/1550459394181275649) - - [Let’s Understand Path Traversal Vulnerabilities](https://twitter.com/Dinosn/status/1550452207379550208) - - [VLANPWN: VLAN attacks toolkit](https://twitter.com/Dinosn/status/1550428404679430145) - - [unlicense 0.3.0 - A dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x. Now with support for virtualized entry points and Delphi exe...](https://twitter.com/Dinosn/status/1550428323377037312) - - [Candiru Spyware Caught Exploiting Google Chrome Zero-Day to Target Journalists](https://twitter.com/Dinosn/status/1550417318722904068) - - [TA4563 group leverages EvilNum malware to target European financial and investment entities](https://twitter.com/Dinosn/status/1550363346494537728) - - [Another Meterpreter code injection technique using C++ that attempts to bypass Win-Def.](https://twitter.com/Dinosn/status/1550363213958627328) - - [How Conti ransomware hacked and encrypted the Costa Rican government](https://twitter.com/Dinosn/status/1550337724120539136) - - [Cybercrime Group TA4563 Targets DeFi Market With Evolving Evilnum Backdoor](https://twitter.com/Dinosn/status/1550337530050093058) - - [Dependency Confusion](https://twitter.com/Dinosn/status/1550337487335309313) - - [Ex-Coinbase manager charged in first crypto insider-trading case](https://twitter.com/Dinosn/status/1550337190168825858) -- 安全客-有思想的安全新媒体 - - [数字安全观察-每周简报（2022.07.13 -2022.07.19）](https://www.anquanke.com/post/id/276900) - - [邮件钓鱼演练指南](https://www.anquanke.com/post/id/276829) - - [记货拉拉信息安全月钓鱼体验活动](https://www.anquanke.com/post/id/276741) - - [Neopets虚拟宠物网站出现千万级数据泄露](https://www.anquanke.com/post/id/276797) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [新兴的H0lyGh0st勒索软件与朝鲜有关联](https://www.4hou.com/posts/8Yo3) - - [8个值得关注的企业存储趋势](https://www.4hou.com/posts/vJY5) -- 信息安全知识库 - - [Cloud RedTeam视角下元数据服务攻防实践](https://vipread.com/library/topic/3839) - - [浅析云存储的攻击利用方式](https://vipread.com/library/topic/3840) - - [云原生背景下的应用安全建设](https://vipread.com/library/topic/3841) - - [浅谈云原生环境信息收集技术](https://vipread.com/library/topic/3842) - - [DevOps落地思考](https://vipread.com/library/topic/3843) - - [云原生安全实践 (Cloud Native Security practices](https://vipread.com/library/topic/3844) - - [DevSecOps邂逅云原生 ——云原生时代下的持续安全](https://vipread.com/library/topic/3845) - - [使用 DevSecOps 构建安全软件](https://vipread.com/library/topic/3846) - - [安全软件如何做开源](https://vipread.com/library/topic/3847) - - [K8s 安全策略最佳实践](https://vipread.com/library/topic/3848) - - [开源软件漏洞挖掘实践](https://vipread.com/library/topic/3849) - - [CSA云安全联盟标准-《云原生安全技术规范》解读](https://vipread.com/library/topic/3850) - - [软件供应链安全威胁与业界解决方案](https://vipread.com/library/topic/3851) - - [Serverless应用安全浅谈](https://vipread.com/library/topic/3852) -- Files ≈ Packet Storm - - [Open-Xchange App Suite 7.10.x Cross Site Scripting / Command Injection](https://packetstormsecurity.com/files/167794/openxchange7106-execxss.txt) - - [Backdoor.Win32.Eclipse.h MVID-2022-0625 Hardcoded Credential](https://packetstormsecurity.com/files/167793/MVID-2022-0625.txt) - - [Apple Security Advisory 2022-07-20-7](https://packetstormsecurity.com/files/167792/APPLE-SA-2022-07-20-7.txt) - - [Apple Security Advisory 2022-07-20-6](https://packetstormsecurity.com/files/167791/APPLE-SA-2022-07-20-6.txt) - - [Apple Security Advisory 2022-07-20-5](https://packetstormsecurity.com/files/167790/APPLE-SA-2022-07-20-5.txt) - - [Apple Security Advisory 2022-07-20-4](https://packetstormsecurity.com/files/167789/APPLE-SA-2022-07-20-4.txt) - - [Apple Security Advisory 2022-07-20-3](https://packetstormsecurity.com/files/167788/APPLE-SA-2022-07-20-3.txt) - - [Apple Security Advisory 2022-07-20-2](https://packetstormsecurity.com/files/167787/APPLE-SA-2022-07-20-2.txt) - - [Apple Security Advisory 2022-07-20-1](https://packetstormsecurity.com/files/167786/APPLE-SA-2022-07-20-1.txt) -- Sec-News 安全文摘 - - [Trustedsec ELFLoader 原理简析(Linux平台bof实现)](https://wiki.ioin.in/url/DA92) -- 跳跳糖 - 安全与分享社区 - - [sAMAccountName Spoofing之九个为什么](https://tttang.com/archive/1675/) -- 安全脉搏 - - [获取 Spring heapdump中的密码明文](https://www.secpulse.com/archives/184037.html) - - [Xposed框架食用指南](https://www.secpulse.com/archives/184002.html) - - [Frida与Android CTF](https://www.secpulse.com/archives/183978.html) - - [Fastjson 代码执行 CVE-2022-25845](https://www.secpulse.com/archives/183931.html) -- unSafe.sh - 不安全 - - [The Good, the Bad and the Ugly in Cybersecurity – Week 30](https://buaq.net/go-118860.html) - - [Privileges.app and time-limited admin](https://buaq.net/go-118837.html) - - [LiveTargetsFinder - Generates Lists Of Live Hosts And URLs For Targeting, Automating The Usage Of MassDNS, Masscan And Nmap To Filter Out Unreachable Hosts And Gather Service Information](https://buaq.net/go-118839.html) - - [The more predictable you are, the less you get detected — hiding malicious shellcodes via Shannon…](https://buaq.net/go-118825.html) - - [《关于开展网络安全服务认证工作的实施意见（征求意见稿）》发布](https://buaq.net/go-118909.html) - - [云原生安全实践 (Cloud Native Security practices](https://buaq.net/go-118911.html) - - [获取 Spring heapdump中的密码明文](https://buaq.net/go-118835.html) - - [方弗相机（Funfor Cam）- 直出哈苏、富士、理光色彩的胶片感照片，以及一大堆的修图工具[iPhone/iPad]](https://buaq.net/go-118818.html) - - [DevOps落地思考](https://buaq.net/go-118910.html) - - [浅谈云原生环境信息收集技术](https://buaq.net/go-118900.html) - - [云原生背景下的应用安全建设](https://buaq.net/go-118899.html) - - [浅析云存储的攻击利用方式](https://buaq.net/go-118873.html) - - [本周看什么丨最近值得一看的 7 部作品](https://buaq.net/go-118833.html) -- Hexacorn - - [The curse of being ‘technical’](https://www.hexacorn.com/blog/2022/07/22/the-curse-of-being-technical/) - - [Week of Data Dumps, Part 2 – GUIDs](https://www.hexacorn.com/blog/2022/07/22/week-of-data-dumps-part-2-guids/) -- Bug Bounty in InfoSec Write-ups on Medium - - [The more predictable you are, the less you get detected — hiding malicious shellcodes via Shannon…](https://infosecwriteups.com/the-more-predictable-you-are-the-less-you-get-detected-hiding-malicious-shellcodes-via-shannon-111a83fe60e4?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [Support Spotlight: Using Guided Answers? Let Us Know, Attach It To The Incident.](https://blogs.sap.com/2022/07/22/support-spotlight-using-guided-answers-let-us-know-attach-it-to-the-incident./) - - [eSocial: Publicada versão Beta (S-1.1) do layout](https://blogs.sap.com/2022/07/22/esocial-publicada-versao-beta-s-1.1-do-layout/) - - [SAP Product Lifecycle Management Info Days, July 26–27](https://blogs.sap.com/2022/07/22/sap-product-lifecycle-management-info-days-july-26-27/) - - [SAP Digital Manufacturing Cloud | Process Extension Integrated with SAP Workflow Management](https://blogs.sap.com/2022/07/22/sap-digital-manufacturing-cloud-process-extension-integrated-with-sap-workflow-management/) - - [Scaling up statutory reporting with extensibility in SAP S/4HANA](https://blogs.sap.com/2022/07/22/scaling-up-statutory-reporting-with-extensibility-in-sap-s-4hana/) - - [Report ZCLEANUP_PASSWORD_HASH_VALUESX – Remove weak password hash values](https://blogs.sap.com/2022/07/22/report-zcleanup_password_hash_valuesx-remove-weak-password-hash-values/) - - [Moderate way of Debugging for Technical Consultants – “Art of Removing Errors”](https://blogs.sap.com/2022/07/22/moderate-way-of-debugging-for-technical-consultants-art-of-removing-errors/) - - [Top notes for SAP S/4HANA TM implementations](https://blogs.sap.com/2022/07/22/top-notes-for-sap-s-4hana-tm-implementations/) - - [Quick Guide – Consume your Data Warehouse Cloud View in SAC Story](https://blogs.sap.com/2022/07/22/quick-guide-consume-your-data-warehouse-cloud-view-in-sac-story/) - - [What’s New in SAP AI Core & SAP AI Launchpad in Q2 2022](https://blogs.sap.com/2022/07/22/whats-new-in-sap-ai-core-sap-ai-launchpad-in-q2-2022/) -- Hex Rays - - [Igor’s tip of the week #99: Enums](https://hex-rays.com/blog/igors-tip-of-the-week-99-enums/) -- Reverse Engineering - - [GitHub - ZehMatt/zasm-modules: Generating binary modules with zasm](https://www.reddit.com/r/ReverseEngineering/comments/w5e6hp/github_zehmattzasmmodules_generating_binary/) -- The Daily Swig | Cybersecurity news and views - - [‘We’re still fighting last decade’s battle’ – Sonatype CTO Brian Fox on the struggle to secure the neglected software supply chain](https://portswigger.net/daily-swig/were-still-fighting-last-decades-battle-sonatype-cto-brian-fox-on-the-struggle-to-secure-the-neglected-software-supply-chain) - - [Zyxel firewall vulnerabilities left business networks open to abuse](https://portswigger.net/daily-swig/zyxel-firewall-vulnerabilities-left-business-networks-open-to-abuse) - - [Grafana patches vulnerability that could lead to admin account takeover](https://portswigger.net/daily-swig/grafana-patches-vulnerability-that-could-lead-to-admin-account-takeover) -- Application Security Blog - - [Out-of-band application security with Intelligent Orchestration](https://www.synopsys.com/blogs/software-security/out-of-band-appsec-intelligent-orchestration/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 30](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-30-4/) -- daniel.haxx.se - - [Microsoft FOSS Fund Winner: curl](https://daniel.haxx.se/blog/2022/07/22/microsoft-foss-fund-winner-curl/) -- Binary Ninja - - [Reverse Engineering a Cobalt Strike Dropper With Binary Ninja](https://binary.ninja/2022/07/22/reverse-engineering-cobalt-strike.html) -- KitPloit - PenTest & Hacking Tools - - [LiveTargetsFinder - Generates Lists Of Live Hosts And URLs For Targeting, Automating The Usage Of MassDNS, Masscan And Nmap To Filter Out Unreachable Hosts And Gather Service Information](http://www.kitploit.com/2022/07/livetargetsfinder-generates-lists-of.html) -- 安全客 - - [【技术分享】云沙箱流量识别技术剖析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774302&idx=1&sn=cddb9d766ee484f623dc3035ee70b6eb&chksm=889368b1bfe4e1a769a0aed4ec8bd955430bf87a12beb6e0ef7e05016a3f6117ec713b3afa8c&scene=58&subscene=0#rd) - - [【安全头条】Neopets虚拟宠物网站出现千万级数据泄露](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774302&idx=2&sn=86326aa05615046560afce027b757bb6&chksm=889368b1bfe4e1a7016e8bbe00b236fab9f23d59dc4f623132ff3a06c8d43aed6fa9004e2c83&scene=58&subscene=0#rd) -- Intigriti - - [Lighten up; Dark Theme is here!](https://blog.intigriti.com/2022/07/22/intigriti-dark-theme/) -- 奇安信病毒响应中心 - - [每周勒索威胁摘要](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247490625&idx=1&sn=cc9351c89e2ad1ee6f094af0049ba07b&chksm=ec6a6c69db1de57f6f38f4508ccac4f4ec89c310300e723dd5c22026c8591973d04b52606798&scene=58&subscene=0#rd) -- 吾爱破解论坛 - - [昨日暑假开放注册四小时共注册32245人，没有激活的同学请尽快激活啦，发帖前请认真阅读注册须知，防止违规封号注销，刚加入的同学请经常登录并保持活跃（注意：签到不算活跃，只有发帖或回帖才算），参与到论坛交流中来，对于给予帮助你的人加热心和论坛币，做一个热心受欢迎的人。](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651137865&idx=1&sn=3879d02888be1bea8e133e3b0aadd4f3&chksm=bd50b71d8a273e0b9a44a56e4ff6cd6e8ecc1f49fecde5c6e6d954b48eda22224fa96fd0bcb3&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [每周高级威胁情报解读(2022.07.14~07.21)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502458&idx=1&sn=35e3dc759586587a9376f0eed25d73ee&chksm=ea663d0ddd11b41b43d064e7b60c1fc238099139e3c3bb1af16339f1bd797b93f6f4617d8cf3&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [【6月报】绿盟科技金融事业部安全月报](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247492025&idx=1&sn=cf830740eec53a02c34e72606c977d16&chksm=eaac72fedddbfbe8dac1058ebd2809bb7612e8d426a4720c0f74f9d5013df068536d748e1496&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [Linux内核跟踪：ftrace hook入门手册（下）](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492749&idx=1&sn=2a19290418764d4e4ecfc25d147189eb&chksm=e84c4252df3bcb44f75c71e7f74319ceb1565e306e14ab8e152622046ca32d160c7d06f9a7c4&scene=58&subscene=0#rd) -- 安全威胁情报 - - [0day检测手段完全揭秘：没有最好，只有更全](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173145&idx=1&sn=94d664d0f7471439ffbbef7d6a1da4f7&chksm=f4489565c33f1c7315fd3ae577d1c6b0137bd256fce132507c10f16b67105d5302ffb9f96b64&scene=58&subscene=0#rd) -- 网安寻路人 - - [印度“国家数据治理框架政策”（中译文）](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495694&idx=1&sn=e23f4afa5b3bd6bab09c4ad29d0f237b&chksm=97e94de4a09ec4f27bdceece0defcea647e4578f94eef86773b8a4f4643fb0f5228b99b520cd&scene=58&subscene=0#rd) -- 安全牛 - - [AI技术在身份欺诈检测中的五种应用](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116286&idx=1&sn=902d40536e786c32b087ee830e441435&chksm=bd14622d8a63eb3b4e86237abdc933cb7958a183403d577215482649d36cdb51237dae240e9e&scene=58&subscene=0#rd) - - [2022年第二季度API安全态势研究：月均攻击数量超25万次](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116286&idx=2&sn=340d5edd0ef1c4db901b236fd0276c59&chksm=bd14622d8a63eb3ba38020533e15cbc196017c441f7b13695513aacb317be28edd7c5a32cbbe&scene=58&subscene=0#rd) - - [《关于开展网络安全服务认证工作的实施意见（征求意见稿）》公布](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116286&idx=3&sn=a49e789833dd8374c6b9664168146b3a&chksm=bd14622d8a63eb3b42979060c2660dd5b7478e01618b95a805532b9e3420f773bcbf2e21690b&scene=58&subscene=0#rd) -- 极客公园 - - [腾讯的 Web3 梦想，不到一年就「破灭」了？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652961202&idx=1&sn=fd6ee954e5f550f76a3ed25147a2cad5&chksm=7e55840449220d1298022e35d79f82b48e0be7555bcc02136e582c7886d54af5cb249a2d1bff&scene=58&subscene=0#rd) - - [「高开低走」的云游戏，如今怎么样了？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652961202&idx=2&sn=af17efb3173eb7ce5214c25fcfe097f7&chksm=7e55840449220d1298ff3d51240f879b7919effa05cf3d31e0bae24a4f3676ecad1eb335e081&scene=58&subscene=0#rd) - - [广汽董事长：电池太贵，车厂给宁德时代打工；被罚 80 亿，滴滴：认真完成整改；美国总统拜登新冠检测呈阳性｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652961158&idx=1&sn=d49a74a986fe7dae801697acf56bbb90&chksm=7e55843049220d26511d24d6c40ed46566a39d8136b31ac22dc9bfb3ff47508fb658bd874310&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [【火绒安全周报】滴滴被处80.26亿元罚款/俩黑客出狱后联手作案被拘](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247507198&idx=1&sn=2f8a79366f96381c41f2064bb1012871&chksm=eb7002c1dc078bd71d06e9e709f0bbdb2a8018e2849522914da6ce324df103d42e6992750d0f&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [Oracle发布2022年7月的安全公告](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492077&idx=1&sn=0a364b1bd31ffea54f4afa95899d6e3d&chksm=fd74d124ca03583235959f629d6a3018bcc0ff729048ff2036c027b0bd758c4cb7aa818b241a&scene=58&subscene=0#rd) -- text/plain - - [My Next Opportunity](https://textslashplain.com/2022/07/22/iwebbrowser3beforenavigate/) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jul.22th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495693&idx=1&sn=871d89fc8c73ffe201b8c64ef444198c&chksm=ce96bd33f9e13425b1d00561494e0c094d0088f5259415cfd632f7954ac0b8f632a07f5b33a8&scene=58&subscene=0#rd) -- M01NTeam - - [每周蓝军技术推送（2022.7.16-7.22）](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247488936&idx=1&sn=f0af27e6f52625959ca3c2c46fa936cf&chksm=c187d5b9f6f05caf976f08b2a6894146a0a22e9b46e42eaa1095500545f39a75eaa45fbd7a92&scene=58&subscene=0#rd) -- 东软网络安全 - - [东软NetEye出席2022数字安全与法治高峰论坛](https://mp.weixin.qq.com/s?__biz=MjM5NTAyODkxNw==&mid=2649212451&idx=1&sn=35f5c1690f9c56bbc7ec773b53fc0d40&chksm=beedacf9899a25eff3d8dc11d7c2af5b5c6dc83eceb477c9e7834b3a38e5c30cc478fa403e69&scene=58&subscene=0#rd) -- 火线Zone - - [对Kubernetes 的 AWS IAM Authenticator的身份验证利用](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247496081&idx=1&sn=e714f211d02fd0f3dedc7677e8dcfd13&chksm=eaa979b1dddef0a72bb1ad10de86aeba0fa46c79007da491400f441f156462d460e5286e1902&scene=58&subscene=0#rd) -- 星阑科技 - - [夏日清凉福利，热҈气҈退！退！退！](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494484&idx=1&sn=102f6cbb098db239bd4ff7689987ab99&chksm=c00746c8f770cfde15b9d7026745e8d100628ca536797929d045fecb3391d5a0f37aff128638&scene=58&subscene=0#rd) -- Checkmarx.com - - [Application Security Leader Checkmarx Appoints Yoshishige Nakamichi as Country Manager for Japan](https://checkmarx.com/press-releases/application-security-leader-checkmarx-appoints-yoshishige-nakamichi-as-country-manager-for-japan/) diff --git a/archive/2022/2022-07-24.md b/archive/2022/2022-07-24.md deleted file mode 100644 index 2e7277a733..0000000000 --- a/archive/2022/2022-07-24.md +++ /dev/null @@ -1,108 +0,0 @@ -# 每日安全资讯（2022-07-24） - -- HackerOne Hacker Activity - - [[doc.rt.informaticacloud.com] Reflected XSS via Stack Strace](https://hackerone.com/reports/232320) - - [[doc.rt.informaticacloud.com] Arbitrary File Reading via Double URL Encode](https://hackerone.com/reports/232371) - - [reflected XSS on panther.com](https://hackerone.com/reports/1601140) - - [Rack CVE-2022-30122: Denial of Service Vulnerability in Rack Multipart Parsing](https://hackerone.com/reports/1627159) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Easy Phone |Dbltek GoIP | Local File İnclusion Vulnerability](https://cxsecurity.com/issue/WLB-2022070065) - - [Kite 1.2021.610.0 Unquoted Service Path](https://cxsecurity.com/issue/WLB-2022070064) - - [Backdoor.Win32.Eclipse.h / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022070063) - - [OctoBot WebInterface 0.4.3 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022070062) - - [Sourcegraph Gitserver 3.36.3 Remote Code Execution (RCE)](https://cxsecurity.com/issue/WLB-2022070061) - - [Royal Event Management System 1.0 todate SQL Injection (Authenticated)](https://cxsecurity.com/issue/WLB-2022070060) -- Security Boulevard - - [BSidesSF 2022 – Rob Jerdonek’s And Lily Chau’s ‘Got Popcorn?’ ‘What’s On The Vuln Channel Tonight?](https://securityboulevard.com/2022/07/bsidessf-2022-rob-jerdoneks-and-lily-chaus-got-popcorn-whats-on-the-vuln-channel-tonight/) - - [XKCD ‘Physics Cost-Saving Tips’](https://securityboulevard.com/2022/07/xkcd-physics-cost-saving-tips/) - - [BSidesSF 2022 – Abhay Bhargav’s ‘Hook, Line And Sinker – Pillaging API Webhooks’](https://securityboulevard.com/2022/07/bsidessf-2022-abhay-bhargavs-hook-line-and-sinker-pillaging-api-webhooks/) -- unSafe.sh - 不安全 - - [Evaluating the Arm TrustZone as an Environment for Rootkits - Analyzing the Impact of a Compromised Secure World](https://buaq.net/go-118966.html) - - [Un3xpected DoS Attack on Profile Pictur3](https://buaq.net/go-118952.html) - - [modDetective - Tool That Chronologizes Files Based On Modification Time In Order To Investigate Recent System Activity](https://buaq.net/go-118953.html) - - [Update: oledump.py Version 0.0.69](https://buaq.net/go-118938.html) - - [I mean, IDOR is NOT only about others ID](https://buaq.net/go-118932.html) - - [播客 Plus | Disney 卖的是糖，HBO 卖的是酒，Netflix 卖的是毒](https://buaq.net/go-118936.html) - - [如何在微信、QQ 批量给不同人发送不同的信息？](https://buaq.net/go-118929.html) - - [cby的日常(before 2022.6.20)](https://buaq.net/go-118951.html) - - [新出现的HavanaCrypt 勒索软件冒充谷歌软件更新应用程序传播](https://buaq.net/go-118927.html) - - [Retbleed推测执行攻击影响AMD、Intel CPU](https://buaq.net/go-118913.html) - - [「空调救命」不是玩笑话，聊聊中暑的预防、发现与救治](https://buaq.net/go-118925.html) - - [Decompiler Explorer – Compare tools on the forefront of static analysis from your web browser](https://buaq.net/go-118912.html) - - [An informal review of CTF abuse](https://buaq.net/go-118965.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [新出现的HavanaCrypt 勒索软件冒充谷歌软件更新应用程序传播](https://www.4hou.com/posts/nJz7) - - [Retbleed推测执行攻击影响AMD、Intel CPU](https://www.4hou.com/posts/7Jn1) -- SecWiki News - - [SecWiki News 2022-07-23 Review](http://www.sec-wiki.com/?2022-07-23) -- Twitter @Nicolas Krassas - - [modDetective - Tool That Chronologizes Files Based On Modification Time In Order To Investigate Recent System Activity](https://twitter.com/Dinosn/status/1550882321494118402) - - [HTB: Catch](https://twitter.com/Dinosn/status/1550882019697197059) - - [This is why you should NEVER use the eval() function — RCE!](https://twitter.com/Dinosn/status/1550794388187627520) - - [This one trick will exploit URL parsers to perform SSRF](https://twitter.com/Dinosn/status/1550794316691431424) - - [SonicWall fixed critical SQLi in Analytics and GMS products](https://twitter.com/Dinosn/status/1550715782992171011) - - [Don't dive head first into that crypto pool, FBI warns](https://twitter.com/Dinosn/status/1550704484631957504) - - [Confuser - New Dependency Confusion Detection Tool](https://twitter.com/Dinosn/status/1550703863627485185) - - [Hacker selling Twitter account data of 5.4 million users for $30k](https://twitter.com/Dinosn/status/1550703792202698752) - - [Defeating Javascript Obfuscation](https://twitter.com/Dinosn/status/1550703679023579136) - - [My Big Coin founder is – you guessed it – a $6m crypto-fraudster](https://twitter.com/Dinosn/status/1550703629232898049) -- gynvael.coldwind//vx.log (en) - - [An informal review of CTF abuse](https://gynvael.coldwind.pl/?id=750) -- SAP Blogs - - [Use of SAP in Public Sector](https://blogs.sap.com/2022/07/23/use-of-sap-in-public-sector/) - - [Consume a SAP Sales and Service Core (formerly SAP C4C) API to create Sales Orders using an OData receiver adapter in SAP Cloud Integration](https://blogs.sap.com/2022/07/23/consume-a-sap-sales-and-service-core-formerly-sap-c4c-api-to-create-sales-orders-using-an-odata-receiver-adapter-in-sap-cloud-integration/) - - [Kyma’s serverless Python functions – A short excursion](https://blogs.sap.com/2022/07/23/kymas-serverless-python-functions-a-short-excursion/) - - [JSON alternative to maintenance views in ABAP](https://blogs.sap.com/2022/07/23/json-alternative-to-maintenance-views-in-abap/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Un3xpected DoS Attack on Profile Pictur3](https://infosecwriteups.com/un3xpected-dos-attack-on-profile-pictur3-b957979dcc7?source=rss----7b722bfd1b8d--bug_bounty) - - [I mean, IDOR is NOT only about others ID](https://infosecwriteups.com/i-mean-idor-is-not-only-about-others-id-2d26115072ba?source=rss----7b722bfd1b8d--bug_bounty) -- Hexacorn - - [Week of Data Dumps, Part 3 – service names](https://www.hexacorn.com/blog/2022/07/23/week-of-data-dumps-part-3-service-names/) -- Reverse Engineering - - [Evaluating the Arm TrustZone as an Environment for Rootkits - Analyzing the Impact of a Compromised Secure World](https://www.reddit.com/r/ReverseEngineering/comments/w65p3k/evaluating_the_arm_trustzone_as_an_environment/) - - [Decompiler Explorer – Compare tools on the forefront of static analysis from your web browser](https://www.reddit.com/r/ReverseEngineering/comments/w5sa7a/decompiler_explorer_compare_tools_on_the/) -- KitPloit - PenTest & Hacking Tools - - [modDetective - Tool That Chronologizes Files Based On Modification Time In Order To Investigate Recent System Activity](http://www.kitploit.com/2022/07/moddetective-tool-that-chronologizes.html) -- 网络安全观 - - [致美国总统的零信任报告](https://mp.weixin.qq.com/s?__biz=MzIxNzUxNzA2NQ==&mid=2247494739&idx=1&sn=75d45eb6ab1965ad361405b611fbaa27&chksm=97fa3135a08db823bfed90e3adb086bd640eccfce8e132103db877bbdeeceec59bfdcaecb738&scene=58&subscene=0#rd) -- 红日安全 - - [@所有人：你不是一个人在战！hvv学习交流群正式开放，扫码进！](https://mp.weixin.qq.com/s?__biz=MzI4NjEyMDk0MA==&mid=2649850741&idx=1&sn=15abc98afc2b55c4db085eb94a291246&chksm=f3e4edf6c49364e0d652d23193dee2292ed18d74eccc66abbef96296dcb3c981aff3b5504c82&scene=58&subscene=0#rd) -- Didier Stevens - - [Update: oledump.py Version 0.0.69](https://blog.didierstevens.com/2022/07/23/update-oledump-py-version-0-0-69/) -- 安全圈 - - [【安全圈】推特被黑客入侵：540万账户信息泄露，卖价3万美元](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652007909&idx=1&sn=30ebbebc526fcab4a22b05172196e6b9&chksm=f36f41a5c418c8b3ac272991a0cc28b04a56632e9e6bcad32cbddd44ff5a046f36a32bfe8fac&scene=58&subscene=0#rd) - - [【安全圈】微信崩了！官方回应称“部分功能发生故障，功能已经恢复中](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652007909&idx=2&sn=5cc5eb33abf09100b7f55269f70d41e5&chksm=f36f41a5c418c8b3187834735f470820ae0f1e7f0ed021a14706d2947d5a874ab91f04209514&scene=58&subscene=0#rd) - - [【安全圈】Win11即日起默认阻止RDP暴力破解 10次错误登录就会被锁定](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652007909&idx=3&sn=d6a1f2536e15561004c798ed82b9b77e&chksm=f36f41a5c418c8b3a69b07101b28ad7c99fd8de32683018cf3c5dff10e8837f96aeaa0721b1f&scene=58&subscene=0#rd) - - [【安全圈】关于Oracle多个安全漏洞的通报](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652007909&idx=4&sn=d51243aee92bc9d50d4f0c5a6b7ead75&chksm=f36f41a5c418c8b394f42b8a3966a90c5dfb0e23a23b813f14d057f5b1515db48a6b00242469&scene=58&subscene=0#rd) -- 情报分析师 - - [2022年全球供应链图文报告](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511328&idx=1&sn=fe4fc165f3bed9145b834cebec9d7e86&chksm=8716b9abb06130bd4d9cd63ec5568cc1d0b02ebd9747dad6f3c1b46757dbb03fc2ca0840a2fe&scene=58&subscene=0#rd) - - [【空间情报】朝鲜卫星发射站的新发现](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511328&idx=2&sn=2bec3baa0bfdfb5929a2e026b6fad328&chksm=8716b9abb06130bd1d04bd939969942e34e190056bede08b115bf9cbaa1a636226b937b2234b&scene=58&subscene=0#rd) - - [实用OSINT 工具包](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511328&idx=3&sn=9c2a26574031470d1b591c60cbee303d&chksm=8716b9abb06130bd87166497cec46378902d04f23d84326c06035767a1750d282e35d0265281&scene=58&subscene=0#rd) -- 看雪学院 - - [React Native Hermes 逆向实践](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458968&idx=1&sn=a5381820219048cef57f37acc54de3c2&chksm=b18e2bd286f9a2c45ddbd890fe92b7b2998ceadc86bd78d8cf00feb4577043ed27b9f2bfddc6&scene=58&subscene=0#rd) - - [库存告急！2022新款速干衣：Reverse everything](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458968&idx=2&sn=e2660b7342023a89f09af05e47e87330&chksm=b18e2bd286f9a2c4d452397e456ec0eedbb08d9d953f2156447d5984d002128bf27f96d66d75&scene=58&subscene=0#rd) - - [《安卓逆向入门》学懂学透](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458968&idx=3&sn=af46785b60f8fdd5377d42565ae981c2&chksm=b18e2bd286f9a2c458f78e533e36923b2035360dc6c58602556e04169db2c32730ec963d6caf&scene=58&subscene=0#rd) -- 极客公园 - - [印度 B2B 大跃进：1 年 10 个独角兽，反超中国](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652961309&idx=1&sn=b7cc9111f8bf077bb559059327d86f45&chksm=7e5587ab49220ebd4ba026979ba5b2c377878539acf2e3fa07bafad0d08b9e047649f164d04e&scene=58&subscene=0#rd) - - [特斯拉回应林志颖车祸：不清楚原因；B 站公布直播年龄底线，16 周岁；福特推出电动车自动充电机器人｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652961308&idx=1&sn=f7312c80d3b8cb9f2dfb08b7a5d71128&chksm=7e5587aa49220ebc1015735bed83c8eaf9b6507920d9066b6cfebd61e60d8ae126e860b00d62&scene=58&subscene=0#rd) - - [科技新趋势：智能驾驶、区块链、3D 传感与工业外骨骼机器人](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652961308&idx=2&sn=ea4fe26e9032348c78e4e3c65b248e18&chksm=7e5587aa49220ebcf86a0b5242f4b373d792dd7c38ce4c766b62389c3b888f938f9273fd135a&scene=58&subscene=0#rd) -- KCon黑客大会 - - [KCon 2022 亮点及议程大揭秘！文末福利依旧～](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135348&idx=1&sn=80275a26cdcfd7e5fda4e2e8def5c4d6&chksm=f2c11c14c5b6950297726f4127d43352148ec24dc80a3bb48bd7a882f1ee10780e755155d270&scene=58&subscene=0#rd) -- 中国信息安全 - - [黄坤明出席第五届数字中国建设峰会开幕式时强调 在数字化发展浪潮中把握新机遇、应对新挑战、塑造新优势](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162510&idx=1&sn=c23b4ce97e065ba31b657382b53a5a12&chksm=8b5ee637bc296f217159b6ac18bba22d90438c4929560eca68dfd08e082717f047a1db22a1bf&scene=58&subscene=0#rd) - - [评论 | 维护网络安全、保护个人信息，滴滴须牢记！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162510&idx=2&sn=b047a042229f118f03bb37a4d8fbe931&chksm=8b5ee637bc296f21fb67c1b4a02004e88dcf8d3e0789db3178b919c56b176b477d6716035c61&scene=58&subscene=0#rd) - - [专题·云安全将来时 | 云原生应用程序保护平台（CNAPP）技术浅析](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162510&idx=3&sn=6011b09c3f0d2571267ad5760a7c30fe&chksm=8b5ee637bc296f21c0eb3c9b322ffeddd10480a0d14f2aa5affdf7a678923edbaa5954152d48&scene=58&subscene=0#rd) - - [提醒 | 你的钱包安全吗？这几个手机支付的坏习惯必须改！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162510&idx=4&sn=ed6b1fb985285db9973448ba8a3cca4a&chksm=8b5ee637bc296f21a9c79c7b6843a2a66613d52d9be808f165d0b8d05ff9b1124e88313c248d&scene=58&subscene=0#rd) -- 电子物证 - - [【引入区块链存证　推进证据制度改革】](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651042771&idx=1&sn=dbd64028cc02642fdc0ee9d18aa6b4e6&chksm=80d0fc22b7a77534bad14d232c3959e75dbb0ec322409cb8dfc5d85f0e3a882aa21b2ebe7df3&scene=58&subscene=0#rd) - - [【大数据时代海量数据的多元化证明机制研究】](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651042771&idx=2&sn=7d8cdb63a76994b6c4b34d37c50c9ae7&chksm=80d0fc22b7a77534c5f13a9c39f718619cb78c5ed52ed7ec64f2afd529d19d156ce884ce90f7&scene=58&subscene=0#rd) - - [【认真对待证据】](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651042771&idx=3&sn=31ecbc067390218dbed946d563753122&chksm=80d0fc22b7a77534efa2fe9940123817f1b16e6360aa160ce04046851a6841b0e6d1876eed2c&scene=58&subscene=0#rd) - - [【聊天记录解疑难】](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651042771&idx=4&sn=a906f3e531bc0abefadeb5673b61f497&chksm=80d0fc22b7a7753436e0cfa6e39647fa0f1604578223845e03d59c720e6580a0c053cfef67b6&scene=58&subscene=0#rd) -- 网安国际 - - [InForSec互联网基础设施安全论坛将于7月27日下午举办，请注意地址有变化！](https://mp.weixin.qq.com/s?__biz=MzA4ODYzMjU0NQ==&mid=2652311134&idx=1&sn=b4737b0a6e802a26c3fa8cd89877e307&chksm=8bc493d0bcb31ac6f6aaefee9de8e1c47149f500f0cc3447d2f18326a0f45b3c62d9e818712a&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [cby的日常(before 2022.6.20)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486054&idx=1&sn=c5bd87993c7292e4d2cc3b31674e6435&chksm=fab2c959cdc5404f2949588ba09740e39962a69bcd23e0c536fb8bb2c8ad8893246f7cb54c43&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【情报实战】参加美国“环太军演2022”的舰船都有哪些？](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651130740&idx=1&sn=3e4d625ce259f8f6c30ca36252cb18d1&chksm=f1af7c4ec6d8f5589103e5df26eccb53c9a1587adfc875a465f7daad8eba2bf3134be75bec57&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [强势登榜！深信服获2022「全球白帽黑客奥斯卡」PwnieAwards 2项提名！](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650263024&idx=1&sn=de4903cab79b6d7d74b282fdf0bb893d&chksm=f3e27784c495fe920399e477e41f30adb81383cfd18e031d67b7b28f27fb5e5363173466fdf9&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-25.md b/archive/2022/2022-07-25.md deleted file mode 100644 index e36c14f05b..0000000000 --- a/archive/2022/2022-07-25.md +++ /dev/null @@ -1,69 +0,0 @@ -# 每日安全资讯（2022-07-25） - -- HackerOne Hacker Activity - - [CVE-2022-27781: CERTINFO never-ending busy-loop](https://hackerone.com/reports/1606039) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Moqui Framework 2.1.3 - Reflected Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022070066) -- Twitter @Nicolas Krassas - - [RT Daniel Küffer: Day 33 of 365 🎷🎸 Join us at the #365jazzgarage! A song a day. For one year. Featuring Daniel Küffer (saxophone) and Dani Sol...](https://twitter.com/oyecomova66/status/1551059094789885953) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [从窃取cookie到BEC：攻击者使用AiTM钓鱼网站作为进一步财务欺诈的入口](https://www.4hou.com/posts/RBLE) - - [抵御勒索软件攻击指南](https://www.4hou.com/posts/AO19) -- SecWiki News - - [SecWiki News 2022-07-24 Review](http://www.sec-wiki.com/?2022-07-24) -- Security Boulevard - - [BSidesSF 2022 – Kyle Tobener, MakeItHackin, shenetworks, Kylie Robison ‘Hacker TikTok: Community, Creativity, And Controversy’](https://securityboulevard.com/2022/07/bsidessf-2022-kyle-tobener-makeithackin-shenetworks-kylie-robison-hacker-tiktok-community-creativity-and-controversy/) - - [CommitStrip ‘Don’t Even Need To Pretend Any More’](https://securityboulevard.com/2022/07/commitstrip-dont-even-need-to-pretend-any-more/) - - [BSidesSF 2022 – Omid Mirzaei’s ‘Practical Threat Hunting With Machine Learning’](https://securityboulevard.com/2022/07/bsidessf-2022-omid-mirzaeis-practical-threat-hunting-with-machine-learning/) - - [New Business Email Compromise Schemes Add Vendor Deception](https://securityboulevard.com/2022/07/new-business-email-compromise-schemes-add-vendor-deception/) -- Sec-News 安全文摘 - - [CVE-2022-0540: Jira身份验证绕过分析](https://wiki.ioin.in/url/2P6o) -- Sploitus.com Exploits RSS Feed - - [Exploit for Type Confusion in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=8C048A68-D3B8-57D5-9F89-6F850B0895AE&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Prestashop Blockwishlist exploit](https://sploitus.com/exploit?id=07597D1E-9918-5E4C-89D8-857E228869A4&utm_source=rss&utm_medium=rss) -- unSafe.sh - 不安全 - - [Doenerium - Fully Undetected Grabber (Grabs Wallets, Passwords, Cookies, Modifies Discord Client Etc.)](https://buaq.net/go-119017.html) - - [YouTube影片實務01：Filmora 11使用關鍵幀局部放大螢幕](https://buaq.net/go-119015.html) - - [Red vs Blue Team Project](https://buaq.net/go-119018.html) - - [《安卓高级研修班》推出【看雪安卓应用安全能力认证】证书](https://buaq.net/go-119096.html) - - [用 AHK 写成的「代码片段管理工具」](https://buaq.net/go-119011.html) - - [一键给照片添加小米徕卡味的相框](https://buaq.net/go-119007.html) - - [7 款软件、4 大维度，远程桌面控制软件横评](https://buaq.net/go-119006.html) - - [Update: re-search.py Version 0.0.21](https://buaq.net/go-119008.html) - - [听闻 Typora 加大了对测试版更新提示的力度](https://buaq.net/go-119001.html) - - [攻击者在黑客论坛上推广新版本Redeemer 勒索软件](https://buaq.net/go-119003.html) - - [CVE-2022-0540: Jira身份验证绕过分析](https://buaq.net/go-118998.html) - - [从窃取cookie到BEC：攻击者使用AiTM钓鱼网站作为进一步财务欺诈的入口](https://buaq.net/go-118999.html) - - [抵御勒索软件攻击指南](https://buaq.net/go-118990.html) - - [一日一技 | 想体验 WSL 但系统盘不够大？简单几步就可以将 WSL 装进非系统盘](https://buaq.net/go-118997.html) -- cloud world - - [kubectl kruise - OpenKruise Cli 利器](https://cloudsjhan.github.io/2022/07/24/kubectl-kruise-OpenKruise-Cli-%E5%88%A9%E5%99%A8/) -- Twitter @bytehx - - [RT Lohitaksh Nandan: Bug Bounty payloads github Repos List: #bugbounty #bugbountytips #cybersecurity](https://twitter.com/NandanLohitaksh/status/1551095128575553537) -- SAP Blogs - - [How to add/extend Smart Links in different Fiori Application Models](https://blogs.sap.com/2022/07/24/how-to-add-extend-smart-links-in-different-fiori-application-models/) -- Reverse Engineering - - [The End of PPLdump](https://www.reddit.com/r/ReverseEngineering/comments/w719s0/the_end_of_ppldump/) - - [A fast STM32 emulator implemented in Rust](https://www.reddit.com/r/ReverseEngineering/comments/w77vvf/a_fast_stm32_emulator_implemented_in_rust/) -- Didier Stevens - - [Update: re-search.py Version 0.0.21](https://blog.didierstevens.com/2022/07/24/update-re-search-py-version-0-0-21/) -- KitPloit - PenTest & Hacking Tools - - [Doenerium - Fully Undetected Grabber (Grabs Wallets, Passwords, Cookies, Modifies Discord Client Etc.)](http://www.kitploit.com/2022/07/doenerium-fully-undetected-grabber.html) -- 看雪学院 - - [恭喜ID[飞翔的猫咪]获看雪安卓应用安全能力认证高级安全工程师！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458969&idx=1&sn=0d7dfd462114c9648629a110686896f6&chksm=b18e2bd386f9a2c5bd6a5cd6105ae39caec3092fa6a07d7b617eab768f9aa1de1a1cd5f23739&scene=58&subscene=0#rd) - - [《安卓高级研修班》推出【看雪安卓应用安全能力认证】证书](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458458969&idx=2&sn=d1669d8eed5c67f4835f944acc6bcd27&chksm=b18e2bd386f9a2c502191f1eefde75f40bef93bef65860ba2043eb4c373f9be2f173f2b79019&scene=58&subscene=0#rd) -- Twitter @hakivvi - - [RT Clément Labro: The July 2022 update of Windows 10/11 killed PPLdump 💀😢 Find out how in this blog post... 👉](https://twitter.com/itm4n/status/1551209957424615426) -- 青衣十三楼飞花堂 - - [cby的日常(before 2022.6.30)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486058&idx=1&sn=bcc456a557d110c38d5da3a3c7443090&chksm=fab2c955cdc54043975e45810716cd81a41a0311359ae8a5e940793cc859cf0f42f4027a6466&scene=58&subscene=0#rd) -- 互联网安全内参 - - [攻击面管理：2022年为何成为主流？](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504620&idx=1&sn=2a67bf7899f1670ffc8de3d7caccd03c&chksm=ebfa95ccdc8d1cda5d4111754aa8710e0574dae718ad061e07739b40fa9a26a2c7b8ba3894f3&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报评估】朝鲜的军事能力](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511450&idx=1&sn=a4fe539600a4ead54b10ee684c7dc066&chksm=8716b611b0613f076ed12d8c693ad6b1fb9cd49b666e8215e5f3b023d1ed95d72bee5b9546a5&scene=58&subscene=0#rd) - - [国际刑警组织通知解释](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650511450&idx=2&sn=903b5c771bb7f768c73a8ecc60da0e5d&chksm=8716b611b0613f0764cc08f56422ebcc6225ef67fe6e4b9bcbb4cb2a251b843131efa69f9d92&scene=58&subscene=0#rd) -- 中国信息安全 - - [聚焦 | 第五届数字中国建设峰会在福州开幕](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162541&idx=1&sn=cbbd69190e58d855ec51cc5f8fa29542&chksm=8b5ee614bc296f029302976eaf54a0d79cf3bf4b1642261f4e437b1ee507e5b787f406e83366&scene=58&subscene=0#rd) - - [《数字中国发展报告（2021年）》正式发布](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162541&idx=2&sn=953094c78802e3b8c7d2e230d64d3712&chksm=8b5ee614bc296f0220571da7018a5393452ab1e02c7be0a5c1b6f5da3099501854ac41036d09&scene=58&subscene=0#rd) -- 极客公园 - - [大众 CEO 迪斯辞职，曾主导电气化改革；iPhone 14 或取消 SIM 卡槽；漫威开发「灭霸手套」，售价上亿｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652961334&idx=1&sn=754e8743bb8f5ba321b0cceec3a8a4b8&chksm=7e55878049220e96f2728c7433e7c0108bc5bcf85f5afb750e1d5db95859028e3b07eed47431&scene=58&subscene=0#rd) - - [科技新趋势：智能驾驶、区块链、3D 传感与工业外骨骼机器人](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652961334&idx=2&sn=3d2464625d4214906e764169aa5e3b86&chksm=7e55878049220e96d38e3eca96bfc5afec90a7dd7f5979bf8e9609b5972ae33a1fa5fd3a4bc8&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-26.md b/archive/2022/2022-07-26.md deleted file mode 100644 index 829aa9ea67..0000000000 --- a/archive/2022/2022-07-26.md +++ /dev/null @@ -1,167 +0,0 @@ -# 每日安全资讯（2022-07-26） - -- HackerOne Hacker Activity - - [Node.js - DLL Hijacking on Windows](https://hackerone.com/reports/1636566) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Patlite 1.46 Buffer Overflow](https://cxsecurity.com/issue/WLB-2022070068) - - [Marty Marketplace Multi Vendor Ecommerce Script 1.2 SQL Injection](https://cxsecurity.com/issue/WLB-2022070067) -- Microsoft Security Blog - - [Discover 5 lessons Microsoft has learned about compliance management](https://www.microsoft.com/security/blog/2022/07/25/discover-5-lessons-microsoft-has-learned-about-compliance-management/) -- 安全客-有思想的安全新媒体 - - [内网--端口转发以及端口复用](https://www.anquanke.com/post/id/276710) - - [CVE-2022-33980 Apache Commons Configuration 远程命令执行漏洞分析](https://www.anquanke.com/post/id/276734) - - [诉讼史上第一起加密货币内幕交易案即将开庭](https://www.anquanke.com/post/id/276897) -- Envato Tuts+ Code - Mobile Development - - [Android From Scratch: Creating Styles and Themes](https://code.tutsplus.com/tutorials/android-from-scratch-creating-styles-and-themes--cms-26942) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [KCon 2022 大会亮点及议程大揭秘！](https://www.4hou.com/posts/mX7G) - - [Pretender——通过 DHCPv6 DNS、LLMNR、NetBIOS-NS 欺骗等手段实现中间人劫持的工具](https://www.4hou.com/posts/yk6n) - - [国产MiCODUS GPS车载定位器多安全漏洞，影响全球150万车辆](https://www.4hou.com/posts/03AL) - - [海云安-行业动态 | 数据出境安全制度的要点解读](https://www.4hou.com/posts/4KWx) - - [IP地址分类及范围](https://www.4hou.com/posts/kM66) -- 跳跳糖 - 安全与分享社区 - - [CVE–2019–8985 Netis WF2411 RCE 详细解析](https://tttang.com/archive/1672/) -- Recent Commits to cve:main - - [Update Mon Jul 25 11:30:17 UTC 2022](https://github.com/trickest/cve/commit/a86b558fe18c3d709b4685b7883f5c0558969e63) -- unSafe.sh - 不安全 - - [江西周某炫富：怪不得你在负重前行，原来是有人骑在你头上岁月静好](https://buaq.net/go-119247.html) - - [Malware spent months hoovering up credit card details from 300 US restaurants](https://buaq.net/go-119207.html) - - [Cloud Security Handbook](https://buaq.net/go-119214.html) - - [Fortune Names SentinelOne a Top Workplace for Millennials | Sentinels Share Why They Agree](https://buaq.net/go-119212.html) - - [Tomcat WebSocket内存马原理浅析](https://buaq.net/go-119203.html) - - [hw中无视杀软使用远控工具进行横向移动Tips](https://buaq.net/go-119204.html) - - [IAM-Deescalate: An Open Source Tool to Help Users Reduce the Risk of Privilege Escalation](https://buaq.net/go-119202.html) - - [Bpflock - eBPF Driven Security For Locking And Auditing Linux Machines](https://buaq.net/go-119188.html) - - [Lightning Framework, modular Linux malware](https://buaq.net/go-119182.html) -- 先知安全技术社区 - - [Tomcat WebSocket内存马原理浅析](https://xz.aliyun.com/t/11566) -- Security Boulevard - - [Why Your Code Signing Policies Are Being Ignored](https://securityboulevard.com/2022/07/why-your-code-signing-policies-are-being-ignored/) - - [BSidesSF 2022 – Dmitriy Beryoza’s ‘Log In Your Own Eye – Exploiting A Stealthy C2 Channel In Azure Logging Infrastructure’](https://securityboulevard.com/2022/07/bsidessf-2022-dmitriy-beryozas-log-in-your-own-eye-exploiting-a-stealthy-c2-channel-in-azure-logging-infrastructure/) - - [Bridging the security gap in continuous testing and the CI/CD pipeline](https://securityboulevard.com/2022/07/bridging-the-security-gap-in-continuous-testing-and-the-ci-cd-pipeline/) - - [Amid Layoffs and Recessionary Fears, Digital Executive Protection is More Critical Than Ever](https://securityboulevard.com/2022/07/amid-layoffs-and-recessionary-fears-digital-executive-protection-is-more-critical-than-ever/) - - [Microsoft sent you a USB stick – what would you do?](https://securityboulevard.com/2022/07/microsoft-sent-you-a-usb-stick-what-would-you-do/) - - [Finally! Windows to Block Password Guessing — by Default](https://securityboulevard.com/2022/07/finally-windows-to-block-password-guessing-by-default/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 391’](https://securityboulevard.com/2022/07/robert-m-lees-jeff-haas-little-bobby-comic-week-391/) - - [How Automated API Attacks Are the Digital Equivalent of Mockingbirds](https://securityboulevard.com/2022/07/how-automated-api-attacks-are-the-digital-equivalent-of-mockingbirds/) - - [Premier Dating Platform Reduces Fraud by 80% with Arkose Labs](https://securityboulevard.com/2022/07/premier-dating-platform-reduces-fraud-by-80-with-arkose-labs/) - - [Episode 1: Know Your Group, Your Pack, and Your Quarry](https://securityboulevard.com/2022/07/episode-1-know-your-group-your-pack-and-your-quarry/) -- ArthurChiao's Blog - - [Differentiate three types of eBPF redirections (2022)](https://arthurchiao.github.io/blog/differentiate-bpf-redirects/) -- Twitter @Nicolas Krassas - - [Source code for Rust-based info-stealer released on hacker forums](https://twitter.com/Dinosn/status/1551641153157693440) - - [Flaws in FileWave MDM could have allowed hacking +1000 organizzations](https://twitter.com/Dinosn/status/1551636098228649984) - - [hoaxshell: unconventional Windows reverse shell](https://twitter.com/Dinosn/status/1551616627925520387) - - [Qakbot Is Back With a New Trick: DLL Sideloading](https://twitter.com/Dinosn/status/1551616002764464130) - - [Critical Filewave MDM Vulnerabilities Allow Attackers Full Mobile Device Control](https://twitter.com/Dinosn/status/1551609033894797330) - - [DoJ approves Google's acquisition of Mandiant](https://twitter.com/Dinosn/status/1551608795230572545) - - [Hackers exploited PrestaShop zero-day to breach online stores](https://twitter.com/Dinosn/status/1551608500073254913) - - [Lockbit ransomware gang claims to have breached the Italian Revenue Agency](https://twitter.com/Dinosn/status/1551608399586070528) - - [Flaws in Enabot Ebo Air Home Security Robot Allowed Attackers to Spy on Users](https://twitter.com/Dinosn/status/1551607861008105473) - - [Lock down your Neopets account: Data breach being investigated](https://twitter.com/Dinosn/status/1551607794637357056) - - [Experts Uncover New 'CosmicStrand' UEFI Firmware Rootkit Used by Chinese Hackers](https://twitter.com/Dinosn/status/1551607740241412098) - - [Month of PowerShell: Process Threat Hunting, Part 2](https://twitter.com/Dinosn/status/1551518659994083330) - - [Office 365 regional website appears down,](https://twitter.com/Dinosn/status/1551514276099407873) - - [Hacking UK train tickets for fun, but not for profit (MCH2022)](https://twitter.com/Dinosn/status/1551494279121571840) - - [Racoon Stealer is Back — How to Protect Your Organization](https://twitter.com/Dinosn/status/1551494211186335745) - - [Common Security Vulnerabilities in Core AWS Services: Exploitation and Mitigation](https://twitter.com/Dinosn/status/1551492143121842186) - - [ropr: blazing fast multithreaded ROP Gadget finder](https://twitter.com/Dinosn/status/1551490119999393792) - - [Technical Advisory – Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CV...](https://twitter.com/Dinosn/status/1551487481186603008) - - [PART 2: How I Met Your Beacon – Cobalt Strike](https://twitter.com/Dinosn/status/1551486285403103237) -- 安全脉搏 - - [Burpsuite技巧之MD5加密密码爆破、带验证码爆破](https://www.secpulse.com/archives/184141.html) - - [实战|某次红蓝对抗之Solr-RCE实战绕过](https://www.secpulse.com/archives/184114.html) - - [某知名OA高版本getshell思路](https://www.secpulse.com/archives/184090.html) -- Sploitus.com Exploits RSS Feed - - [Marty Marketplace Multi Vendor Ecommerce Script 1.2 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167796&utm_source=rss&utm_medium=rss) - - [Patlite 1.46 Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:167797&utm_source=rss&utm_medium=rss) - - [Exploit for Type Confusion in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=AEB0F5A5-E56A-5496-A431-5B7650A28B86&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=7E9D2224-5410-5B9B-902F-2292B3099682&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Input Validation in Rocket.Chat exploit](https://sploitus.com/exploit?id=ACA8C836-16BA-58BA-BC3F-EDB9171B9895&utm_source=rss&utm_medium=rss) -- 先知安全技术社区 - - [Tomcat WebSocket内存马原理浅析](https://xz.aliyun.com/t/11566) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5530-1](https://packetstormsecurity.com/files/167799/USN-5530-1.txt) - - [Logwatch 7.7](https://packetstormsecurity.com/files/167798/logwatch-7.7.tar.gz) - - [Patlite 1.46 Buffer Overflow](https://packetstormsecurity.com/files/167797/CVE-2022-35911.sh.txt) - - [Marty Marketplace Multi Vendor Ecommerce Script 1.2 SQL Injection](https://packetstormsecurity.com/files/167796/mmves12-sql.txt) - - [VMware Security Advisory 2021-0025.3](https://packetstormsecurity.com/files/167795/VMSA-2021-0025-3.txt) -- Forcepoint - - [Ukraine and Beyond: A ‘To The Point Cybersecurity’ Podcast Recap](https://www.forcepoint.com/blog/insights/to-the-point-cybersecurity-podcast-cant-miss-episodes) -- Current Posts - Red Team Journal - - [Manage Your ‘Free Cells’ Mindfully](https://www.redteamjournal.com/blog/manage-free-cells) -- Securelist - - [CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit](https://securelist.com/cosmicstrand-uefi-firmware-rootkit/106973/) -- SpiderLabs Blog from Trustwave - - [Want To Become A Red teamer? This Is What You Need To Know](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/want-to-become-a-red-teamer-this-is-what-you-need-to-know/) -- Didier Stevens - - [Quickpost: Standby Power Consumption Of My USB Chargers (120V vs 230V)](https://blog.didierstevens.com/2022/07/25/quickpost-standby-power-consumption-of-my-usb-chargers-120v-vs-230v/) -- Toooold - - [Measure the unmeasurable: botnet and German tanks](https://toooold.com/2022/07/25/measure_unmeasureable.html) -- blog.avast.com EN - - [AV-Comparatives’ Approved Business Product award: Avast Business takes home the prize](https://blog.avast.com/av-comparatives-approved-business-product-award) -- SAP Blogs - - [SAP Qualtrics Employee Experience User Group – Now Live!](https://blogs.sap.com/2022/07/25/sap-qualtrics-employee-experience-user-group-now-live/) - - [How to configure SSO with Fiori Launchpad and Google IDP](https://blogs.sap.com/2022/07/25/how-to-configure-sso-with-fiori-launchpad-and-google-idp/) - - [How grant-types keep your application secure?](https://blogs.sap.com/2022/07/25/how-grant-types-keep-your-application-secure/) - - [Enable Withholding Tax Rates for Non-Localized Countries/Regions in Business Configuration for SAP Business ByDesign](https://blogs.sap.com/2022/07/25/enable-withholding-tax-rates-for-non-localized-countries-regions-in-business-configuration-for-sap-business-bydesign/) - - [Lot Sizes in Time Series Supply Planning – SAP IBP Explainer Video Series](https://blogs.sap.com/2022/07/25/lot-sizes-in-time-series-supply-planning-sap-ibp-explainer-video-series/) - - [SAP Document and Reporting Compliance: Introducing the Leading Note for Argentina [EN]](https://blogs.sap.com/2022/07/25/sap-document-and-reporting-compliance-introducing-the-leading-note-for-argentina-en/) - - [Some of UI annotations/Local annotations for LROP Fiori application.](https://blogs.sap.com/2022/07/25/some-of-ui-annotations-local-annotations-for-lrop-fiori-application./) - - [Send application/x-www-form-urlencoded data to a HTTP receiver adapter in SAP Cloud Integration to send SMS messages consuming a Twilio API](https://blogs.sap.com/2022/07/25/send-application-x-www-form-urlencoded-data-to-a-http-receiver-adapter-in-sap-cloud-integration-to-send-sms-messages-consuming-a-twilio-api/) -- CCC Event Blog - - [Techis und Ökos gehen mit der Bits & Bäume Konferenz 2022 in die zweite Runde](https://events.ccc.de/2022/07/24/bits-und-baeume/) -- Application Security Blog - - [Bridging the security gap in continuous testing and the CI/CD pipeline](https://www.synopsys.com/blogs/software-security/gartner-critical-capabilities-appsec-continuous-testing/) -- Malwarebytes Labs - - [Lock down your Neopets account: Data breach being investigated](https://blog.malwarebytes.com/cybercrime/2022/07/lock-down-your-neopets-account-now-alleged-data-breach-being-investigated/) - - [Malware spent months hoovering up credit card details from 300 US restaurants](https://blog.malwarebytes.com/awareness/2022/07/magecart-infection/) - - [Lightning Framework, modular Linux malware](https://blog.malwarebytes.com/reports/2022/07/lightning-framework-modular-linux-malware/) - - [Update Google Chrome now! New version includes 11 important security patches](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/07/update-google-chrome-now-new-version-includes-important-security-patches/) - - [A week in security (July 18 – July 24)](https://blog.malwarebytes.com/a-week-in-security/2022/07/a-week-in-security-july-18-2022-july-24-2022/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [How I Got Robbed and Beaten and Illegally Arrested by a Local Troyan Gang in Bulgaria? - Part Two](http://ddanchev.blogspot.com/2022/07/how-i-got-robbed-and-beaten-and.html) -- Intigriti - - [What is a bug bounty platform? And what are the alternatives?](https://blog.intigriti.com/2022/07/25/what-bug-bounty-platform-what-are-alternatives/) -- SentinelOne - - [Fortune Names SentinelOne a Top Workplace for Millennials | Sentinels Share Why They Agree](https://www.sentinelone.com/blog/fortune-names-sentinelone-a-top-workplace-for-millennials-sentinels-share-why-they-agree/) -- Webroot Blog - - [Top 5 Security Trends this Summer: RSA Conference & Black Hat 2022](https://www.webroot.com/blog/2022/07/25/top-5-security-trends-this-summer-rsa-conference-black-hat-2022/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/w7hzf7/rreverseengineerings_weekly_questions_thread/) - - [CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit](https://www.reddit.com/r/ReverseEngineering/comments/w7tkwg/cosmicstrand_the_discovery_of_a_sophisticated/) - - [VMProtect's Anti Debugging Techniques](https://www.reddit.com/r/ReverseEngineering/comments/w80rs6/vmprotects_anti_debugging_techniques/) -- print("") - - [记一次PHP文件上传WAF+沙盒绕过](https://www.o2oxy.cn/4095.html) -- The Daily Swig | Cybersecurity news and views - - [Cisco patches dangerous bug trio in Nexus Dashboard](https://portswigger.net/daily-swig/cisco-patches-dangerous-bug-trio-in-nexus-dashboard) - - [Adversarial attacks can cause DNS amplification, fool network defense systems, machine learning study finds](https://portswigger.net/daily-swig/adversarial-attacks-can-cause-dns-amplification-fool-network-defense-systems-machine-learning-study-finds) -- KitPloit - PenTest & Hacking Tools - - [Bpflock - eBPF Driven Security For Locking And Auditing Linux Machines](http://www.kitploit.com/2022/07/bpflock-ebpf-driven-security-for.html) -- Security Uncorked - - [WiFi Security: The 3 Types of WiFi Networks](https://securityuncorked.com/2022/07/wifi-security-the-3-types-of-wifi-networks/) -- Checkmarx.com - - [Checkmarx Launches Global Managed Security Service Provider (MSSP) Program](https://checkmarx.com/press-releases/checkmarx-launches-global-managed-security-service-provider-mssp-program/) -- 安全客 - - [【技术分享】Tomcat 内存马技术分析（一）—— Filter型](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774376&idx=1&sn=5273159548ea223775dd3d14528e8f3a&chksm=88936947bfe4e0517c1d025d4f3fff754a5e4b907dba94a0189e4591d90dbd672d7c32a92896&scene=58&subscene=0#rd) - - [【安全头条】诉讼史上第一起加密货币内幕交易案即将开庭](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774376&idx=2&sn=6b6d53d0ee5d0227fb39150a795d6a8a&chksm=88936947bfe4e05168ba5cbfd91da9a47f6bfde7180c348787075ad1159119b5e0a382ef2328&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (07.18-07.24)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491183&idx=1&sn=b62d27cb82ba1f559791262d22dd4296&chksm=fe251b6ec952927839d7930c65b85de4cc2977165ca31ac7ac116668ae33e8157352cc711c13&scene=58&subscene=0#rd) - - [安全日报（2022.07.25）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491183&idx=2&sn=58602d80f887d5036884b87faa29a453&chksm=fe251b6ec9529278393342fbae2f3fb36951a3312080a9bc302a40bc976b34162d4791101d3c&scene=58&subscene=0#rd) -- 中国信息安全 - - [倾情推出 |《中国信息安全》“企业成长计划”！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162643&idx=1&sn=fcc4f3a6047a0c2f4e4cc0181243ee18&chksm=8b5ee7aabc296ebc7c8c9b145f16e6a5cf8316143db3edce69f2a312214d50a00f65d775198d&scene=58&subscene=0#rd) - - [评论 | 依法处罚滴滴，让互联网企业在规范中获得更长远发展](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162643&idx=2&sn=8079f311410af1b06c61686ecedc6e8b&chksm=8b5ee7aabc296ebcaf950062f7284e44203f68b571c29163382dce3ae8162b27e73d595a09d9&scene=58&subscene=0#rd) - - [公安部：不断提升我国网络安全和数据安全保护能力 保护数字经济发展](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162643&idx=3&sn=b7bb28e2e653df4b79f1e27584f42bbc&chksm=8b5ee7aabc296ebceb6abf6e269e141e12fefe668c9202837b95fa63654b16c2acfd2cb3b061&scene=58&subscene=0#rd) - - [赵立坚列举美国监听帝国又一例证](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162643&idx=4&sn=73effee2dea1f2b6e9af96952679495c&chksm=8b5ee7aabc296ebc724ad0fd2b35fd0d49b9b046dbaf4411e72e70a58f17c947203bb334d7b6&scene=58&subscene=0#rd) - - [工信部：加强手机等移动智能终端技术规范引导，持续做好未成年人网络保护相关工作](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162643&idx=5&sn=2079857ce6490cad96f543241380dcb5&chksm=8b5ee7aabc296ebcfb771346b3a2751b886354f3323993f56f371cf1a23fd6353897d226f5c2&scene=58&subscene=0#rd) - - [关注 | 国家网信办发布第九批境内区块链信息服务名称及备案编号](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664162643&idx=6&sn=c9c59485e3d8c1de074fe772e382b731&chksm=8b5ee7aabc296ebc388ec2d7b8099cc2ae3f9a956368e2fce31cf5ca89e71ff6fc144cf366b1&scene=58&subscene=0#rd) -- 安全牛 - - [下一代终端安全管理的关键特征与应用趋势](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116329&idx=1&sn=5bc72fbd94767475054d1f533f998c4d&chksm=bd1463fa8a63eaecd74f51605796190096b129b65b070805a9bd418716780d7c895f25881b69&scene=58&subscene=0#rd) - - [安全头条 | 公安部网安局召开全国网安部门“百日行动”推进会；苹果紧急发布macOS和iOS安全补丁](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116329&idx=2&sn=0685d7b09b99bf529bd7df0c173d78e1&chksm=bd1463fa8a63eaec0e6fb55863a09953f42728f388904d8da262f12369e3f60aa7cffcc964bd&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（35期）：LINUX应急响应](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116329&idx=3&sn=0fe27159f5c20bcdf1f944b06e622ee0&chksm=bd1463fa8a63eaecf802cdbe313990ad9d134ec37431e6aaba1725423cacddfe7972f100e790&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】公安部“净网”专项行动：行政处罚 16.2 万家互联网企业](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652008338&idx=1&sn=dcd01e386cb4debc599249c4d247c79d&chksm=f36f43d2c418cac40e6dea7848683eb4b7ab4711c6d6e870a26270469e85a1b272c9d4f7761a&scene=58&subscene=0#rd) - - [【安全圈】关停“外挂”网站30余个！警方连破3起涉黑客攻击犯罪案](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652008338&idx=2&sn=0ca71bba419913aba50d588717ebfee1&chksm=f36f43d2c418cac4391b5871f21f37366266d289f75a7fcae90269712cd77220a9abe11215d2&scene=58&subscene=0#rd) - - [【安全圈】网络攻击愈演愈烈，网络安全人才培养刻不容缓](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652008338&idx=3&sn=ed253e726b9d1d337f8df22f006045d9&chksm=f36f43d2c418cac4b0342c7d02f24f05e664b88a898e86a9fe265518970921480c641e80ecac&scene=58&subscene=0#rd) - - [【安全圈】加拿大惨遭勒索软件攻击，要求支付赎金隐私数据或泄露](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652008338&idx=4&sn=09e2573f0efac8867543bac4a16ee7b3&chksm=f36f43d2c418cac43056890a9831a55a07704c03947b6614c7f27371269fa536ec848b770128&scene=58&subscene=0#rd) - - [【安全圈】研究人员警告 谷歌浏览器在野外出现新变种](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652008338&idx=5&sn=95cdc077ce738695cdf0393ffa63cba7&chksm=f36f43d2c418cac4fa08cb33827f31c046ce8c485d59e443d1aeadebae4f1d2b7fe251aa29d4&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-27.md b/archive/2022/2022-07-27.md deleted file mode 100644 index a2943ed016..0000000000 --- a/archive/2022/2022-07-27.md +++ /dev/null @@ -1,165 +0,0 @@ -# 每日安全资讯（2022-07-27） - -- Trustwave Blog - - [6 Top Cloud Security Problems – from a GRC consultant’s perspective](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/6-top-cloud-security-problems-from-a-grc-consultants-perspective/) -- Snowming04's Blog - - [为什么 Venus protocol Governance 不会受到闪电贷的影响](http://snowming.me/2022/07/26/venus-protocol-governance-flashloan-analysis/) -- HackerOne Hacker Activity - - [Race condition in faucet when using starport](https://hackerone.com/reports/1438052) -- Recent Commits to cve:main - - [Update Tue Jul 26 11:33:40 UTC 2022](https://github.com/trickest/cve/commit/9b52d59646a06570b54462cc515e0855cc23d279) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [IOTransfer 4.0 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022070074) - - [Roxy-WI Remote Command Execution](https://cxsecurity.com/issue/WLB-2022070073) - - [Garage Management System 1.0 Shell Upload](https://cxsecurity.com/issue/WLB-2022070072) - - [Hospital Information System 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022070071) - - [PCProtect Endpoint 5.17.470 Tampering / Privilege Escalation](https://cxsecurity.com/issue/WLB-2022070070) - - [Expert X Jobs Portal And Resume Builder 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022070069) -- Security Boulevard - - [Slack for Security – Using Slack as a Security and Privacy LMS](https://securityboulevard.com/2022/07/slack-for-security-using-slack-as-a-security-and-privacy-lms/) - - [XKCD ‘Deepfakes’](https://securityboulevard.com/2022/07/xkcd-deepfakes/) - - [Don’t Overlook DFARS 7012 c-g Incident Reporting Requirements](https://securityboulevard.com/2022/07/dont-overlook-dfars-7012-c-g-incident-reporting-requirements/) - - [BSidesSF 2022 – Carla Sun’s ‘Ooga Booga – Avoiding Reinvention Of The Wheel (Useful Security Tools And Lessons To Know)](https://securityboulevard.com/2022/07/bsidessf-2022-carla-suns-ooga-booga-avoiding-reinvention-of-the-wheel-useful-security-tools-and-lessons-to-know/) - - [AWS Adds More Tools to Secure Cloud Workloads](https://securityboulevard.com/2022/07/aws-adds-more-tools-to-secure-cloud-workloads/) - - [CrowdStrike Expands Reach and Scope of CNAPP Capabilities](https://securityboulevard.com/2022/07/crowdstrike-expands-reach-and-scope-of-cnapp-capabilities/) - - [Firmware Security Realizations – Part 1 – Secure Boot and DBX](https://securityboulevard.com/2022/07/firmware-security-realizations-part-1-secure-boot-and-dbx/) - - [The Top Cyberthreats that SMBs Should Look out for](https://securityboulevard.com/2022/07/the-top-cyberthreats-that-smbs-should-look-out-for/) - - [StringJS Typosquat Deploys Discord Infostealer Obfuscated Five Times](https://securityboulevard.com/2022/07/stringjs-typosquat-deploys-discord-infostealer-obfuscated-five-times/) -- Microsoft Security Blog - - [Malicious IIS extensions quietly open persistent backdoors into servers](https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/) - - [How one Microsoft product manager acts as champion for identity security](https://www.microsoft.com/security/blog/2022/07/26/how-one-microsoft-product-manager-acts-as-champion-for-identity-security/) -- Files ≈ Packet Storm - - [Roxy-WI Remote Command Execution](https://packetstormsecurity.com/files/167805/roxy_wi_exec.rb.txt) - - [Ubuntu Security Notice USN-5532-1](https://packetstormsecurity.com/files/167804/USN-5532-1.txt) - - [Hospital Information System 1.0 SQL Injection](https://packetstormsecurity.com/files/167803/his10-sql.txt) - - [Garage Management System 1.0 Shell Upload](https://packetstormsecurity.com/files/167802/gms10-shell.txt) - - [Expert X Jobs Portal And Resume Builder 1.0 SQL Injection](https://packetstormsecurity.com/files/167801/expertxjprb10-sql.txt) - - [PCProtect Endpoint 5.17.470 Tampering / Privilege Escalation](https://packetstormsecurity.com/files/167800/pcprotectep517470-escalate.txt) -- Sploitus.com Exploits RSS Feed - - [Roxy-WI Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167805&utm_source=rss&utm_medium=rss) - - [Expert X Jobs Portal And Resume Builder 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37855&utm_source=rss&utm_medium=rss) - - [Garage Management System 1.0 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:167802&utm_source=rss&utm_medium=rss) - - [Marty Marketplace Multi Vendor Ecommerce Script 1.2 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37854&utm_source=rss&utm_medium=rss) - - [Expert X Jobs Portal And Resume Builder 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167801&utm_source=rss&utm_medium=rss) - - [WordPress Plugin Visual Slide Box Builder 3.2.9 - SQLi exploit](https://sploitus.com/exploit?id=EDB-ID:50980&utm_source=rss&utm_medium=rss) - - [Roxy-WI Remote Command Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37859&utm_source=rss&utm_medium=rss) - - [Hospital Information System 1.0 SQL Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37857&utm_source=rss&utm_medium=rss) - - [PCProtect Endpoint 5.17.470 Tampering / Privilege Escalation Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37856&utm_source=rss&utm_medium=rss) - - [PCProtect Endpoint 5.17.470 Tampering / Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:167800&utm_source=rss&utm_medium=rss) - - [Hospital Information System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167803&utm_source=rss&utm_medium=rss) - - [Garage Management System 1.0 Shell Upload Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37858&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-31181 exploit](https://sploitus.com/exploit?id=E8928D90-57ED-5A6A-9CEF-82114C097DAC&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-2466 exploit](https://sploitus.com/exploit?id=9FE0E53F-98EC-58DF-A8D1-B0F7047FF1AE&utm_source=rss&utm_medium=rss) - - [Exploit for OS Command Injection in Openssl exploit](https://sploitus.com/exploit?id=90D0B73F-6288-58DF-893E-AE5DD3207FA3&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Rarlab Unrar exploit](https://sploitus.com/exploit?id=4E2B73A6-1A0A-5AE6-A7D0-44663A8164FC&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-07-26 Review](http://www.sec-wiki.com/?2022-07-26) -- 跳跳糖 - 安全与分享社区 - - [pem类文件解析及2022蓝帽杯crypto详解](https://tttang.com/archive/1670/) -- Twitter @Nicolas Krassas - - [Zyxel authentication bypass patch analysis (CVE-2022-0342)](https://twitter.com/Dinosn/status/1551995818034470913) - - [US raises reward for tips on North Korean hackers to $10 million](https://twitter.com/Dinosn/status/1551995467629723648) - - [SonicWall urges customers to patch critical SQL injection bug ASAP](https://twitter.com/Dinosn/status/1551995352953376769) - - [Hackers Increasingly Using WebAssembly Coded Cryptominers to Evade Detection](https://twitter.com/Dinosn/status/1551995210074292224) - - [Hackers steal $6 million from blockchain music platform Audius](https://twitter.com/Dinosn/status/1551995142902616064) - - [Mail Server Misconfiguration leads to sending a fax from anyone’s account on HelloFax (Dropbox BBP)…](https://twitter.com/Dinosn/status/1551995032311414786) - - [Ducktail Spear-Phishing Campaign Uses LinkedIn to Hijack Facebook Business Accounts](https://twitter.com/Dinosn/status/1551994852551835648) - - [Threat actors leverages DLL-SideLoading to spread Qakbot malware](https://twitter.com/Dinosn/status/1551994636440330243) - - [Microsoft: IIS extensions increasingly used as Exchange backdoors](https://twitter.com/Dinosn/status/1551994486800130050) - - [LockBit ransomware gang claims it ransacked Italy’s tax agency](https://twitter.com/Dinosn/status/1551994413752193025) - - [packj: detect malicious/risky open-source software packages](https://twitter.com/Dinosn/status/1551993039438086144) - - [CrackQL: GraphQL password brute-force and fuzzing utility](https://twitter.com/Dinosn/status/1551992991631409153) - - [macOS local security: escaping the sandbox and bypassing TCC (MCH2022)](https://twitter.com/Dinosn/status/1551991978501496834) - - [How do GPS/Galileo really work & how the](https://twitter.com/Dinosn/status/1551991836885098496) - - [Make URL path combinations using a wordlist](https://twitter.com/Dinosn/status/1551961663016169474) - - [Supercharged Version of Amadey Infostealer & Malware Dropper Bypasses AVs](https://twitter.com/Dinosn/status/1551823191001137152) - - [Node.js prototype pollution is bad for your app environment](https://twitter.com/Dinosn/status/1551822952362135552) - - [Hackers Exploit PrestaShop Zero-Day to Steal Payment Data from Online Stores](https://twitter.com/Dinosn/status/1551822839640199168) -- unSafe.sh - 不安全 - - [SonicWall urges customers to patch critical SQL injection bug ASAP](https://buaq.net/go-119400.html) - - [Celebrating 10 Years of Cobalt Strike](https://buaq.net/go-119399.html) - - [Microsoft clamps down on RDP brute-force attacks in Windows 11](https://buaq.net/go-119401.html) - - [timwhitez starred ZentaoSqli](https://buaq.net/go-119396.html) - - [记忆熊（RememBear）将于2023年7月18日关闭服务](https://buaq.net/go-119394.html) - - [DUCKTAIL: An infostealer malware targeting Facebook Business accounts](https://buaq.net/go-119382.html) - - [How to analyze Linux malware – A case study of Symbiote](https://buaq.net/go-119381.html) - - [State of the Art of Ethereum Smart Contract Fuzzing in 2022 [EthCC5]](https://buaq.net/go-119383.html) - - [Laurel - Transform Linux Audit Logs For SIEM Usage](https://buaq.net/go-119373.html) - - ['Cancer Girl' scam has stolen more than half a million dollars](https://buaq.net/go-119371.html) - - [IW Weekly #11: Hacking Nginx, eJPT2.0, Free Hacking Resources, OWASP API, and more](https://buaq.net/go-119372.html) - - [为什么会有这么多编程语言？](https://buaq.net/go-119403.html) - - [Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Reponse Report](https://buaq.net/go-119368.html) - - [少数派会员第二季正式上线，现在加入可享超值优惠](https://buaq.net/go-119350.html) - - [Zyxel authentication bypass patch analysis (CVE-2022-0342)](https://buaq.net/go-119354.html) - - [关于 Coremail windows邮箱客户端（Air 版）特定附件名显示不正确问题的说明](https://buaq.net/go-119352.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [关于 Coremail windows 邮箱客户端（Air 版）特定附件名显示不正确问题的说明](https://www.4hou.com/posts/jJAP) - - [权威推荐！腾讯安全DDoS边缘安全产品获国际研究机构Omdia认可](https://www.4hou.com/posts/vJm5) - - [某知名OA高版本getshell思路（附部分脚本）](https://www.4hou.com/posts/wgn8) - - [八月如火，这一场“网络安全饕餮盛宴”与您不见不散](https://www.4hou.com/posts/gX7G) - - [Luna 和 Black Basta——适用于 Windows、Linux 和 ESXi 的新型勒索软件](https://www.4hou.com/posts/3JYR) - - [黑客出售540万推特账号数据](https://www.4hou.com/posts/jJAv) - - [流行的ICS平台的关键漏洞可能触发RCE](https://www.4hou.com/posts/mXZE) - - [攻防演练 | 观成瞰云有效检出冰蝎4.0加密流量](https://www.4hou.com/posts/r7gp) -- 安全脉搏 - - [关于 Coremail windows邮箱客户端（Air 版）特定附件名显示不正确问题的说明](https://www.secpulse.com/archives/184225.html) - - [红队防猝死手册](https://www.secpulse.com/archives/184212.html) - - [什么？你还不会webshell免杀？（二）](https://www.secpulse.com/archives/184170.html) - - [CVE-2022-33891 Apache spark shell 命令注入漏洞复现](https://www.secpulse.com/archives/184149.html) -- 安全客-有思想的安全新媒体 - - [AI在莫斯科国际象棋比赛压断对手手指](https://www.anquanke.com/post/id/276966) -- Sucuri Blog - - [DHL Phishing Page Uses Telegram Bot for Exfiltration](https://blog.sucuri.net/2022/07/dhl-phishing-page-uses-telegram-bot-for-exfiltration.html) -- 先知安全技术社区 - - [记一次授权非域环境下的大型内网横向渗透](https://xz.aliyun.com/t/11579) -- 先知安全技术社区 - - [记一次授权非域环境下的大型内网横向渗透](https://xz.aliyun.com/t/11579) -- MWR Publications - - [DUCKTAIL: An infostealer malware targeting Facebook Business accounts](https://labs.withsecure.com/publications/ducktail/) -- Pentest Blog - - [Advisory | Roxy-WI Unauthenticated Remote Code Executions CVE-2022-31137](https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137/) -- hn security - - [Zyxel authentication bypass patch analysis (CVE-2022-0342)](https://security.humanativaspa.it/zyxel-authentication-bypass-patch-analysis-cve-2022-0342/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Basics of OSINT in the Context of Fighting Cybercrime - The Definite Beginner's Guide](http://ddanchev.blogspot.com/2022/07/basics-of-osint-in-context-of-fighting.html) -- blog.avast.com EN - - ['Cancer Girl' scam has stolen more than half a million dollars](https://blog.avast.com/cancer-girl-scam) - - [New Magecart campaigns target online ordering sites](https://blog.avast.com/magecart-campaigns-online-ordering) -- Malwarebytes Labs - - [SonicWall urges customers to patch critical SQL injection bug ASAP](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/07/sonicwall-urges-clients-to-patch-critical-sql-injection-bug-asap/) - - [Microsoft clamps down on RDP brute-force attacks in Windows 11](https://blog.malwarebytes.com/cybercrime/2022/07/microsoft-clamps-down-on-rdp-brute-force-attacks-in-windows-11/) - - [Demo: Your data has been encrypted! Stopping ransomware attacks with Malwarebytes EDR](https://blog.malwarebytes.com/business/2022/07/demo-your-data-has-been-encrypted-stopping-ransomware-attacks-with-malwarebytes-edr/) -- Bug Bounty in InfoSec Write-ups on Medium - - [IW Weekly #11: Hacking Nginx, eJPT2.0, Free Hacking Resources, OWASP API, and more](https://infosecwriteups.com/iw-weekly-11-hacking-nginx-ejpt2-0-free-hacking-resources-owasp-api-and-more-642045883c0?source=rss----7b722bfd1b8d--bug_bounty) - - [Mail Server Misconfiguration leads to sending a fax from anyone’s account on HelloFax (Dropbox BBP)…](https://infosecwriteups.com/mail-server-misconfiguration-leads-to-sending-a-fax-from-anyones-account-on-hellofax-dropbox-bbp-aab3d97ab4e7?source=rss----7b722bfd1b8d--bug_bounty) -- Sucuri Blog - - [DHL Phishing Page Uses Telegram Bot for Exfiltration](https://blog.sucuri.net/2022/07/dhl-phishing-page-uses-telegram-bot-for-exfiltration.html) -- Intigriti - - [Security is a continuous process. Here’s why your testing process should be too](https://blog.intigriti.com/2022/07/26/security-continuous-process-why-testing-process-should-be-too/) -- SAP Blogs - - [SAPinsider 2022; What happens in Vegas should NOT stay in Vegas!](https://blogs.sap.com/2022/07/26/sapinsider-2022-what-happens-in-vegas-should-not-stay-in-vegas/) - - [SAP Fiori – Using Launchpad Content Aggregator (/N/UI2/FLPCA) to create Fiori Text Matrix in Excel using Custom Business Roles](https://blogs.sap.com/2022/07/26/sap-fiori-using-launchpad-content-aggregator-n-ui2-flpca-to-create-fiori-text-matrix-in-excel-using-custom-business-roles/) - - [On Boarding already in the Customer Experience Value map](https://blogs.sap.com/2022/07/26/on-boarding-already-in-the-customer-experience-value-map/) - - [New openSAP course on SAP Screen Personas for SAP S/4HANA Cloud](https://blogs.sap.com/2022/07/26/new-opensap-course-on-sap-screen-personas-for-sap-s-4hana-cloud/) - - [Custom Database Refresh (Oracle) with SAP Landscape Management (LaMa)](https://blogs.sap.com/2022/07/26/custom-database-refresh-oracle-with-sap-landscape-management-lama/) - - [SAP S/4HANA Key User Extensibility powered by Embedded Steampunk: Custom Field with ABAP implemented Value Help](https://blogs.sap.com/2022/07/26/sap-s-4hana-key-user-extensibility-powered-by-embedded-steampunk-custom-field-with-abap-implemented-value-help/) - - [Fieldglass Features: #2 – Advisor Reports](https://blogs.sap.com/2022/07/26/fieldglass-features-2-advisor-reports/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-07-25 - IcedID (Bokbot) infection with Cobalt Strike](https://www.malware-traffic-analysis.net/2022/07/25/index.html) -- Reverse Engineering - - [How to analyze Linux malware – A case study of Symbiote](https://www.reddit.com/r/ReverseEngineering/comments/w8kn5a/how_to_analyze_linux_malware_a_case_study_of/) - - [Zyxel authentication bypass patch analysis (CVE-2022-0342)](https://www.reddit.com/r/ReverseEngineering/comments/w8ff3w/zyxel_authentication_bypass_patch_analysis/) - - [SIGMA vs Indicators of Compromise (IOCs)](https://www.reddit.com/r/ReverseEngineering/comments/w8ohge/sigma_vs_indicators_of_compromise_iocs/) -- The Daily Swig | Cybersecurity news and views - - [FileWave MDM authentication bypass bugs expose managed devices to hijack risk](https://portswigger.net/daily-swig/filewave-mdm-authentication-bypass-bugs-expose-managed-devices-to-hijack-risk) - - [Critical security vulnerability in Grails could lead to remote code execution](https://portswigger.net/daily-swig/critical-security-vulnerability-in-grails-could-lead-to-remote-code-execution) - - [Cloud fax company claims healthcare pros are ditching email for ‘more secure’ fax](https://portswigger.net/daily-swig/cloud-fax-company-claims-healthcare-pros-are-ditching-email-for-more-secure-fax) -- Black Hills Information Security - - [Impacket Defense Basics With an Azure Lab](https://www.blackhillsinfosec.com/impacket-defense-basics-with-an-azure-lab/) -- Twitter @Keiran Smith (Affix) - - [Sold my Audi A3 with @CazooUK what a breeze will totally recommend to anyone](https://twitter.com/cli/status/1551910960838967301) - - [apparently @AdmiralUK won't let me change an insurance policy on a car I pay for, I pay the insurance for and I'm the registered keeper and policy adm...](https://twitter.com/cli/status/1551910707142295554) -- Blog - Praetorian - - [Anatomy of an Automotive Security Assessment](https://www.praetorian.com/blog/automotive-security-assessment-anatomy/) -- KitPloit - PenTest & Hacking Tools - - [Laurel - Transform Linux Audit Logs For SIEM Usage](http://www.kitploit.com/2022/07/laurel-transform-linux-audit-logs-for.html) diff --git a/archive/2022/2022-07-28.md b/archive/2022/2022-07-28.md deleted file mode 100644 index f58653e22c..0000000000 --- a/archive/2022/2022-07-28.md +++ /dev/null @@ -1,164 +0,0 @@ -# 每日安全资讯（2022-07-28） - -- HackerOne Hacker Activity - - [HTML Injection via Email Share](https://hackerone.com/reports/1490311) -- Twitter @Nicolas Krassas - - [UAC bypass, Elevate, Persistence methods](https://twitter.com/Dinosn/status/1552330428878577664) - - [Microsoft: Windows, Adobe zero-days used to deploy Subzero malware](https://twitter.com/Dinosn/status/1552314169248055296) - - [Anti-vaxxer dating site exposes user data](https://twitter.com/Dinosn/status/1552313974716305409) - - [These 28+ Android Apps with 10 Million Downloads from the Play Store Contain Malware](https://twitter.com/Dinosn/status/1552313829756919811) - - [How a Race Condition made these crypto hackers $5000 bug bounty](https://twitter.com/Dinosn/status/1552264055779377160) - - [Weak data protection helped China attack US Federal Reserve, report says](https://twitter.com/Dinosn/status/1552244375245185026) - - [Re @wimremes Listening…](https://twitter.com/Dinosn/status/1552168234857766912) - - [Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, I...](https://twitter.com/Dinosn/status/1552160320415834112) - - [Advisory | Roxy-WI Unauthenticated Remote Code Executions CVE-2022-31137](https://twitter.com/Dinosn/status/1552144621689528327) - - [How to analyze Linux malware – A case study of Symbiote](https://twitter.com/Dinosn/status/1552144491666198534) - - [European Cops Helped 1.5 Million Decrypt Ransomwared Computers](https://twitter.com/Dinosn/status/1552144415271145472) - - [Hunting For Mass Assignment Vulnerabilities Using GitHub CodeSearch and](https://twitter.com/Dinosn/status/1552144110194200576) - - [Around the world in 80 networks, Hacking Universities Worldwide. ( ...lessons learned at age 15. ) (MCH2022)](https://twitter.com/Dinosn/status/1552144040824561664) - - [Hackers scan for vulnerabilities within 15 minutes of disclosure](https://twitter.com/Dinosn/status/1552143920989196288) - - [Discord, Telegram Services Hijacked to Launch Array of Cyberattacks](https://twitter.com/Dinosn/status/1552143862524772353) - - [Culture shock: Ransomware gang sacks arts orgs' email lists](https://twitter.com/Dinosn/status/1552143756991905792) - - [RT Blue Team News: Dlinject - Inject A Shared Library (I.E. Arbitrary Code) Into A Live Linux Process, Without Ptrace](https://twitter.com/blueteamsec1/status/1552106888262606849) -- Microsoft Security Blog - - [Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits](https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/) -- 跳跳糖 - 安全与分享社区 - - [基于python的RPC Fuzz寻找可提权函数](https://tttang.com/archive/1678/) -- 安全客-有思想的安全新媒体 - - [收到陌生人转账被要求退回？这种极其隐蔽的诈骗手段又出现了](https://www.anquanke.com/post/id/276114) - - [一文看懂Rad基础操作](https://www.anquanke.com/post/id/277002) - - [海纳百川｜一款开源&在线&免费的容器安全检测平台](https://www.anquanke.com/post/id/276768) - - [重磅官宣|2022 CCS成都网络安全大会定档——云上安全新形态，拥抱数字新未来](https://www.anquanke.com/post/id/277038) - - [2021年大规模数据泄露事件：美国T-Mobile达成5亿美元和解协议](https://www.anquanke.com/post/id/277004) - - [一次不出网上线cs实战案例](https://www.anquanke.com/post/id/276882) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [亚信安全信磐SDP升级而来 4大变化打开零信任准入新局面](https://www.4hou.com/posts/q8A0) - - [一文了解“账号预劫持”（account pre-hijacking）](https://www.4hou.com/posts/oJAX) - - [浅析云原生应用安全组织架构](https://www.4hou.com/posts/6VXN) -- unSafe.sh - 不安全 - - [How to Modernize Vulnerability Management in Today’s Evolving Threat Landscape](https://buaq.net/go-119560.html) - - [Five types of software licenses you need to understand](https://buaq.net/go-119561.html) - - [Looking at Patch Gap Vulnerabilities in the VMware ESXi TCP/IP Stack](https://buaq.net/go-119566.html) - - [Framing without iframes](https://buaq.net/go-119559.html) - - [IIS extensions are on the rise as backdoors to servers](https://buaq.net/go-119541.html) - - [Anti-vaxxer dating site exposes user data](https://buaq.net/go-119542.html) - - [PCI DSS 4.0 – Customized Approach Explained](https://buaq.net/go-119544.html) - - [In post-Roe US, experts share how to keep your data private](https://buaq.net/go-119543.html) - - [⚛️ React 开发最佳实践 - V2EX](https://buaq.net/go-119536.html) - - [Pretender - Your MitM Sidekick For Relaying Attacks Featuring DHCPv6 DNS Takeover As Well As mDNS, LLMNR And NetBIOS-NS Spoofing](https://buaq.net/go-119535.html) - - [PrestaShop warns of vulnerability: Update your stores now!](https://buaq.net/go-119531.html) - - [Simplifying the fight against ransomware: An expert explains](https://buaq.net/go-119532.html) -- Planet Classpath - - [Mark Wielaard: Happy birthday, Valgrind!](https://gnu.wildebeest.org/blog/mjw/2022/07/27/happy-birthday-valgrind/) -- SecWiki News - - [SecWiki News 2022-07-27 Review](http://www.sec-wiki.com/?2022-07-27) -- 先知安全技术社区 - - [某cms代码审计](https://xz.aliyun.com/t/11574) - - [APC进程注入](https://xz.aliyun.com/t/11572) -- Jiajun的编程随想 - - [错误处理实践](https://jiajunhuang.com/articles/2022_07_27-how_to_return_error.md.html) -- Trustwave Blog - - [How to Build a Better and More Secure Supply Chain: A Trustwave Ebook](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/how-to-build-a-better-and-more-secure-supply-chain-a-trustwave-ebook/) -- 安全脉搏 - - [MSSQL注入DNS带外问题解决](https://www.secpulse.com/archives/184293.html) - - [记一次攻防演练中的有趣溯源分析](https://www.secpulse.com/archives/184266.html) - - [什么是Tor？Tor浏览器更新有什么用？](https://www.secpulse.com/archives/184246.html) - - [用于预防勒索软件的 DevSecOps 流程](https://www.secpulse.com/archives/184238.html) - - [Qakbot新型感染链：使用Windows7系统侧加载感染设备](https://www.secpulse.com/archives/184215.html) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-5640-01](https://packetstormsecurity.com/files/167858/RHSA-2022-5640-01.txt) - - [Red Hat Security Advisory 2022-5718-01](https://packetstormsecurity.com/files/167857/RHSA-2022-5718-01.txt) - - [Red Hat Security Advisory 2022-5664-01](https://packetstormsecurity.com/files/167856/RHSA-2022-5664-01.txt) - - [Red Hat Security Advisory 2022-5703-01](https://packetstormsecurity.com/files/167855/RHSA-2022-5703-01.txt) - - [Red Hat Security Advisory 2022-5641-01](https://packetstormsecurity.com/files/167854/RHSA-2022-5641-01.txt) - - [Red Hat Security Advisory 2022-5531-01](https://packetstormsecurity.com/files/167853/RHSA-2022-5531-01.txt) - - [Red Hat Security Advisory 2022-5626-01](https://packetstormsecurity.com/files/167852/RHSA-2022-5626-01.txt) - - [Red Hat Security Advisory 2022-5622-01](https://packetstormsecurity.com/files/167851/RHSA-2022-5622-01.txt) - - [Red Hat Security Advisory 2022-5004-01](https://packetstormsecurity.com/files/167850/RHSA-2022-5004-01.txt) - - [Red Hat Security Advisory 2022-5719-01](https://packetstormsecurity.com/files/167849/RHSA-2022-5719-01.txt) - - [Red Hat Security Advisory 2022-5597-01](https://packetstormsecurity.com/files/167848/RHSA-2022-5597-01.txt) - - [Red Hat Security Advisory 2022-4931-01](https://packetstormsecurity.com/files/167847/RHSA-2022-4931-01.txt) - - [Red Hat Security Advisory 2022-5620-01](https://packetstormsecurity.com/files/167846/RHSA-2022-5620-01.txt) - - [Red Hat Security Advisory 2022-5556-01](https://packetstormsecurity.com/files/167845/RHSA-2022-5556-01.txt) - - [Red Hat Security Advisory 2022-5564-01](https://packetstormsecurity.com/files/167844/RHSA-2022-5564-01.txt) - - [Red Hat Security Advisory 2022-5681-01](https://packetstormsecurity.com/files/167843/RHSA-2022-5681-01.txt) - - [Red Hat Security Advisory 2022-5596-01](https://packetstormsecurity.com/files/167842/RHSA-2022-5596-01.txt) - - [Red Hat Security Advisory 2022-5532-01](https://packetstormsecurity.com/files/167841/RHSA-2022-5532-01.txt) - - [Red Hat Security Advisory 2022-5636-01](https://packetstormsecurity.com/files/167840/RHSA-2022-5636-01.txt) - - [Red Hat Security Advisory 2022-5709-01](https://packetstormsecurity.com/files/167839/RHSA-2022-5709-01.txt) - - [Red Hat Security Advisory 2022-5704-01](https://packetstormsecurity.com/files/167838/RHSA-2022-5704-01.txt) - - [Red Hat Security Advisory 2022-5687-01](https://packetstormsecurity.com/files/167837/RHSA-2022-5687-01.txt) - - [Red Hat Security Advisory 2022-5685-01](https://packetstormsecurity.com/files/167836/RHSA-2022-5685-01.txt) - - [Red Hat Security Advisory 2022-5526-01](https://packetstormsecurity.com/files/167835/RHSA-2022-5526-01.txt) - - [Red Hat Security Advisory 2022-5542-01](https://packetstormsecurity.com/files/167834/RHSA-2022-5542-01.txt) -- Security Boulevard - - [Do you know how many cert-manager instances your developers are using? Are they all using the latest stable version?](https://securityboulevard.com/2022/07/do-you-know-how-many-cert-manager-instances-your-developers-are-using-are-they-all-using-the-latest-stable-version/) - - [The Strategic Impact of Verizon’s 2022 Data Breach Investigations Report](https://securityboulevard.com/2022/07/the-strategic-impact-of-verizons-2022-data-breach-investigations-report/) - - [What’s New with the Arkose Labs Platform: July 2022](https://securityboulevard.com/2022/07/whats-new-with-the-arkose-labs-platform-july-2022/) - - [API inventory: Focusing on runtime code, not never-invoked libraries](https://securityboulevard.com/2022/07/api-inventory-focusing-on-runtime-code-not-never-invoked-libraries/) - - [BSidesSF 2022 – Len Noe’s ‘Biohacker: The Invisible Threat’](https://securityboulevard.com/2022/07/bsidessf-2022-len-noes-biohacker-the-invisible-threat/) - - [How to Secure Financial Services Applications](https://securityboulevard.com/2022/07/how-to-secure-financial-services-applications/) - - [The Top 8 Social Media Scams You Need to Watch Out For](https://securityboulevard.com/2022/07/the-top-8-social-media-scams-you-need-to-watch-out-for/) - - [Threat analysis: Follina exploit fuels ‘live-off-the-land’ attacks](https://securityboulevard.com/2022/07/threat-analysis-follina-exploit-fuels-live-off-the-land-attacks/) - - [The Ultimate Guide to Data Security in the Manufacturing Industry](https://securityboulevard.com/2022/07/the-ultimate-guide-to-data-security-in-the-manufacturing-industry/) - - [Cyber Risk Quantification Time to Value](https://securityboulevard.com/2022/07/cyber-risk-quantification-time-to-value/) -- 先知安全技术社区 - - [某cms代码审计](https://xz.aliyun.com/t/11574) - - [APC进程注入](https://xz.aliyun.com/t/11572) -- Recent Commits to cve:main - - [Update Wed Jul 27 11:36:26 UTC 2022](https://github.com/trickest/cve/commit/f26d4a2dbdb406a84a4c72d662190d4a044c035b) -- Bug Bounty in InfoSec Write-ups on Medium - - [How a Race Condition made these crypto hackers $5000 bug bounty](https://infosecwriteups.com/how-a-race-condition-made-these-crypto-hackers-5000-bug-bounty-a72158a472a8?source=rss----7b722bfd1b8d--bug_bounty) -- Cerbero Blog - - [AbuseCH Intelligence 2.1 Package](https://blog.cerbero.io/?p=2452) -- SAP Blogs - - [Is there really any “Good” in “The Good, the Bad and the Ugly about SAP’s Industry Cloud” Commercialisation Model for SAP Partners?](https://blogs.sap.com/2022/07/27/is-there-really-any-good-in-the-good-the-bad-and-the-ugly-about-saps-industry-cloud-commercialisation-model-for-sap-partners/) - - [SAP Fiori development newsletter July 2022](https://blogs.sap.com/2022/07/27/sap-fiori-development-newsletter-july-2022/) - - [Nota Técnica 2021.004: Tipo e Uso de Veículo, Informação Adicional de Item e Ato Concessório](https://blogs.sap.com/2022/07/27/nota-tecnica-2021.004-tipo-e-uso-de-veiculo-informacao-adicional-de-item-e-ato-concessorio/) - - [Replacement Process in Advanced Returns Management for SAP S/4HANA Cloud](https://blogs.sap.com/2022/07/27/replacement-process-in-advanced-returns-management-for-sap-s-4hana-cloud/) - - [SAP BTP Innobytes – July 2022](https://blogs.sap.com/2022/07/27/sap-btp-innobytes-july-2022/) - - [Moving Analytical content via Transport Management](https://blogs.sap.com/2022/07/27/moving-analytical-content-via-transport-management/) - - [Product Updates for SAP Business Application Studio – Release 2207](https://blogs.sap.com/2022/07/27/product-updates-for-sap-business-application-studio-release-2207/) - - [Common Approach for Time Off Period End Processing Rule](https://blogs.sap.com/2022/07/27/common-approach-for-time-off-period-end-processing-rule/) - - [How to Increase RoI on Cybersecurity Investments](https://blogs.sap.com/2022/07/27/how-to-increase-roi-on-cybersecurity-investments/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-07-26 - Files for an ISC diary (IcedID with DarkVNC and Cobalt Strike)](https://www.malware-traffic-analysis.net/2022/07/26/index.html) -- GuidePoint Security - - [PCI DSS 4.0 – Customized Approach Explained](https://www.guidepointsecurity.com/blog/pci-dss-4-0-customized-approach-explained/) -- Application Security Blog - - [Five types of software licenses you need to understand](https://www.synopsys.com/blogs/software-security/5-types-of-software-licenses-you-need-to-understand/) -- PortSwigger Blog - - [Burp Suite certification: a year in review](https://portswigger.net/blog/burp-suite-certification-a-year-in-review) -- PortSwigger Research - - [Framing without iframes](https://portswigger.net/research/framing-without-iframes) -- The Daily Swig | Cybersecurity news and views - - [One in five data breaches due to software supply chain compromise, IBM report warns](https://portswigger.net/daily-swig/one-in-five-data-breaches-due-to-software-supply-chain-compromise-ibm-report-warns) - - [Open-Xchange issues fixes for RCE, SSRF bugs in OX App Suite](https://portswigger.net/daily-swig/open-xchange-issues-fixes-for-rce-ssrf-bugs-in-ox-app-suite) -- Reverse Engineering - - [Looking at Patch Gap Vulnerabilities in the VMware ESXi TCP/IP Stack](https://www.reddit.com/r/ReverseEngineering/comments/w9hf51/looking_at_patch_gap_vulnerabilities_in_the/) - - [Binary Ninja - Discord Rich Presence Fix (the old plugin is broken)](https://www.reddit.com/r/ReverseEngineering/comments/w98r5q/binary_ninja_discord_rich_presence_fix_the_old/) -- Intigriti - - [How to prepare your internal team for launching a bug bounty program](https://blog.intigriti.com/2022/07/27/prepare-internal-team-launching-bug-bounty-program/) -- SentinelOne - - [How to Modernize Vulnerability Management in Today’s Evolving Threat Landscape](https://www.sentinelone.com/blog/how-to-modernize-vulnerability-management-in-todays-evolving-threat-landscape/) -- PortSwigger Blog - - [Burp Suite certification: a year in review](https://portswigger.net/blog/burp-suite-certification-a-year-in-review) -- text/plain - - [New Recipes for “Cookies”](https://textslashplain.com/2022/07/27/new-recipes-for-cookies/) -- Malwarebytes Labs - - [IIS extensions are on the rise as backdoors to servers](https://blog.malwarebytes.com/reports/2022/07/iis-extensions-are-on-the-rise-as-backdoors-to-servers/) - - [Anti-vaxxer dating site exposes user data](https://blog.malwarebytes.com/privacy-2/2022/07/anti-vaxxer-dating-site-exposes-user-data/) - - [In post-Roe US, experts share how to keep your data private](https://blog.malwarebytes.com/privacy-2/2022/07/in-post-roe-us-experts-share-how-to-keep-your-data-private/) - - [PrestaShop warns of vulnerability: Update your stores now!](https://blog.malwarebytes.com/cybercrime/2022/07/prestashop-warns-of-vulnerability-update-your-stores-now/) - - [Simplifying the fight against ransomware: An expert explains](https://blog.malwarebytes.com/business/2022/07/simplifying-the-fight-against-ransomware-an-expert-explains/) - - [T-Mobile agrees to pay customers $350 million in settlement over data breach](https://blog.malwarebytes.com/reports/2022/07/t-mobile-agrees-to-pay-customers-350-million-in-settlement-over-data-breach/) -- Checkmarx.com - - [What Are the Challenges with Securing APIs?](https://checkmarx.com/blog/what-are-the-challenges-with-securing-apis/) -- KitPloit - PenTest & Hacking Tools - - [Pretender - Your MitM Sidekick For Relaying Attacks Featuring DHCPv6 DNS Takeover As Well As mDNS, LLMNR And NetBIOS-NS Spoofing](http://www.kitploit.com/2022/07/pretender-your-mitm-sidekick-for.html) -- rtl-sdr.com - - [A teardown of the early 2000’s Psion Wavefinder DAB SDR Receiver](https://www.rtl-sdr.com/a-teardown-of-the-early-2000s-psion-wavefinder-dab-sdr-receiver/) - - [Decoding Inmarsat STD-C with Command Line Decoder STDCDEC and SigDigger](https://www.rtl-sdr.com/decoding-inmarsat-std-c-with-command-line-decoder-stdcdec-and-sigdigger/) - - [APT_COLOR: Add False Color to Black and White NOAA APT Images](https://www.rtl-sdr.com/apt_color-add-false-color-to-black-and-white-noaa-apt-images/) -- Envato Tuts+ Code - Mobile Development - - [How to Create a React Native Calendar Component](https://code.tutsplus.com/tutorials/how-to-create-a-react-native-calendar-component--cms-33664) diff --git a/archive/2022/2022-07-29.md b/archive/2022/2022-07-29.md deleted file mode 100644 index 732ec7e5cc..0000000000 --- a/archive/2022/2022-07-29.md +++ /dev/null @@ -1,143 +0,0 @@ -# 每日安全资讯（2022-07-29） - -- Microsoft Security Blog - - [Industrial systems: What it takes to secure and staff them](https://www.microsoft.com/security/blog/2022/07/28/industrial-systems-what-it-takes-to-secure-and-staff-them/) -- HackerOne Hacker Activity - - [HTML Injection via TikTok Ads Email Share](https://hackerone.com/reports/1376990) - - [Twitter Account hijack through broken link in https://runpanther.io](https://hackerone.com/reports/1607429) - - [Hijack all emails sent to any domain that uses Cloudflare Email Forwarding](https://hackerone.com/reports/1419341) - - [Acronis True Image Local Privilege Escalation Due To Race Condition In Application Verification](https://hackerone.com/reports/1251464) - - [Off-by-slash vulnerability in nodejs.org and iojs.org](https://hackerone.com/reports/1650273) -- unSafe.sh - 不安全 - - [实战登录框漏洞测试](https://buaq.net/go-119707.html) - - [The SMB Guide to Cyber Resilience | Avast](https://buaq.net/go-119712.html) - - [Enough's enough: 7 signs to put down your phone and walk away](https://buaq.net/go-119713.html) -- Sploitus.com Exploits RSS Feed - - [Loan Management System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167861&utm_source=rss&utm_medium=rss) - - [Loan Management System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167860&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Apache Http Server exploit](https://sploitus.com/exploit?id=4051D2EF-1C43-576D-ADB2-B519B31F93A0&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-26138 exploit](https://sploitus.com/exploit?id=E443E98A-3304-54B8-97FD-0FEF9DA283B3&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Wordpress exploit](https://sploitus.com/exploit?id=1FF81FE4-266E-5D63-AB0D-0AC9FF830BF8&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-11111 exploit](https://sploitus.com/exploit?id=2B1A3155-78FF-581C-B7F9-10DA96F13F28&utm_source=rss&utm_medium=rss) -- Tenable Blog - - [The Ransomware Ecosystem: In Pursuit of Fame and Fortune](https://www.tenable.com/blog/the-ransomware-ecosystem-in-pursuit-of-fame-and-fortune) -- 跳跳糖 - 安全与分享社区 - - [windows内存管理详解](https://tttang.com/archive/1590/) -- Files ≈ Packet Storm - - [Wireshark Analyzer 3.6.7](https://packetstormsecurity.com/files/167863/wireshark-3.6.7.tar.xz) - - [Ubuntu Security Notice USN-5535-1](https://packetstormsecurity.com/files/167862/USN-5535-1.txt) - - [Loan Management System 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/167861/loanms10-xss.txt) - - [Loan Management System 1.0 SQL Injection](https://packetstormsecurity.com/files/167860/loanmgmtsys10-sql.txt) -- Twitter @Nicolas Krassas - - [TerraformGoat - "Vulnerable By Design" Multi Cloud Deployment Tool](https://twitter.com/Dinosn/status/1552751781196750850) - - [FileWave Fixes Bugs That Left 1,000+ Orgs Open To Ransomware](https://twitter.com/Dinosn/status/1552751526627647488) - - [US Puts $10 Million Bounty On North Korean Cyber Crews](https://twitter.com/Dinosn/status/1552731877131395072) - - [RT 0xdf: Support will be the fourth box I've had the honor to have go live on @hackthebox_eu! It's based on a real life PenTest story, and I had a lot...](https://twitter.com/0xdf_/status/1552722393730359301) - - [MS-SQL servers hacked to steal bandwidth with proxyware](https://twitter.com/Dinosn/status/1552713768651706368) - - [Microsoft 365 outage knocks down admin center in North America](https://twitter.com/Dinosn/status/1552713628608073732) - - [Spain arrests suspected hackers who sabotaged radiation alert system](https://twitter.com/Dinosn/status/1552713564460392449) - - [1,000s of Phishing Attacks Blast Off From InterPlanetary File System](https://twitter.com/Dinosn/status/1552690528860442625) - - [SharpTongue Deploys Clever Mail-Stealing Browser Extension “SHARPEXT”](https://twitter.com/Dinosn/status/1552689703249403904) - - [Malicious npm packages steal Discord users’ payment card info](https://twitter.com/Dinosn/status/1552689571711811585) - - [“Orwellian in the extreme” food store installs facial recognition cameras to stop crime, faces backlash](https://twitter.com/Dinosn/status/1552688706989035520) - - [ENISA provides data related to major telecom security incidents in 2021](https://twitter.com/Dinosn/status/1552685443963035652) - - [Google brings Street View back to India following 2016 ban](https://twitter.com/Dinosn/status/1552685143596404739) - - [RT PT SWARM: 🚨 New article by our researcher Aleksey Solovev: "Researching Open Source apps for XSS to RCE flaws". Read the article:](https://twitter.com/ptswarm/status/1552656845231177737) - - [RT Ange: I updated my hash collision repo with more info about DetectColl and safe hashes](https://twitter.com/angealbertini/status/1552620742495375361) -- Security Boulevard - - [What are NS Records and Why Are They Important to DNS?](https://securityboulevard.com/2022/07/what-are-ns-records-and-why-are-they-important-to-dns/) - - [Cybersecurity Vendor Consolidation on the Horizon](https://securityboulevard.com/2022/07/cybersecurity-vendor-consolidation-on-the-horizon/) - - [Deep Dive into Google’s AlloyDB Architecture for PostgreSQL](https://securityboulevard.com/2022/07/deep-dive-into-googles-alloydb-architecture-for-postgresql/) - - [Deepfence at Black Hat 2022](https://securityboulevard.com/2022/07/deepfence-at-black-hat-2022/) - - [Builders and Breakers](https://securityboulevard.com/2022/07/builders-and-breakers/) - - [Yet Another Uefi Bootkit Discovered: Meet CosmicStrand](https://securityboulevard.com/2022/07/yet-another-uefi-bootkit-discovered-meet-cosmicstrand/) - - [The Week in Cybersecurity: Austrian hackers-for-hire KNOTWEED serve up Subzero malware](https://securityboulevard.com/2022/07/the-week-in-cybersecurity-austrian-hackers-for-hire-knotweed-serve-up-subzero-malware/) - - [Teleport Embraces FIDO to Eliminate IT Infrastructure Passwords](https://securityboulevard.com/2022/07/teleport-embraces-fido-to-eliminate-it-infrastructure-passwords/) - - [BSidesSF 2022 – Jean-Baptiste Aviat’s And Vladimir de Turckheim’s ‘XSS Mitigation: The State Of The Art’](https://securityboulevard.com/2022/07/bsidessf-2022-jean-baptiste-aviats-and-vladimir-de-turckheims-xss-mitigation-the-state-of-the-art/) - - [ESG Technical Review of the Gurucul Security Analytics and Operations Platform](https://securityboulevard.com/2022/07/esg-technical-review-of-the-gurucul-security-analytics-and-operations-platform/) -- 安全客-有思想的安全新媒体 - - [抖音电商百日漏洞赏金活动上线！](https://www.anquanke.com/post/id/277130) - - [Frida与Android CTF](https://www.anquanke.com/post/id/276895) - - [CVE-2022-33891 Apache Spark shell命令注入漏洞分析](https://www.anquanke.com/post/id/277003) - - [美国政府再次加码提供朝鲜黑客情报的赏金](https://www.anquanke.com/post/id/277107) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [奇安信成为首家获得中国信通院全系列数据安全认证企业](https://www.4hou.com/posts/zlqZ) - - [“无文件”恶意软件的最新藏匿处](https://www.4hou.com/posts/QLJM) - - [Chrome 0 day漏洞被用于监控活动](https://www.4hou.com/posts/8YX3) -- Recent Commits to cve:main - - [Update Thu Jul 28 11:33:13 UTC 2022](https://github.com/trickest/cve/commit/10efab3e46dc5e3e14570893d695999a129685a8) -- 安全脉搏 - - [一次踩坑无数的栈溢出实验 | 技术精选0139](https://www.secpulse.com/archives/184402.html) - - [云沙箱流量识别技术剖析 | 高级攻防11](https://www.secpulse.com/archives/184387.html) - - [什么？你还不会webshell免杀？（三）](https://www.secpulse.com/archives/184357.html) - - [关于栈迁移的那些事儿](https://www.secpulse.com/archives/184339.html) -- 先知安全技术社区 - - [实战登录框漏洞测试](https://xz.aliyun.com/t/11577) -- bunnie's blog - - [The Plausibly Deniable DataBase (PDDB): It’s Real Now!](https://www.bunniestudios.com/blog/?p=6449) -- Sec-News 安全文摘 - - [Researching Open Source apps for XSS to RCE flaws](https://wiki.ioin.in/url/7KBQ) -- ElcomSoft blog - - [checkm8 Extraction: iPhone 7](https://blog.elcomsoft.com/2022/07/checkm8-extraction-iphone-7/) -- Jiajun的编程随想 - - [三种git流程以及发版模型](https://jiajunhuang.com/articles/2022_07_28-git_flows.md.html) -- SecWiki News - - [SecWiki News 2022-07-28 Review](http://www.sec-wiki.com/?2022-07-28) -- 先知安全技术社区 - - [实战登录框漏洞测试](https://xz.aliyun.com/t/11577) -- Forcepoint - - [Malware evolves constantly. Your security should too.](https://www.forcepoint.com/blog/insights/malware-detection-evolved) -- Bug Bounty in InfoSec Write-ups on Medium - - [Why this SIMPLE mistake earned a $5000 bug bounty from Reddit](https://infosecwriteups.com/why-this-simple-mistake-earned-a-5000-bug-bounty-from-reddit-d906cb46c60e?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [Integration between SAP Commerce and Customer Data Cloud](https://blogs.sap.com/2022/07/28/integration-between-sap-commerce-and-customer-data-cloud/) - - [New Learning Environments for Conversions from SAP ERP to SAP S/4HANA 2021](https://blogs.sap.com/2022/07/28/new-learning-environments-for-conversions-from-sap-erp-to-sap-s-4hana-2021/) - - [SAP BTP Security: How to use mTLS with Destinations](https://blogs.sap.com/2022/07/28/sap-btp-security-how-to-use-mtls-with-destinations/) - - [Web application health check monitoring: SAP Alert Notification Service & SAP Automation Pilot rock again](https://blogs.sap.com/2022/07/28/web-application-health-check-monitoring-sap-alert-notification-service-sap-automation-pilot-rock-again/) - - [Support Spotlight: Using DI API connections](https://blogs.sap.com/2022/07/28/support-spotlight-using-di-api-connections/) - - [What’s New in SAP Analytics Cloud Release 2022.16](https://blogs.sap.com/2022/07/28/whats-new-in-sap-analytics-cloud-release-2022.16/) - - [Project Manufacturing Management and Optimization: Subcontracting](https://blogs.sap.com/2022/07/28/project-manufacturing-management-and-optimization-subcontracting/) - - [What is SAP Experience and how to gain it through SAP training?](https://blogs.sap.com/2022/07/28/what-is-sap-experience-and-how-to-gain-it-through-sap-training/) - - [Guided Answers for Multitarget Applications for Cloud Foundry](https://blogs.sap.com/2022/07/28/guided-answers-for-multitarget-applications-for-cloud-foundry/) - - [SAP Cloud Integration: Bloomberg API Integration using JWT OAuth Authentication.](https://blogs.sap.com/2022/07/28/sap-cloud-integration-bloomberg-api-integration-using-jwt-oauth-authentication./) -- SpiderLabs Blog from Trustwave - - [IPFS: The New Hotbed of Phishing](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ipfs-the-new-hotbed-of-phishing/) -- Securelist - - [LofyLife: malicious npm packages steal Discord tokens and bank card data](https://securelist.com/lofylife-malicious-npm-packages/107014/) - - [APT trends report Q2 2022](https://securelist.com/apt-trends-report-q2-2022/106995/) -- Trail of Bits Blog - - [Shedding smart contract storage with Slither](https://blog.trailofbits.com/2022/07/28/shedding-smart-contract-storage-with-slither/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-07-27 - IcedID (Bokbot) activity: two infection runs](https://www.malware-traffic-analysis.net/2022/07/27/index.html) -- SentinelOne - - [Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool](https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/) -- IMQ Minded Security Blog - - [UN ECE 155 Threats in the real world: Wireless Networking Attacks and Mitigations. A case study](https://blog.mindedsecurity.com/2022/07/un-ece-155-threats-in-real-world.html) -- Reverse Engineering - - [Extracting Ghidra Decompiler Output with Python](https://www.reddit.com/r/ReverseEngineering/comments/wabmjd/extracting_ghidra_decompiler_output_with_python/) -- Sandfly Security Blog RSS Feed - - [Sandfly 4.0 - SSH Credential Auditing and eBPF Rootkit Detection](https://www.sandflysecurity.com/blog/sandfly-4-0-new-ssh-credential-and-key-auditing) -- Malwarebytes Labs - - [Radioactivity monitoring and warning system hacked, disabled by attackers](https://blog.malwarebytes.com/reports/2022/07/radioactivity-monitoring-and-warning-system-hacked-disabled-by-attackers/) - - [TikTok owner ByteDance pushed a pro-China agenda to Americans, say former employees](https://blog.malwarebytes.com/privacy-2/2022/07/tiktok-owner-bytedance-pushed-a-pro-china-agenda-to-americans-say-former-employees/) - - [“Orwellian in the extreme” food store installs facial recognition cameras to stop crime, faces backlash](https://blog.malwarebytes.com/privacy-2/2022/07/orwellian-in-the-extreme-food-store-installs-facial-recognition-cameras-to-stop-crime-faces-backlash/) -- Current Posts - Red Team Journal - - [Getting Ready for What’s Next](https://www.redteamjournal.com/blog/getting-ready-whats-next) -- Microsoft Security Response Center - - [Anatomy of a Cloud-Service Security Update](https://msrc-blog.microsoft.com/2022/07/28/anatomy-of-a-cloud-service-security-update/) -- blog.avast.com EN - - [The SMB Guide to Cyber Resilience | Avast](https://blog.avast.com/smb-guide-cyber-resilience) - - [Enough's enough: 7 signs to put down your phone and walk away](https://blog.avast.com/enoughs-enough-7-signs-to-put-down-your-phone-and-walk-away) - - [Candiru: Attack targeting journalists in the Middle East](https://blog.avast.com/candiru-targeting-journalists-middle-east) -- IMQ Minded Security Blog - - [UN ECE 155 Threats in the real world: Wireless Networking Attacks and Mitigations. A case study](https://blog.mindedsecurity.com/2022/07/un-ece-155-threats-in-real-world.html) -- KitPloit - PenTest & Hacking Tools - - [TerraformGoat - "Vulnerable By Design" Multi Cloud Deployment Tool](http://www.kitploit.com/2022/07/terraformgoat-vulnerable-by-design.html) -- Twitter @hakivvi - - [RT Chromium Disclosed Security Bugs: Security: Browser-side origin confusion for javascript/data URLs opened in a new window/tab by cross-origin ifram...](https://twitter.com/BugsChromium/status/1552718535402610688) - - [RT reverseame: How to stop Firefox from spamming your proxy tools like Burp/Fiddler with “](https://twitter.com/reverseame/status/1552568950717911041) -- The Daily Swig | Cybersecurity news and views - - [GitHub enhances 2FA for npm, improves security and manageability](https://portswigger.net/daily-swig/github-enhances-2fa-for-npm-improves-security-and-manageability) - - [Onfido bug bounty program launched to help shore up ID verification defenses](https://portswigger.net/daily-swig/onfido-bug-bounty-program-launched-to-help-shore-up-id-verification-defenses) -- Wallarm - - [API Vulnerabilities Jump Up 3.7x in Q2-2022](https://lab.wallarm.com/api-vulnerabilities-jump-up-3-7x-in-q2-2022/) diff --git a/archive/2022/2022-07-30.md b/archive/2022/2022-07-30.md deleted file mode 100644 index dece2edef1..0000000000 --- a/archive/2022/2022-07-30.md +++ /dev/null @@ -1,245 +0,0 @@ -# 每日安全资讯（2022-07-30） - -- HackerOne Hacker Activity - - [Possible to make restricted files public on Phabricator via Diffusion](https://hackerone.com/reports/1560717) - - [Send Fax from Anyone's HelloFax Account Due to Misconfigured Email Validation](https://hackerone.com/reports/1428385) - - [@nextcloud/logger NPM package brings vulnerable ansi-regex version](https://hackerone.com/reports/1607601) -- Twitter @Nicolas Krassas - - [CVE-2022-32744: Critical Samba admin password reset flaw](https://twitter.com/Dinosn/status/1553081073394909185) - - [To settle with the DoJ, Uber must confess to a cover-up. And it did.](https://twitter.com/Dinosn/status/1553077677963239426) - - [US govt warns Americans of escalating SMS phishing attacks](https://twitter.com/Dinosn/status/1553055225015140352) - - [RT Ron Bowes: If y'all are running Zimbra, you really should make sure it's patched. And probably unplugged. Here's my analysis of a recent blind-Memc...](https://twitter.com/iagox86/status/1553054401786675201) - - [me vs request smugglingPOST](https://twitter.com/Dinosn/status/1553036161647628288) - - [CVE-2022-36364: Apache Calcite Avatica Remote Code Execution](https://twitter.com/Dinosn/status/1552992666652114945) - - [CVE-2022-36123: Linux kernel arbitrary code execution flaw](https://twitter.com/Dinosn/status/1552986156027056128) - - [How this team accidentally found a SSRF in Slack exposing AWS credentials! A $4000 bug bounty](https://twitter.com/Dinosn/status/1552986084379955201) - - [Researchers Warns of Increase in Phishing Attacks Using Decentralized IPFS Network](https://twitter.com/Dinosn/status/1552985886773710848) - - [Dahua IP Camera Vulnerability Could Let Attackers Take Full Control Over Devices](https://twitter.com/Dinosn/status/1552984992367755264) - - [Microsoft links Raspberry Robin malware to Evil Corp attacks](https://twitter.com/Dinosn/status/1552984846414274561) - - [#FF thanks!](https://twitter.com/Dinosn/status/1552978808751505408) - - [RT Uriel Kosayev: Re @Sidragon1 @Gl3bGl4z @OphirHarpaz @NoyPearl @saab1892 @Dinosn](https://twitter.com/MalFuzzer/status/1552956299490611200) - - [RT nikhil(niks): pretty excited to speak at @synack booth in @BlackHatEvents 😃](https://twitter.com/niksthehacker/status/1552942565694984193) - - [Windows Event Log Killer](https://twitter.com/Dinosn/status/1552928666786619392) - - [Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.](https://twitter.com/Dinosn/status/1552928618157842432) - - [Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Mals...](https://twitter.com/Dinosn/status/1552927528930656256) - - [US court system suffered 'incredibly significant attack' – sealed files at risk](https://twitter.com/Dinosn/status/1552908799647916033) - - [RT starlabs: Our team member, @testanull , just made the PoC for CVE-2022-2185 available. It's related to](https://twitter.com/starlabs_sg/status/1552893294749057026) - - [Battlefy - 83,610 breached accounts](https://twitter.com/Dinosn/status/1552874270686326785) -- Recent Commits to cve:main - - [Update Fri Jul 29 11:31:23 UTC 2022](https://github.com/trickest/cve/commit/fa4467eaff46aa96874103704ae3aa2202a8d33a) -- Security Boulevard - - [Raccoon Stealer v2: The Latest Generation of the Raccoon Family](https://securityboulevard.com/2022/07/raccoon-stealer-v2-the-latest-generation-of-the-raccoon-family/) - - [911 Proxy Service Implodes After Disclosing Breach](https://securityboulevard.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/) - - [Aspen Security Forum 2022 – Dan Porterfield’s And Anja Manuel’s ‘Opening Remarks’](https://securityboulevard.com/2022/07/aspen-security-forum-2022-dan-porterfields-and-anja-manuels-opening-remarks/) - - [Win Prizes Fit for a Superhero as Part of the Sysadmin Day Giveaway](https://securityboulevard.com/2022/07/win-prizes-fit-for-a-superhero-as-part-of-the-sysadmin-day-giveaway/) - - [Introducing IaC Security from Black Duck](https://securityboulevard.com/2022/07/introducing-iac-security-from-black-duck/) - - [Mergers and Acquisitions in API Security and Bot Management](https://securityboulevard.com/2022/07/mergers-and-acquisitions-in-api-security-and-bot-management/) - - [Daniel Stori’s ‘bad malloc’](https://securityboulevard.com/2022/07/daniel-storis-bad-malloc/) - - [Solved: Subzero Spyware Secret — Austrian Firm Fingered](https://securityboulevard.com/2022/07/solved-subzero-spyware-secret-austrian-firm-fingered/) - - [TLDR: The Highlights of AWS re:Inforce 2022](https://securityboulevard.com/2022/07/tldr-the-highlights-of-aws-reinforce-2022/) - - [Meet Noname Security at Black Hat USA 2022!](https://securityboulevard.com/2022/07/meet-noname-security-at-black-hat-usa-2022/) -- Files ≈ Packet Storm - - [Transposh WordPress Translation 1.0.8.1 Remote Code Execution](https://packetstormsecurity.com/files/167887/wptransposh1081-exec.txt) - - [Ubuntu Security Notice USN-5541-1](https://packetstormsecurity.com/files/167886/USN-5541-1.txt) - - [Transposh WordPress Translation 1.0.8.1 SQL Injection](https://packetstormsecurity.com/files/167885/wptransposh1081-sql.txt) - - [Ubuntu Security Notice USN-5540-1](https://packetstormsecurity.com/files/167884/USN-5540-1.txt) - - [Faraday 4.0.4](https://packetstormsecurity.com/files/167883/faraday-4.0.4.tar.gz) - - [Transposh WordPress Translation 1.0.8.1 Improper Authorization](https://packetstormsecurity.com/files/167882/wptransposh1081-auth.txt) - - [Red Hat Security Advisory 2022-5753-01](https://packetstormsecurity.com/files/167881/RHSA-2022-5753-01.txt) - - [Geonetwork 4.2.0 XML Injection](https://packetstormsecurity.com/files/167880/geonetwork420-xml.txt) - - [Ubuntu Security Notice USN-5539-1](https://packetstormsecurity.com/files/167879/USN-5539-1.txt) - - [Transposh WordPress Translation 1.0.8.1 Information Disclosure](https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt) - - [Ubuntu Security Notice USN-5536-1](https://packetstormsecurity.com/files/167877/USN-5536-1.txt) - - [Crime Reporting System 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/167875/crs10-xss.txt) - - [Transposh WordPress Translation 1.0.8.1 Cross Site Request Forgery](https://packetstormsecurity.com/files/167874/wptransposh1081-xsrf.txt) - - [Ubuntu Security Notice USN-5537-2](https://packetstormsecurity.com/files/167873/USN-5537-2.txt) - - [rpc.py 0.6.0 Remote Code Execution](https://packetstormsecurity.com/files/167872/rpcpy060-exec.txt) - - [Ubuntu Security Notice USN-5538-1](https://packetstormsecurity.com/files/167871/USN-5538-1.txt) - - [Transposh WordPress Translation 1.0.7 Incorrect Authorization](https://packetstormsecurity.com/files/167870/wptransposh107-auth.txt) - - [Red Hat Security Advisory 2022-5754-01](https://packetstormsecurity.com/files/167869/RHSA-2022-5754-01.txt) - - [Dingtian-DT-R002 3.1.276A Authentication Bypass](https://packetstormsecurity.com/files/167868/dingtian31276A-bypass.txt) - - [Ubuntu Security Notice USN-5537-1](https://packetstormsecurity.com/files/167867/USN-5537-1.txt) - - [Transposh WordPress Translation 1.0.7 Cross Site Scripting](https://packetstormsecurity.com/files/167865/wptransposh107-xss.txt) - - [Abusing Microsoft System Center Configuration Manager (SCCM)](https://packetstormsecurity.com/files/167876/abusing-msccm.pdf) - - [WordPress WP-UserOnline 2.87.6 Cross Site Scripting](https://packetstormsecurity.com/files/167864/wpuseronline2876-xss.txt) -- Sploitus.com Exploits RSS Feed - - [Transposh WordPress Translation 1.0.8.1 Improper Authorization exploit](https://sploitus.com/exploit?id=PACKETSTORM:167882&utm_source=rss&utm_medium=rss) - - [Geonetwork 4.2.0 - XML External Entity (XXE) exploit](https://sploitus.com/exploit?id=EDB-ID:50982&utm_source=rss&utm_medium=rss) - - [WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:50988&utm_source=rss&utm_medium=rss) - - [Dingtian-DT-R002 3.1.276A - Authentication Bypass exploit](https://sploitus.com/exploit?id=EDB-ID:50984&utm_source=rss&utm_medium=rss) - - [rpc.py 0.6.0 - Remote Code Execution (RCE) exploit](https://sploitus.com/exploit?id=EDB-ID:50983&utm_source=rss&utm_medium=rss) - - [WordPress WP-UserOnline 2.87.6 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167864&utm_source=rss&utm_medium=rss) - - [Transposh WordPress Translation 1.0.8.1 Information Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:167878&utm_source=rss&utm_medium=rss) - - [Transposh WordPress Translation 1.0.7 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167866&utm_source=rss&utm_medium=rss) - - [Dingtian-DT-R002 3.1.276A Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:167868&utm_source=rss&utm_medium=rss) - - [rpc.py 0.6.0 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167872&utm_source=rss&utm_medium=rss) - - [Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal exploit](https://sploitus.com/exploit?id=EDB-ID:50986&utm_source=rss&utm_medium=rss) - - [Transposh WordPress Translation 1.0.8.1 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167885&utm_source=rss&utm_medium=rss) - - [Transposh WordPress Translation 1.0.7 Incorrect Authorization exploit](https://sploitus.com/exploit?id=PACKETSTORM:167870&utm_source=rss&utm_medium=rss) - - [Transposh WordPress Translation 1.0.8.1 Cross Site Request Forgery exploit](https://sploitus.com/exploit?id=PACKETSTORM:167874&utm_source=rss&utm_medium=rss) - - [Crime Reporting System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167875&utm_source=rss&utm_medium=rss) - - [Geonetwork 4.2.0 XML Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167880&utm_source=rss&utm_medium=rss) - - [Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution exploit](https://sploitus.com/exploit?id=EDB-ID:50987&utm_source=rss&utm_medium=rss) - - [Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path exploit](https://sploitus.com/exploit?id=EDB-ID:50985&utm_source=rss&utm_medium=rss) - - [Transposh WordPress Translation 1.0.8.1 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167887&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Simplefilelist Simple-File-List exploit](https://sploitus.com/exploit?id=6C93FAEB-C59D-5CE0-B3D3-A261C0293F64&utm_source=rss&utm_medium=rss) - - [Exploit for Incorrect Permission Assignment for Critical Resource in Gitlab exploit](https://sploitus.com/exploit?id=653E81B0-D72C-5EBB-A8CC-E83C83BCD62B&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Polkit Project Polkit exploit](https://sploitus.com/exploit?id=7692DA4F-829F-584A-833E-69C1D811E9DE&utm_source=rss&utm_medium=rss) -- C-skills - - [Parallel find trickery](https://c-skills.blogspot.com/2022/07/parallel-find-trickery.html) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-july-29) -- 安全客-有思想的安全新媒体 - - [数字安全观察-每周简报(2022.07.20 -2022.07.26)](https://www.anquanke.com/post/id/277213) - - [西班牙警方逮捕两名辐射警报系统网络攻击嫌疑黑客](https://www.anquanke.com/post/id/277160) -- Sec-News 安全文摘 - - [Executor内存马的实现](https://wiki.ioin.in/url/ADkn) - - [Apple Safari IDN URL Spoofing](https://wiki.ioin.in/url/m0Om) - - [Gitlab Project Import RCE Analysis (CVE-2022-2185)](https://wiki.ioin.in/url/6nqB) -- SecWiki News - - [SecWiki News 2022-07-29 Review](http://www.sec-wiki.com/?2022-07-29) -- Sucuri Blog - - [WordPress Vulnerabilities & Patch Roundup — July 2022](https://blog.sucuri.net/2022/07/wordpress-vulnerabilities-patch-roundup-july-2022.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [腾讯安全发布边缘安全加速平台Tencent Cloud EdgeOne：全球2800多个边缘节点，具备10余项安全、加速能力](https://www.4hou.com/posts/N15D) - - [2022重保最新钓鱼案件典型攻击手法复盘](https://www.4hou.com/posts/LBAX) - - [齐向东出席全球数字经济大会：网络安全运营水平决定了数字城市的抗风险能力](https://www.4hou.com/posts/KEAM) - - [SUSECON开源技术峰会登陆北京，快报名！](https://www.4hou.com/posts/JXEJ) - - [工信部信息中心《数据传输安全白皮书》重磅发布，星阑受邀参编并进行API安全主题演讲](https://www.4hou.com/posts/GKwL) - - [WMCTF2022 | 首届“安洵杯”国际赛报名开启！](https://www.4hou.com/posts/EQKY) - - [通过对网络访问帐户进行解密来探索 SCCM](https://www.4hou.com/posts/50A8) - - [新型恶意软件可劫持 Facebook 企业帐户](https://www.4hou.com/posts/pV9p) - - [北卡新品“公务咔信”在数字中国峰会隆重发布！](https://www.4hou.com/posts/DEwy) -- Filippo Valsorda - - [KEMs and Post-Quantum age](https://words.filippo.io/dispatches/post-quantum-age/) -- 安全脉搏 - - [Coremail邮件安全：2022重保最新钓鱼案件典型攻击手法复盘](https://www.secpulse.com/archives/184499.html) - - [浅谈热部署工具 springboot-devtools 安全风险](https://www.secpulse.com/archives/184472.html) - - [进程注入的探索](https://www.secpulse.com/archives/184460.html) - - [实战 | 记一次挖掘到微软的存储型XSS漏洞的经历](https://www.secpulse.com/archives/184450.html) -- unSafe.sh - 不安全 - - [Google delays Chrome third party cookie sunsetting…again](https://buaq.net/go-119900.html) - - [WordPress Vulnerabilities & Patch Roundup — July 2022](https://buaq.net/go-119912.html) - - [Apple Safari IDN URL Spoofing](https://buaq.net/go-119897.html) - - [The Good, the Bad, and the Ugly in Cybersecurity – Week 31](https://buaq.net/go-119902.html) - - [职场“首七” - 土拨鼠数据合规与安全](https://buaq.net/go-119922.html) - - [Gitlab Project Import RCE Analysis (CVE-2022-2185)](https://buaq.net/go-119870.html) - - [Maldev-For-Dummies - A Workshop About Malware Development](https://buaq.net/go-119880.html) - - [How this team accidentally found a SSRF in Slack exposing AWS credentials! A $4000 bug bounty](https://buaq.net/go-119865.html) - - [腾讯安全发布边缘安全加速平台Tencent Cloud EdgeOne：全球2800多个边缘节点，具备10余项安全、加速能力](https://buaq.net/go-119866.html) - - [掌握了这一招，Go版本的管理不用愁](https://buaq.net/go-119917.html) - - [派周报 | 本周会员内容提要；跑题：裁员语文](https://buaq.net/go-119862.html) - - [本周看什么丨最近值得一看的 6 部作品](https://buaq.net/go-119863.html) -- 美团技术团队 - - [日志导致线程Block的这些坑，你不得不防](https://tech.meituan.com/2022/07/29/tips-for-avoiding-log-blocking-threads.html) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [New Qualys Research Report: Evolution of Quasar RAT](https://blog.qualys.com/category/vulnerabilities-threat-research) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Web Design By East Technologies - SQL Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022070078) - - [COURIER DEPRIXA V2.5 CSRF Vulnerability](https://cxsecurity.com/issue/WLB-2022070077) - - [Loan Management System 1.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022070076) - - [WordPress Plugin Visual Slide Box Builder 3.2.9 SQLi](https://cxsecurity.com/issue/WLB-2022070075) -- 跳跳糖 - 安全与分享社区 - - [GadgetInspector原理分析](https://tttang.com/archive/1683/) -- Current Posts - Red Team Journal - - [The Pointillism of Daily Events](https://www.redteamjournal.com/blog/pointillism-daily-events) -- scriptkidd1e - - [Office365 Advanced Threat Protection (ATP)](https://scriptkidd1e.wordpress.com/2022/07/29/office365-advanced-threat-protection-atp/) -- 博客园 - 挖洞的土拨鼠 - - [职场“首七” - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16533651.html) -- Real-time communications security on Communication Breakdown - Real-Time Communications Security - - [WebRTC 0day, FreePBX not Asterisk attacks and talks at MCH2022](https://www.rtcsec.com/newsletter/2022-07-rtcsec-news/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Introducing WhoisXML API's WHOIS Conclave Law Enforcement IoCs and Research on Demand Threat Intelligence Feed!](http://ddanchev.blogspot.com/2022/07/introducing-whoisxml-apis-whois.html) -- Twitter @bytehx - - [RT 23pds: 🐮](https://twitter.com/IM_23pds/status/1552845432237150208) -- Malwarebytes Labs - - [To settle with the DoJ, Uber must confess to a cover-up. And it did.](https://blog.malwarebytes.com/cybercrime/2022/07/to-settle-with-the-doj-uber-must-confess-to-a-cover-up-and-it-did/) - - [The ransomware landscape changes as fewer victims decide to pay](https://blog.malwarebytes.com/ransomware/2022/07/the-ransomware-landscape-changes-as-less-victims-decide-to-pay/) - - [Criminals using compromised social media accounts to “post indecent images of children” says UK cybercrime organization](https://blog.malwarebytes.com/privacy-2/2022/07/criminals-using-compromised-social-media-accounts-to-post-indecent-images-of-children-says-uk-cybercrime-organization/) - - [Google delays Chrome third party cookie sunsetting…again](https://blog.malwarebytes.com/privacy-2/2022/07/google-delays-chrome-third-party-cookie-sunsetting-again/) -- Hex Rays - - [Igor’s tip of the week #100: Collapsing pseudocode parts](https://hex-rays.com/blog/igors-tip-of-the-week-100-collapsing-pseudocode-parts/) -- SAP Blogs - - [SAP Data Intelligence – What’s New in DI:2022/08](https://blogs.sap.com/2022/07/29/sap-data-intelligence-whats-new-in-di2022-08/) - - [Feedback feature: Almost like making a wish for the genie of the lamp, but in the SAP S/4HANA Cloud way](https://blogs.sap.com/2022/07/29/feedback-feature-almost-like-making-a-wish-for-the-genie-of-the-lamp-but-in-the-sap-s-4hana-cloud-way/) - - [What’s in a successful journey? Leverage journey modeling to achieve process and experience excellence at scale](https://blogs.sap.com/2022/07/29/whats-in-a-successful-journey-leverage-journey-modeling-to-achieve-process-and-experience-excellence-at-scale/) - - [What is Account Assignment Category in SAP MM, How to configure?](https://blogs.sap.com/2022/07/29/what-is-account-assignment-category-in-sap-mm-how-to-configure/) - - [End to End : Step by Step CFL enablement of Custom Fields of EBAN , EKPO Table – Part 1](https://blogs.sap.com/2022/07/29/end-to-end-step-by-step-cfl-enablement-of-custom-fields-of-eban-ekpo-table-part-1/) - - [The ABAP Detective Melts in the Heat](https://blogs.sap.com/2022/07/29/the-abap-detective-melts-in-the-heat/) - - [SAP Process Automation Beginner Series](https://blogs.sap.com/2022/07/29/sap-process-automation-beginner-series/) - - [Generic Custom Object](https://blogs.sap.com/2022/07/29/generic-custom-object/) - - [SAP Procurement 2208 Release Key Innovations Preview](https://blogs.sap.com/2022/07/29/sap-procurement-2208-release-key-innovations-preview/) -- Bug Bounty in InfoSec Write-ups on Medium - - [How this team accidentally found a SSRF in Slack exposing AWS credentials! A $4000 bug bounty](https://infosecwriteups.com/how-this-team-accidentally-found-a-ssrf-in-slack-exposing-aws-credentials-a-4000-bug-bounty-513be19286e?source=rss----7b722bfd1b8d--bug_bounty) -- SentinelOne - - [The Good, the Bad, and the Ugly in Cybersecurity – Week 31](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-31-4/) -- Reverse Engineering - - [Zeratool v2.2: Automatic Exploit Generation (AEG) with automated remote libc leaking and ret2dlresolve rop chain generation for exploitable CTF problems.](https://www.reddit.com/r/ReverseEngineering/comments/wb9imd/zeratool_v22_automatic_exploit_generation_aeg/) - - [nanopb Protobuf Decompiler - Anvil Secure](https://www.reddit.com/r/ReverseEngineering/comments/wb9nem/nanopb_protobuf_decompiler_anvil_secure/) -- Application Security Blog - - [Introducing IaC Security from Black Duck](https://www.synopsys.com/blogs/software-security/black-duck-iac/) -- Sucuri Blog - - [WordPress Vulnerabilities & Patch Roundup — July 2022](https://blog.sucuri.net/2022/07/wordpress-vulnerabilities-patch-roundup-july-2022.html) -- Sick Codes – Security Research, Hardware & Software Hacking, Consulting, Linux, IoT, Cloud, Embedded, Arch, Tweaks & Tips! - - [CVE-2022-36123 – A vulnerability in Linux kernel mainline v5.18-rc1 through v5.19-rc6 does not clear statically allocated variables in the block starting symbol (.bss) due to a failed early_xen_iret_patch leading to an asm_exc_page_fault, or arbitrary code execution](https://sick.codes/sick-2022-128/) -- The Daily Swig | Cybersecurity news and views - - [GitHub Actions workflow flaws provided write access to projects including Logstash](https://portswigger.net/daily-swig/github-actions-workflow-flaws-provided-write-access-to-projects-including-logstash) - - [XSS vulnerabilities in Google Cloud, Google Play could lead to account hijacks](https://portswigger.net/daily-swig/xss-vulnerabilities-in-google-cloud-google-play-could-lead-to-account-hijacks) - - [Bug Bounty Radar // The latest bug bounty programs for August 2022](https://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-august-2022) -- KitPloit - PenTest & Hacking Tools - - [Maldev-For-Dummies - A Workshop About Malware Development](http://www.kitploit.com/2022/07/maldev-for-dummies-workshop-about.html) -- 吾爱破解论坛 - - [【原创】DBeaver Ultimate edition 算法分析/本地服务器搭建](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651137957&idx=1&sn=4c4ab3ec6b52473624faf20fd36d8620&chksm=bd50b7f18a273ee778749f5e2b275982e4c7431948541dfcf02abb8121b57bf5b60a6036ce0f&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【资料】2022年美国航母舰队和远征战斗群部署位置图](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651130914&idx=1&sn=c35bcf3e7dcce67d03cd93ea4481673c&chksm=f1af7b18c6d8f20eb10b9125205449b112da5747b6c93a3f1d1990f367b96c2951f9551ab5a2&scene=58&subscene=0#rd) -- 看雪学院 - - [指令级工具Dobby源码阅读](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458459349&idx=1&sn=c7befdac063330a9ada2e3d1b0e396ef&chksm=b18e2c5f86f9a5492113d4584d85a484eedb3384f8e4ad14235273dd830e4cd57615f08ec926&scene=58&subscene=0#rd) - - [英美启用《数据访问协议》，将可便捷调用彼此互联网用户数据](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458459349&idx=2&sn=ccb295910dccdb428ca85434d6291ccd&chksm=b18e2c5f86f9a549136b4b19289327c5191b4033c2b1f4c790013fc146023da0b6f90dc25ad4&scene=58&subscene=0#rd) - - [这波赚了！雪花创作激励计划，你参与了吗？](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458459349&idx=3&sn=2714c1ce409ff4493c925b2ae77627da&chksm=b18e2c5f86f9a54957e65c85754885e543fa284ac0e709440e792d9124cd8e34ccd8097a2661&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】DiceCTF 2021 学习笔记](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774570&idx=1&sn=a8c5e588e3ce365e49a017652da90187&chksm=88936985bfe4e0930077c6a0c3e4e9e93bbcac515429aec6bd37cd525d318e5f67e912af33a9&scene=58&subscene=0#rd) - - [【安全头条】西班牙警方逮捕两名辐射警报系统网络攻击嫌疑黑客](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774570&idx=2&sn=2d722016acc74c0aee3ce46875a0e3c9&chksm=88936985bfe4e093de4e65ce04bc907b43a34c684963d3387f8b14ab2d39ce87907ccabdf9d2&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [万字长文：安全知识图谱技术概述](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492837&idx=1&sn=e280977956425e40d352ba52e65085ab&chksm=e84c423adf3bcb2ca0a02d7751161ca5d4d3ae1a58f1cbbe6df0031ba5847490b2a225de8546&scene=58&subscene=0#rd) -- 安全牛 - - [Kubernetes应用中必须避免的七个基本错误](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116537&idx=1&sn=7601c92c893a7d09fb184e67283089f8&chksm=bd14632a8a63ea3cf6fada2f6296c85d7888c7b6f859121f9f5278285e7cb4a0760c7b66ce8d&scene=58&subscene=0#rd) - - [利用隐私计算构建数据安全协同应用生态](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116537&idx=2&sn=afba74e2b719ccf4ae1241e31afa4831&chksm=bd14632a8a63ea3cb553508da78fae19a4a2aef90296a3e0e47e6f6e4b73b5539981f9de9880&scene=58&subscene=0#rd) - - [开展敏捷化IT审计的实用建议](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116537&idx=3&sn=00814d558124e40e4702aebc5ca94eaa&chksm=bd14632a8a63ea3ce0d1d5cea4a9a9d68c85ed698203c9dbc8dda51c503b4dcfd0f1eb2da4fc&scene=58&subscene=0#rd) -- blog.avast.com EN - - [eIDAS 2.0 Developments | Avast](https://blog.avast.com/eidas-developments) -- Twitter @hakivvi - - [Re @infosec_au Have you tried \\?\GLOBALROOT\Device\HarddiskVolumeX, it may work if you filename end up as the first arg to CreateFile().](https://twitter.com/hakivvi/status/1553067522529837058) -- 情报分析师 - - [刚刚！美国发布《海军部队结构和造船计划》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512764&idx=1&sn=4756069aa1de129d005abf4b5003809a&chksm=8716b337b0613a21fa53f0b2d01b1ee6b859fb5932d0cf996e3432553d8b034c339df5a66c5b&scene=58&subscene=0#rd) - - [开源情报工具——NCEI（自然灾害查看器）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512764&idx=2&sn=4ead7898927b0185d8d4badf9f756bba&chksm=8716b337b0613a21696ca1464521f196818282300cb56ccff862c8f3882ea1e1ea6bda420456&scene=58&subscene=0#rd) -- 安全威胁情报 - - [大量包含CobaltStrike木马的邮件袭来，如何一招甄别？](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173437&idx=1&sn=e556bb6abc896c0bf853895cd6f4a231&chksm=f4489441c33f1d575c4fbb12f1479761d0f9de243f1ec36ac6bc149ea47d11aaeebd4a83134a&scene=58&subscene=0#rd) -- 星阑科技 - - [工信部信息中心《数据传输安全白皮书》重磅发布，星阑受邀参编并进行API安全主题演讲](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494626&idx=1&sn=0b99352a797f99061548130f8458b87f&chksm=c007467ef770cf68476e77f2b37825a622deae5406a376496acd7c822a8a4aa44ffd21607f8e&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [新型恶意软件可劫持 Facebook 企业帐户](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546840&idx=1&sn=e89b8762a592f5c3dc4a4d26bdd6ffa4&chksm=e915e7e2de626ef4f2eb1bd602d5f23a602a5e0ad1c26591d964024777f05dde96ab391d604b&scene=58&subscene=0#rd) - - [通过对网络访问帐户进行解密来探索 SCCM](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546840&idx=2&sn=e9a207344ac816daaefee97d220e3a29&chksm=e915e7e2de626ef474d23d3a57a25c477c08f96f6f263c415c5115b3653bb3673d08a18b137e&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [中国汽车行业信息安全体系可信赖度评估机制研究](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529475&idx=1&sn=2c6a6c4c8a2129cd04fad12c054a4598&chksm=c1e9f852f69e7144db02c679158d8b4b41b962ff43d6215e363e775d5760cbf4c99147afb8a4&scene=58&subscene=0#rd) - - [《2022年数据泄露成本报告》的十大关键发现](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529475&idx=2&sn=5c6d09c3cc353b52974f9efe52c135c1&chksm=c1e9f852f69e7144191e63bdcf316b7f94c283ac01acc4128e99efdc518afcbf58d36eded223&scene=58&subscene=0#rd) - - [西班牙一核安全系统遭黑客攻击，部分地区服务中断数月](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529475&idx=3&sn=49705a6660571bf8f15c9391ca176522&chksm=c1e9f852f69e7144ee1a4190057c6d055ddb0634078b7457a1732658a8a7b38916231b955a1a&scene=58&subscene=0#rd) -- 互联网安全内参 - - [美国前国安官员成立开源情报基金会，加强社交媒体等公开数据利用](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504777&idx=1&sn=6adf7641aa132879d9be3a0a2685d601&chksm=ebfa94a9dc8d1dbf64fb93e3d2c46d016e503e9ee0126ec0ef4a5c7cda39261a89a943833d02&scene=58&subscene=0#rd) - - [《可信隐私计算研究报告（2022年）》正式发布（附下载）](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504777&idx=2&sn=4f78df45c6c95defd13411102c26e334&chksm=ebfa94a9dc8d1dbf386fb95b7da6cf96eb753df54d7ef57862a61da06e6cb86c713c1cf46df4&scene=58&subscene=0#rd) - - [微软默认禁用Office宏之后，黑客找到了新攻击技术](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504777&idx=3&sn=8cd987071e5465e41db10cc755025abe&chksm=ebfa94a9dc8d1dbfe23391bde41489aea0ee060531617f7e152ead00f8d21d1d0d9fd0f20a6a&scene=58&subscene=0#rd) - - [食品和饮料生产的网络安全：风险和建议](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504777&idx=4&sn=35bd673a15f7379d726c90c1febbc895&chksm=ebfa94a9dc8d1dbf208c497aa150fe4d074e0579899917930f84ac70f787e9bbef95c2d55bca&scene=58&subscene=0#rd) -- 补天平台 - - [重磅官宣 | 2022 CCS 成都网络安全大会暨网络数据治理峰会定档 - 云上安全新形态，拥抱数字新未来](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494823&idx=1&sn=c8d5f1f53ede0589c811cdb04e284d2c&chksm=eaf9a4ebdd8e2dfdbe2837558985f75569f4a8df5dccd1b04c422a7909da82e1932171c948d1&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [阅读推荐 2022-07-29](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492096&idx=1&sn=c9a874bad307694dc824898847d1e661&chksm=c063ccd9f71445cfc67dbb31d4524abbac3dcf6ba574c8584af74e625e680c1cd44a60594278&scene=58&subscene=0#rd) -- 极客公园 - - [TCL 创始人李东生：40 年穿越周期的启示](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962353&idx=1&sn=dcf4a4ab08a675b17adb2407d20041d6&chksm=7e55838749220a913af62d4e2846f9dd6393aa7052705cec8ed0e2f039e62ba534f8ab4e3402&scene=58&subscene=0#rd) - - [极氪聪聪： 从 All In「新造车」到加速进化](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962348&idx=1&sn=7d10e18190d5958d22a898a8f5886726&chksm=7e55839a49220a8c0069e2405e67cc10ccd539613f752bd9e1191afafa4b86c35acc71961a52&scene=58&subscene=0#rd) - - [传每日优鲜「原地解散」，已无法下单；SpaceX 星链将升级，或直连手机；中国空间站只写中文：母语最直接准确｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962129&idx=1&sn=52dab5858d283aa4b52511e191b75b33&chksm=7e5580e7492209f163ac5f0e1a88352cb4abe9be73e03ff57b974bdd35db4ff7afb6340c2410&scene=58&subscene=0#rd) -- M01NTeam - - [每周蓝军技术推送（2022.7.23-7.29）](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489074&idx=1&sn=b555f49e04c5b524ae4721656c0e40b5&chksm=c187d623f6f05f3537a67e3c56463cd2bedc32c8a4e8005a4020995b2bfb4cb6a84cc5a3a5ba&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Jul.29th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495709&idx=1&sn=5a626090488e5ed4079ba53d22ad2e1c&chksm=ce96bd23f9e13435f920560905a0bfefd9007c2c624226b9d38091b437e875fa83fec8dffc22&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [深入浅出决策树](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495031&idx=1&sn=6fa9a22aa90ca6a309a3b82926c85495&chksm=fa5238c9cd25b1df1566b1ecb64ac5bbcf9a7f679b1ae3f64887d6788e33ed64ad2992809a3e&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-07-31.md b/archive/2022/2022-07-31.md deleted file mode 100644 index 7e3916495c..0000000000 --- a/archive/2022/2022-07-31.md +++ /dev/null @@ -1,78 +0,0 @@ -# 每日安全资讯（2022-07-31） - -- HackerOne Hacker Activity - - [Corsa Site Scripting Vulnerability (XSS)](https://hackerone.com/reports/1650210) - - [Open redirection at https://smartreports.mtncameroon.net](https://hackerone.com/reports/1530396) -- SecWiki News - - [SecWiki News 2022-07-30 Review](http://www.sec-wiki.com/?2022-07-30) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-26138 exploit](https://sploitus.com/exploit?id=120220D8-2281-57EE-BD84-1A33B8841E56&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Apache Spark exploit](https://sploitus.com/exploit?id=B4E992DA-531E-5132-8B77-B17902277650&utm_source=rss&utm_medium=rss) -- Verne in GitHub - - [离线备份小鹅通反派影评以及节目列表](https://einverne.github.io/post/2022/07/fanpaiyingping-list.html) - - [MySQL Binary Log 清理](https://einverne.github.io/post/2022/07/mysql-binary-log.html) -- Recent Commits to cve:main - - [Update Sat Jul 30 11:34:28 UTC 2022](https://github.com/trickest/cve/commit/5353c280ae28ec9a84b87d3ebf3f293f0e24c48a) -- unSafe.sh - 不安全 - - [2022全球数字经济大会数字安全峰会暨ISC2022第十届互联网安全大会开幕](https://buaq.net/go-119996.html) - - [ISC 2022第十届互联网安全大会开幕，樊友山出席并致辞](https://buaq.net/go-119997.html) - - [Nginx 0day LDAP RCE 漏洞情报](https://buaq.net/go-119986.html) - - [你向往二舅的坚韧不拔，我向往周公子的低调奢华](https://buaq.net/go-119995.html) - - [GSuite domain takeover through delegation](https://buaq.net/go-119975.html) - - [Syntax Highlight – 为 macOS 快速查看添加代码高亮功能，支持 100+ 格式](https://buaq.net/go-119969.html) - - [任意键｜初见月迅龙、爱生气的巫妖王、奶刃三部曲及其他](https://buaq.net/go-119973.html) - - [久违低价！BitDock 终生版 7 折，让你电脑桌面焕然一新](https://buaq.net/go-119964.html) - - [IVANTIAVALANCHE漏洞利用（上）](https://buaq.net/go-119960.html) - - [IDA Pro 8.0 released.](https://buaq.net/go-119959.html) - - [乌克兰广播电台被黑，传播乌克兰总统虚假消息](https://buaq.net/go-119961.html) - - [来一场义工旅行，就可以改变人生吗？](https://buaq.net/go-119957.html) - - [Treebox - Python AST sandbox challenge from Google CTF 2022](https://buaq.net/go-119984.html) - - [Offensive Security OSED Review](https://buaq.net/go-120007.html) - - [New Qualys Research Report: Evolution of Quasar RAT](https://buaq.net/go-119915.html) - - [Introducing IaC Security from Black Duck](https://buaq.net/go-119916.html) - - [nanopb Protobuf Decompiler - Anvil Secure](https://buaq.net/go-119914.html) - - [To settle with the DoJ, Uber must confess to a cover-up. And it did.](https://buaq.net/go-119910.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [2022全球数字经济大会数字安全峰会暨ISC2022第十届互联网安全大会开幕](https://www.4hou.com/posts/VZ0v) - - [ISC 2022第十届互联网安全大会开幕，樊友山出席并致辞](https://www.4hou.com/posts/RB5O) - - [IVANTIAVALANCHE漏洞利用（上）](https://www.4hou.com/posts/r7g4) - - [乌克兰广播电台被黑，传播乌克兰总统虚假消息](https://www.4hou.com/posts/6VYR) -- Security Boulevard - - [Aspen Security Forum 2022 – Moderator: Mary Louise Kelly, Co-Host, All Things Considered, NPR – Fireside Chats with General John W. “Jay” Raymond Chief of Space Operations, U.S. Space Force](https://securityboulevard.com/2022/07/aspen-security-forum-2022-moderator-mary-louise-kelly-co-host-all-things-considered-npr-fireside-chats-with-general-john-w-jay-raymond-chief-of-space-operations-u-s-space-force/) - - [XKCD ‘Proxy Variable’](https://securityboulevard.com/2022/07/xkcd-proxy-variable/) - - [Staying Ahead of the Distortion of a Cyber Attack?](https://securityboulevard.com/2022/07/staying-ahead-of-the-distortion-of-a-cyber-attack/) - - [Aspen Security Forum 2022 – Anja Manuel’s ‘Opens The 22 Aspen Security Forum’](https://securityboulevard.com/2022/07/aspen-security-forum-2022-anja-manuels-opens-the-22-aspen-security-forum/) - - [The Past, Present, and Future of (Zero) Trust](https://securityboulevard.com/2022/07/the-past-present-and-future-of-zero-trust/) -- gynvael.coldwind//vx.log (en) - - [Treebox - Python AST sandbox challenge from Google CTF 2022](https://gynvael.coldwind.pl/?id=751) -- cloud world - - [2022 31 Open source weekly report](https://cloudsjhan.github.io/2022/07/30/2022-31-Open-source-weekly-report-1/) -- Twitter @Nicolas Krassas - - [A compact guide to network pivoting for penetration testings / CTF challenges.](https://twitter.com/Dinosn/status/1553315940133007361) - - [Security Teams Overwhelmed With Bugs, Bitten by Patch Prioritization](https://twitter.com/Dinosn/status/1553272019969622016) - - [CVE-2022-36123 - Linux kernel <5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to caus...](https://twitter.com/Dinosn/status/1553266798811832320) - - [Feds put $10m bounty on Putin pal accused of bankrolling US election troll farm](https://twitter.com/Dinosn/status/1553266750711554048) - - [Zeratool v2.2: Automatic Exploit Generation (AEG) with automated remote libc leaking and ret2dlresolve rop chain generation for exploitable CTF proble...](https://twitter.com/Dinosn/status/1553265693134569475) -- Bug Bounty in InfoSec Write-ups on Medium - - [GSuite domain takeover through delegation](https://infosecwriteups.com/gsuite-domain-takeover-through-delegation-9d6664c91142?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [Onboarding – How to resolve, E-Verify did not receive your case information error](https://blogs.sap.com/2022/07/30/onboarding-how-to-resolve-e-verify-did-not-receive-your-case-information-error/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Shots from the Wild West - Sample Compilation of RATs (Remote Access Tools) and Trojan Horses Screenshots - An OSINT Analysis - Part Two](http://ddanchev.blogspot.com/2022/07/shots-from-wild-west-sample-compilation.html) -- Hexacorn - - [Week of Data Dumps, Part 4 – games-related strings](https://www.hexacorn.com/blog/2022/07/30/week-of-data-dumps-part-4-games-related-strings/) -- Reverse Engineering - - [IDA Pro 8.0 released.](https://www.reddit.com/r/ReverseEngineering/comments/wbnncd/ida_pro_80_released/) -- HAHWUL - - [GraphQL Security](https://www.hahwul.com/cullinan/graphql/) - - [ZAP⚡️ Replacer VS Sender Script](https://www.hahwul.com/2022/07/30/zap-replacer-vs-sender-script/) -- ChaMd5安全团队 - - [威胁情报 0729-0730](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247506417&idx=1&sn=5d44d5e70209ca87d123365aad64864c&chksm=e89df129dfea783fa3f0a5787262e5b0f11f7bb7c08b1d637816b60a5f85b46df0a53175c6bb&scene=58&subscene=0#rd) -- 极客公园 - - [在快手，短视频和直播正在成为行业新的「编程语言」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962417&idx=1&sn=184b128f01d17dc35fcdc58237470310&chksm=7e5583c749220ad11ac0966fc896100d763d7b1bffd505c5dc8ae42fb82537d7ce53371e1a1a&scene=58&subscene=0#rd) - - [Instgram：确实学不了 TikTok；每日优鲜创始人徐正：我没跑路；雪碧「经典绿瓶」或成绝响｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962379&idx=1&sn=8636e43a0b0facc30434ba152e84349c&chksm=7e5583fd49220aebf74e44229341d7880bf1c8009171036eae45ff123ee8d94dde7f842fae20&scene=58&subscene=0#rd) -- 情报分析师 - - [【人物库】南希·佩洛西 2022年净资产， 年龄， 身高， 体重， 传记](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512854&idx=1&sn=9c1cd807cfb0b5a069b6a7e436f11d72&chksm=8716b39db0613a8b9a59df230215d43b6ec3624c49e0625a4c9c1f2f2736ba13bc5ff09a53d1&scene=58&subscene=0#rd) - - [技巧篇—利用搜索引擎高效调查](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512854&idx=2&sn=0aa11ebe7c053341219cbfa7ed69d918&chksm=8716b39db0613a8bf17f62811ca16f38484f2ad2c53bbcab69c3d6811b3449ea53ed847e7262&scene=58&subscene=0#rd) -- Twitter @hakivvi - - [RT Gynvael Coldwind: I've posted a short blog post about a Python sandbox challenge I've made for Google CTF 2022: I've also aggregated solutions I co...](https://twitter.com/gynvael/status/1553308976309276674) diff --git a/archive/2022/2022-08-01.md b/archive/2022/2022-08-01.md deleted file mode 100644 index b8968b2643..0000000000 --- a/archive/2022/2022-08-01.md +++ /dev/null @@ -1,102 +0,0 @@ -# 每日安全资讯（2022-08-01） - -- HackerOne Hacker Activity - - [Open S3 Bucket Accessible by any Aws User](https://hackerone.com/reports/1654145) -- Verne in GitHub - - [从 mkv 文件中提取字幕文件](https://einverne.github.io/post/2022/07/extract-subtitle-from-mkv.html) -- Security Boulevard - - [Filters, Protects, Blocks: 3 Ways A DNS Ensures Safer Online Experience](https://securityboulevard.com/2022/07/filters-protects-blocks-3-ways-a-dns-ensures-safer-online-experience/) - - [Aspen Security Forum 2022 – Anja Manuel, Aspen Strategy Group And Joseph Nye, Aspen Strategy Group And Dean Emeritus, Harvard Kennedy School, Harvard University ‘Day 2 Opening Remarks’](https://securityboulevard.com/2022/07/aspen-security-forum-2022-anja-manuel-aspen-strategy-group-and-joseph-nye-aspen-strategy-group-and-dean-emeritus-harvard-kennedy-school-harvard-university-day-2-opening-remarks/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 392’](https://securityboulevard.com/2022/07/robert-m-lees-jeff-haas-little-bobby-comic-week-392/) - - [Aspen Security Forum 2022 – Moderator: Trymaine Lee, MSNBC Correspondent ‘Fireside Chat With Secretary Alejandro N. Mayorkas, 7th Secretary, U.S. Department of Homeland’](https://securityboulevard.com/2022/07/aspen-security-forum-2022-moderator-trymaine-lee-msnbc-correspondent-fireside-chat-with-secretary-alejandro-n-mayorkas-7th-secretary-u-s-department-of-homeland/) - - [Richard Stiennon Talks about Security Yearbook 2022](https://securityboulevard.com/2022/07/richard-stiennon-talks-about-security-yearbook-2022/) - - [Cyber Attacks Against Critical Infrastructure Quietly Increase](https://securityboulevard.com/2022/07/cyber-attacks-against-critical-infrastructure-quietly-increase/) -- bunnie's blog - - [Name that Ware, July 2022](https://www.bunniestudios.com/blog/?p=6461) - - [Winner, Name that Ware June 2022](https://www.bunniestudios.com/blog/?p=6458) -- SecWiki News - - [SecWiki News 2022-07-31 Review](http://www.sec-wiki.com/?2022-07-31) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [IVANTIAVALANCHE漏洞利用（下）](https://www.4hou.com/posts/vJm0) - - [Magecart对餐厅订餐系统进行攻击](https://www.4hou.com/posts/2Jgz) -- unSafe.sh - 不安全 - - [[AHK＃53] AutoHotkey多行內容輸出時的偏移問題](https://buaq.net/go-120082.html) - - [timwhitez starred DeathSleep](https://buaq.net/go-120064.html) - - [Vulnerabilities Scan](https://buaq.net/go-120068.html) - - [YouTube影片實務02：Filmora 11製作Subscription推廣動畫的幾個方法](https://buaq.net/go-120057.html) - - [即将涨价的 VR 头显，买来可以玩什么？](https://buaq.net/go-120055.html) - - [Quickpost: iPad Pro Charging – Power Consumption](https://buaq.net/go-120049.html) - - [Barbee – 隐藏 macOS 菜单栏图标。想做 Bartender 平替？](https://buaq.net/go-120053.html) - - [用插件让新标签页回归空白，和恼人的搜索栏与广告标说再见](https://buaq.net/go-120048.html) -- Sploitus.com Exploits RSS Feed - - [Exploit for Code Injection in Vmware Spring Framework exploit](https://sploitus.com/exploit?id=C4EB8052-6E91-5327-87BE-51E8490B0A4E&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Wordpress exploit](https://sploitus.com/exploit?id=EF99CAFC-9C3F-5D3F-8BD9-A576A17E59E3&utm_source=rss&utm_medium=rss) -- modexp - - [Shellcode: Data Masking](https://modexp.wordpress.com/2022/07/31/shellcode-data-masking/) -- Twitter @Nicolas Krassas - - [Disclosing information with a side-channel in Django](https://twitter.com/Dinosn/status/1553800412775473155) - - [The Enchiridion of Impetus Exemplar (Intro to Threat Modeling)](https://twitter.com/Dinosn/status/1553800165663948800) - - [GSuite domain takeover through delegation](https://twitter.com/Dinosn/status/1553799945068609540) - - [Facebook ads push Android adware with 7 million installs on Google Play](https://twitter.com/Dinosn/status/1553799736775286789) - - [911 (](https://twitter.com/Dinosn/status/1553799707151011841) - - [Tim Hortons offer free coffee and donut to settle data privacy invasion claims](https://twitter.com/Dinosn/status/1553799582500388865) - - [Meta, U.S. hospitals sued for tracking patients on medical portals](https://twitter.com/Dinosn/status/1553799516331118593) - - [Shellcode: Data Masking](https://twitter.com/Dinosn/status/1553799458688847873) - - [Running Exploit As Protected Process Ligh From Userland](https://twitter.com/Dinosn/status/1553799414707265539) - - [Pokemon-Shellcode-Loader: Tired of looking at hex all day and popping '\x41's? Rather look at Lugia/Charmander? I have the solution for you.](https://twitter.com/Dinosn/status/1553799167964839937) - - [CQ, a code security scanner](https://twitter.com/Dinosn/status/1553798527465267200) - - [Month of PowerShell - Offensive PowerShell with Metasploit Meterpreter](https://twitter.com/Dinosn/status/1553798334242082816) - - [EDR Blindness, pt II](https://twitter.com/Dinosn/status/1553787082400829440) - - [Authentication Bypass Techniques using SQLi, PHP, XPath, and LDAP injection](https://twitter.com/Dinosn/status/1553787047932006401) - - [Huge network of 11,000 fake investment sites targets Europe](https://twitter.com/Dinosn/status/1553786344589197315) - - [Manipulating Windows Tokens with Go](https://twitter.com/Dinosn/status/1553616994133594114) - - [Critical Vulnerability Affecting Arris / Arris-variant DSL/Fiber Routers](https://twitter.com/Dinosn/status/1553616935320969216) - - [I'm Building a Self-Destructing USB Drive.](https://twitter.com/Dinosn/status/1553616891440250880) -- Recent Commits to cve:main - - [Update Sun Jul 31 11:35:04 UTC 2022](https://github.com/trickest/cve/commit/b8bf0453720a14df67f55001e01e91e8bd24802b) -- Blogs on dade - - [What the heck is Winget](https://0xda.de/blog/2022/07/what-the-heck-is-winget/) -- SAP Blogs - - [Printing of Warehouse order after confirmation in SAP EWM](https://blogs.sap.com/2022/07/31/printing-of-warehouse-order-after-confirmation-in-sap-ewm/) - - [Show Only What You Really Need](https://blogs.sap.com/2022/07/31/show-only-what-you-really-need/) - - [Backup and Recovery for the SAP HANA (BTP)](https://blogs.sap.com/2022/07/31/backup-and-recovery-for-the-sap-hana-btp/) - - [Use the Fediverse instead of Twitter, LinkedIn, …](https://blogs.sap.com/2022/07/31/use-the-fediverse-instead-of-twitter-linkedin-.../) - - [Configure Different Trust Configurations for the Same Identity Authentication Tenant (Azure AD Apps)](https://blogs.sap.com/2022/07/31/configure-different-trust-configurations-for-the-same-identity-authentication-tenant-azure-ad-apps/) - - [S/4HANA Grocery Retail Blog part 2](https://blogs.sap.com/2022/07/31/s-4hana-grocery-retail-blog-part-2/) - - [Magentrix (Service Portal) Integration with C4C](https://blogs.sap.com/2022/07/31/magentrix-service-portal-integration-with-c4c/) - - [Create S4 Solution Order from C4C Sales Quote via API](https://blogs.sap.com/2022/07/31/create-s4-solution-order-from-c4c-sales-quote-via-api/) -- Hexacorn - - [Week of Data Dumps, Part 5 – commands](https://www.hexacorn.com/blog/2022/07/31/week-of-data-dumps-part-5-commands/) -- Didier Stevens - - [Quickpost: iPad Pro Charging – Power Consumption](https://blog.didierstevens.com/2022/07/31/quickpost-ipad-pro-charging-power-consumption/) -- 丁爸情报分析师的工具箱 - - [【知识】轨迹挖掘](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651130960&idx=1&sn=8a68fdf5625cc98f9abbc48e36bf4620&chksm=f1af7b6ac6d8f27c7f97751da2a729a76b910368db58989b9049f0b9a4642a332777ac6054e2&scene=58&subscene=0#rd) -- 有价值炮灰 - - [IO_FILE 与高版本 glibc 中的漏洞利用技巧](https://mp.weixin.qq.com/s?__biz=MzA3MzU1MDQwOA==&mid=2247484063&idx=1&sn=a9557d0e9da2a34badffa271137ce8e9&chksm=9f0c1db8a87b94ae1e3fb080a40277e232c0330fd579654597b7d021711efe87470b95005e7b&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [ETC自助迁移小记](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486070&idx=1&sn=05515136fd9b351c86ff75b7067d4867&chksm=fab2c949cdc5405fee70d9e9d23e7e3d05fc54233b71314ba3b58ad0ec190968e6d90ef201e6&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [每日情报汇总分析](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492849&idx=1&sn=afefb1e2c82db31a67cc7161051a6770&chksm=e84c422edf3bcb3835edfd300461494f3748c99f29c9d2f4e19f29110677759a5791065e6dcc&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】“二舅币崩盘”上热搜，共发行1万亿枚，交易网站已无相关币种搜索信息](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652009920&idx=1&sn=133459f286b5766bdcebc674f581be0a&chksm=f36f5980c418d096fbd54d1bc952802e0d4c2f845b7d660aa92b62a87c200dc4c450396e9d0b&scene=58&subscene=0#rd) - - [【安全圈】杭州义桥综合行政执法队破获萧山区首例虚拟货币“挖矿”案件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652009920&idx=2&sn=0692dfe0fb45e6c16159e50fe20dc8e3&chksm=f36f5980c418d0963cc0c6d94d7ae27d5f3f7a61cf3b5e686b1ecf4bdf1d3689219111958445&scene=58&subscene=0#rd) - - [【安全圈】​广西、安徽警方破获利用“猫池”进行违法犯罪活动的案件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652009920&idx=3&sn=afe1ee81e5807de1f445be0164d07948&chksm=f36f5980c418d096081c5002b5827705d2cade95f14fd3380917415cef2908b4e42d6f354d63&scene=58&subscene=0#rd) - - [【安全圈】8月1日起施行！国家网信办《互联网用户账号信息管理规定》](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652009920&idx=4&sn=964cc256de486dc0294993dbf78997b8&chksm=f36f5980c418d0966802184f540fc668091566cc1e6197c62c8c5ce8d1b0bc5b8bbff1277efb&scene=58&subscene=0#rd) - - [【安全圈】​为"礼尚往来" ,俄罗斯黑客侵入乌克兰国防大学服务器](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652009920&idx=5&sn=423762365b3e15928c665e22d0eb3c72&chksm=f36f5980c418d096a0f5303c7c69b0a5f2a6e72fb147ba9ae4e2857dd27d9a07f8094fe64500&scene=58&subscene=0#rd) -- 红日安全 - - [这篇文章超有料——威胁情报共享07.31](https://mp.weixin.qq.com/s?__biz=MzI4NjEyMDk0MA==&mid=2649850788&idx=1&sn=df9da1833aa55d46fbfa6563cd685485&chksm=f3e4ed27c4936431ee39d4b98b9377b835c0972b5630309a10b8d2831d32e0374e8d9a8a5ffa&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [【公告】JSRC六月英雄榜单揭晓](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727834936&idx=1&sn=e1fa880452ae30fc45247a9614d5c9b9&chksm=8050a2b0b7272ba63720018e02d5bcf3f1e18984c0e89c2ff58142d25052a2a53c28d8c57d5e&scene=58&subscene=0#rd) -- 云鼎实验室 - - [每周云安全资讯-2022年第31周](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494600&idx=1&sn=1750545f70e3dfbaf001685c325da0c5&chksm=fd79174eca0e9e58f3551f0fc325ed839393f98d04d68e6c730fcdb5a1fe2ae1dbe684bc4d1c&scene=58&subscene=0#rd) -- 安全威胁情报 - - [今年HVV内存马杀疯了，怎么破？](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173451&idx=1&sn=fa6a7586c4d2d40c920fa414747ef427&chksm=f4488bb7c33f02a11f340c788711292e5e63a5a29d3bda2f7148c915fe280b2eeb4cc6d97263&scene=58&subscene=0#rd) -- 极客公园 - - [增长放缓，元宇宙岗位正在消失；马斯克反诉推特；亚马逊将关闭个人网盘业务｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962442&idx=1&sn=a44d72c2df170516f2bbac0cea5e6e25&chksm=7e55833c49220a2a6a3d0ea38a52b8cec8958e3561458630d0252ed6d5bf2fec333c65fcd5fe&scene=58&subscene=0#rd) -- 情报分析师 - - [全网追踪佩洛西，行程和名单公布，第一站新加坡！](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512887&idx=1&sn=4cdc0df7231e3b5e1dec66861a96bcd8&chksm=8716b3bcb0613aaafe990824b79f5b1e5fb0f4128af55c93d0a1e44feb01c4a12dc4c97810c0&scene=58&subscene=0#rd) - - [世界第一次数字战争才刚刚开始](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512887&idx=2&sn=fcb7d01d846ee3393bcf1f1393c7fe22&chksm=8716b3bcb0613aaa6397ccf0ed54508173f74712fe72032a2413b3127bfdd1368b9e99eb0325&scene=58&subscene=0#rd) -- Twitter @Keiran Smith (Affix) - - [You 👏🏻 can’t 👏🏻 target 👏🏻 fat 👏🏻 loss. The only way to loose da is calorie deficit #weightlossmyths #fatlosss #fitness #bulls...](https://twitter.com/cli/status/1553634410913824768) -- 安全研究GoSSIP - - [vSGX：在AMD SEV处理器上虚拟化SGX](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492105&idx=1&sn=4098c415e1a931395c544c476db819b7&chksm=c063ccd0f71445c6fe17c364ab326651b2fae3a058b5d92254934ef74c0de349f8f6a9bba8be&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-02.md b/archive/2022/2022-08-02.md deleted file mode 100644 index d9def50e8f..0000000000 --- a/archive/2022/2022-08-02.md +++ /dev/null @@ -1,289 +0,0 @@ -# 每日安全资讯（2022-08-02） - -- Files ≈ Packet Storm - - [Packet Storm New Exploits For July, 2022](https://packetstormsecurity.com/files/167907/202207-exploits.tgz) - - [Ubuntu Security Notice USN-5542-1](https://packetstormsecurity.com/files/167905/USN-5542-1.txt) - - [Backdoor.Win32.Destrukor.20 MVID-2022-0627 Remote Command Execution](https://packetstormsecurity.com/files/167904/MVID-2022-0627.txt) - - [Omnia MPX 1.5.0+r1 Path Traversal](https://packetstormsecurity.com/files/167903/omniampx150-traversal.txt) - - [Red Hat Security Advisory 2022-5770-01](https://packetstormsecurity.com/files/167902/RHSA-2022-5770-01.txt) - - [NanoCMS 0.4 Remote Code Execution](https://packetstormsecurity.com/files/167901/nanocms04-exec.txt) - - [Red Hat Security Advisory 2022-5767-01](https://packetstormsecurity.com/files/167900/RHSA-2022-5767-01.txt) - - [CuteEditor For PHP 6.6 Directory Traversal](https://packetstormsecurity.com/files/167899/cuteeditorforphp66-traversal.txt) - - [Backdoor.Win32.Destrukor.20 MVID-2022-0626 Authentication Bypass / Code Execution](https://packetstormsecurity.com/files/167898/MVID-2022-0626.txt) - - [mPDF 7.0 Local File Inclusion](https://packetstormsecurity.com/files/167897/mpdf70-lfi.txt) - - [WordPress Duplicator 1.4.6 Backup Disclosure](https://packetstormsecurity.com/files/167896/wpduplicator146-disclose.txt) - - [WordPress Duplicator 1.4.7 Information Disclosure](https://packetstormsecurity.com/files/167895/wpduplicator147-disclose.txt) - - [Webmin 1.996 Remote Code Execution](https://packetstormsecurity.com/files/167894/webmin1996-exec.txt) - - [CodeIgniter CMS 4.2.0 SQL Injection](https://packetstormsecurity.com/files/167893/codeignitercms420-sql.txt) - - [Easy Chat Server 3.1 Buffer Overflow](https://packetstormsecurity.com/files/167892/easychatserver31-overflow.txt) - - [Wavlink WN530HG4 Password Disclosure](https://packetstormsecurity.com/files/167891/wavlinkwn530hg4-disclose.txt) - - [Wavlink WN533A8 Password Disclosure](https://packetstormsecurity.com/files/167890/wavlinkwn533a8-disclose.txt) - - [Wavlink WN533A8 Cross Site Scripting](https://packetstormsecurity.com/files/167889/wavlinkwn533a8-xss.txt) - - [WordPress SeatReg 1.23.0 Open Redirect](https://packetstormsecurity.com/files/167888/wpseatreg1230-redirect.txt) - - [Crime Reporting System 1.0 SQL Injection](https://packetstormsecurity.com/files/167906/crimereportingsystem10-sql.txt) -- HackerOne Hacker Activity - - [Insecure TLS Configuration #3530](https://hackerone.com/reports/1639423) - - [delete the subaccount from the user id](https://hackerone.com/reports/1646340) - - [Insecure use of shell.openExternal() in Rocket.Chat Desktop App leading to RCE](https://hackerone.com/reports/924151) - - [Race condition on https://judge.me/people](https://hackerone.com/reports/1566017) -- Recent Commits to cve:main - - [Update Mon Aug 1 11:33:58 UTC 2022](https://github.com/trickest/cve/commit/4c7de90c4083918ba8541cedd5ed660e09a1dbd6) -- Security Boulevard - - [Backup Encryption: What It Is and Why It’s Important for Data Security](https://securityboulevard.com/2022/08/backup-encryption-what-it-is-and-why-its-important-for-data-security/) - - [This was H1 2022 – Part 1 – The Fight Against Cybercrime](https://securityboulevard.com/2022/08/this-was-h1-2022-part-1-the-fight-against-cybercrime/) - - [GhangorCloud Extends AI Platform to Automate Compliance](https://securityboulevard.com/2022/08/ghangorcloud-extends-ai-platform-to-automate-compliance/) - - [Visibility into Peacetime Traffic. Is it Too Much to Expect From Your DDoS Protection Provider?](https://securityboulevard.com/2022/08/visibility-into-peacetime-traffic-is-it-too-much-to-expect-from-your-ddos-protection-provider/) - - [How to Stop Outages in Your Kubernetes Clusters [Case Study]](https://securityboulevard.com/2022/08/how-to-stop-outages-in-your-kubernetes-clusters-case-study/) - - [Aspen Security Forum 2022 – Moderator: David Sanger ‘Fireside Chat On Cyber, Crypto And Quantum With Anne Neuberger’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-david-sanger-fireside-chat-on-cyber-crypto-and-quantum-with-anne-neuberger/) - - [The New Features in Frontline’s Latest Release: Everything You Need To Know](https://securityboulevard.com/2022/08/the-new-features-in-frontlines-latest-release-everything-you-need-to-know/) - - [This Year’s Global Partner Award Winners Are Customer-Wired](https://securityboulevard.com/2022/08/this-years-global-partner-award-winners-are-customer-wired/) - - [10 Essential Cybersecurity Tips to Ensure Safe Online Shopping for Customers](https://securityboulevard.com/2022/08/10-essential-cybersecurity-tips-to-ensure-safe-online-shopping-for-customers/) - - [Daniel Stori’s ‘Ghost In The Shell’](https://securityboulevard.com/2022/08/daniel-storis-ghost-in-the-shell/) -- SecWiki News - - [SecWiki News 2022-08-01 Review](http://www.sec-wiki.com/?2022-08-01) -- Sploitus.com Exploits RSS Feed - - [NanoCMS 0.4 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167901&utm_source=rss&utm_medium=rss) - - [Wavlink WN530HG4 Password Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:167891&utm_source=rss&utm_medium=rss) - - [Omnia MPX 1.5.0+r1 - Path Traversal Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37882&utm_source=rss&utm_medium=rss) - - [Omnia MPX 1.5.0+r1 Path Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:167903&utm_source=rss&utm_medium=rss) - - [mPDF 7.0 - Local File Inclusion Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37881&utm_source=rss&utm_medium=rss) - - [Wavlink WN533A8 - Cross-Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37875&utm_source=rss&utm_medium=rss) - - [mPDF 7.0 Local File Inclusion exploit](https://sploitus.com/exploit?id=PACKETSTORM:167897&utm_source=rss&utm_medium=rss) - - [Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH) Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37885&utm_source=rss&utm_medium=rss) - - [Webmin 1.996 - Remote Code Execution (RCE) (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:50998&utm_source=rss&utm_medium=rss) - - [Webmin 1.996 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167894&utm_source=rss&utm_medium=rss) - - [Wavlink WN533A8 - Password Disclosure exploit](https://sploitus.com/exploit?id=EDB-ID:50990&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Destrukor.20 MVID-2022-0626 Authentication Bypass / Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167898&utm_source=rss&utm_medium=rss) - - [CodeIgniter CMS 4.2.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167893&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Destrukor.20 MVID-2022-0627 Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167904&utm_source=rss&utm_medium=rss) - - [CuteEditor For PHP 6.6 Directory Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:167899&utm_source=rss&utm_medium=rss) - - [Easy Chat Server 3.1 Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:167892&utm_source=rss&utm_medium=rss) - - [WordPress Plugin Duplicator 1.4.7 - Information Disclosure exploit](https://sploitus.com/exploit?id=EDB-ID:50993&utm_source=rss&utm_medium=rss) - - [WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download exploit](https://sploitus.com/exploit?id=EDB-ID:50992&utm_source=rss&utm_medium=rss) - - [Omnia MPX 1.5.0+r1 - Path Traversal exploit](https://sploitus.com/exploit?id=EDB-ID:50996&utm_source=rss&utm_medium=rss) - - [Wavlink WN530HG4 - Password Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37877&utm_source=rss&utm_medium=rss) - - [WordPress Duplicator 1.4.6 Plugin - Unauthenticated Backup Download Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37879&utm_source=rss&utm_medium=rss) - - [WordPress Duplicator 1.4.7 Plugin - Information Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37878&utm_source=rss&utm_medium=rss) - - [WordPress Duplicator 1.4.6 Backup Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:167896&utm_source=rss&utm_medium=rss) - - [mPDF 7.0 - Local File Inclusion exploit](https://sploitus.com/exploit?id=EDB-ID:50995&utm_source=rss&utm_medium=rss) - - [Wavlink WN533A8 - Password Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37876&utm_source=rss&utm_medium=rss) - - [NanoCMS v0.4 - Remote Code Execution (RCE) (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:50997&utm_source=rss&utm_medium=rss) - - [Wavlink WN530HG4 - Password Disclosure exploit](https://sploitus.com/exploit?id=EDB-ID:50991&utm_source=rss&utm_medium=rss) - - [Crime Reporting System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167906&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Wso2 Api Manager exploit](https://sploitus.com/exploit?id=73D3FF42-50ED-5AA6-BE08-B8A26D20593A&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Initialization in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=707C38FA-F0B2-55CC-8D02-98EDBDDA27DB&utm_source=rss&utm_medium=rss) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Transposh WordPress Translation 1.0.8.1 Cross Site Request Forgery](https://cxsecurity.com/issue/WLB-2022080008) - - [Transposh WordPress Translation 1.0.7 Incorrect Authorization](https://cxsecurity.com/issue/WLB-2022080007) - - [Transposh WordPress Translation 1.0.7 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022080006) - - [WordPress Plugin WP-UserOnline 2.87.6 Stored Cross-Site Scripting (XSS)](https://cxsecurity.com/issue/WLB-2022080005) - - [Kaivalya Techno Soft Pvt - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022080004) - - [Backdoor.Win32.Destrukor.20 / Authentication Bypass](https://cxsecurity.com/issue/WLB-2022080003) - - [Try Catch Technologies - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022080002) - - [Backdoor.Win32.Destrukor.20 / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022080001) -- unSafe.sh - 不安全 - - [Have we lost the fight for data privacy? Lock and Code S03E16](https://buaq.net/go-120299.html) - - [CVE-2022-35405 Zoho Password Manager Pro XML-RPC RCE](https://buaq.net/go-120275.html) - - [不删除"key"的CC6反序列化](https://buaq.net/go-120276.html) - - [域渗透之委派攻击全集](https://buaq.net/go-120277.html) - - [麻烦版主删除这些无用招聘信息删除账号](https://buaq.net/go-120268.html) - - [A Detailed Analysis of the RedLine Stealer](https://buaq.net/go-120280.html) - - [GitLab Security Issues: Six Months of Vulnerabilities](https://buaq.net/go-120281.html) - - [AllHackingTools - a system designed to automate the download process and install various tools for penetration testing.](https://buaq.net/go-120259.html) - - [Network Pivoting Techniques](https://buaq.net/go-120261.html) - - [uiuctf-2022-writeup](https://buaq.net/go-120269.html) - - [SilentHound - Quietly Enumerate An Active Directory Domain Via LDAP Parsing Users, Admins, Groups, Etc.](https://buaq.net/go-120260.html) -- 安全客-有思想的安全新媒体 - - [一款WebShell检测引擎的开发与实践](https://www.anquanke.com/post/id/277270) - - [二季度勒索软件报告显示赎金中位数继续下降](https://www.anquanke.com/post/id/277207) -- Blog & What's New | Offensive Security - - [Introduction to Car Hacking: The CAN Bus](https://www.offensive-security.com/offsec/introduction-to-car-hacking-the-can-bus/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [数字经济时代下如何满足多种云环境安全需求？](https://www.4hou.com/posts/JXPg) - - [安全狗云原生安全能力全面亮相全球数字经济大会暨ISC互联网安全大会](https://www.4hou.com/posts/6VzV) - - [揭示OT安全四大挑战！Fortinet 发布《2022年全球运营技术和网络安全态势报告》](https://www.4hou.com/posts/8YBg) - - [银保监会发布《关于进一步促进信用卡业务规范健康发展的通知》，强化个人信息保护](https://www.4hou.com/posts/2J11) - - [混合工作的现实驱动基于硬件的新型安全策略](https://www.4hou.com/posts/9XpD) - - [CVE-2022-30563：浙江大华网络摄像机安全漏洞](https://www.4hou.com/posts/PJ51) - - [ISC 2022 | 360叶健：以“看见”为核心打造数字安全体系](https://www.4hou.com/posts/3JKO) - - [重磅官宣|2022 CCS成都网络安全大会暨网络数据治理峰会定档——云上安全新形态，拥抱数字新未来](https://www.4hou.com/posts/17BV) - - [增强级，高性能！奇安信新一代智慧防火墙通过三类产品评测](https://www.4hou.com/posts/ZXmw) -- Twitter @Nicolas Krassas - - [CVE-2022-35405 Zoho Password Manager Pro XML-RPC RCE](https://twitter.com/Dinosn/status/1554183923286040577) - - [Founder Of Pro Russian Hacktivist Killnet Quitting Group](https://twitter.com/Dinosn/status/1554183467973353477) - - [Millions of Arris routers are vulnerable to path traversal attacks](https://twitter.com/Dinosn/status/1554183257041915905) - - [Steam, PayPal blocked as Indonesia enforces new Internet regulation](https://twitter.com/Dinosn/status/1554183205716205570) - - [Chromium Browsers Allow Data Exfiltration via Bookmark Syncing](https://twitter.com/Dinosn/status/1554183115173773313) - - [Researchers Discover Nearly 3,200 Mobile Apps Leaking Twitter API Keys](https://twitter.com/Dinosn/status/1554182373318836226) - - [BlackCat ransomware claims attack on European gas pipeline](https://twitter.com/Dinosn/status/1554114427640758275) - - [SilentHound - Quietly Enumerate An Active Directory Domain Via LDAP Parsing Users, Admins, Groups, Etc.](https://twitter.com/Dinosn/status/1554108078366285824) - - [Why this EASY vulnerability resulted in a $20,000 bug bounty from GitLab](https://twitter.com/Dinosn/status/1554093732093468672) - - [Chisel-Strike: .NET XOR encrypted cobalt strike aggressor implementation](https://twitter.com/Dinosn/status/1554093545199489024) - - [cats: REST API Fuzzer and negative testing tool](https://twitter.com/Dinosn/status/1554059385747525634) - - [DongTai is an interactive application security testing(IAST) product that supports the detection of OWASP WEB TOP 10 vulnerabilities](https://twitter.com/Dinosn/status/1554056219991613441) - - [LinkedIn enumeration tool to extract valid employee names from an organization through search engine scraping](https://twitter.com/Dinosn/status/1554055217410412544) - - [A flaw in Dahua IP Cameras allows full take over of the devices](https://twitter.com/Dinosn/status/1554050009053777922) - - [Re @_inno92 @SaveToNotion Muted](https://twitter.com/Dinosn/status/1554049817424404482) - - [Threat actor claims to have hacked European manufacturer of missiles MBDA](https://twitter.com/Dinosn/status/1553963681318322176) - - [Australia charges dev of Imminent Monitor RAT used by domestic abusers](https://twitter.com/Dinosn/status/1553963634363088896) -- 安全脉搏 - - [以训辅教，以战促学 | 新版攻防世界平台正式上线运营！](https://www.secpulse.com/archives/184588.html) - - [对一个手游修改器锁机APP的分析](https://www.secpulse.com/archives/184569.html) - - [Microsoft SQL服务器被黑客入侵 带宽被窃取](https://www.secpulse.com/archives/184530.html) - - [如何为 Web 应用程序执行安全测试](https://www.secpulse.com/archives/184507.html) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor](https://blog.qualys.com/category/vulnerabilities-threat-research) -- 先知安全技术社区 - - [CVE-2022-35405 Zoho Password Manager Pro XML-RPC RCE](https://xz.aliyun.com/t/11578) - - [不删除"key"的CC6反序列化](https://xz.aliyun.com/t/11562) - - [域渗透之委派攻击全集](https://xz.aliyun.com/t/11555) -- 先知安全技术社区 - - [CVE-2022-35405 Zoho Password Manager Pro XML-RPC RCE](https://xz.aliyun.com/t/11578) - - [不删除"key"的CC6反序列化](https://xz.aliyun.com/t/11562) - - [域渗透之委派攻击全集](https://xz.aliyun.com/t/11555) -- Current Posts - Red Team Journal - - [Sorry, No Case Studies—But . . .](https://www.redteamjournal.com/blog/sorry-no-case-study) -- Bug Bounty in InfoSec Write-ups on Medium - - [Zero-day XSS](https://infosecwriteups.com/zero-day-xss-309916922ea6?source=rss----7b722bfd1b8d--bug_bounty) - - [Why this EASY vulnerability resulted in a $20,000 bug bounty from GitLab](https://infosecwriteups.com/how-this-easy-vulnerability-resulted-in-a-20-000-bug-bounty-from-gitlab-d9dc9312c10a?source=rss----7b722bfd1b8d--bug_bounty) - - [This SIMPLE vulnerability in Shopify earned a $2500 bug bounty](https://infosecwriteups.com/this-simple-vulnerability-in-shopify-earned-a-2500-bug-bounty-25f0b8358012?source=rss----7b722bfd1b8d--bug_bounty) -- Didier Stevens - - [Overview of Content Published in July](https://blog.didierstevens.com/2022/08/01/overview-of-content-published-in-july-7/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/wdard0/rreverseengineerings_weekly_questions_thread/) - - [A Detailed Analysis of the RedLine Stealer](https://www.reddit.com/r/ReverseEngineering/comments/wdi4vj/a_detailed_analysis_of_the_redline_stealer/) -- blog.avast.com EN - - [Prepare for a Hacking Incident | Avast](https://blog.avast.com/prepare-hacking-incident) - - [NSO Pegasus Spyware Developments | Avast](https://blog.avast.com/nso-pegasus-spyware-developments) -- SAP Blogs - - [“I feel the need, the need for speed” (How to speed up your SAP S/4HANA Digital Transformation)](https://blogs.sap.com/2022/08/01/i-feel-the-need-the-need-for-speed-how-to-speed-up-your-sap-s-4hana-digital-transformation/) - - [SAP Open Connectors – Healthcare info from Epic FHIR Sandbox systems](https://blogs.sap.com/2022/08/01/sap-open-connectors-healthcare-info-from-epic-fhir-sandbox-systems/) - - [Currency conversion in BW/4HANA, Enterprise HANA Modelling](https://blogs.sap.com/2022/08/01/currency-conversion-in-bw-4hana-enterprise-hana-modelling/) - - [SAP S/4 HANA for Manufacturing Logistics: Key Learnings from a Successful Event Showcase](https://blogs.sap.com/2022/08/01/sap-s-4-hana-for-manufacturing-logistics-key-learnings-from-a-successful-event-showcase/) - - [New Payment Purpose in SAP Business ByDesign](https://blogs.sap.com/2022/08/01/new-payment-purpose-in-sap-business-bydesign/) - - [Realize More Value from Your RISE with SAP S/4HANA Cloud, private edition](https://blogs.sap.com/2022/08/01/realize-more-value-from-your-rise-with-sap-s-4hana-cloud-private-edition/) - - [HCM Brasil: pré-requisitos de Support Package para implementação de SAP Notes](https://blogs.sap.com/2022/08/01/hcm-brasil-pre-requisitos-de-support-package-para-implementacao-de-sap-notes-5/) - - [The SAP S/4HANA Cloud Universe](https://blogs.sap.com/2022/08/01/the-sap-s-4hana-cloud-universe/) - - [SAP Business Technology Platform中国数据中心和全球数据中心的差异](https://blogs.sap.com/2022/08/01/sap-business-technology-platform%e4%b8%ad%e5%9b%bd%e6%95%b0%e6%8d%ae%e4%b8%ad%e5%bf%83%e5%92%8c%e5%85%a8%e7%90%83%e6%95%b0%e6%8d%ae%e4%b8%ad%e5%bf%83%e7%9a%84%e5%b7%ae%e5%bc%82/) -- Hex Rays - - [IDA 8.0 released](https://hex-rays.com/blog/ida-8-0-released/) -- Malwarebytes Labs - - [When a sextortion victim fights back](https://blog.malwarebytes.com/hacking-2/2022/08/when-a-sextortion-victim-fights-back/) - - [Millions of Arris routers are vulnerable to path traversal attacks](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/) - - [Wrestling star Mick Foley’s Twitter compromised, selling PS5 consoles](https://blog.malwarebytes.com/scams/2022/08/wrestling-star-mick-foleys-twitter-compromised-selling-ps5-consoles/) - - [Have we lost the fight for data privacy? Lock and Code S03E16](https://blog.malwarebytes.com/podcast/2022/08/have-we-lost-the-fight-for-data-privacy-lock-and-code-s03e16/) - - [A week in security (July 25 – July 31)](https://blog.malwarebytes.com/a-week-in-security/2022/08/a-week-in-security-july-25-july-31/) -- KitPloit - PenTest & Hacking Tools - - [SilentHound - Quietly Enumerate An Active Directory Domain Via LDAP Parsing Users, Admins, Groups, Etc.](http://www.kitploit.com/2022/08/silenthound-quietly-enumerate-active.html) - - [PR-DNSd - Passive-Recursive DNS Daemon](http://www.kitploit.com/2022/07/pr-dnsd-passive-recursive-dns-daemon.html) -- The Daily Swig | Cybersecurity news and views - - [‘You get respect for owning what happened’ – SolarWinds’ CISO on the legacy and lessons of Sunburst](https://portswigger.net/daily-swig/you-get-respect-for-owning-what-happened-solarwinds-ciso-on-the-legacy-and-lessons-of-sunburst) - - [CompleteFTP path traversal flaw allowed attackers to delete server files](https://portswigger.net/daily-swig/completeftp-path-traversal-flaw-allowed-attackers-to-delete-server-files) -- Wallarm - - [GitLab Security Issues: Six Months of Vulnerabilities](https://lab.wallarm.com/gitlab-security-issues-six-months-of-vulnerabilities/) -- 安全客 - - [【技术分享】我是如何入侵Apple并拿到40万赏金的（二）](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774614&idx=1&sn=0ee01d1de5cdfc2748207245a6913598&chksm=88936a79bfe4e36f8363a9be5d46ae5c94f3c142a666f098f3d11de50e2ca55984f63181a27a&scene=58&subscene=0#rd) - - [【安全头条】二季度勒索软件报告显示赎金中位数继续下降](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774614&idx=2&sn=11901a05f17b344728b08f047137b87e&chksm=88936a79bfe4e36fe845546fdf641e55c633a06b33617df7e80d5cec9956bab715b1b1b6af72&scene=58&subscene=0#rd) -- Security Café - - [Certified Hybrid Multi-Cloud Red Team Specialist – Review and Tips](https://securitycafe.ro/2022/08/01/certified-hybrid-multi-cloud-red-team-specialist-review-and-tips/) -- 绿盟科技研究通讯 - - [每日情报汇总分析](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492861&idx=1&sn=fda772551cbfa9081fb11bdf33a5f1f9&chksm=e84c4222df3bcb34ebff654facad9b8be911451e76316d44cd937b3a10520b0636ff10da22c5&scene=58&subscene=0#rd) - - [每日情报汇总分析-0730](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492861&idx=2&sn=ae91e2afeccc8b25284529afeabd8162&chksm=e84c4222df3bcb346978f7bfde1609bbacdf4cda42efd3ec55935a334f19ec26ec47b3ec6964&scene=58&subscene=0#rd) -- 雷神众测 - - [热烈庆祝中国人民解放军建军95周年](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498945&idx=1&sn=5810f36b8688af6f2864a1e06c14d98f&chksm=f2584fb2c52fc6a4eebf5ab3997092de4acc49a58e35c13e89dc1027ff45872596687e7527f0&scene=58&subscene=0#rd) -- 暗影安全 - - [TP-Link AX50 远程代码执行](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163102&idx=1&sn=67899ac8625310131ce694b5a42ee868&chksm=f1d4e5bbc6a36cad9d81db901fe28dd6faeef101625786b5d7607cf89497aef4b2331ca25a8c&scene=58&subscene=0#rd) - - [CVE: N/A（Schneider Electric C-Bus Automation Controller～）](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163102&idx=2&sn=4b35f1d7b7e326cd2990a17e6f21a1a0&chksm=f1d4e5bbc6a36cad0cc8f07d41a26784942a5827d1b65bf26897cab9037b0516b8180534448e&scene=58&subscene=0#rd) - - [ISC2022 HackingClub白帽峰会倒计时1天！最全议程正式公布！元宇宙集结，精彩绝伦！](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163102&idx=3&sn=05d22208e7aca1440f188c1146263372&chksm=f1d4e5bbc6a36cad1f16ec4697ddfa896143b432d679a08159f653dda263162dd7f4ba818146&scene=58&subscene=0#rd) - - [以训辅教，以战促学 | 新版攻防世界平台正式上线运营！](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163096&idx=1&sn=9c141967591e0124cdc7c26500d66028&chksm=f1d4e5bdc6a36cab882aa8c3eae98be12edf47ebbd5df29c25441fa1b283ecb995a9717b8bf5&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【情报实战】佩洛西去台湾了？](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651130985&idx=1&sn=d02e42995a26cb7df0b07d8bf80eff6d&chksm=f1af7b53c6d8f2458ba1a40b5e2dfaedaf3d09a33a7f793f0249c77917935acacf0910aa8686&scene=58&subscene=0#rd) -- 看雪学院 - - [so文件分析的一些心得](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458459775&idx=1&sn=6c0c9339f1ffc06d3eba9a4e595e75ff&chksm=b18e2ef586f9a7e384e18d417ac75f9c2d12d1364b5c5f14dc1b42a7fc94b0f4d5e75c0e4d4e&scene=58&subscene=0#rd) - - [一澳大利亚黑客被指控自15岁起售卖14500份间谍软件](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458459775&idx=2&sn=c6a18412b0e537bb9339fc74371bb7e3&chksm=b18e2ef586f9a7e359f7152c359670dd7af77b973ea9e48db43e73865c251be47ee9abc8171d&scene=58&subscene=0#rd) -- 互联网安全内参 - - [美国联邦法院系统曝数据泄露：“广度和范围惊人”！司法部已介入调查](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504804&idx=1&sn=8cca62f71f2c8514cc4f98b8b1f6eaf9&chksm=ebfa9484dc8d1d927af71561dfcfc516eb872f117fa2731602980c0ebfe1b810a46aa7da255b&scene=58&subscene=0#rd) - - [苹果网络流量诡异绕道俄罗斯](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504804&idx=2&sn=655fa241581896c3f358c49983016316&chksm=ebfa9484dc8d1d92f0a31b4f4ae9a351a71a85436407a0d3ef8a6172a30718642f87e243db79&scene=58&subscene=0#rd) - - [开源安全的利器：八个顶级SBOM工具](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504804&idx=3&sn=e4d292f404147f4ca1a270fbeac56379&chksm=ebfa9484dc8d1d92b6f39426859a2a9d3c8341445a70e3a2be03c84edb79b4a78f47b1b0ef48&scene=58&subscene=0#rd) - - [OT网络不堪一击！Mandiant发布红队模拟勒索软件测试结果](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504804&idx=4&sn=d63e3f570c4a72341b33669f52ecced9&chksm=ebfa9484dc8d1d92306e703b67230eeaf0566803c4e424ce3314e2ac7a41458f44a181c0b3b7&scene=58&subscene=0#rd) -- 腾讯安全威胁情报中心 - - [御界NDR「横移检测版」保卫内网安全，全面检测域渗透攻击](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500450&idx=1&sn=04d236671a17942a0d16b2c42550bc98&chksm=ec9f1bd1dbe892c7a828c6ab887ff30534347833fb21e6798970c11cb1028a3a3e4dcbc784cc&scene=58&subscene=0#rd) - - [重保特辑｜拦截99%恶意流量，揭秘WAF攻防演练最佳实践](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500450&idx=2&sn=5e9547381c2ec0bba0ebc82d8926fedc&chksm=ec9f1bd1dbe892c754f827b25d8b5b49c52cb3c39837216288eccb789f1e089d11d23cd212d8&scene=58&subscene=0#rd) - - [重保特辑｜筑牢第一道防线，云防火墙攻防演练最佳实践](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500450&idx=3&sn=c77293505c89d6ef4e713bbeaaba90bf&chksm=ec9f1bd1dbe892c71bc36fc87f76895cc9cf941d2116c37d45f5c8103588d3d65d0bcaafe59d&scene=58&subscene=0#rd) -- text/plain - - [Certificate Revocation in Microsoft Edge](https://textslashplain.com/2022/08/01/certificate-revocation-in-microsoft-edge/) -- 白帽100安全攻防实验室 - - [以训辅教，以战促学 | 新版攻防世界平台正式上线运营！](https://mp.weixin.qq.com/s?__biz=MzIxMDYyNTk3Nw==&mid=2247490166&idx=1&sn=e7daec76fb980a4bf5329efaf2ef6044&chksm=9760eea0a01767b6ecde642171264d1d195bb0cb1a284c347eb26c73a08f7cb6b37ce00d1382&scene=58&subscene=0#rd) -- Tide安全团队 - - [RBCD深度利用之烂番茄](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247499797&idx=1&sn=4f711bb40c910890e38c8504672427e5&chksm=ce5de274f92a6b62113f4a16b34af20f84fa719ef116beb709ead6ca5011c64285b3cb13e4dc&scene=58&subscene=0#rd) -- 数世咨询 - - [QuSecure签署量子安全合同 每年价值超过1亿美元](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494465&idx=1&sn=e9bf38be5e0eb5d13dc12c1087bec2a7&chksm=c14499fcf63310eaf758a80d25806a3cd7b6d58f279989001d88dfb9ba3b925e54e88dd7e607&scene=58&subscene=0#rd) -- M01NTeam - - [攻击技术研判 | 改进的反虚拟机反调试技术](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489099&idx=1&sn=ea3ed0a66c21c419bb9a7d0088fb646d&chksm=c187d65af6f05f4c5073be0bdaa3bb0e9d2765bf9d04df3b6b9caacb077a0e2e74b74e96697d&scene=58&subscene=0#rd) -- XCTF联赛 - - [以训辅教，以战促学 | 新版攻防世界平台正式上线运营！](https://mp.weixin.qq.com/s?__biz=MjM5NDU3MjExNw==&mid=2247507412&idx=1&sn=a8eb1bfbec4dea0bbd2461f0ebdca6aa&chksm=a6872fee91f0a6f8e22246e174cd414eb1430963d2b2ef73cbfed958e11e174fff4c22e33eda&scene=58&subscene=0#rd) -- 情报分析师 - - [情报必读精选电子书合集](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512888&idx=1&sn=5a037d0f0204f9a7505018abe3ccb161&chksm=8716b3b3b0613aa500cf4bbce926988a33b8daae31810632fc84b535514a7ad7031edd8e67c8&scene=58&subscene=0#rd) -- Twitter @hakivvi - - [RT DreyAnd: My writeup for the Intigriti July XSS challenge:](https://twitter.com/dreyand_/status/1553899592630034433) -- NOVASEC - - [DNSlog搭建-单域名单接管部署RevSuit](https://mp.weixin.qq.com/s?__biz=MzUzODU3ODA0MA==&mid=2247487700&idx=1&sn=4af97026bfd01081929e94f225ced5eb&chksm=fad4cdc3cda344d5677dbd7e0b5875038eb830701f8c9cacf3439697dd7d81ea5d38f9b02230&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 全球数据跨境流动标准合同条款研究](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530083&idx=1&sn=3f79dd4f02812008f112e5152b0ac471&chksm=fa93c0a2cde449b42e80c0f3fcca4dbfffb2676b5384898b9c37b6642d5ba51cc6888eaddc4c&scene=58&subscene=0#rd) - - [国家工程研究中心安全资讯周报20220801期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530083&idx=2&sn=6facb7d3d612d228aca0dac1b8ae1624&chksm=fa93c0a2cde449b48d7135d3fb9896a3f0656506518ca03ee6fbd1547f1814508c218a68e621&scene=58&subscene=0#rd) - - [美国众议院通过了《勒索软件法案》主要应对俄罗斯、朝鲜、伊朗在内的多国勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530083&idx=3&sn=d95717d14b13779d9f947fbccfd7782a&chksm=fa93c0a2cde449b4da9f5f6ebc3886e5cedb938d1a47d52a398aadcf6d95af7f3df456bcb27e&scene=58&subscene=0#rd) - - [Magecart对餐厅订餐系统进行攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530083&idx=4&sn=bfb0b96d9da192e4065a1dc7e6b698c3&chksm=fa93c0a2cde449b4e447108ed2b0054ae3c9e1e6de3082e50dfa3ca0fe6fd848cb6d4dc826fc&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [CVE-2022-30563：浙江大华网络摄像机安全漏洞](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546999&idx=1&sn=ccd9fc528b987ec53f7febef04249f2d&chksm=e915e84dde62615bf1d125e0805bb74295a7cc6222e2559294e5cb420c369fd77c860129cd43&scene=58&subscene=0#rd) - - [混合工作的现实驱动基于硬件的新型安全策略](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247546999&idx=2&sn=a10af04ec44a3d895a686ec983fbc2a0&chksm=e915e84dde62615bd3bf5cd6ecc925bd1f985c358a0951380b9d913142e05284c1f134a960f1&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | 2022年移动应用安全状况（附报告下载）](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494651&idx=1&sn=e150c9509c86507056017d8b9bb9adc3&chksm=c0074667f770cf7119e689f69cee3f721166c2c0acb5f846200adb47ec20be58621dc1990a75&scene=58&subscene=0#rd) -- Checkmarx.com - - [Why Great Code is Secure Code](https://checkmarx.com/blog/why-great-code-is-secure-code/) -- 三六零CERT - - [安全事件周报 (07.25-07.31)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491209&idx=1&sn=6f8659783bc3b467284f3ff9dc946073&chksm=fe251b88c952929e8ba05a8e75e9a7660de5425849f7072ec36aacc9a7e41339900c2eb4a45b&scene=58&subscene=0#rd) - - [安全日报（2022.08.01）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491209&idx=2&sn=6d1b1c9ea261197fcaa72351d9568d29&chksm=fe251b88c952929e216bb38d264ee90694c441f3fa0006297436b73b34b1fc6278e3d51e0723&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】“倒虫草”结果被虚拟货币“割韭菜”](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010145&idx=1&sn=176606248b57594060c1f63cc0c1bb88&chksm=f36f5ae1c418d3f7a469e3c9b30bf6503101c51f4526f321068921bbd7e10cb36834b42ff67d&scene=58&subscene=0#rd) - - [【安全圈】美国法院遭受“难以置信的重大攻击”—密封文件面临风险](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010145&idx=2&sn=d71a29ed81574d57576356a13ef653ac&chksm=f36f5ae1c418d3f7789a5db4415a2b6521254b8c89a1d172a9068d26ede59c096d5714a36efa&scene=58&subscene=0#rd) - - [【安全圈】洪都拉斯建立比特币中心 美国国务院触手伸向朝鲜黑客](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010145&idx=3&sn=f807f3370d51dbc1b21be562a1987466&chksm=f36f5ae1c418d3f71d68036e500506ddd8166ae1c0a2955eb255732371e17818b05a218180b6&scene=58&subscene=0#rd) - - [【安全圈】澳洲男子因向数万名网络犯罪分子销售间谍软件而被捕](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010145&idx=4&sn=99eba49acc167703c54e3b520727f51f&chksm=f36f5ae1c418d3f701c896edc3089b8f17c437901de18be0eb604bb646ea5b51fac34c444000&scene=58&subscene=0#rd) - - [【安全圈】ISC 2022王一鸣：筑牢适应数字经济发展的网络和数据安全屏障](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010145&idx=5&sn=f5b07b014093b79cbb9caad4d2ed120f&chksm=f36f5ae1c418d3f7a9d65e0d999af20b42543ab6796b2e4183cbeb38f1cb51d8d9be7ee07601&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [8.1 每日情报要闻总结](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247495110&idx=1&sn=4ef036fca36142366c909667b9fbc1f6&chksm=cfca8ed2f8bd07c42dd8ce9fd890a6a12394d24209837813befafe8cc9f7c02fac2408bbeeef&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [记一次曲折的域环境渗透测试 IV](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495188&idx=1&sn=e0f35bae189290f1f50f3b5ffd178b77&chksm=fa523baacd25b2bcfc308326ae47debd14b64ae2b4267b10807b69eaa56bc194d2e2ef4ddc5e&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [图虫专测上线！拼手速赢5倍积分！](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489227&idx=1&sn=39a054881b0eb29bac7197c606148074&chksm=fa9eed9dcde9648b0515d6fed141ec6264e4f08b0c29a904b97cd64c6d3c41bb2c8500c0db18&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第30期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492139&idx=1&sn=53ee951745ab41ca341af44cf20171a6&chksm=fd74d2e2ca035bf466fb22adfd7ce0f75e566ab160e27865524282144956c50fe1718cf3fd7a&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220725-20220731)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492139&idx=2&sn=d618ff445b2b00a51153195424db9b6d&chksm=fd74d2e2ca035bf4408a132b6216c33bd666f22cf8f305ecb1f66b1e9fc6bcab7c855341e7d2&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [chrome 插件开发指南](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496953&idx=1&sn=1f19b59e7e3333c84a4d20f4a7ad931e&chksm=e9d33f1bdea4b60da469657c250fe991ea1a7d6bb470422e9ec82e7f509fc77efc3cc39ca22f&scene=58&subscene=0#rd) - - [稀土掘金社区校园大使持续招募！字节跳动实习 Offer 等你拿！](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496953&idx=2&sn=ced522529422778ae09caaf2dcf2d4a6&chksm=e9d33f1bdea4b60dd610fa5eb20fe7ea1a56a739216768ac2e8f54a2b693748e3f65015882ae&scene=58&subscene=0#rd) -- 中国信息安全 - - [论坛·网络公开溯源 | 国际网络攻击溯源机制的必要性和可行性探析](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163104&idx=1&sn=dcdb92c75460369d8ac1924efe3bbb15&chksm=8b5ee5d9bc296ccf3b1f198701b6e8546df0cddc950176fa7995b2130f05e1402c8f06aba3e3&scene=58&subscene=0#rd) - - [齐向东：产业数字化转型需做好“三防”](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163104&idx=2&sn=f0e3af30ead9f2e759537fa04be94572&chksm=8b5ee5d9bc296ccf9ba8b6fc3ef8b1c892cdda863e8b641855957eea92642eaea66d74be5c21&scene=58&subscene=0#rd) - - [专题·漏洞治理 | 从漏洞管理到攻击面管理](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163104&idx=3&sn=8c2aa130714e1a192d0394163c15c0e0&chksm=8b5ee5d9bc296ccfc8d539e37f8125ce6d2d0def5a6215c099c9baf71ca66c31f0ca6bd34913&scene=58&subscene=0#rd) - - [关注 | 涉信息网络犯罪特点和趋势司法大数据专题报告发布](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163104&idx=4&sn=88d35c0aaab082c1c5b107461978aa16&chksm=8b5ee5d9bc296ccfc0a687ab1d23bd674ff0073d15a55630f48b07a42d523fe1e6a68b0fe3b7&scene=58&subscene=0#rd) -- 安全牛 - - [网络安全纵深防御简析：目的、要素与实践](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116584&idx=1&sn=91d9b870fa5647515957724032d10a04&chksm=bd1464fb8a63eded23b6cbb3b7cd395b0439a0eb75d3c3becefa7bf74ea086fc08ccd29f347d&scene=58&subscene=0#rd) - - [安全头条 | 阿里巴巴与蚂蚁集团终止《数据共享协议》；网信部门重拳整治网络直播、短视频领域乱象](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116584&idx=2&sn=253280ddb3151b383ae3fa55ac77b425&chksm=bd1464fb8a63ededc131e00f437e1b9ca0e3ddafdff9fc7e5a92594c86eb9d5204fda8c1bfe1&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（37期）：红蓝对抗公开课](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116584&idx=3&sn=87cb703bb256a4cdcd1c4b5b35643c73&chksm=bd1464fb8a63ededa33f5c761c0aca9cdc1cda75921aaa8e3dfbaec502ae7cc85e84e39f36a3&scene=58&subscene=0#rd) -- leveryd - - [基于ebpf的容器逃逸(上)](https://mp.weixin.qq.com/s?__biz=MzkyMDIxMjE5MA==&mid=2247485146&idx=1&sn=41ec7cb0c233d3f7371d99f091fffca3&chksm=c197016bf6e0887db4c9b04fd7614926106286e1280fffcaf0b04fbd0238d8374ec91a49e632&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [阅读推荐 2022-08-01 JIGSAW](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492117&idx=1&sn=80a706025d704ba91b41858f6a5baead&chksm=c063ccccf71445da5f48e232600da779b3a9a54a647bc86190b5df4c9b7c9742e6a01ce26e47&scene=58&subscene=0#rd) -- 陌陌安全 - - [公告 | 创新类产品、游戏范围更新及业务范围汇总](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487328&idx=1&sn=51d92eeb6aa7869718315422cc304da6&chksm=eadc0502ddab8c142b101005dd4b8ec428ffa0450646283ede593d4f5a5297b3097166b08d09&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Aug.1st]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495711&idx=1&sn=531205f45fb99068f6d3adb0dfce7a5c&chksm=ce96bd21f9e13437376e8e8c0ab693fe88373ae09777e12e59dac12c8a6e0e87e0531212e0c3&scene=58&subscene=0#rd) -- 极客公园 - - [二手车全面取消限制，可全国流通；AMD 市值超越英特尔；传英伟达 RTX 4080 跑分是 3080 两倍｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962467&idx=1&sn=258ca0982e31055381f856d578874459&chksm=7e55831549220a03ec6a6952b4e2caa87f461ef28c708cfcbca37b4856e33bd4890674fbecef&scene=58&subscene=0#rd) -- KCon黑客大会 - - [延期公告｜第十一届 KCon 黑客大会将延期举办](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135615&idx=1&sn=b0f845e0b0194c2d4c2785aca2ed2f7d&chksm=f2c11f1fc5b696094cd5cbe8ab058a5afb9d05844681d8f55b9784e8d0f969713f89cdf752f0&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220801期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529511&idx=1&sn=43621e3ada788ddd074b5d970e233af6&chksm=c1e9f876f69e7160a34995543d9e8151a8be8601fa723e8b8e79ca7e7ac6a966846a01959dd8&scene=58&subscene=0#rd) - - [全球数据跨境流动标准合同条款研究](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529511&idx=2&sn=7a663a46c39325cba934a0d8f41c4370&chksm=c1e9f876f69e7160e3a4911b2bd714eb065e97930b71438d47dc9a461fb0e45efbbbff2a7875&scene=58&subscene=0#rd) - - [云计算服务主要安全风险及应对措施初探](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529511&idx=3&sn=e9cdb752122db191fa145804a0b9463d&chksm=c1e9f876f69e7160617393e97ebeb24d64a4ab8bc15025c7ca79171c4557c6c8b819b4539b15&scene=58&subscene=0#rd) - - [新型恶意软件可劫持 Facebook 企业帐户](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529511&idx=4&sn=ccf60153e28ec2b8ddadf1fc4592c32b&chksm=c1e9f876f69e71601b3fa1ee2113a0ffd6b6d88a8c1323d6389f53abe679e633429fcb386976&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-03.md b/archive/2022/2022-08-03.md deleted file mode 100644 index fc09439b6b..0000000000 --- a/archive/2022/2022-08-03.md +++ /dev/null @@ -1,224 +0,0 @@ -# 每日安全资讯（2022-08-03） - -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5544-1](https://packetstormsecurity.com/files/167911/USN-5544-1.txt) - - [Gentoo Linux Security Advisory 202207-01](https://packetstormsecurity.com/files/167910/glsa-202207-01.txt) - - [Ubuntu Security Notice USN-5543-1](https://packetstormsecurity.com/files/167909/USN-5543-1.txt) - - [uftpd 2.10 Directory Traversal](https://packetstormsecurity.com/files/167908/uftpd210-traversal.txt) -- HackerOne Hacker Activity - - [One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com](https://hackerone.com/reports/1567186) - - [Found Origin IP's lead to access to gitlab](https://hackerone.com/reports/1637577) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [rpc.py 0.6.0 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022080022) - - [Dingtian-DT-R002 3.1.276A Authentication Bypass](https://cxsecurity.com/issue/WLB-2022080021) - - [Omnia MPX 1.5.0+r1 Path Traversal](https://cxsecurity.com/issue/WLB-2022080020) - - [mPDF 7.0 Local File Inclusion](https://cxsecurity.com/issue/WLB-2022080019) - - [CodeIgniter CMS 4.2.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022080018) - - [WordPress Duplicator 1.4.7 Information Disclosure](https://cxsecurity.com/issue/WLB-2022080017) - - [Easy Chat Server 3.1 Buffer Overflow](https://cxsecurity.com/issue/WLB-2022080016) - - [Wavlink WN533A8 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022080015) - - [Wavlink WN530HG4 Password Disclosure](https://cxsecurity.com/issue/WLB-2022080014) - - [WordPress SeatReg 1.23.0 Open Redirect](https://cxsecurity.com/issue/WLB-2022080013) - - [Wavlink WN533A8 Password Disclosure](https://cxsecurity.com/issue/WLB-2022080012) - - [Powered by Compusys e Solutions - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022080011) - - [Newgen Technologies - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022080010) - - [uftpd 2.10 Directory Traversal](https://cxsecurity.com/issue/WLB-2022080009) -- Security Boulevard - - [Healthcare Apps and Patient Portals are Under Attack](https://securityboulevard.com/2022/08/healthcare-apps-and-patient-portals-are-under-attack/) - - [The Challenge Digital Executive Protection Poses to Enterprise Security Teams](https://securityboulevard.com/2022/08/the-challenge-digital-executive-protection-poses-to-enterprise-security-teams/) - - [VMware Auth Bypass Vulnerability: What You Need to Know](https://securityboulevard.com/2022/08/vmware-auth-bypass-vulnerability-what-you-need-to-know/) - - [No SOCKS, No Shoes, No Malware Proxy Services!](https://securityboulevard.com/2022/08/no-socks-no-shoes-no-malware-proxy-services/) - - [Employees’ Side Hustles: The Hidden Threat to Your Organization’s Cybersecurity](https://securityboulevard.com/2022/08/employees-side-hustles-the-hidden-threat-to-your-organizations-cybersecurity/) - - [Aspen Security Forum 2022 – Moderator: Courtney Kube, ‘Fireside Chat With General Charles Q. Brown’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-courtney-kube-fireside-chat-with-general-charles-q-brown/) - - [Ameesh Divatia appears on theCUBE at AWS re:Inforce to talk about proxy architecture and the future of data security](https://securityboulevard.com/2022/08/ameesh-divatia-appears-on-thecube-at-aws-reinforce-to-talk-about-proxy-architecture-and-the-future-of-data-security/) - - [Video Demo: Add Quantitative Cyber Risk Analysis to a GRC or IRM](https://securityboulevard.com/2022/08/video-demo-add-quantitative-cyber-risk-analysis-to-a-grc-or-irm/) - - [AWS re:Inforce Reinforces the Need to Build Security Into the Data Pipeline](https://securityboulevard.com/2022/08/aws-reinforce-reinforces-the-need-to-build-security-into-the-data-pipeline/) - - [AWS Security Trends of 2022: Five Themes and Why They Matter](https://securityboulevard.com/2022/08/aws-security-trends-of-2022-five-themes-and-why-they-matter/) -- Microsoft Security Blog - - [Microsoft announces new solutions for threat intelligence and attack surface management](https://www.microsoft.com/security/blog/2022/08/02/microsoft-announces-new-solutions-for-threat-intelligence-and-attack-surface-management/) -- Sploitus.com Exploits RSS Feed - - [uftpd 2.10 - Directory Traversal (Authenticated) Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37886&utm_source=rss&utm_medium=rss) - - [uftpd 2.10 - Directory Traversal (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:51000&utm_source=rss&utm_medium=rss) - - [uftpd 2.10 Directory Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:167908&utm_source=rss&utm_medium=rss) - - [Exploit for Type Confusion in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=A5C99698-1B9B-58C5-8CD0-6C2D15021C06&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Apache Spark exploit](https://sploitus.com/exploit?id=312A4E25-C0C4-5182-B6B4-EF33CA732F8C&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Wordpress exploit](https://sploitus.com/exploit?id=DE4AF484-6094-5907-A0D3-BE373D17427D&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Initialization in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=91ACFD93-47E2-56B0-A34A-8DC0F7D97A8E&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-36946 exploit](https://sploitus.com/exploit?id=D5706C20-994B-524A-8C43-838B970CD47C&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [CVE-2022-31656: critical auth bypass flaw in multiple VMware products](https://twitter.com/Dinosn/status/1554523283130826752) - - [Semiconductor manufacturer Semikron hit by LV ransomware attack](https://twitter.com/Dinosn/status/1554523096807350272) - - [Movie torrents hijacked to send tips on bypassing Russian censorship](https://twitter.com/Dinosn/status/1554522815671537665) - - [Mobile store owner hacked T-Mobile employees to unlock phones](https://twitter.com/Dinosn/status/1554522531700285441) - - [Post-Quantum Encryption Contender Is Taken Out By Single-Core PC And 1 Hour](https://twitter.com/Dinosn/status/1554522471826694146) - - [Chinese Hackers Using New Manjusaka Hacking Framework Similar to Cobalt Strike](https://twitter.com/Dinosn/status/1554522141466443777) - - [U.S. Crypto Firm Nomad Hit By $190 Million Theft](https://twitter.com/Dinosn/status/1554521989171318786) - - [Lawsuit Claims Facebook Scraping Data From Hospital Sites](https://twitter.com/Dinosn/status/1554521928903311362) - - [Microsoft announces new external attack surface audit tool](https://twitter.com/Dinosn/status/1554459174041526272) - - [RevSuit is a flexible and powerful reverse connection platform designed for receiving connection from target host in penetration.](https://twitter.com/Dinosn/status/1554458876359196678) - - [MyBB 0day Authenticated Remote code execution](https://twitter.com/Dinosn/status/1554455180275499008) - - [CVE-2022-35650 Analysis](https://twitter.com/Dinosn/status/1554455062910566405) - - [scan4all: Vulnerabilities Scan: 15000+PoCs; 7000+Web fingerprints](https://twitter.com/Dinosn/status/1554455002495815681) - - [CVE-2022-35918: Streamlit directory traversal vulnerability](https://twitter.com/Dinosn/status/1554454921348583425) - - [Is CSRF really dead? Examining Stripe’s $5000 CSRF bug bounty.](https://twitter.com/Dinosn/status/1554454798921043969) - - [New 'ParseThru' Parameter Smuggling Vulnerability Affects Golang-based Applications](https://twitter.com/Dinosn/status/1554454449510354945) - - [(ZOHO) Manage Engine Desktop Central – SQL Injection / Arbitrary File Write](https://twitter.com/Dinosn/status/1554454298439868416) - - [EU missile maker MBDA confirms data theft extortion, denies breach](https://twitter.com/Dinosn/status/1554454121289322497) - - [A python script to scan for Apache Tomcat server vulnerabilities.](https://twitter.com/Dinosn/status/1554453179403747329) -- 先知安全技术社区 - - [某Office2.02前台RCE分析](https://xz.aliyun.com/t/11569) -- Tenable Blog - - [CVE-2022-31656: VMware Patches Several Vulnerabilities in Multiple Products (VMSA-2022-0021)](https://www.tenable.com/blog/cve-2022-31656-vmware-patches-several-vulnerabilities-in-multiple-products-vmsa-2022-0021) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [子芽新书《DevSecOps敏捷安全》如约而至](https://www.4hou.com/posts/vJ90) - - [【安全玻璃盒】孝道科技双产品通过信通院工具能力测试](https://www.4hou.com/posts/q8M0) - - [以训辅教，以战促学 | 新版攻防世界平台正式上线运营！](https://www.4hou.com/posts/7JWy) - - [虚假的加密货币应用程序骗取投资者数百万元](https://www.4hou.com/posts/l68M) - - [LockBit组织其最新变体LockBit3.0中新增了BlackMatter功能](https://www.4hou.com/posts/YXlM) - - [ISC 2022 | 360潘剑锋：真正的EDR是“看见”威胁的眼睛](https://www.4hou.com/posts/mXM9) -- Recent Commits to cve:main - - [Update README.md](https://github.com/trickest/cve/commit/19b106c7ab3cf19e11f003fc9b4955d24b912445) - - [Merge pull request #49 from trickest/searchable-database](https://github.com/trickest/cve/commit/8c54fd6b39887d8d34fe1c086162c6474517eba7) - - [Delete CVE_list.json](https://github.com/trickest/cve/commit/dec52dae8a12ddf08346b8ae8b9ccc17f84632b9) - - [Merge pull request #21 from AndrewMohawk/main](https://github.com/trickest/cve/commit/eba0f13153c17203138bca66a60d7484eb3879df) -- 跳跳糖 - 安全与分享社区 - - [浅析Vmess流量与强网杯2022谍影重重](https://tttang.com/archive/1687/) -- unSafe.sh - 不安全 - - [某Office2.02前台RCE分析](https://buaq.net/go-120459.html) - - [7 Tips to Clean & Maintain Your Website](https://buaq.net/go-120471.html) - - [Hacking and PenTesting Captive Portal Enabled Wireless Networks](https://buaq.net/go-120447.html) - - [CISO Insights | How to Get the Most Out of XDR](https://buaq.net/go-120448.html) - - [The Roadmap to Adopting SASE in 2022 According to Gartner®](https://buaq.net/go-120446.html) - - [DNS 查询原理详解](https://buaq.net/go-120435.html) - - [timwhitez starred CallStack-Spoofer](https://buaq.net/go-120436.html) - - [timwhitez starred NimicStack](https://buaq.net/go-120437.html) - - [零信任安全论坛精选议题视频上线 | CIS大会夏日版](https://buaq.net/go-120512.html) - - [Is CSRF really dead? Examining Stripe’s $5000 CSRF bug bounty.](https://buaq.net/go-120428.html) - - [子芽新书《DevSecOps敏捷安全》如约而至](https://buaq.net/go-120429.html) - - [timwhitez starred goloader](https://buaq.net/go-120438.html) - - [Go：这个结果没想到吧？](https://buaq.net/go-120461.html) -- Sucuri Blog - - [7 Tips to Clean & Maintain Your Website](https://blog.sucuri.net/2022/08/7-tips-to-clean-maintain-your-website-server.html) -- 安全脉搏 - - [浅谈程序的数字签名](https://www.secpulse.com/archives/184623.html) - - [深入浅出Flask PIN](https://www.secpulse.com/archives/184605.html) -- 安全客-有思想的安全新媒体 - - [云沙箱流量识别技术剖析](https://www.anquanke.com/post/id/277431) - - [安全事件周报 (07.25-07.31)](https://www.anquanke.com/post/id/277267) - - [Audius金库1850万枚AUDIO被盗事件分析](https://www.anquanke.com/post/id/277154) - - [智能审批 | 字节跳动数据访问控制实践经验分享](https://www.anquanke.com/post/id/277115) - - [Meta因使用医疗数据提供广告遭集体诉讼](https://www.anquanke.com/post/id/277268) -- SecWiki News - - [SecWiki News 2022-08-02 Review](http://www.sec-wiki.com/?2022-08-02) -- Forcepoint - - [The Roadmap to Adopting SASE in 2022 According to Gartner®](https://www.forcepoint.com/blog/insights/gartner-2022-strategic-roadmap-sase-convergence) -- 先知安全技术社区 - - [某Office2.02前台RCE分析](https://xz.aliyun.com/t/11569) -- Bug Bounty in InfoSec Write-ups on Medium - - [Is CSRF really dead? Examining Stripe’s $5000 CSRF bug bounty.](https://infosecwriteups.com/is-csrf-really-dead-examining-stripes-5000-csrf-bug-bounty-37bbd6631de3?source=rss----7b722bfd1b8d--bug_bounty) -- 博客园 - 挖洞的土拨鼠 - - [数据合规工作简述 - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16541297.html) -- SAP Blogs - - [Building an OData Service with a Spring-Boot Java Application using Olingo – Part III (Payloads and Custom Logic)](https://blogs.sap.com/2022/08/02/building-an-odata-service-with-a-spring-boot-java-application-using-olingo-part-iii-payloads-and-custom-logic/) - - [How to create a sticky button in SAP Ui5](https://blogs.sap.com/2022/08/02/how-to-create-a-sticky-button-in-sap-ui5/) - - [Health Monitoring of RPA bots with SAP Cloud ALM & Integration Steps for SAP Intelligent RPA with SAP ALM Instance](https://blogs.sap.com/2022/08/02/health-monitoring-of-rpa-bots-with-sap-cloud-alm-integration-steps-for-sap-intelligent-rpa-with-sap-alm-instance/) - - [Manage & Organize your MS Azure Resource Groups or Entire Cloud Landscape with SAP LAMA 3.0 SP 23 Enterprise Edition](https://blogs.sap.com/2022/08/02/manage-organize-your-ms-azure-resource-groups-or-entire-cloud-landscape-with-sap-lama-3.0-sp-23-enterprise-edition/) - - [When to use Event Mesh Webhook](https://blogs.sap.com/2022/08/02/when-to-use-event-mesh-webhook/) - - [New Features in Contract Accounting and Invoicing (SAP S/4HANA Cloud 2208)](https://blogs.sap.com/2022/08/02/new-features-in-contract-accounting-and-invoicing-sap-s-4hana-cloud-2208/) - - [Service in SAP S/4HANA Cloud 2208](https://blogs.sap.com/2022/08/02/service-in-sap-s-4hana-cloud-2208/) - - [Easy UI5 3.5.0 – Now Available!](https://blogs.sap.com/2022/08/02/easy-ui5-3.5.0-now-available/) - - [SAP’s Vision for Process Automation explained](https://blogs.sap.com/2022/08/02/saps-vision-for-process-automation-explained/) -- Reverse Engineering - - [Technical series on creating extra-sensory perception (ESP) hacks for games](https://www.reddit.com/r/ReverseEngineering/comments/wdxpfd/technical_series_on_creating_extrasensory/) - - [Hashlink VM bytecode disassembler and decompiler](https://www.reddit.com/r/ReverseEngineering/comments/we6o9j/hashlink_vm_bytecode_disassembler_and_decompiler/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [In Retrospective - A New DIY Herpes Botnet Builder Spotted in the Wild - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-new-diy-herpes-botnet.html) - - [In Retrospective - A New Dedal DDoS Bot Spotted in the Wild - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-new-dedal-ddos-bot.html) - - [In Retrospective - A New E-Shop for Compromised PCs Spotted in the Wild - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-new-e-shop-for.html) - - [In Retrospective - A New Armageddon DDoS Bot - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-new-armageddon-ddos.html) - - [In Retrospective - A New Anthena DDoS Bot Spotted in the Wild - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-new-anthena-ddos-bot.html) - - [Sample Screenshots of TDoS (Telephony Denial of Service) Tools - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/sample-screenshots-of-tdos-telephony.html) -- SentinelOne - - [CISO Insights | How to Get the Most Out of XDR](https://www.sentinelone.com/blog/ciso-insights-how-to-get-the-most-out-of-xdr/) -- The Daily Swig | Cybersecurity news and views - - [Trio of XSS bugs in open source web apps could lead to complete system compromise](https://portswigger.net/daily-swig/trio-of-xss-bugs-in-open-source-web-apps-could-lead-to-complete-system-compromise) -- Application Security Blog - - [CyRC Vulnerability Analysis: Repo jacking in the software supply chain](https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-analysis-repo-jacking/) -- Sucuri Blog - - [7 Tips to Clean & Maintain Your Website](https://blog.sucuri.net/2022/08/7-tips-to-clean-maintain-your-website-server.html) -- Hacking Dream - - [Hacking and PenTesting Captive Portal Enabled Wireless Networks](https://www.hackingdream.net/2022/08/hacking-and-pentesting-captive-portal-wifi.html) -- 博客园 - sevck - - [sqlmap dump cvs conver to sql file - sevck](https://www.cnblogs.com/sevck/p/16544364.html) - - [【PHP代码审计】 某USDT跑分系统 - sevck](https://www.cnblogs.com/sevck/p/16544322.html) - - [【JAVA代码审计】某电商传销系统代码审计几处0day - sevck](https://www.cnblogs.com/sevck/p/16544112.html) -- Cerbero Blog - - [Video: Blitz XLS Malware Payload Extraction](https://blog.cerbero.io/?p=2457) -- Blog - Praetorian - - [AWS Security Trends of 2022: Five Themes and Why They Matter](https://www.praetorian.com/blog/aws-security-trends-of-2022/) -- webs3c - Latest posts - - [This writeup is currently under review](https://webs3c.com/t/this-writeup-is-currently-under-review/93#post_2) - - [The Beginner Guide of Reconnaissance](https://webs3c.com/t/the-beginner-guide-of-reconnaissance/178#post_1) -- Black Hills Information Security - - [Talkin’ About Infosec News – 8/1/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-8-1-2022/) -- SecPulse安全脉搏 - - [【漏洞预警】大华IP摄像头重放漏洞](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044689&idx=1&sn=6dbc61c24a2236a48068f0d60ffc57fa&chksm=803fa80fb748211934160e55a2d35d211923f960cb7d0a0a1ce218ee5bb1037fc24c80f09e80&scene=58&subscene=0#rd) - - [【中奖名单】《白话零信任》书籍中奖名单公布啦！](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044689&idx=2&sn=f10b0a3c139857a2c56e84df707ca8dc&chksm=803fa80fb7482119c6adc1e0b25cbd64ade930df9eb340db9b5a438e2e040caf4938d881cc75&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【技巧】追踪佩洛西专机](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131012&idx=1&sn=244ff4f1deba5ba763ee095a0764094c&chksm=f1af7bbec6d8f2a818dafed521dd7f25606cdcfa74cc7968d7fb1e6618ce32d9ca97194cb13c&scene=58&subscene=0#rd) - - [【资料】佩洛西家族负面黑料](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131012&idx=2&sn=751c87d72b13603007f833f9d9e8b362&chksm=f1af7bbec6d8f2a805db71820731ae3a40a947ca935d7bdd10a89ba8bb95e6767885ceaf5f98&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】A-Journey-into-Synology-NAS-系列——群晖NAS介绍](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774625&idx=1&sn=5d427d3b3161d3f098290aae9f30c627&chksm=88936a4ebfe4e35861d2054a39d03e86aeccccb4a7d465234f8903a18c0b392a8bdd009c7a65&scene=58&subscene=0#rd) - - [【安全头条】Meta因使用医疗数据提供广告遭集体诉讼](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774625&idx=2&sn=86e2b5d241ad4d047628059eb40699d3&chksm=88936a4ebfe4e3582c946d3c0864c3d3a27721672bd78f27ffc0866c40307dd2e809cc4be8c9&scene=58&subscene=0#rd) -- - - [Captain’s Log: July 2022](https://cornerpirate.com/2022/08/02/captains-log-july-2022/) -- 绿盟科技研究通讯 - - [每日情报汇总分析](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492874&idx=1&sn=3d11f2fe616d487ebf1c1f23611f03ca&chksm=e84c43d5df3bcac3ac0b3f2f9c25964d5fa261bf95fb0289ac3ba388fbdf477fc0a9609a1fef&scene=58&subscene=0#rd) -- 看雪学院 - - [House of apple 一种新的glibc中IO攻击方法](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458459847&idx=1&sn=f4afaf30634e626ce539023d1de675fe&chksm=b18e2e4d86f9a75bf414e6332f9cfb5601fffe6f3388d5810971b0e92738fe640552ea889841&scene=58&subscene=0#rd) - - [子芽新书《DevSecOps敏捷安全》 如约而至](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458459847&idx=2&sn=248232b1ce797578e3d08e9a3109c40a&chksm=b18e2e4d86f9a75ba2423a945afaa248127d6ca13ef6d6ee230517782c1c3cc52e9610906e5e&scene=58&subscene=0#rd) - - [窃取150GB数据，ALPHV声称实施了对欧洲能源供应商Creos的网络攻击](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458459847&idx=3&sn=1d06bf15df39764e27a2394cd00b3c04&chksm=b18e2e4d86f9a75b0aafef9f29017d781a82e263fa56069a524571b4f356908e97ee4d196fb6&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.08.02）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491212&idx=1&sn=5f887ef10dd851fd8a3799c4c6aca348&chksm=fe251b8dc952929bd28fa76cf54f2416b00db8d58c6271848dd85edb487c5ea22da98a1495fb&scene=58&subscene=0#rd) -- 代码卫士 - - [开源软件 LibreOffice 修复多个与宏、密码等相关的漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513283&idx=1&sn=5fbd02e0f95926cab449829326e0a8a1&chksm=ea9485a9dde30cbf0fb5e64dcbabdcbc1486306bbf9305df01d0f12022f30b84421fe09b167c&scene=58&subscene=0#rd) - - [CompleteFTP 路径遍历缺陷可导致服务器文件遭删除](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513283&idx=2&sn=1191567d5c667a5413e00d453ef8b5da&chksm=ea9485a9dde30cbf4561e0a83d2a5b96ebcdc2f16f0c7e2a2cc46c6ddbc698bb97e74fd44341&scene=58&subscene=0#rd) -- 奇安信CERT - - [不要让谣言驱动应急响应](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496742&idx=1&sn=c6e402fe1076b5c78d24829901471fac&chksm=fe79d0bec90e59a83f6fdadd2d345461b270f407683fbd64f5d984fe3bf5ab0a3b8ea397fa50&scene=58&subscene=0#rd) -- 互联网安全内参 - - [中欧天然气管道公司疑遭勒索软件攻击，150GB数据失窃](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504858&idx=1&sn=ff91fe517beed67a5004c6635c6b9777&chksm=ebfa94fadc8d1dec793c34fe3f02d476ef5814dd9af9d9fa8ef699a32007f5b05d31b528abf9&scene=58&subscene=0#rd) - - [美国与乌克兰签署深化网络安全合作协议](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504858&idx=2&sn=01ad3a1fbdacf75e3bf4a0304b479aee&chksm=ebfa94fadc8d1deca5544c1f8f4dbe0d988888199d0b46f563c9ff776813b9a25e2f8972f0b9&scene=58&subscene=0#rd) - - [国际网络攻击溯源机制的必要性和可行性探析](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504858&idx=3&sn=5c7c01be5af811c0db5d3aa9616f95f7&chksm=ebfa94fadc8d1decc88397ffae555244538fd26249800423f04d9cc657183eb59767e02d3258&scene=58&subscene=0#rd) - - [《涉信息网络犯罪特点和趋势·司法大数据专题报告》发布](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247504858&idx=4&sn=c3b168664c827d37004dc6e3b62efdfb&chksm=ebfa94fadc8d1dec9800a0e7ae0010f036607d85a442771b6f1be9c597d9795eafe6dd8deab0&scene=58&subscene=0#rd) -- 极客公园 - - [进入深水区，AI 基础设施的角色是什么？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962751&idx=1&sn=95bff4ae5c6d3ce1cdc953629e6faedd&chksm=7e55820949220b1feb2b03f1f2c1916438596fab71923a9edda6d68e473b458220f6d3cda449&scene=58&subscene=0#rd) - - [在元宇宙里做「空间」生意，靠什么拿下上亿融资？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962751&idx=2&sn=5503c46b483b12a52a044fe6ae7a2cf5&chksm=7e55820949220b1fa2cf0e323878ce0ae40819f8bdc82de15fce16a36e9f8d54183b2bda3418&scene=58&subscene=0#rd) - - [蔚来计划推出 10 万元入门轿车；支付宝中国董事长变更；吉卜力公园最新场景曝光｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962505&idx=1&sn=f210f6ea01b6451503de02c4183968b2&chksm=7e55837f49220a694463558982e5e7aebe9c81c8760d6dff8299788c719b444f1c6b5308bc22&scene=58&subscene=0#rd) -- 安全牛 - - [暑期阅读推荐——8部网络安全题材畅销小说](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116701&idx=1&sn=0294f2dfd7ba2043e7108c2c11e1bd37&chksm=bd14644e8a63ed58691844c5a1970936f297457ee75e7ee2804b22ccb49e3923858d9bf82306&scene=58&subscene=0#rd) - - [云计算安全审计概览](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116701&idx=2&sn=908ac10e0e5ac4a1be36cc4719f40974&chksm=bd14644e8a63ed58c92320d0b56ad7128aac0ee9fe6a8d204261a549fc9b4f29cf04e22a0d1a&scene=58&subscene=0#rd) - - [安全牛课堂|8月40+热门资质认证开课计划](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116701&idx=3&sn=e8ad812d007b03d7512e321614c5a7ec&chksm=bd14644e8a63ed58c0002d20953bc9c862bb957bb832795ae7495b68bebc0ed5c454c1851146&scene=58&subscene=0#rd) -- Checkmarx.com - - [When It Comes to Cloud, Location Matters](https://checkmarx.com/blog/when-it-comes-to-cloud-location-matters/) -- 谛听ditecting - - [谛听|“谛听”团队参加2021年国家重点研发计划项目“智能网联场景工业控制系统深度防御与安全处置技术”工作推进会议](https://mp.weixin.qq.com/s?__biz=MzU3MzQyOTU0Nw==&mid=2247487701&idx=1&sn=faad98d48b8d3d02a545f88903627375&chksm=fcc09291cbb71b876c1101f42235bf72b4bbf309f887c5543536cce3b11a8b0ef06c52f15514&scene=58&subscene=0#rd) -- 星阑科技 - - [【技术干货】CVE-2022-33891 Apache Spark shell命令注入漏洞分析](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494694&idx=1&sn=561f31ff7b57eec886e6fa854d753ed4&chksm=c00741baf770c8ac229ddb5b1c2783aa31126879ede68c370ebd2c5a983abec8463d41f3bbaa&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [从漏洞管理到攻击面管理](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529543&idx=1&sn=365025703684091eaf990bbc9441e31e&chksm=c1e9f816f69e7100947e5fc5e18b261c9404f7cb832a83c5dcaee0ae013c970428a947f1d071&scene=58&subscene=0#rd) - - [混合工作的现实驱动基于硬件的新型安全策略](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529543&idx=2&sn=e62018c1bfc5ea8dce8d6dbd2c166fe2&chksm=c1e9f816f69e7100645db096be0664e3b122285215c7bbc3cfb60c348eaff3ac551717eda56d&scene=58&subscene=0#rd) - - [美国联邦法院系统曝数据泄露：“广度和范围惊人”！司法部已介入调查](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529543&idx=3&sn=173971fb2cbb497f99a711accbcf54d6&chksm=c1e9f816f69e7100a1de9d674e5881766bcb499a16db90b4e1f5512503ac03c74318265e7c43&scene=58&subscene=0#rd) -- 东软网络安全 - - [东软NetEye正式授牌成为国家工业信息安全发展研究中心人才研修班实训基地](https://mp.weixin.qq.com/s?__biz=MjM5NTAyODkxNw==&mid=2649212549&idx=1&sn=23fe667890e1fda63ca15cc36b340ede&chksm=beedac5f899a2549186b53e8037f7f5d72b65dd50a0be647be720b736505e9f8ace9820b7f30&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报追踪】近日美国在台湾附近部署船只和飞机](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512959&idx=1&sn=11eee5cfe1bf89c8cc06930d7ed0d935&chksm=8716b074b0613962dbb368266328f11f3a9ed85ac4f7fba4c62fa139ca60e2a4ab0e5198393d&scene=58&subscene=0#rd) - - [南希·佩洛西个性档案](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650512959&idx=2&sn=c5e25e9f855b3e519b0833693f69dd56&chksm=8716b074b06139622fb67b89f327fd11090f487bc5b57873f1f1640b7682cba1d691b68c38cb&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [微服务超 10 万、跨语言场景，字节服务网格依靠 CloudWeGo 扛住流量洪峰](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247496994&idx=1&sn=30b31fca735f7b7f2d31f8cc77a4c971&chksm=e9d33ec0dea4b7d6812b9eebd800ea9933fe42ca1a5198c04bd277a8683f0579a644c895556a&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [强网杯WriteUp｜强网先锋 & Web](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495285&idx=1&sn=a8f54ff19453025c19636e36c735495d&chksm=fa523bcbcd25b2dd18b3be161b09208ddcb4c7f5621cabc6c965e93859f44b37c329b8d9e1d4&scene=58&subscene=0#rd) -- 娜璋AI安全之家 - - [[AI安全论文] (23)恶意代码作者溯源(去匿名化)经典论文阅读：二进制和源代码对比](https://mp.weixin.qq.com/s?__biz=Mzg5MTM5ODU2Mg==&mid=2247496613&idx=1&sn=3dc22c85334a14c5fe1e138d95a494a0&chksm=cfcf4368f8b8ca7e5933ca3ad0096f4c21a48def945f0939a6781bf6481d642381e2ca47c173&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [虚假的加密货币应用程序骗取投资者数百万元](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547103&idx=1&sn=c55c60fb51be8b095fbf1ca0cf539d4f&chksm=e915e8e5de6261f34ecb8e6f80e2a589b2941efa28d6b3d780322243ba3ee1140df666cb1f35&scene=58&subscene=0#rd) - - [LockBit组织其最新变体LockBit3.0中新增了BlackMatter功能](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547103&idx=2&sn=8cd6bebedbf213240f9e1ae341d23c96&chksm=e915e8e5de6261f342851dfe2b20b7051bdfded407694014ebbf6848f37882a6de1049afc4dc&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-04.md b/archive/2022/2022-08-04.md deleted file mode 100644 index 709873b7f7..0000000000 --- a/archive/2022/2022-08-04.md +++ /dev/null @@ -1,214 +0,0 @@ -# 每日安全资讯（2022-08-04） - -- HackerOne Hacker Activity - - [XSS in redditmedia.com can compromise data of reddit.com](https://hackerone.com/reports/862882) -- unSafe.sh - 不安全 - - [OSCP Bonus Points Update: Sunsetting PEN-200 Legacy Course Exercises and a New Way to Achieve Points!](https://buaq.net/go-120619.html) - - [timwhitez starred go-zabbix-get](https://buaq.net/go-120607.html) - - [timwhitez starred grepWin](https://buaq.net/go-120608.html) - - [OAuth 2.0利用方式](https://buaq.net/go-120604.html) - - [Update now! VMWare patches critical vulnerabilities in several products](https://buaq.net/go-120605.html) - - [Abusing URL Shortners for fun and profit](https://buaq.net/go-120597.html) - - [Multiple bugs in one program leads to 1500€](https://buaq.net/go-120598.html) - - [Kage - Graphical User Interface For Metasploit Meterpreter And Session Handler](https://buaq.net/go-120599.html) - - [For months, JusTalk messages were accessible to everyone on the Internet](https://buaq.net/go-120595.html) - - [Meeting 2024 Federal Zero Trust Deadlines](https://buaq.net/go-120606.html) - - [PART 3: How I Met Your Beacon - Brute Ratel - MDSec](https://buaq.net/go-120590.html) - - [timwhitez starred 2022-HW-POC](https://buaq.net/go-120589.html) -- Sploitus.com Exploits RSS Feed - - [Multi-Language Hotel Management 2022 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167912&utm_source=rss&utm_medium=rss) - - [IObit Malware Fighter 9.2 Tampering / Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:167913&utm_source=rss&utm_medium=rss) - - [MobileIron Log4Shell Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167917&utm_source=rss&utm_medium=rss) - - [Zoho Password Manager Pro XML-RPC Java Deserialization exploit](https://sploitus.com/exploit?id=PACKETSTORM:167918&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Vmware Spring Cloud Gateway exploit](https://sploitus.com/exploit?id=571017BF-5A13-5AE0-991E-5676C236A65F&utm_source=rss&utm_medium=rss) - - [Exploit for OS Command Injection in Hikvision Ds-2Cd2026G2-Iu\/Sl Firmware exploit](https://sploitus.com/exploit?id=418BE453-0A45-5824-8B13-1994DF7349FF&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-08-03 Review](http://www.sec-wiki.com/?2022-08-03) -- Files ≈ Packet Storm - - [Zoho Password Manager Pro XML-RPC Java Deserialization](https://packetstormsecurity.com/files/167918/zoho_password_manager_pro_xml_rpc_rce.rb.txt) - - [MobileIron Log4Shell Remote Command Execution](https://packetstormsecurity.com/files/167917/mobileiron_core_log4shell.rb.txt) - - [Ubuntu Security Notice USN-5545-1](https://packetstormsecurity.com/files/167915/USN-5545-1.txt) - - [Ubuntu Security Notice USN-5463-2](https://packetstormsecurity.com/files/167914/USN-5463-2.txt) - - [Multi-Language Hotel Management 2022 1.0 SQL Injection](https://packetstormsecurity.com/files/167912/mlhm202210-sql.txt) - - [IObit Malware Fighter 9.2 Tampering / Privilege Escalation](https://packetstormsecurity.com/files/167913/iobitmalwarefighter92-auth.txt) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [漏洞预警|Streamlit 路径遍历漏洞](https://www.4hou.com/posts/GKQL) - - [真刑啊！男子破解博彩网站漏洞，每月“薅羊毛”10多万，凭技术走上歪路](https://www.4hou.com/posts/EQ6Y) - - [IPFS成为钓鱼攻击的温床](https://www.4hou.com/posts/QL50) - - [正确的 WAF 配置对网络安全是如此重要](https://www.4hou.com/posts/DWDK) - - [“软件定义汽车”的背后，海量代码安全性该如何保证？](https://www.4hou.com/posts/AO93) - - [ISC 2022 | “护航数字山河.数据安全协同创新”高峰会大咖汇聚，共话数据安全最优解](https://www.4hou.com/posts/DEJy) - - [精选用户故事|洞态IAST在聚水潭的误报率几乎为0，如何做到？](https://www.4hou.com/posts/nJNW) -- 先知安全技术社区 - - [OAuth 2.0利用方式](https://xz.aliyun.com/t/11585) -- 安全客-有思想的安全新媒体 - - [RedGuard - Excellent C2 Front Flow Control tool](https://www.anquanke.com/post/id/277364) - - [BlackCat勒索组织宣称对欧洲天然气公司网络攻击负责](https://www.anquanke.com/post/id/277361) -- Security Boulevard - - [Where Does Shared Responsibility Model for Security Breaks in the Real World?](https://securityboulevard.com/2022/08/where-does-shared-responsibility-model-for-security-breaks-in-the-real-world/) - - [Four Pillars of Breach and Attack Simulation (BAS)](https://securityboulevard.com/2022/08/four-pillars-of-breach-and-attack-simulation-bas/) - - [Product Update | NEW! Live Google Chat Search](https://securityboulevard.com/2022/08/product-update-new-live-google-chat-search/) - - [Privilege Escalation Types and Attack Paths](https://securityboulevard.com/2022/08/privilege-escalation-types-and-attack-paths/) - - [Aspen Security Forum 2022 – Moderator: Edward Luce ‘Fireside Chat with Ambassador Qin Gang’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-edward-luce-fireside-chat-with-ambassador-qin-gang/) - - [Wicked Good Development Episode 13: Hacks and Ax, July Edition](https://securityboulevard.com/2022/08/wicked-good-development-episode-13-hacks-and-ax-july-edition/) - - [A Brief History of How Iron Sharpens Iron in Firmware Security](https://securityboulevard.com/2022/08/a-brief-history-of-how-iron-sharpens-iron-in-firmware-security/) - - [Building a modern API security strategy — API testing](https://securityboulevard.com/2022/08/building-a-modern-api-security-strategy-api-testing/) - - [Researchers Find 3,200 Apps Exposing Twitter API Keys, Cite ‘BOT Army’ Threat](https://securityboulevard.com/2022/08/researchers-find-3200-apps-exposing-twitter-api-keys-cite-bot-army-threat/) - - [Security is Hard and the Stakes are High](https://securityboulevard.com/2022/08/security-is-hard-and-the-stakes-are-high/) -- Blog & What's New | Offensive Security - - [OSCP Bonus Points Update: Sunsetting PEN-200 Legacy Course Exercises and a New Way to Achieve Points!](https://www.offensive-security.com/offsec/sunsetting-pen-200-legacy-topic-exercises/) -- Twitter @Nicolas Krassas - - [Cyberattackers Drain Nearly $6M From Solana Crypto Wallets](https://twitter.com/Dinosn/status/1554916319400759296) - - [Introducing BloodHound 4.2 — The Azure Refactor](https://twitter.com/Dinosn/status/1554916140442423303) - - [Manjusaka, a new attack tool similar to Sliver and Cobalt Strike](https://twitter.com/Dinosn/status/1554915939971485696) - - [Google Meet Phishing Template For Gophish](https://twitter.com/Dinosn/status/1554910255137570816) - - [Google fixed Critical Remote Code Execution flaw in Android](https://twitter.com/Dinosn/status/1554895489241317377) - - [VirusTotal Reveals Most Impersonated Software in Malware Attacks](https://twitter.com/Dinosn/status/1554895423210491905) - - [Thousands of Solana wallets drained in attack using unknown exploit](https://twitter.com/Dinosn/status/1554799546932363267) - - [NortonLifeLock and Avast $8.6b deal gets provisional yes from UK regulator](https://twitter.com/Dinosn/status/1554799444515864581) - - [PART 3: How I Met Your Beacon – Brute Ratel](https://twitter.com/Dinosn/status/1554776273334968320) - - [35,000 code repos not hacked—but clones flood GitHub to serve malware](https://twitter.com/Dinosn/status/1554776131278184448) - - [dnsReaper - subdomain takeover tool for attackers, bug bounty hunters and the blue team!](https://twitter.com/Dinosn/status/1554771199955173377) - - [Technical Analysis of Industrial Spy Ransomware](https://twitter.com/Dinosn/status/1554757659215241218) - - [RT Stephen Lacy: I am uncovering what seems to be a massive widespread malware attack on @github. - Currently over 35k repositories are infected - So ...](https://twitter.com/stephenlacy/status/1554697077430505473) - - [Robinhood's crypto unit hit with $30m fine over security, anti-crime misses](https://twitter.com/Dinosn/status/1554674987784716291) - - [NIST SIKE finalist for quantum safe crypto has been broken by a very efficient classical computer attack.](https://twitter.com/Dinosn/status/1554674708477509632) - - [Using process creation properties to catch evasion techniques](https://twitter.com/Dinosn/status/1554674618539147270) - - [How a crypto bridge bug led to a $200m 'decentralized crowd looting'](https://twitter.com/Dinosn/status/1554672777000632322) - - [RT Vulns Security: Dear Researchers, We would like to offer you cooperation in the field of vulnerability research and We are Constantly buying variou...](https://twitter.com/vulns_sec/status/1554638057961299968) -- Microsoft Security Blog - - [Microsoft Defender Experts for Hunting proactively hunts threats](https://www.microsoft.com/security/blog/2022/08/03/microsoft-defender-experts-for-hunting-proactively-hunts-threats/) -- 先知安全技术社区 - - [OAuth 2.0利用方式](https://xz.aliyun.com/t/11585) -- 安全脉搏 - - [对APP逆向抓包的实践](https://www.secpulse.com/archives/184703.html) - - [RBCD深度利用之烂番茄](https://www.secpulse.com/archives/184686.html) - - [代码审计之逃不过的命运](https://www.secpulse.com/archives/184672.html) - - [红蓝对抗经验分享：CS免杀姿势](https://www.secpulse.com/archives/184653.html) -- 跳跳糖 - 安全与分享社区 - - [探索Windows内核系列——句柄，利用句柄进行进程保护](https://tttang.com/archive/1682/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [WordPress WP-UserOnline 2.87.6 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022080028) - - [NanoCMS 0.4 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022080027) - - [Webmin 1.996 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022080026) - - [MobileIron Log4Shell Remote Command Execution](https://cxsecurity.com/issue/WLB-2022080025) - - [Multi-Language Hotel Management 2022 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022080024) - - [IObit Malware Fighter 9.2 Tampering / Privilege Escalation](https://cxsecurity.com/issue/WLB-2022080023) -- Bug Bounty in InfoSec Write-ups on Medium - - [Abusing URL Shortners for fun and profit](https://infosecwriteups.com/abusing-url-shortners-for-fun-and-profit-c83c67713916?source=rss----7b722bfd1b8d--bug_bounty) - - [Multiple bugs in one program leads to 1500€](https://infosecwriteups.com/multiple-bugs-in-one-program-leads-to-1500-c35fcde06bc7?source=rss----7b722bfd1b8d--bug_bounty) -- SpiderLabs Blog from Trustwave - - [The Price Cybercriminals Charge for Stolen Data](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-price-cybercriminals-charge-for-stolen-data/) -- Forcepoint - - [Meeting 2024 Federal Zero Trust Deadlines](https://www.forcepoint.com/blog/insights/meeting-2024-federal-zero-trust-deadlines) -- Malwarebytes Labs - - [Woody RAT: A new feature-rich malware spotted in the wild](https://blog.malwarebytes.com/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild/) - - [Bank fraud scammers trick victims with claims of bogus Zelle transfers](https://blog.malwarebytes.com/social-engineering/2022/08/bank-fraud-scammers-trick-victims-with-claims-of-bogus-zelle-transfers/) - - [NetStandard attack should make Managed Service Providers sit up and take notice](https://blog.malwarebytes.com/security-world/2022/08/netstandard-attack-should-make-managed-service-providers-sit-up-and-take-notice/) - - [Update now! VMWare patches critical vulnerabilities in several products](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/update-now-vmware-patches-critical-vulnerabilities-in-several-products/) - - [For months, JusTalk messages were accessible to everyone on the Internet](https://blog.malwarebytes.com/privacy-2/2022/08/for-months-justalk-messages-were-accessible-to-everyone-on-the-internet/) - - [How to protect yourself and your kids against device theft](https://blog.malwarebytes.com/awareness/2022/08/how-to-protect-yourself-and-your-kids-against-device-theft/) -- Hex Rays - - [IDA 8.0: Qt 5.12.2 sources & build scripts](https://hex-rays.com/blog/ida-8-0-qt-5-12-2-sources-build-scripts/) -- blog.avast.com EN - - [Avast One steps up home network protection, digital safety guidance](https://blog.avast.com/avast-one-home-network-protection-safety-guidance) -- SentinelOne - - [LABScon | Security Research in Real Time – Talks Not To Miss, Part One](https://www.sentinelone.com/blog/labscon-security-research-in-real-time-talks-not-to-miss-part-one/) -- SAP Blogs - - [SAP Intelligent Robotic Process Automation Content in SAP S/4HANA Cloud 2208 – (Deep Dive)](https://blogs.sap.com/2022/08/03/intelligent-erp-update-sap-intelligent-robotic-process-automation-content-in-sap-s-4hana-cloud-2208-deep-dive/) - - [Digital Notifications App – Transformation Scenario](https://blogs.sap.com/2022/08/03/digital-notifications-app-transformation-scenario/) - - [Upgrade Mobile Application Integration Framework (MAIF) using SAP Note Transport-based Correction Instructions (TCI) in S/4HANA system](https://blogs.sap.com/2022/08/03/upgrade-mobile-application-integration-framework-maif-using-sap-note-transport-based-correction-instructions-tci-in-s-4hana-system/) - - [Flatten Parent-Child Hierarchy into Level Hierarchy using HANA (2.0 & above) Hierarchy Functions in SQL](https://blogs.sap.com/2022/08/03/flatten-parent-child-hierarchy-into-level-hierarchy-using-hana-2.0-above-hierarchy-functions-in-sql/) - - [Configure SAP-SIC – For Vertex](https://blogs.sap.com/2022/08/03/configure-sap-sic-for-vertex/) - - [Como usar Cloud BAdIs para alterar os dados da sua nota fiscal](https://blogs.sap.com/2022/08/03/como-usar-cloud-badis-para-alterar-os-dados-da-sua-nota-fiscal/) - - [Add a custom Business Partner Correspondence form in SAP Document and Reporting Compliance – Statutory Reporting (Formerly ACR)](https://blogs.sap.com/2022/08/03/add-a-custom-business-partner-correspondence-form-in-sap-document-and-reporting-compliance-statutory-reporting-formerly-acr/) - - [Adaptation Plan to General Data Protection Regulation (GDPR) (I)](https://blogs.sap.com/2022/08/03/adaptation-plan-to-general-data-protection-regulation-gdpr-i/) - - [Annual Leave Entitlement Proration Rounding Up to multiple of 0.5 in SF Time Off scenario](https://blogs.sap.com/2022/08/03/annual-leave-entitlement-proration-rounding-up-to-multiple-of-0.5-in-sf-time-off-scenario/) -- Toooold - - [Linkedin spam: a case study of robust feature engineering](https://toooold.com/2022/08/03/linkedin_fraud_account.html) -- Application Security Blog - - [Building a software Bill of Materials with Black Duck](https://www.synopsys.com/blogs/software-security/building-sbom-with-black-duck/) -- The Daily Swig | Cybersecurity news and views - - [Swiss government announces upcoming launch of federal bug bounty program](https://portswigger.net/daily-swig/swiss-government-announces-upcoming-launch-of-federal-bug-bounty-program) - - [Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisory](https://portswigger.net/daily-swig/jenkins-security-unpatched-xss-csrf-bugs-included-in-latest-plugin-advisory) -- 博客园 - sevck - - [【PHP代码审计】TP3.2某传销系统getshell - sevck](https://www.cnblogs.com/sevck/p/16547738.html) -- Securelist - - [DDoS attacks in Q2 2022](https://securelist.com/ddos-attacks-in-q2-2022/107025/) -- KitPloit - PenTest & Hacking Tools - - [Kage - Graphical User Interface For Metasploit Meterpreter And Session Handler](http://www.kitploit.com/2022/08/kage-graphical-user-interface-for.html) -- Blog - Praetorian - - [The Economy of Trust in Smart Contract Security](https://www.praetorian.com/blog/web3-trust-dependencies/) -- 奇安信威胁情报中心 - - [借助码云，仿冒微软，回连某电视台网站的RT样本分析](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247502934&idx=1&sn=1a86f6956ff33d3f3d4a935b7cac4ddb&chksm=ea663b21dd11b237dfeae00760f94d8f67f1ed9e855298cbf72ce1c85665e4fee58323deff83&scene=58&subscene=0#rd) -- 代码卫士 - - [VMware：立即、马上修复这个严重的认证绕过漏洞！](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513307&idx=1&sn=22a89560c545c2168147b9a9ea5ea9bf&chksm=ea9485b1dde30ca7cc5237c2be269090f21d72c259ef84384b2acc1e2f180f0899796cb4e52d&scene=58&subscene=0#rd) - - [开源web应用中存在三个XSS漏洞，可导致系统遭攻陷](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513307&idx=2&sn=4a99112b9efeb2e33add05f94b1dd1d5&chksm=ea9485b1dde30ca77b26b217f677ed8a3be57d9c8750d39780781015e46520db5185da5bd1dc&scene=58&subscene=0#rd) -- 红日安全 - - [这篇文章超有料——威胁情报共享08.03](https://mp.weixin.qq.com/s?__biz=MzI4NjEyMDk0MA==&mid=2649850821&idx=1&sn=e33b013156603dfc179561842cba28df&chksm=f3e4ed46c49364508d31cfd5a15d6fde61793f1fce238d0b8abfc7951107166760788e03f67b&scene=58&subscene=0#rd) -- r2c website - - [Testing autofix behavior of SAST rules](https://r2c.dev/blog/2022/testing-autofix-behavior-of-sast-rules/) -- 安全客 - - [【技术分享】剖析脏牛1_mmap如何映射内存到文件](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774647&idx=1&sn=01a74164b8e0ebc2110a67cfe6912a57&chksm=88936a58bfe4e34e23a4cd3cb05e202aceb62837aafa22e49fab8fcf8eeea720fd52e61948b1&scene=58&subscene=0#rd) - - [【安全头条】BlackCat勒索组织宣称对欧洲天然气公司网络攻击负责](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774647&idx=2&sn=76c32299d7fd908d5222dcfafc397b6c&chksm=88936a58bfe4e34e54f1da7c491601af6e8cb1bd7e1d70de1414668cefc6468ebcb2f657e637&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [新书 |《DevSecOps敏捷安全》企业安全建设指南](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485822&idx=1&sn=bc4deb5926ad3abd3dbca8d7c37ba5b5&chksm=fa5aa793cd2d2e855da3d2f3c3b7189d0d5f166130af71d4a88fdf84391381574a716d6b27e7&scene=58&subscene=0#rd) - - [.NET Tricks系列 命名空间赋值重写WebShell](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485822&idx=2&sn=dccfb8d79a79126500e27201d9869fbb&chksm=fa5aa793cd2d2e8599bd52547e9036b7ceec6a0b9469b3e1b7e8a628b137bf2ee442c1fab725&scene=58&subscene=0#rd) -- M01NTeam - - [绿盟科技研究类社招及实习生招聘启动！](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489113&idx=1&sn=1b4ae3bf202fb93d9bfe73446a142eb1&chksm=c187d648f6f05f5e8ade147d36e6616b171c253a846c0fd6e83b2eca8f8f08b67e628c4ba069&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [每日情报汇总分析](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492879&idx=1&sn=3f93e25cad16b5d79957531acc43d5bf&chksm=e84c43d0df3bcac64c7085a7672d87b9083405127ffa9689f8182c9c6971a6b16289a7250a09&scene=58&subscene=0#rd) -- 安全牛 - - [浅谈当前云WAF应用的价值与不足](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116766&idx=1&sn=f6e59ccf93eb93939e0a575cfcd81987&chksm=bd14640d8a63ed1bbb4459dd92d9c46f5840c9a40d19f2692f435464c5a417f6c8722f84acb7&scene=58&subscene=0#rd) - - [从海外技术创新看零信任应用发展](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116766&idx=2&sn=6220c611cc138ab0d870ec1e80073973&chksm=bd14640d8a63ed1b959171a7e718fd23d6aab5626c264affb961d5177210fb31bf011267ee3c&scene=58&subscene=0#rd) - - [云服务中的安全责任共担模型](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116766&idx=3&sn=50e3efedcfae0a7bbedbdc590dab8786&chksm=bd14640d8a63ed1b2d6fb93422782eadd5832d5e75179123b58298df3969e815497284341a0c&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [移动应用安全黑灰产对抗分析之“虚假”的点击](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247489166&idx=1&sn=54782275b6b0e92ac586aa54ac34c3ef&chksm=e9b930e2deceb9f44c6211466da19cadb50641a81174afcf9dcf26ad586b61b8d6051f052ddc&scene=58&subscene=0#rd) -- 看雪学院 - - [Android APP漏洞之战——SQL注入漏洞初探](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460061&idx=1&sn=ce272d6b2b2f839d7eeeb2896eb90ee5&chksm=b18e2f1786f9a60139d90f95e9442cc01b6f218f6bd47045dbdeb25d946d7427ba16c9c24cd9&scene=58&subscene=0#rd) - - [（文末抽奖）荣耀七夕奖励计划！双倍奖金、荣耀70 Pro等你拿](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460061&idx=2&sn=d90150dd9dc772cb7d5a5571e7347bad&chksm=b18e2f1786f9a6016b87c5c5dc4544e6902a57c4d00d9d8e8cb472470ef84063849fe0f732dd&scene=58&subscene=0#rd) - - [VMware 修复CVSS评分9.8的身份验证绕过漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460061&idx=3&sn=a69c59fbc79b634b447555f2ac76af93&chksm=b18e2f1786f9a601c51138cea6e9f663ec20364f3f7e629496aaac4c6a3207bec8e87cc4296a&scene=58&subscene=0#rd) - - [LLVM与代码混淆技术，详解3种经典代码混淆方式+2种变体](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460061&idx=4&sn=5dd3aaa631f75b4e6cf47f2f9053d734&chksm=b18e2f1786f9a601fcdcf165bd1359a162f8762acc4662ed56286e4702e5ecac1c0b90113ba6&scene=58&subscene=0#rd) -- SecIN技术平台 - - [原创 | TP5 RCE漏洞总结](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494653&idx=1&sn=04654fc45de601b350b924e7a695ffc8&chksm=eb84b6a9dcf33fbf4d5745d8aa3eb15fe6d9777533149211cd7c90e8384af06070dad527997e&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [印度网络间谍生财有道！攻击律所、律师及相关企业高管以寻求诉讼优势](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530154&idx=1&sn=213c31da5aabeb1c4c736fa64c269fb7&chksm=fa93c06bcde4497dc5cfb8b08827b3d6ca2874424e7e59a22feb71c940392f35ac43416e9a95&scene=58&subscene=0#rd) - - [数据安全技术和市场之我见](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530154&idx=2&sn=ff9eff8894b33efd2840f957854fa29c&chksm=fa93c06bcde4497dc6774e061ed439f7d654eb61bbdbccacae195ba9108bd34897193c4f9da2&scene=58&subscene=0#rd) - - [航天工业五个重大网络安全事件](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530154&idx=3&sn=7d1c0101ddaf59cf928ac3c06a73654a&chksm=fa93c06bcde4497df940664a2df6254e2a199c50d48668d0c0502c4bb6118de84eb6002e4906&scene=58&subscene=0#rd) -- Checkmarx.com - - [Large Scale Campaign Created Fake GitHub Projects Clones with Fake Commit Added Malware](https://checkmarx.com/blog/large-scale-campaign-created-fake-github-projects-clones-with-fake-commit-added-malware/) - - [A Practical Example of the Power of Checkmarx Fusion](https://checkmarx.com/blog/a-practical-example-of-the-power-of-checkmarx-fusion/) -- 中国信息安全 - - [论坛·原创 | 从俄乌冲突看网络空间武器化倾向及其影响](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163274&idx=1&sn=b6d52787561c655fcb3e99a9dc3dd3be&chksm=8b5ee533bc296c250b856500bebe9d437f1132b63788acce046b859d3b1502a00dfbe585ac3f&scene=58&subscene=0#rd) - - [专题·云安全将来时 | 云原生时代下新安全范式的思考与应对](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163274&idx=2&sn=8a508e22ae4a7ab9fd205d79fbd24e21&chksm=8b5ee533bc296c2551faad05d770b4a79a1d496a09c306b80a70d45c2d653e78fca39c9bf032&scene=58&subscene=0#rd) - - [观点 | 保障数据依法有序流动](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163274&idx=3&sn=9cd6350f93e52ae90dd6014c82993bfd&chksm=8b5ee533bc296c25b876859b6cfdcaa4c318c6747fd1876bfe03cd1183a94da261dac90ca079&scene=58&subscene=0#rd) - - [前沿 | 智能汽车创新须重视数据安全](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163274&idx=4&sn=03fad1d829eaf510c77403535d9e8d41&chksm=8b5ee533bc296c25fc9e8ef4c04c93af17fa322a415e3df3117614540eb260628b8309f8c414&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】超 8000个Solana 钱包被盗，约 5.8 亿美元流向 4 个地址](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010771&idx=1&sn=892742461a3fb4791d6eb4fa83ff5d7f&chksm=f36f5553c418dc4583e93aa3db2495657346ddbcbb88c334d5ec9e087f5b556c2c0f01a4c3a4&scene=58&subscene=0#rd) - - [【安全圈】外媒：台湾地区领导人办公室网站受网络攻击，一度出现故障​](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010771&idx=2&sn=7111f4355de3e393a047d8a47d574776&chksm=f36f5553c418dc450a9d08c570c1c99a704ba1c8ea2a038c7cd666b532dba487972fd9051b03&scene=58&subscene=0#rd) - - [【安全圈】微博崩了](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010771&idx=3&sn=c6db3995aff2d6e1c509754cd217dd38&chksm=f36f5553c418dc4525d83d96e527d53a1678023184afe88c0fdbe70bdb39d9dc5eaa1aac3472&scene=58&subscene=0#rd) - - [【安全圈】广东通信管理局对小鹏汽车、广汽丰田开展网络安全检查](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010771&idx=4&sn=6548584377ce9b07f483a32edb95e267&chksm=f36f5553c418dc45f8e717839607f8e03cbddcd01098149aa8d64cb99cf13cf10f75838a479e&scene=58&subscene=0#rd) - - [【安全圈】虚假的加密货币应用程序骗取投资者数百万元](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010771&idx=5&sn=e946457edb7684103e657a2e5dd48397&chksm=f36f5553c418dc4546845efd96ab7e88384b0113edb208223a7e8ab7f89fb4c1369b2352fc5b&scene=58&subscene=0#rd) - - [【安全圈】中欧天然气管道公司疑遭勒索软件攻击，150GB数据失窃](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652010771&idx=6&sn=4606410112930c31ce9942d551162728&chksm=f36f5553c418dc4520e843240e4378b7d3071b7446c390e134e3414d150e23da035001987023&scene=58&subscene=0#rd) -- 极客公园 - - [一份当代年轻人报告，藏着多少信号](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962775&idx=1&sn=0be098a1467e9177afb98dc7f6e5cb53&chksm=7e55826149220b776754d7368e36eb3c8e807e6bfa13e072376493cd6c2c6c67e1d430f32ab4&scene=58&subscene=0#rd) - - [罗技合作腾讯，将推云游戏掌机；何小鹏：望 2025 年实现自动驾驶；温度已达 32.5℃，北极现在可穿短袖｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962774&idx=1&sn=26851a4531800f8d43ee36c326df1864&chksm=7e55826049220b76328c449a3391f8ed8bb86cb3c5dc002d9548332739bbc792a3d0e558f10e&scene=58&subscene=0#rd) -- 情报分析师 - - [扎瓦希里被死神地狱火刀片搅碎！现场还原美军斩首行动](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513110&idx=1&sn=3abaf9b6eef3dafd3356d1b0803f258d&chksm=8716b09db061398bb7dae4eb4093663d7ea38e421e2f6babffea0272fc7d63a09e0cb122489a&scene=58&subscene=0#rd) - - [【实战技法】使用阴影和光学对美军基地中的照片进行地理定位](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513110&idx=2&sn=23ca023f13fa2624c5af9091c58897bf&chksm=8716b09db061398b9ba97a132e7289fd509cc31cecceece1783c7f20b2bfcedf81054c56f25c&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [强网杯WriteUp｜Reverse 方向](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495291&idx=1&sn=6f3bbcfb6e190a9846766626b69939cd&chksm=fa523bc5cd25b2d312d89fd357e06e719ce1776915f501473f46713b47a7a5891d20fa142018&scene=58&subscene=0#rd) -- 谛听ditecting - - [谛听|“谛听”团队参加2021年国家重点研发计划项目“智能网联场景工业控制系统深度防御与安全处置技术”工作推进会议](https://mp.weixin.qq.com/s?__biz=MzU3MzQyOTU0Nw==&mid=2247487711&idx=1&sn=6c2f3ce92f57a373b5affcf9bacd655f&chksm=fcc0929bcbb71b8d61265f14b9af9ab1719d67437c6068edddf9e9767cbaf28fd0da6c3c953b&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [《数字中国发展报告（2021年）》（附全文）](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529725&idx=1&sn=fbabbe53351f9c204b815abc0c7aa6b6&chksm=c1e9f8acf69e71baa7c0025bf8cd4d3fe0c1225ea0b0fdfde4d0ffb5729dc12f71e26d83bb14&scene=58&subscene=0#rd) - - [中欧天然气管道公司疑遭勒索软件攻击，150GB数据失窃](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529725&idx=2&sn=da08d7a5ca5101d86df1ab6ffa867511&chksm=c1e9f8acf69e71bad1d6a729ebd3adc67e1c0d998098d429308f7ea85fa143dbf87a32dbd278&scene=58&subscene=0#rd) - - [虚假的加密货币应用程序骗取投资者数百万元](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529725&idx=3&sn=bf70bcf55f7c6ef34abeab43b1568664&chksm=c1e9f8acf69e71ba4a24bbec1c0bafee27c7e914a2bb7a8b4eadeb40261fd1067bda80b855b8&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [IPFS成为钓鱼攻击的温床](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547235&idx=1&sn=06a4ecba097340c9b5293091a85fd29e&chksm=e915e959de62604f602e1a657607a3c77d11769405f42d57d4f3365b6d85566528034c2312be&scene=58&subscene=0#rd) - - [正确的 WAF 配置对网络安全是如此重要](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547235&idx=2&sn=461f782fa8a19585095e8373bf1658e1&chksm=e915e959de62604f5f0f29bdbf13c566b29d031a291701c2b1cccca6522515bfe33a97d46885&scene=58&subscene=0#rd) -- webs3c - Latest posts - - [Subdomain Enumeration Methodology Discussion!](https://webs3c.com/t/subdomain-enumeration-methodology-discussion/182#post_1) - - [reconFTW, an overview](https://webs3c.com/t/reconftw-an-overview/183#post_1) -- 星阑科技 - - [星阑科技多领域上榜《CCSIP 2022中国网络安全产业全景图》](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494712&idx=1&sn=cd0eefc872bf401fa1439cc529367a1f&chksm=c00741a4f770c8b28745f9938c3a63bbfe148ec20dca2a844e80b984b890c8e54b947ddc9ffe&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-05.md b/archive/2022/2022-08-05.md deleted file mode 100644 index d0685683f0..0000000000 --- a/archive/2022/2022-08-05.md +++ /dev/null @@ -1,212 +0,0 @@ -# 每日安全资讯（2022-08-05） - -- HackerOne Hacker Activity - - [Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability](https://hackerone.com/reports/1658418) - - [Unauthenticated Private Messages DIsclosure via wordpress Rest API](https://hackerone.com/reports/1590237) - - [Sensei LMS IDOR to send message](https://hackerone.com/reports/1592596) - - [Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.com](https://hackerone.com/reports/1577370) -- Files ≈ Packet Storm - - [VMware Workspace ONE Access Privilege Escalation](https://packetstormsecurity.com/files/167973/vmware_workspace_one_access_certproxy_lpe.rb.txt) - - [Chrome WebGL Uniform Integer Overflows](https://packetstormsecurity.com/files/167972/GS20220804145252.tgz) - - [Gentoo Linux Security Advisory 202208-01](https://packetstormsecurity.com/files/167971/glsa-202208-01.txt) - - [Gentoo Linux Security Advisory 202208-05](https://packetstormsecurity.com/files/167970/glsa-202208-05.txt) - - [Gentoo Linux Security Advisory 202208-04](https://packetstormsecurity.com/files/167969/glsa-202208-04.txt) - - [Gentoo Linux Security Advisory 202208-03](https://packetstormsecurity.com/files/167968/glsa-202208-03.txt) - - [Gentoo Linux Security Advisory 202208-02](https://packetstormsecurity.com/files/167967/glsa-202208-02.txt) - - [Backdoor.Win32.Jokerdoor MVID-2022-0628 Buffer Overflow](https://packetstormsecurity.com/files/167966/MVID-2022-0628.txt) - - [Red Hat Security Advisory 2022-5904-01](https://packetstormsecurity.com/files/167965/RHSA-2022-5904-01.txt) - - [Red Hat Security Advisory 2022-5903-01](https://packetstormsecurity.com/files/167964/RHSA-2022-5903-01.txt) - - [Red Hat Security Advisory 2022-5892-01](https://packetstormsecurity.com/files/167963/RHSA-2022-5892-01.txt) - - [Red Hat Security Advisory 2022-5893-01](https://packetstormsecurity.com/files/167962/RHSA-2022-5893-01.txt) - - [Red Hat Security Advisory 2022-5894-01](https://packetstormsecurity.com/files/167961/RHSA-2022-5894-01.txt) - - [Ubuntu Security Notice USN-5547-1](https://packetstormsecurity.com/files/167960/USN-5547-1.txt) - - [Red Hat Security Advisory 2022-5766-01](https://packetstormsecurity.com/files/167959/RHSA-2022-5766-01.txt) - - [Red Hat Security Advisory 2022-5778-01](https://packetstormsecurity.com/files/167958/RHSA-2022-5778-01.txt) - - [Red Hat Security Advisory 2022-5765-01](https://packetstormsecurity.com/files/167957/RHSA-2022-5765-01.txt) - - [Red Hat Security Advisory 2022-5840-01](https://packetstormsecurity.com/files/167956/RHSA-2022-5840-01.txt) - - [Red Hat Security Advisory 2022-5729-01](https://packetstormsecurity.com/files/167955/RHSA-2022-5729-01.txt) - - [Red Hat Security Advisory 2022-5806-01](https://packetstormsecurity.com/files/167954/RHSA-2022-5806-01.txt) - - [Red Hat Security Advisory 2022-5821-01](https://packetstormsecurity.com/files/167953/RHSA-2022-5821-01.txt) - - [Red Hat Security Advisory 2022-5730-01](https://packetstormsecurity.com/files/167952/RHSA-2022-5730-01.txt) - - [Red Hat Security Advisory 2022-5805-01](https://packetstormsecurity.com/files/167951/RHSA-2022-5805-01.txt) - - [Red Hat Security Advisory 2022-5756-01](https://packetstormsecurity.com/files/167950/RHSA-2022-5756-01.txt) - - [Red Hat Security Advisory 2022-5809-01](https://packetstormsecurity.com/files/167949/RHSA-2022-5809-01.txt) -- 安全通告 - - [安全通告 - 涉及华为终端某产品的输入校验漏洞](//www.huawei.com/cn/psirt/security-advisories/2022/huawei-sa-20220810-01-8cfecdcc-cn) -- Sploitus.com Exploits RSS Feed - - [IObit Malware Fighter 9.2 Tampering / Privilege Escalation Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37888&utm_source=rss&utm_medium=rss) - - [VMware Workspace ONE Access Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:167973&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Jokerdoor MVID-2022-0628 Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:167966&utm_source=rss&utm_medium=rss) - - [MobileIron Log4Shell Remote Command Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37889&utm_source=rss&utm_medium=rss) - - [Multi-Language Hotel Management 2022 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37887&utm_source=rss&utm_medium=rss) - - [WordPress Download Manager 3.2.50 Arbitrary File Deletion exploit](https://sploitus.com/exploit?id=PACKETSTORM:167920&utm_source=rss&utm_medium=rss) - - [WordPress Duplicator 1.4.7 Unauthenticated Backup Download exploit](https://sploitus.com/exploit?id=PACKETSTORM:167919&utm_source=rss&utm_medium=rss) - - [Zoho Password Manager Pro XML-RPC Java Deserialization Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37890&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Apache Http Server exploit](https://sploitus.com/exploit?id=DBF996C3-DC2A-5859-B767-6B2FC38F2185&utm_source=rss&utm_medium=rss) -- Tenable Blog - - [Analyzing the Vulnerabilities Associated with the Top Malware Strains of 2021](https://www.tenable.com/blog/analyzing-the-vulnerabilities-associated-with-the-top-malware-strains-of-2021) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [谷歌从市场删除了多个包含恶意软件的Android应用程序](https://www.4hou.com/posts/xjVB) - - [3200 App泄露推特API密钥，可实现账户劫持](https://www.4hou.com/posts/KE5M) - - [奇安信入围权威机构托管安全服务报告](https://www.4hou.com/posts/N1pD) -- Microsoft Security Blog - - [How IT and security teams can work together to improve endpoint security](https://www.microsoft.com/security/blog/2022/08/04/how-it-and-security-teams-can-work-together-to-improve-endpoint-security/) -- SecWiki News - - [SecWiki News 2022-08-04 Review](http://www.sec-wiki.com/?2022-08-04) -- 跳跳糖 - 安全与分享社区 - - [2022UIUCTF-Spoink(Pebble最新模板注入)](https://tttang.com/archive/1692/) -- obaby@mars - - [JEB Decompiler 4.18](http://h4ck.org.cn/2022/08/jeb-decompiler-4-18/) -- 美团技术团队 - - [Kafka在美团数据平台的实践](https://tech.meituan.com/2022/08/04/the-practice-of-kafka-in-the-meituan-data-platform.html) -- Trustwave Blog - - [Trustwave Named Innovation Leader in Frost & Sullivan’s Frost Radar Global Managed Detection and Response Market](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-named-innovation-leader-in-frost-sullivans-frost-radar-global-managed-detection-and-response-market/) -- Sucuri Blog - - [How to Create Secure Passwords for Your Website in 6 Easy Steps](https://blog.sucuri.net/2022/08/how-to-create-secure-passwords-for-your-website.html) -- ElcomSoft blog - - [Windows Hello: No TPM No Security](https://blog.elcomsoft.com/2022/08/windows-hello-no-tpm-no-security/) - - [New in Elcomsoft System Recovery: Microsoft Azure Accounts, LUKS2 and Forensic Tool Filters](https://blog.elcomsoft.com/2022/08/new-in-elcomsoft-system-recovery-microsoft-azure-accounts-luks2-and-forensic-tool-filters/) -- Filippo Valsorda - - [A Wide Reduction Trick](https://words.filippo.io/dispatches/wide-reduction/) -- 先知安全技术社区 - - [MSF多层内网渗透全过程](https://xz.aliyun.com/t/11588) - - [ThinkPHP V6.0.12LTS 反序列化漏洞的保姆级教程（含exp编写过程）](https://xz.aliyun.com/t/11584) -- 先知安全技术社区 - - [MSF多层内网渗透全过程](https://xz.aliyun.com/t/11588) - - [ThinkPHP V6.0.12LTS 反序列化漏洞的保姆级教程（含exp编写过程）](https://xz.aliyun.com/t/11584) -- Twitter @Nicolas Krassas - - [PersistenceSniper: Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in W...](https://twitter.com/Dinosn/status/1555183608989622274) - - [This is how he could hijack Reddit accounts with just ONE click: a $10,000 bug bounty](https://twitter.com/Dinosn/status/1555183447504732162) - - [RedGuard: C2 front flow control tool to avoid Blue Teams, AVs, EDRs check](https://twitter.com/Dinosn/status/1555183148299870209) - - [Hackers Exploited Atlassian Confluence Bug to Deploy Ljl Backdoor for Espionage](https://twitter.com/Dinosn/status/1555182678126858242) - - [Cirrusgo - A Fast Tool To Scan SAAS, PAAS App Written In Go](https://twitter.com/Dinosn/status/1555182245744451588) - - [Browser In The Browser (BITB) Templates](https://twitter.com/Dinosn/status/1555179371735957505) - - [2022 exploit pocs,](https://twitter.com/Dinosn/status/1555179185810857986) - - [Hide process,port,self under Linux using the ld_preload](https://twitter.com/Dinosn/status/1555178685099024386) - - [BloodHound Attack Research Kit](https://twitter.com/Dinosn/status/1555177251343302659) - - [UK Parliament bins its TikTok account over China surveillance fears](https://twitter.com/Dinosn/status/1555082374727319552) - - [Student crashes Cloudflare beta party, redirects email, bags a bug bounty](https://twitter.com/Dinosn/status/1555082239209242625) - - [Kage - Graphical User Interface For Metasploit Meterpreter And Session Handler](https://twitter.com/Dinosn/status/1555053070182236164) - - [Critical RCE Bug in DrayTek Routers Opens SMBs to Zero-Click Attacks](https://twitter.com/Dinosn/status/1555052817471213568) - - [For months, JusTalk messages were accessible to everyone on the Internet](https://twitter.com/Dinosn/status/1555052653171843072) - - [Spanish research agency still recovering after ransomware attack](https://twitter.com/Dinosn/status/1555052574973349888) - - [Tonight We're Gonna Log On Like It's 1979](https://twitter.com/Dinosn/status/1555052377882955782) - - [Ex-T-Mobile US store owner phished staff, raked in $25m from unlocking phones](https://twitter.com/Dinosn/status/1555052236971118594) - - [Abusing URL Shortners for fun and profit](https://twitter.com/Dinosn/status/1555052014383599616) - - [Woody RAT: A new feature-rich malware spotted in the wild](https://twitter.com/Dinosn/status/1555051905382055937) - - [Cloned Atomic Wallet website is pushing Mars Stealer malware](https://twitter.com/Dinosn/status/1555051851963310080) -- 安全脉搏 - - [【漏洞预警】大华IP摄像头重放漏洞](https://www.secpulse.com/archives/184761.html) - - [一次手动修改shellcode过火绒](https://www.secpulse.com/archives/184719.html) - - [蓝队防守方战前准备篇（上）](https://www.secpulse.com/archives/184745.html) -- paper - Last paper - - [依靠 Windows Defender | LockBit 勒索软件通过 Microsoft 安全工具侧面加载 Cobalt Strike](https://paper.seebug.org/1940/) -- 安全客-有思想的安全新媒体 - - [补丁分析发现Zyxel认证绕过(CVE-2022-0342)](https://www.anquanke.com/post/id/277276) - - [无文件恶意软件攻击](https://www.anquanke.com/post/id/277187) - - [欧盟导弹制造商MBDA否认遭网络攻击](https://www.anquanke.com/post/id/277463) -- Security Boulevard - - [Aspen Security Forum 2022 – Moderator: David Ignatius, Secretary Frank Kendall USAF ‘Fireside Chat On Modernization And The Future Of Warfare’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-david-ignatius-secretary-frank-kendall-usaf-fireside-chat-on-modernization-and-the-future-of-warfare/) - - [CommitStrip ‘Stack-Doubt’](https://securityboulevard.com/2022/08/commitstrip-stack-doubt/) - - [GwisinLocker ransomware targets South Korean industrial and pharma firms](https://securityboulevard.com/2022/08/gwisinlocker-ransomware-targets-south-korean-industrial-and-pharma-firms/) - - [Study Shows Widespread Abuse of Code Signing Certificates](https://securityboulevard.com/2022/08/study-shows-widespread-abuse-of-code-signing-certificates/) - - [Canary Tokens [Security Zines]](https://securityboulevard.com/2022/08/canary-tokens-security-zines/) - - [Scammers Sent Uber to Take Elderly Lady to the Bank](https://securityboulevard.com/2022/08/scammers-sent-uber-to-take-elderly-lady-to-the-bank/) - - [BlackCloak Brings Digital Executive Protection to Black Hat 2022](https://securityboulevard.com/2022/08/blackcloak-brings-digital-executive-protection-to-black-hat-2022/) - - [This Week in Malware—Typosquats in PyPI, dependency confusion packages](https://securityboulevard.com/2022/08/this-week-in-malware-typosquats-in-pypi-dependency-confusion-packages/) - - [Cyberbullying vs. trolling: Here’s how to differentiate between them](https://securityboulevard.com/2022/08/cyberbullying-vs-trolling-heres-how-to-differentiate-between-them/) - - [How to Talk to Your Board (So They’ll Listen!)](https://securityboulevard.com/2022/08/how-to-talk-to-your-board-so-theyll-listen/) -- unSafe.sh - 不安全 - - [Cyberbullying vs. trolling: Here's how to differentiate between them](https://buaq.net/go-120777.html) - - [Who Needs Macros? | Threat Actors Pivot to Abusing Explorer and Other LOLBins via Windows Shortcuts](https://buaq.net/go-120781.html) - - [A Wide Reduction Trick](https://buaq.net/go-120778.html) - - [CyRC Vulnerability Advisory: Local privilege escalation in Kaspersky VPN](https://buaq.net/go-120779.html) - - [zeroperil/HookDump: Security product hook detection](https://buaq.net/go-120758.html) - - [Ransomware protection with Malwarebytes EDR: Your FAQs, answered!](https://buaq.net/go-120766.html) - - [泛微漏洞测试求助](https://buaq.net/go-120756.html) - - [百日行动亮利剑，梆梆安全助力企业数据安全保卫战](https://buaq.net/go-120759.html) -- Twitter @bytehx - - [RT 5pider: 90% of my Twitter DMs are asking me about how to start getting into Malware development. Well, I love answering them but it's easier to wri...](https://twitter.com/C5pider/status/1555256779553906694) - - [RT Brute Logic: Brute SVG Collection => use in uploads or regular input. XSS (no image) XSS (valid image) Redirect (default) Redirect (custom) Redirec...](https://twitter.com/brutelogic/status/1555247051461517312) - - [RT _fget_+0x1e: Finally! Today i published my first tool on my @github, and name of the tool is #cvePuller written in #Golang this tool is simply fetc...](https://twitter.com/ransomsec/status/1555246686204678144) - - [RT PT SWARM: 🔥 A tip for getting RCE in Jetty apps with just one XML file!](https://twitter.com/ptswarm/status/1555184661751648256) - - [RT Nicolas Krassas: 2022 exploit pocs,](https://twitter.com/Dinosn/status/1555179185810857986) -- Bug Bounty in InfoSec Write-ups on Medium - - [This is how he could hijack Reddit accounts with just ONE click: a $10,000 bug bounty](https://infosecwriteups.com/this-is-how-he-could-hijack-reddit-accounts-with-just-one-click-a-10-000-bug-bounty-7fd8d54d5582?source=rss----7b722bfd1b8d--bug_bounty) -- 博客园 - 挖洞的土拨鼠 - - [个人信息那些事 - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16548974.html) -- Malwarebytes Labs - - [Ransomware review: July 2022](https://blog.malwarebytes.com/threat-intelligence/2022/08/ransomware-review-july-2022/) - - [Ransomware protection with Malwarebytes EDR: Your FAQs, answered!](https://blog.malwarebytes.com/business/2022/08/ransomware-protection-with-malwarebytes-edr-your-faqs-answered/) -- blog.avast.com EN - - [Cyberbullying vs. trolling: Here's how to differentiate between them](https://blog.avast.com/cyberbullying-vs.-trolling-heres-how-to-differentiate-between-them) -- SAP Blogs - - [HCM Brasil: Atualizações e novidades de julho/2022](https://blogs.sap.com/2022/08/04/hcm-brasil-atualizacoes-e-novidades-de-julho-2022/) - - [Processing of Prepayments with SAP S/4HANA Accruals Management](https://blogs.sap.com/2022/08/04/processing-of-prepayments-with-sap-s-4hana-accruals-management/) - - [Automate Salesforce Quote-to-Cash Processes in SAP Business ByDesign](https://blogs.sap.com/2022/08/04/automate-salesforce-quote-to-cash-processes-in-sap-business-bydesign/) - - [Inventory Clerk Persona in SAP Service and Asset Manager](https://blogs.sap.com/2022/08/04/inventory-clerk-persona-in-sap-service-and-asset-manager/) - - [Are The Beatles right when it comes to integration strategies?](https://blogs.sap.com/2022/08/04/are-the-beatles-right-when-it-comes-to-integration-strategies/) - - [GDAL with SAP HANA driver in OSGeo4W](https://blogs.sap.com/2022/08/04/gdal-with-sap-hana-driver-in-osgeo4w/) - - [Bring your Business Process Management skills to the next level.](https://blogs.sap.com/2022/08/04/bring-your-business-process-management-skills-to-the-next-level./) - - [Reverse Tax Engine – Payroll USA](https://blogs.sap.com/2022/08/04/reverse-tax-engine-payroll-usa/) - - [Sync SAP BW Roles to SAC Team](https://blogs.sap.com/2022/08/04/sync-sap-bw-roles-to-sac-team/) - - [Horizon themes now available with the SAP Launchpad service and SAP Work Zone](https://blogs.sap.com/2022/08/04/horizon-themes-now-available-with-the-sap-launchpad-service-and-sap-work-zone/) -- Sucuri Blog - - [How to Create Secure Passwords for Your Website in 6 Easy Steps](https://blog.sucuri.net/2022/08/how-to-create-secure-passwords-for-your-website.html) -- Application Security Blog - - [CyRC Vulnerability Advisory: Local privilege escalation in Kaspersky VPN](https://www.synopsys.com/blogs/software-security/cyrc-advisory-kasperksy-vpn-microsoft-windows/) -- The Daily Swig | Cybersecurity news and views - - [Chromium site isolation bypass allows wide range of attacks on browsers](https://portswigger.net/daily-swig/chromium-site-isolation-bypass-allows-wide-range-of-attacks-on-browsers) - - [ParseThru: HTTP parameter smuggling flaw uncovered in several Go applications](https://portswigger.net/daily-swig/parsethru-http-parameter-smuggling-flaw-uncovered-in-several-go-applications) -- KitPloit - PenTest & Hacking Tools - - [Cirrusgo - A Fast Tool To Scan SAAS, PAAS App Written In Go](http://www.kitploit.com/2022/08/cirrusgo-fast-tool-to-scan-saas-paas.html) -- 博客园 - EtherDream - - [如何让 JS 代码不可断点 - EtherDream](https://www.cnblogs.com/index-html/p/js-anti-breakpoint.html) -- webs3c - Latest posts - - [Subdomain Enumeration Methodology Discussion!](https://webs3c.com/t/subdomain-enumeration-methodology-discussion/182#post_5) -- 看雪学院 - - [CobaltStrike ShellCode详解](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460264&idx=1&sn=52e25757888a3df53e8c6d01c7a0229d&chksm=b18e10e286f999f4d1377a09747bfcb8f2ec5dc8ee757c1e69d5b198403571dd9b5386531ad9&scene=58&subscene=0#rd) - - [重磅上线|看雪课程激励成长体系！新增经验值、积分等5大模块](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460264&idx=2&sn=aefd74552a79522168bf300e0dc26c33&chksm=b18e10e286f999f453360c8a8d7a33f9da8a4d3aa096093e84ea409712e17e11192496cef6a1&scene=58&subscene=0#rd) - - [西班牙国家研究委员会遭受勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460264&idx=3&sn=21277c90eb3de112333550f6612a9c43&chksm=b18e10e286f999f457ecb34cbf52ae94460dc5ace5e0d4ad059a97ab9f1e24163b49c7f10b9a&scene=58&subscene=0#rd) - - [反勒索软件开发实战篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460264&idx=4&sn=05700232e2a545d03c8efc97ec21616c&chksm=b18e10e286f999f40b7abd2e5c000cac5c3fdab663fc35ae71ba5ea76c7be76d725e31417896&scene=58&subscene=0#rd) -- 威努特工控安全 - - [防火墙技术之NAT技术——目的NAT应用（上）](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651087655&idx=1&sn=74d5b115fffec1f17bfc64ba858b2160&chksm=80e67997b791f081900d69e496055f22480314a751c73ee7776fa2da371f7fbe6fdf7fb4ed3a&scene=58&subscene=0#rd) -- text/plain - - [Understanding Browser Channels](https://textslashplain.com/2022/08/04/understanding-browser-channels/) -- Security Uncorked - - [WiFi Security: WPA2 vs. WPA3](https://securityuncorked.com/2022/08/wifi-security-wpa2-vs-wpa3/) -- 三六零CERT - - [安全日报（2022.08.04）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491218&idx=1&sn=3df8ad839a60eba33161b184ef343705&chksm=fe251b93c9529285cbaf2b8d256f7d60fd1b2c025f6361b02531cd61bb5ecd0ecc58a45d0a00&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [七夕甜蜜钜惠，星球优惠劵限时抢购](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485832&idx=1&sn=19db6bd99f285502a3c9fc0296d947aa&chksm=fa5aa765cd2d2e73a99d5a4c99d74bbeebe2018204f5b0d74399859b1995e65b99e8eeec11ff&scene=58&subscene=0#rd) -- rtl-sdr.com - - [SI-SDR-UG Recorded Livestream: Corey Explains DF-Aggregator for KrakenSDR and KerberosSDR](https://www.rtl-sdr.com/si-sdr-ug-recorded-livestream-corey-explains-df-aggregator-for-krakensdr-and-kerberossdr/) -- 慢雾科技 - - [慢雾：Solana 公链大规模盗币事件的分析](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495923&idx=1&sn=170a877e75a5c787525a2790c777f2a9&chksm=fdde8e74caa90762043f9d5d9552244924d62cb412af31a07a3697735fdcf9d745710c8ea593&scene=58&subscene=0#rd) -- 安全威胁情报 - - [福利预告：8月11日溯源版HFish上线，依然0元购](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173505&idx=1&sn=48a2faf5965a7739253fa04249764e5c&chksm=f4488bfdc33f02eb479e410596269ba54af86b7dc28da66180689b117584dcb6efa5b7b7846e&scene=58&subscene=0#rd) - - [安全协同｜用微步在线、可防微杜渐](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173505&idx=2&sn=0b9ee225e847a555eeecf0b42d43e165&chksm=f4488bfdc33f02eb1d09201c84b04bcfcedb0cec5be21efff6d41e2c5f088b7c37f017261271&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [网络空间测绘——MQTT服务篇](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492904&idx=1&sn=2a4846554a925f6c9ce68b44731d279f&chksm=e84c43f7df3bcae14004eb6152eabeb49515baff46541ca5d1763f484576dfc8e463a3b2bb80&scene=58&subscene=0#rd) -- 安全牛 - - [溢价63%！身份安全厂商Ping Identity接受28亿美元全现金收购方案](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116798&idx=1&sn=fbcf3c24a31451393753d498e08ef38d&chksm=bd14642d8a63ed3bfbac38c9717e6fd56633a94a2f1fee5288001b0ac2903a221d45f90292e6&scene=58&subscene=0#rd) - - [盘点 | 最危险的5大勒索攻击团伙](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116798&idx=2&sn=2733a61af56c6e4bcbb108d245305edd&chksm=bd14642d8a63ed3be71b5fd42038aa9b8056a9f2a6f640e2283059e0c2446c153fb7e78343f9&scene=58&subscene=0#rd) - - [安全牛课堂 | 保护计算机使用安全的十个技巧](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116798&idx=3&sn=46dd46c61dd74e59d0254039f749b6a1&chksm=bd14642d8a63ed3b20e874b93dec9f6dbb771e19986547db67015d16738eb9b6646846a8288c&scene=58&subscene=0#rd) -- 极客公园 - - [你身体里的 DNA，能存下整个宇宙的数据](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963041&idx=1&sn=c22d40cd31531f1c3d0f04cee6d4b917&chksm=7e547d574923f4417e3885be966be7a6733e2c26f782dad26ed807204d2be29460b695389242&scene=58&subscene=0#rd) - - [iPadOS 16 推迟发布；大众 40 亿美元买激光雷达；「世界 500 强」发布，中国 145 家公司上榜｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652962995&idx=1&sn=4a7496842f497369177dbef72061bb89&chksm=7e547d054923f41350536afd4dc63f758cde68c06e5f1b4881e8484b640a8dec95ac4628e23c&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [强网杯WriteUp｜PWN & Crypto](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495338&idx=1&sn=cfb6aa2df369ff24221c2aea3ed1fb8c&chksm=fa523b14cd25b2027b2cfc1d3e347443b200a139d026d04f4f1840a26ab6752d2141082f8de3&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [3200 App泄露推特API密钥，可实现账户劫持](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547268&idx=1&sn=6a4a0c884d8fc7548622804d56aa64d7&chksm=e915e9bede6260a891f26e976b994067633a722c9140ecec98e26b156a9bfba957a48093a2cb&scene=58&subscene=0#rd) - - [谷歌从市场删除了多个包含恶意软件的Android应用程序](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547268&idx=2&sn=5b176225805fb4d4d4ba9ad4a40f23e8&chksm=e915e9bede6260a80771d2a7f677350e103b3c4b70b05ab5d5ad5f77315c126feefa569cbcff&scene=58&subscene=0#rd) -- M01NTeam - - [七夕福利|8月活跃粉丝爱意回馈](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489124&idx=1&sn=36f85510ebcb74f9912aec51aaf5be7d&chksm=c187d675f6f05f6328e8dd7ec8e686a7bf12003f4d7eb4083686685bed6b9ec7ac2983a7cb89&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】CVE-2019-10999 Dlink IP 摄像头缓冲区溢出](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774718&idx=1&sn=bfd99d8e1ec1f53faf9aa6332d0de939&chksm=88936a11bfe4e3074c94cdfb9bc4dd06590acff22112bcea1b9ad7fc74f4b54d67576ab4515c&scene=58&subscene=0#rd) - - [【安全头条】欧盟导弹制造商MBDA否认遭网络攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774718&idx=2&sn=06c3e00941886cb77218fac6d0564db2&chksm=88936a11bfe4e3076d898d702fc2350d1fa516bd705503cc124e7073c71b89d6f95e3ae1fc4e&scene=58&subscene=0#rd) -- 互联网安全内参 - - [超2.8亿条公民身份信息在公有云上暴露，印度政府未予置评](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505052&idx=1&sn=857c2c7b7235f9700e567b49b395dcdd&chksm=ebfa93bcdc8d1aaa9a624b5100cddfa27e54c1787da24be3a34076612d5b3386a9e8516d7f13&scene=58&subscene=0#rd) - - [台媒：台铁车站屏幕突现“老巫婆窜访台湾...”等字样](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505052&idx=2&sn=5cc75c67842de535f4e3a49e723e0592&chksm=ebfa93bcdc8d1aaacab0ddf56d42dfdab5c78c0193d0fc785069926c41cc9e5c5914b23da9e1&scene=58&subscene=0#rd) - - [数以千计的APP正在泄露Twitter的API密钥](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505052&idx=3&sn=bfb6966fe3875a23d440d3140a564cec&chksm=ebfa93bcdc8d1aaad0ff143cceae655cb9147fc416cdbee6bcbb2442e3e645c0ee0bf654a882&scene=58&subscene=0#rd) - - [黑客组织公开2TB电子邮件，揭露南美洲多家矿业公司黑幕](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505052&idx=4&sn=90787a3913022da5c19c16689928d02d&chksm=ebfa93bcdc8d1aaac67fae85c18b2cf89021ca21d0dba671390c85108b5ae9088c958aedc587&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-06.md b/archive/2022/2022-08-06.md deleted file mode 100644 index 9b973d1bab..0000000000 --- a/archive/2022/2022-08-06.md +++ /dev/null @@ -1,205 +0,0 @@ -# 每日安全资讯（2022-08-06） - -- Sploitus.com Exploits RSS Feed - - [Backdoor.Win32.Bushtrommel.122 MVID-2022-0630 Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:167977&utm_source=rss&utm_medium=rss) - - [Zimbra UnRAR Path Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:167989&utm_source=rss&utm_medium=rss) - - [Online Admission System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167975&utm_source=rss&utm_medium=rss) - - [VMware Workspace ONE Access Privilege Escalation Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37891&utm_source=rss&utm_medium=rss) - - [WordPress Testimonial Slider And Showcase 2.2.6 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167974&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Bushtrommel.122 MVID-2022-0629 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:167976&utm_source=rss&utm_medium=rss) - - [WordPress Ecwid Ecommerce Shopping Cart 6.10.23 Cross Site Request Forgery exploit](https://sploitus.com/exploit?id=PACKETSTORM:167978&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2021-23841 exploit](https://sploitus.com/exploit?id=4E834790-A0F9-5830-88FE-F520B8FE3CBB&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [Zimbra UnRAR Path Traversal](https://packetstormsecurity.com/files/167989/zimbra_unrar_cve_2022_30333.rb.txt) - - [GNUnet P2P Framework 0.17.3](https://packetstormsecurity.com/files/167988/gnunet-0.17.3.tar.gz) - - [Ubuntu Security Notice USN-5548-1](https://packetstormsecurity.com/files/167987/USN-5548-1.txt) - - [Red Hat Security Advisory 2022-5905-01](https://packetstormsecurity.com/files/167986/RHSA-2022-5905-01.txt) - - [Red Hat Security Advisory 2022-5909-01](https://packetstormsecurity.com/files/167985/RHSA-2022-5909-01.txt) - - [Red Hat Security Advisory 2022-5908-01](https://packetstormsecurity.com/files/167984/RHSA-2022-5908-01.txt) - - [Ubuntu Security Notice USN-5551-1](https://packetstormsecurity.com/files/167983/USN-5551-1.txt) - - [Ubuntu Security Notice USN-5550-1](https://packetstormsecurity.com/files/167982/USN-5550-1.txt) - - [Ubuntu Security Notice USN-5549-1](https://packetstormsecurity.com/files/167981/USN-5549-1.txt) - - [Ubuntu Security Notice USN-5546-1](https://packetstormsecurity.com/files/167980/USN-5546-1.txt) - - [Ubuntu Security Notice USN-5546-2](https://packetstormsecurity.com/files/167979/USN-5546-2.txt) - - [WordPress Ecwid Ecommerce Shopping Cart 6.10.23 Cross Site Request Forgery](https://packetstormsecurity.com/files/167978/wpeesc61023-xsrf.txt) - - [Backdoor.Win32.Bushtrommel.122 MVID-2022-0630 Remote Command Execution](https://packetstormsecurity.com/files/167977/MVID-2022-0630.txt) - - [Backdoor.Win32.Bushtrommel.122 MVID-2022-0629 Authentication Bypass](https://packetstormsecurity.com/files/167976/MVID-2022-0629.txt) - - [Online Admission System 1.0 SQL Injection](https://packetstormsecurity.com/files/167975/onlineadmissionsystem10-sql.txt) - - [WordPress Testimonial Slider And Showcase 2.2.6 Cross Site Scripting](https://packetstormsecurity.com/files/167974/wptss226-xss.txt) -- SecWiki News - - [SecWiki News 2022-08-05 Review](http://www.sec-wiki.com/?2022-08-05) -- 先知安全技术社区 - - [ManageEngine ADSelfService Plus 历史漏洞CVE-2021-40539分析](https://xz.aliyun.com/t/11589) -- 安全客-有思想的安全新媒体 - - [数字安全观察-每周简报 （2022.07.27-2022.08.02）](https://www.anquanke.com/post/id/277610) - - [被骗的钱为什么很难追回来？这里的水到底有多深？](https://www.anquanke.com/post/id/277516) - - [Nomad 跨链桥被盗1.8亿美元事件分析](https://www.anquanke.com/post/id/277553) - - [CVE-2022-26138 Confluence Server硬编码漏洞分析](https://www.anquanke.com/post/id/277532) - - [数千克隆开源项目存在恶意代码专钓马大哈](https://www.anquanke.com/post/id/277529) -- 跳跳糖 - 安全与分享社区 - - [CVE-2022-34918 netfilter nf_tables 本地提权分析](https://tttang.com/archive/1693/) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-aug-5) -- 机智的程序员小熊 - - [django/DRF(Django REST framework) 统一异常处理/输出](https://coding3min.com/1908.html) -- Security Boulevard - - [What You Need to Know About Ransomware in AWS](https://securityboulevard.com/2022/08/what-you-need-to-know-about-ransomware-in-aws/) - - [How to detect Log4j vulnerabilities in Java projects for free with CodeSec](https://securityboulevard.com/2022/08/how-to-detect-log4j-vulnerabilities-in-java-projects-for-free-with-codesec/) - - [RiskLens Wins Best Risk/Security Product in 2022 Risk Technology Awards](https://securityboulevard.com/2022/08/risklens-wins-best-risk-security-product-in-2022-risk-technology-awards/) - - [Aspen Security Forum 2022 – Fireside Chat With William J. Burns, Director, United States Central Intelligence Agency, Moderator: Andrea Mitchell](https://securityboulevard.com/2022/08/aspen-security-forum-2022-fireside-chat-with-william-j-burns-director-united-states-central-intelligence-agency-moderator-andrea-mitchell/) - - [Building a Defense Against Cybersecurity Fraud and Brand Impersonation](https://securityboulevard.com/2022/08/building-a-defense-against-cybersecurity-fraud-and-brand-impersonation/) - - [US Emergency Alert System Has ‘Huge Flaw’ — Broadcasters Must Patch NOW](https://securityboulevard.com/2022/08/us-emergency-alert-system-huge-flaw-broadcasters-must-patch-now/) - - [Cybersecurity Insights with Contrast CISO David Lindner | 8/5](https://securityboulevard.com/2022/08/cybersecurity-insights-with-contrast-ciso-david-lindner-8-5/) - - [XKCD ‘Chemtrails’](https://securityboulevard.com/2022/08/xkcd-chemtrails/) - - [Say it Ain’t So Mom! Back to School Shopping & Retail Cybersecurity](https://securityboulevard.com/2022/08/say-it-aint-so-mom-back-to-school-shopping-retail-cybersecurity/) - - [Buried under security debt? Here’s how to dig yourself out to improve security posture](https://securityboulevard.com/2022/08/buried-under-security-debt-heres-how-to-dig-yourself-out-to-improve-security-posture/) -- Chromium Blog - - [Chrome 105 Beta: Custom Highlighting, Fetch Upload Streaming, and More](http://blog.chromium.org/2022/08/chrome-105-beta-custom-highlighting.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [再次捕获！重保期间拦截针对Coremail的钓鱼攻击](https://www.4hou.com/posts/3JOO) - - [延期公告｜第十一届 KCon 黑客大会将延期举办](https://www.4hou.com/posts/2JO1) - - [知道创宇EDR系统实力通过中国信通院端点检测与响应产品能力评测](https://www.4hou.com/posts/ZXpw) - - [应对数字资产海啸](https://www.4hou.com/posts/gXLj) - - [2022年第二季度APT趋势分析](https://www.4hou.com/posts/oJ6B) - - [被骗的钱为什么很难追回来？这里的水到底有多深？](https://www.4hou.com/posts/JX7J) - - [数据库审计产品进化史](https://www.4hou.com/posts/VZlv) - - [Microsoft SQL服务器被黑客入侵 带宽被窃取](https://www.4hou.com/posts/XVk5) -- Recent Commits to cve:main - - [Update Fri Aug 5 17:16:18 UTC 2022](https://github.com/trickest/cve/commit/45454f74c2a72f29c17e2fa711ba68966a06d35b) - - [Update Fri Aug 5 15:19:22 UTC 2022](https://github.com/trickest/cve/commit/29e114fd9d1bcb3305b4e729f190cffa56c49dc3) -- 安全脉搏 - - [低版本某远控RCE/LPE漏洞复现](https://www.secpulse.com/archives/184838.html) - - [利用PHP的特性做免杀Webshell](https://www.secpulse.com/archives/184784.html) - - [SAST 与 DAST：静态和动态应用程序安全测试](https://www.secpulse.com/archives/184763.html) - - [Http-Sumggling-缓存漏洞](https://www.secpulse.com/archives/184807.html) -- Jay Bosamiya - - [Mixed (Google CTF 2022)](https://www.jaybosamiya.com/blog/2022/08/05/mixed/) -- unSafe.sh - 不安全 - - [cby的日常(before 2022.7.10)](https://buaq.net/go-120946.html) - - [他们已经打进了台湾](https://buaq.net/go-120927.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 32](https://buaq.net/go-120930.html) - - [A new botnet Orchard Generates DGA Domains with Bitcoin Transaction Information](https://buaq.net/go-120929.html) - - [Small business growth in 2022: 7 effective strategies](https://buaq.net/go-120922.html) - - [How to Get Started in Cybersecurity: Learn the Basics](https://buaq.net/go-120924.html) - - [Q&A with Siew Lau: Creativity, law, and bridging cultural differences](https://buaq.net/go-120923.html) - - [FCC warns of steep rise in phishing over SMS](https://buaq.net/go-120921.html) - - [Peetch - An eBPF Playground](https://buaq.net/go-120925.html) - - [数据分级分类 - 挖洞的土拨鼠](https://buaq.net/go-120913.html) - - [看雪第六届安全开发者峰会[议题征集]启动！文末抽奖~](https://buaq.net/go-120912.html) - - [浏览器窗口尺寸相关的 API 整理图 - EtherDream](https://buaq.net/go-120914.html) - - [FreeBuf周报 | 澳大利亚隐私监管机构调查TikTok；印度废除数据保护法；区块链行业遭供应链攻击重创](https://buaq.net/go-120971.html) -- GuidePoint Security - - [How to Get Started in Cybersecurity: Learn the Basics](https://www.guidepointsecurity.com/blog/how-to-get-started-in-cybersecurity-learn-the-basics/) -- 博客园 - 挖洞的土拨鼠 - - [数据分级分类 - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16554344.html) -- 先知安全技术社区 - - [ManageEngine ADSelfService Plus 历史漏洞CVE-2021-40539分析](https://xz.aliyun.com/t/11589) -- hn security - - [A journey into IoT – Unknown Chinese alarm – Part 3 – Radio communications](https://security.humanativaspa.it/a-journey-into-iot-unknown-chinese-alarm-part-3-radio-communications/) -- SAP Blogs - - [SAP PaPM Cloud: What’s New as of 2022-08-01?](https://blogs.sap.com/2022/08/05/sap-papm-cloud-whats-new-as-of-2022-08-01/) - - [Overview of all Data Purge options and Business Case](https://blogs.sap.com/2022/08/05/overview-of-all-data-purge-options-and-business-case/) - - [Unplanned delivery costs – unplanned delivery costs field, direct posting to GL account, subsequent debit](https://blogs.sap.com/2022/08/05/unplanned-delivery-costs-unplanned-delivery-costs-field-direct-posting-to-gl-account-subsequent-debit/) - - [What’s New in SAP Analytics Cloud and SAP Digital Boardroom Q3 2022](https://blogs.sap.com/2022/08/05/whats-new-in-sap-analytics-cloud-and-sap-digital-boardroom-q3-2022/) - - [New Feature: Driving Time and Working Hours Constraints in VSR Optimizer](https://blogs.sap.com/2022/08/05/new-feature-driving-time-and-working-hours-constraints-in-vsr-optimizer/) - - [Interactable split-screen ALV (using CL_SALV_TABLE)](https://blogs.sap.com/2022/08/05/interactable-split-screen-alv-using-cl_salv_table/) - - [The benefits of obtaining SAP Certifications during academic years (through the SAP Dual Study Program): a student’s perspective](https://blogs.sap.com/2022/08/05/the-benefits-of-obtaining-sap-certifications-during-academic-years-through-the-sap-dual-study-program-a-students-perspective/) - - [Top Innovation Picks from SAP Business Technology Platform (Q2/2022)](https://blogs.sap.com/2022/08/05/top-innovation-picks-from-sap-business-technology-platform-q2-2022/) - - [Enterprise Management Layer for SAP S/4HANA – What’s New – September 2022](https://blogs.sap.com/2022/08/05/enterprise-management-layer-for-sap-s-4hana-whats-new-september-2022/) - - [Third-Party Solutions usage in RISE with SAP S/4HANA Cloud, private edition](https://blogs.sap.com/2022/08/05/third-party-solutions-usage-in-rise-with-sap-s-4hana-cloud-private-edition/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 32](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-32-4/) -- Malwarebytes Labs - - [FCC warns of steep rise in phishing over SMS](https://blog.malwarebytes.com/social-engineering/2022/08/fcc-warns-of-steep-rise-in-phishing-over-sms/) -- Hexacorn - - [Week of Data Dumps, Part 6 – file names](https://www.hexacorn.com/blog/2022/08/05/week-of-data-dumps-part-6-file-names/) -- Hex Rays - - [Igor’s tip of the week #101: Decompiling variadic function calls](https://hex-rays.com/blog/igors-tip-of-the-week-101-decompiling-variadic-function-calls/) -- NVISO Labs - - [Finding hooks with windbg](https://blog.nviso.eu/2022/08/05/finding-hooks-with-windbg/) -- KitPloit - PenTest & Hacking Tools - - [Peetch - An eBPF Playground](http://www.kitploit.com/2022/08/peetch-ebpf-playground.html) -- blog.avast.com EN - - [Small business growth in 2022: 7 effective strategies](https://blog.avast.com/small-business-growth-strategies) - - [Q&A with Siew Lau: Creativity, law, and bridging cultural differences](https://blog.avast.com/siew-lau-creativity-law-cultural-differences) -- Reverse Engineering - - [Exception Hijacking: Abusing NTDLL for complete static control flow obfuscation](https://www.reddit.com/r/ReverseEngineering/comments/wgiyth/exception_hijacking_abusing_ntdll_for_complete/) -- text/plain - - [Passkeys](https://textslashplain.com/2022/08/05/passkeys/) -- 博客园 - EtherDream - - [浏览器窗口尺寸相关的 API 整理图 - EtherDream](https://www.cnblogs.com/index-html/p/js-screen-size-api.html) -- 锦行信息安全 - - [【喜报】锦行科技获中国人民解放军某部队感谢信](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247490386&idx=1&sn=719998a17f48021753242b54dc60cd39&chksm=9799e0f7a0ee69e17dd1c845145738dc0f5223afd07931b5db052452b0e2167fdf21edc87d62&scene=58&subscene=0#rd) -- 看雪学院 - - [看雪第六届安全开发者峰会[议题征集]启动！文末抽奖~](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460890&idx=1&sn=334e606210d592f122c74e8e9c873a3e&chksm=b18e125086f99b46143c26217718fbee9acb3f0a798a101dcc3e881f1b5d1a2e0be2d1465317&scene=58&subscene=0#rd) - - [快速定位windows堆溢出](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460890&idx=2&sn=6dda0e1e0dbde3e28864d065c2ad3745&chksm=b18e125086f99b46b5f7e384e417c9c209a052445c1a4c33659f298da40476785f6ed5d9e038&scene=58&subscene=0#rd) - - [Nomad跨链协议被黑走1.9亿美元](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460890&idx=3&sn=196227df3b3d5ee5cd4a3bfa24d9bdcb&chksm=b18e125086f99b464a87f18bc0c9ff242c8378d852e5d67c5048e95ca5863c8c529eef712645&scene=58&subscene=0#rd) - - [《物联网安全入门》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460890&idx=4&sn=73603f269191d0321257ab6a9bae5d4d&chksm=b18e125086f99b463a0305da721053c7ba5f711898480ffad87d7395c12a2343afb405a9df2f&scene=58&subscene=0#rd) - - [夏日找工作不用愁，来这看看？](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460890&idx=5&sn=8e94b7fb3e3919c7cc9e9949bc1c4e32&chksm=b18e125086f99b46fca78e80cac10cf54bc9f6d376508b57585f6a988a8e077102041410cbc3&scene=58&subscene=0#rd) -- 酒仙桥六号部队 - - [曼弗雷德：入侵游戏十二年，我靠一行代码，赚上万美元 | 人物志045](https://mp.weixin.qq.com/s?__biz=MzAwMzYxNzc1OA==&mid=2247500609&idx=1&sn=42650fea56d4739296400fca8fefb336&chksm=9b3ae5f0ac4d6ce662a3c13fb296ae72ad5167be0e97c2c8ddd15b85cff444e104033bb52fdc&scene=58&subscene=0#rd) -- SecPulse安全脉搏 - - [对APP逆向抓包的实践](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044691&idx=1&sn=ece77ce0a58a1b61bf3b5770721b8ab3&chksm=803fa80db748211bd9a39d9fd2d0de864a8771e50609f90515310c17dd2c0ba039ca4f45b448&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】Intel AES-NI使用入门](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774729&idx=1&sn=b67b59adde5b0c61894a3e7e2cb000a2&chksm=88936ae6bfe4e3f0c8127dc36478259b2b606657d741905f657533272c3ed2b427d94b4b3dd3&scene=58&subscene=0#rd) - - [【安全头条】数千克隆开源项目存在恶意代码专钓马大哈](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774729&idx=2&sn=24711fcdc6ae9020cbe9181998ee83d9&chksm=88936ae6bfe4e3f015c422a8ed960a0b5b7269161107c8ce176b0dce09e6b22747e3b1cbf600&scene=58&subscene=0#rd) -- webs3c - Latest posts - - [How to remove duplicate subdomains from result of different tools and combine it together?](https://webs3c.com/t/how-to-remove-duplicate-subdomains-from-result-of-different-tools-and-combine-it-together/188#post_1) -- 我的安全梦 - - [漏洞应急响应交流群](https://mp.weixin.qq.com/s?__biz=MzU3NDY1NTYyOQ==&mid=2247485351&idx=1&sn=f8c7f1675893f3fea911360aa074c96f&chksm=fd2e5a45ca59d3537feca1fbe85f9011c26a14258aef21ab763359f3199520a83fb30ce88898&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-08-05 Magma](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492193&idx=1&sn=151f5e8208fa6e7c9ea2949773ecb41f&chksm=c063ccb8f71445aea8c9a5b9bd6cba3a430a15db7f5dbb281757dc1b9e1d272fe5256e6b73af&scene=58&subscene=0#rd) -- The Daily Swig | Cybersecurity news and views - - [XSS in Gmail’s AMP For Email earns researcher $5,000](https://portswigger.net/daily-swig/xss-in-gmails-amp-for-email-earns-researcher-5-000) - - [High-impact vulnerability in DrayTek routers leaves thousands of SMEs open to exploitation](https://portswigger.net/daily-swig/high-impact-vulnerability-in-draytek-routers-leaves-thousands-of-smes-open-to-exploitation) - - [Authentication bypass bug in Nextauth.js could allow email account takeover](https://portswigger.net/daily-swig/authentication-bypass-bug-in-nextauth-js-could-allow-email-account-takeover) -- 极客公园 - - [独家：快手组织架构再调整，原商业化负责人马宏彬转任国际化负责人](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963467&idx=1&sn=b95fe40e23b6a193bf58e1c6b8434870&chksm=7e547f3d4923f62b329fde713ef32fbc6a9bdcbef71828e93f1d341bc956623b2eb2129cbb49&scene=58&subscene=0#rd) - - [曾经什么都想要的阿里，正在学会「聚焦」和「取舍」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963419&idx=1&sn=fc02c9fda2e5bd8cd9754dc3e5ed40e1&chksm=7e547fed4923f6fb4ccd1dd0fffff629c8969f516cb8f8d9a85413c4ad526ff97c0633936178&scene=58&subscene=0#rd) - - [苹果、索尼押注的技术赛道，国内公司如何拔得头筹？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963419&idx=2&sn=48435e5eac5d61b0396ef2535f3cb209&chksm=7e547fed4923f6fb6d44a49479780e63036ac8e3d71c75c9ffe1551f000567aa1974c4b9e553&scene=58&subscene=0#rd) - - [阿里张勇：工作重心从增长变为服务好现有用户；「蔚来手机」公司正式成立；美团：现可退还摩拜单车押金｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963392&idx=1&sn=6adfcc9463cbeb2bb99c51c5a6ffc2d0&chksm=7e547ff64923f6e01dcb3c01938f2832030ba15bbe617684694db37d5d8e9aeef867017ba39c&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [第二届山石CTF夏令营｜PWN & MISC学员感言摘录](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495349&idx=1&sn=09102b01bead5a1614afa421996b2e69&chksm=fa523b0bcd25b21dc31537a4a914b739520e9921c538264cb3e1da16b42a98f7a8af8168180f&scene=58&subscene=0#rd) -- 安全威胁情报 - - [ISC2022微步陈杰博士：XDR关联检测的真正威力](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173529&idx=1&sn=a0f7b049b5045aa52307228b5abf817d&chksm=f4488be5c33f02f39f89a64e49f80553c7b5bdebe9f488070b68cbb092605be2b31961172829&scene=58&subscene=0#rd) -- 星阑科技 - - [星阑科技入选《云安全全景图2.0》12个细分领域 ，云安全能力再获认可！](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494734&idx=1&sn=dcdb33b8a091a304d1304c003609c35f&chksm=c00741d2f770c8c4f1882d60067f45c06b8f70c96c46427409c1f91197fba6543de3e0c39dfb&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [物联网安全威胁情报（2022年7月）](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530263&idx=1&sn=7e95fb3d5608f73d31c39f6808fad8a7&chksm=fa93c1d6cde448c0088f055b720716b724f59ecc563fed88dbb0d1b483e50a9c6c9fbd30145e&scene=58&subscene=0#rd) - - [最危险的5大勒索攻击团伙](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530263&idx=2&sn=c360ed78a6a501d5d2c682ebead4a409&chksm=fa93c1d6cde448c0ef8decb2766ed5d8dcb594c6fd25af254dea3bb6ac14e1d94f41dee4f860&scene=58&subscene=0#rd) - - [台湾四大网站遭到DDoS攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530263&idx=3&sn=37f68c0af0e63b2464fbd6b166a42c93&chksm=fa93c1d6cde448c09494c7f672a17af537051259747aafa4558ca519f36b1440db9641e7ab38&scene=58&subscene=0#rd) - - [谷歌从市场删除了多个包含恶意软件的Android应用程序](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530263&idx=4&sn=d84ca9dbbd13914a287131feb2ed5620&chksm=fa93c1d6cde448c0eba088d873ac1dfd1f7ccd6bcfdae946e6591ef8753612f44df3e3e7c100&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [物联网安全威胁情报（2022年7月）](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529813&idx=1&sn=42ffc68db32984c9851cee27e2b9f572&chksm=c1e9f904f69e7012ca0944dfbe4def246334c344637283bf9b418b876965065cb8f5c4080fda&scene=58&subscene=0#rd) - - [美国关键基础设施网络防御路线发展与调整](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529813&idx=2&sn=2de0197990f06027f14eca5536ed4b45&chksm=c1e9f904f69e701251d4d3bf7abb28fd50dc90c3d1ce392dc79c117f40231d95d3c3097f41f9&scene=58&subscene=0#rd) - - [超2.8亿条公民身份信息在公有云上暴露，印度政府未予置评](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529813&idx=3&sn=1c175a3f465160647ac8f2e429db7689&chksm=c1e9f904f69e701228044d00f338c60dd426a53c02b1ee1469a82a5ec1f3f9901d3163e03b9b&scene=58&subscene=0#rd) - - [揭秘无文件恶意软件的入侵轨迹](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529813&idx=4&sn=83f3dfb72f03ea206fd71af3a3023efa&chksm=c1e9f904f69e70122be4e63ce4f2773af7cacf05fafdd039aa5f53d186d823ee450c450fc850&scene=58&subscene=0#rd) -- 安全牛 - - [从近期村镇银行事件看村镇银行的金融科技安全](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116913&idx=1&sn=43a027dcc80ecd441ceaebb88e9401aa&chksm=bd1465a28a63ecb41e439b01aba1053e2c2830991002110b36833e45e49a80587ae9ab664439&scene=58&subscene=0#rd) - - [第六批网络关键设备安全检测结果公布](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116913&idx=2&sn=f6ede6ba57a9551527ce20e6a0aef810&chksm=bd1465a28a63ecb4919b77a2a16ef9fa99d170b96d1b211d71c95d71a327ff8c6acdab89c0db&scene=58&subscene=0#rd) - - [《数据传输安全白皮书》发布](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116913&idx=3&sn=f7dfb623818a3e6bcc7924a1629daec6&chksm=bd1465a28a63ecb49dabe670eafbc96f3da1d18d6f2e68ffe9ec171e7501f08a87e7b117a309&scene=58&subscene=0#rd) -- 中国信息安全 - - [论坛·原创 | 严明：对俄乌冲突中网络空间对抗的思考](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163354&idx=1&sn=e7454023fb05ab7588659d11689f7eab&chksm=8b5eeae3bc2963f5e5c34e5c0000e60d89fd8e5926fd6d59279d298fca0a7d8028a2f4a47b85&scene=58&subscene=0#rd) - - [关注 | 工信部：二季度不良手机应用投诉超半数涉信息安全 54款不良手机应用已下架处理](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163354&idx=2&sn=0de5ac62d5e56e9e939cd0858bac80d3&chksm=8b5eeae3bc2963f50adf539efc2a1d306c63b774030e407fb5277b74860eee5d16b969880bde&scene=58&subscene=0#rd) - - [行业 | 云原生环境下，主动防御在红蓝对抗中的应用](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163354&idx=3&sn=c80cca4a90ea4e5d7753947472ccfe7f&chksm=8b5eeae3bc2963f51363b8bba5545c8fa297086ed9c18c761650b33ce305d28b419bde97cc98&scene=58&subscene=0#rd) - - [观点 | 把准网络谣言扩散中的受众选择机制](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163354&idx=4&sn=88968eab5e06f0a791b16eb503daaa22&chksm=8b5eeae3bc2963f51d43d3aa99f8dae29b2b8443c042fd4840f89ee32229f32512a6bbdb9dc6&scene=58&subscene=0#rd) -- 网安国际 - - [InForSec@山东大学网络安全实践教学与高水平人才培养研讨会将于8月13日召开，欢迎报名参会！](https://mp.weixin.qq.com/s?__biz=MzA4ODYzMjU0NQ==&mid=2652311442&idx=1&sn=6f8db8c56e5b2413d8a4f4bde48560f2&chksm=8bc4921cbcb31b0a53d7f29dc126876866d68b4fd408a9c02304888ee69f63c1dc8b2b716378&scene=58&subscene=0#rd) -- SecIN技术平台 - - [活动 | SecIN喊你来投稿啦！投稿即有惊喜好礼～更有机会稿费翻倍！](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494666&idx=1&sn=d2df71ac8d85e05ac1c7ad9573bf07ef&chksm=eb84b15edcf3384842ee84723ccd6468b7ae28e32483f8b35d6d68af7d19cad2bd62112af618&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [2022年第二季度APT趋势分析](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547316&idx=1&sn=0afab839b44790bc2cc082a54022c3c3&chksm=e915e98ede6260989a26c69b4b17822fdf47df815fa3a7cd40f0f07416123d15ad9f5513ff82&scene=58&subscene=0#rd) - - [应对数字资产海啸](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547316&idx=2&sn=bac20b2515fb0c2e902603ec7fd88637&chksm=e915e98ede6260986d13d54170dddc9a388a03329cb99781cf333d038e5fb7957d1085c59e7d&scene=58&subscene=0#rd) -- NOVASEC - - [DNSlog搭建-单域名单接管部署xray reverse](https://mp.weixin.qq.com/s?__biz=MzUzODU3ODA0MA==&mid=2247487731&idx=1&sn=6729c04d9466b3a4b36d2cd4ac6dde19&chksm=fad4cde4cda344f23029523ab4f8f6ff736d273f0a64888a542bfeba4a597442414c2c2a091b&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.08.05）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491221&idx=1&sn=2647768a127e150a8cef6aeab3ad1d74&chksm=fe251b94c95292823dbcfacaa0f623d06df46768d59c1bf38784a188b39f132a584bf043c52a&scene=58&subscene=0#rd) -- M01NTeam - - [每周蓝军技术推送（2022.7.30-8.5）](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489134&idx=1&sn=19035e85cc049919dbf2e682446b3a0e&chksm=c187d67ff6f05f69fd592c2d972968f7899ed0120e33f41201fa0ab027c65f0d778515440584&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [【火绒安全周报】赛米控遭勒索攻击/俄黑客侵入乌国防大学服务器](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247508206&idx=1&sn=16e24bd1d4091c7fb184c9f5de873215&chksm=eb707ed1dc07f7c7202e1efbc74d7d9c554aa5dfbd3da014b10c6a4eeb4349c21f6afbeb0d82&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Aug.5th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495719&idx=1&sn=72cd15ba6b1e5989136db543ce93f3e4&chksm=ce96bd19f9e1340faf39b66ae9623033731d34739ea6acc5217d3704fa81e3503cb8ff26276e&scene=58&subscene=0#rd) -- 情报分析师 - - [战略威慑失败的风险建模（含美国国家利益威胁清单）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513278&idx=1&sn=88753f219a13478915b1728a4e741a9a&chksm=8716b135b061382394756e1391a5ab8eac772ddb5970a5518236729538f983886ee35ef1305b&scene=58&subscene=0#rd) - - [扎瓦希里的死和基地组织的下一步行动](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513278&idx=2&sn=eaf630191b8000e1e8866682b96c3b03&chksm=8716b135b06138231f572e08abda4b892059880fca1216e3e84832d3a3f587729af406667aa8&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-07.md b/archive/2022/2022-08-07.md deleted file mode 100644 index 086092c43a..0000000000 --- a/archive/2022/2022-08-07.md +++ /dev/null @@ -1,110 +0,0 @@ -# 每日安全资讯（2022-08-07） - -- HackerOne Hacker Activity - - [RCE vulnerability in Hyperledger Fabric SDK for Java](https://hackerone.com/reports/801370) - - [Enrolling to a CA that returns an empty response crashes the node process](https://hackerone.com/reports/506412) - - [Brute Force of fabric-ca server admin account](https://hackerone.com/reports/411364) - - [cross site scripting in : mtn.bj](https://hackerone.com/reports/1264834) - - [Ingress-nginx path allows retrieval of ingress-nginx serviceaccount token](https://hackerone.com/reports/1382919) -- Security Boulevard - - [Aspen Security Forum 2022 – Anja Manuel’s ‘Day 3 Opening Remarks’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-anja-manuels-day-3-opening-remarks/) - - [Daniel Stori’s ‘What Processes Do When They’re Idle’](https://securityboulevard.com/2022/08/daniel-storis-what-processes-do-when-theyre-idle-2/) - - [Aspen Security Forum 2022 – ‘The New Russian Empire?’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-the-new-russian-empire/) - - [Class Action Targets Experian Over Account Security](https://securityboulevard.com/2022/08/class-action-targets-experian-over-account-security/) -- Sploitus.com Exploits RSS Feed - - [Exploit for Out-of-bounds Write in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=3E320B36-9DFC-53EF-8079-9B652019A21A&utm_source=rss&utm_medium=rss) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [WordPress Ecwid Ecommerce Shopping Cart 6.10.23 Cross Site Request Forgery](https://cxsecurity.com/issue/WLB-2022080034) - - [WordPress Testimonial Slider And Showcase 2.2.6 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022080033) - - [Backdoor.Win32.Bushtrommel.122 / Authentication Bypass](https://cxsecurity.com/issue/WLB-2022080032) - - [Backdoor.Win32.Bushtrommel.122 / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022080031) - - [Active PHP Bookmarks v1.3 - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022080030) - - [Picaporte Design - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022080029) -- SecWiki News - - [SecWiki News 2022-08-06 Review](http://www.sec-wiki.com/?2022-08-06) -- unSafe.sh - 不安全 - - [Trying to install Penguino x.3 on Linux](https://buaq.net/go-121040.html) - - [ManageEngine ADSelfService Plus 历史漏洞CVE-2021-40539分析](https://buaq.net/go-120941.html) - - [Pict - Post-Infection Collection Toolkit](https://buaq.net/go-121018.html) - - [XMachOViewer 0.04 is a Mach-O viewer for Windows, Linux and MacOS](https://buaq.net/go-121017.html) - - [cby的英文小作文(before 2022.8)](https://buaq.net/go-121044.html) - - [还有这种工具：骂人的时候，主动屏蔽自己的输入法？...更生气了！](https://buaq.net/go-121014.html) - - [ffffffff0x/AboutSecurity: Everything for pentest. | 用于渗透测试的 payload 和 bypass 字典.](https://buaq.net/go-121003.html) - - [[AHK＃54] 用AutoHotkey快速輸出Markdown標題井號(Hashes)](https://buaq.net/go-121006.html) - - [你叉叉（You Fa Fa）- 主动屏蔽输入法敏感词，骂人前提醒自己消消气](https://buaq.net/go-121005.html) - - [任意键｜第九世代宝可梦；彩虹六号出手游；骗情怀的仙剑七及其他](https://buaq.net/go-121008.html) - - [星球专属版CobaltStrike发布——添加双因子认证等多项功能（内附抽奖活动）](https://buaq.net/go-120995.html) - - [How i was able to get 29 free products. | Bug Bounty](https://buaq.net/go-120998.html) - - [Private server emulation for Digimon Online v1.5](https://buaq.net/go-120997.html) - - [Another day, Another IDOR vulnerability— $5000 Reddit Bug Bounty](https://buaq.net/go-120999.html) - - [CosmicStrand：发现复杂的 UEFI 固件 rootkit](https://buaq.net/go-120986.html) - - [Nomad Bridge漏洞利用被窃取1.9亿美元](https://buaq.net/go-120987.html) -- Recent Commits to cve:main - - [Update Sat Aug 6 17:25:16 UTC 2022](https://github.com/trickest/cve/commit/93a6afb5d8162ca109640fdd0f84bad88c3680f6) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [CosmicStrand：发现复杂的 UEFI 固件 rootkit](https://www.4hou.com/posts/kM6N) - - [Nomad Bridge漏洞利用被窃取1.9亿美元](https://www.4hou.com/posts/YX0M) - - [下周五！首聚元宇宙！DEF CON 30 CHINA Party来了！](https://www.4hou.com/posts/503K) -- ArthurChiao's Blog - - [The Mythical Container net.core.somaxconn (2022)](https://arthurchiao.github.io/blog/the-mythical-container-somaxconn/) -- Twitter @Nicolas Krassas - - [HTB: Overgraph](https://twitter.com/Dinosn/status/1555963615123046401) - - [Pict - Post-Infection Collection Toolkit](https://twitter.com/Dinosn/status/1555963393084952584) - - [Microsoft bars Tutanota users from registering MS Teams accounts](https://twitter.com/Dinosn/status/1555963317549731840) - - [Repository of Adversarial Tactics That is Updated Daily](https://twitter.com/Dinosn/status/1555963158518538240) - - [RT VNG Security Response Center: Ladies and Gentlemen: The new Dojo opens to welcome black belt Hackers to fight for honor!!! #VSRC Liferay revisited:...](https://twitter.com/vngsecresponse/status/1555836623879024640) - - [RT Wim Remes: Another ISC2 related post :) Please keep sharing and retweeting so we can reach ISC2 members that aren’t online all the time …](https://twitter.com/wimremes/status/1555808855539449861) - - [nday exploit: libinput format string bug, canary leak exploit (cve-2022-1215)](https://twitter.com/Dinosn/status/1555798015419600896) - - [Chinese Adult Site Leaking 14 Million User Details – and It’s Increasing!](https://twitter.com/Dinosn/status/1555796030746202112) - - [UK NHS suffers outage after cyberattack on managed service provider](https://twitter.com/Dinosn/status/1555795986252972034) - - [Twitter confirms zero-day used to access data of 5.4 million accounts](https://twitter.com/Dinosn/status/1555795914832347136) - - [Another day, Another IDOR vulnerability— $5000 Reddit Bug Bounty](https://twitter.com/Dinosn/status/1555795841637666817) - - [CVE-2022-35924: Nextauth.js Authentication Bypass Vulnerability](https://twitter.com/Dinosn/status/1555795711622529025) - - [jsubfinder: earch webpages & javascript for hidden subdomains and secrets in the given URL](https://twitter.com/Dinosn/status/1555755069131350016) -- Bug Bounty in InfoSec Write-ups on Medium - - [How i was able to get 29 free products. | Bug Bounty](https://infosecwriteups.com/how-i-was-able-to-get-29-free-products-bug-bounty-845667ab4ad4?source=rss----7b722bfd1b8d--bug_bounty) - - [Another day, Another IDOR vulnerability— $5000 Reddit Bug Bounty](https://infosecwriteups.com/another-day-another-idor-vulnerability-5000-reddit-bug-bounty-22a75003d999?source=rss----7b722bfd1b8d--bug_bounty) -- Hexacorn - - [Week of Data Dumps, Part 7 – registry](https://www.hexacorn.com/blog/2022/08/06/week-of-data-dumps-part-7-registry/) -- Reverse Engineering - - [Kanye West's Stem Player - An engineering disaster](https://www.reddit.com/r/ReverseEngineering/comments/whrxga/kanye_wests_stem_player_an_engineering_disaster/) - - [Private server emulation for Digimon Online v1.5](https://www.reddit.com/r/ReverseEngineering/comments/whh71n/private_server_emulation_for_digimon_online_v15/) - - [Reverse-engineering a 1960s hybrid flip flop module with X-ray CT scans](https://www.reddit.com/r/ReverseEngineering/comments/whc9jx/reverseengineering_a_1960s_hybrid_flip_flop/) - - [XMachOViewer 0.04 is a Mach-O viewer for Windows, Linux and MacOS](https://www.reddit.com/r/ReverseEngineering/comments/whm0gi/xmachoviewer_004_is_a_macho_viewer_for_windows/) -- KitPloit - PenTest & Hacking Tools - - [Pict - Post-Infection Collection Toolkit](http://www.kitploit.com/2022/08/pict-post-infection-collection-toolkit.html) -- HAHWUL - - [Docker와 Dumb-Init](https://www.hahwul.com/2022/08/06/docker-dumb-init/) -- Twitter @hakivvi - - [Re @vngsecresponse @testanull Nice work!](https://twitter.com/hakivvi/status/1555863445978992640) -- 青衣十三楼飞花堂 - - [cby的英文小作文(before 2022.8)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486078&idx=1&sn=99b6a6930398118ec2619ae9a65e4506&chksm=fab2c941cdc540570f94155e76eec98294c6db0056a746046f7066fe55ff03bb44e0d06b62fd&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【数据】全球猴痘从5月爆发至今已近3万病例](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131075&idx=1&sn=cfd3b058ecd5438bbbe9a742271105b2&chksm=f1af7bf9c6d8f2ef2b37a05ab2a16c4e8989d89a2090564d3aa785aa7705975286fc0c2c7a8c&scene=58&subscene=0#rd) -- 网安杂谈 - - [浅论跨境电信诈骗案件证据体系的构建](https://mp.weixin.qq.com/s?__biz=MzAwMTMzMDUwNg==&mid=2650886936&idx=1&sn=405bf3acf96d40d6e6653a2f16ec88e0&chksm=812eaf3db659262b3dbab4d05cf8a2d13466a8097f4e4b53c27c6751c2229b1e6372ee7ba029&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】怀疑遭竞争对手攻击，南通一家纺公司雇佣黑客“反击”](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652011512&idx=1&sn=32d6ae8ac2c6bc457a7c817fd9545220&chksm=f36f57b8c418deaeb4583a2c839231f637ce84c3b730b59f0032b0ad5bfdc06c5bf87e694f17&scene=58&subscene=0#rd) - - [【安全圈】GitHub 出现超 35000 个恶意攻击文件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652011512&idx=2&sn=3186ec78eca5602f5e75175b2ade43d8&chksm=f36f57b8c418deaea62d5a7085bce925612b5eee545d5af22c90643620d10a67ec691e6b4ec6&scene=58&subscene=0#rd) - - [【安全圈】美国一人非法解锁运营商合约机获利 2500 万美元](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652011512&idx=3&sn=10c2d40ebff0c12c6158696d237ffa7e&chksm=f36f57b8c418deae9afa4f3caae1754229fb7ac46cabdb0e83472a204b72811a2cd768375051&scene=58&subscene=0#rd) - - [【安全圈】臭名昭著的飞马间谍软件原型被曝光](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652011512&idx=4&sn=77c3723cd730994ec394f6edcc8a1a36&chksm=f36f57b8c418deae3b1e31e2cc08b49091419023c3003320a3979405170091fe24e5768091fd&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [.NET矩阵星球一周热点主题 (内存马+反射)](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485852&idx=1&sn=f0a1186dbbbb61d003fdb67ea5bfaa56&chksm=fa5aa771cd2d2e6782fc1f90c856022ef3eaa9721ce0df72429965da05d2dafc09dea2440fa9&scene=58&subscene=0#rd) -- 极客公园 - - [Salesforce 解散中国团队；亚马逊17 亿美元收购iRobot；拼多多或将推跨境电商｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963489&idx=1&sn=6baefa7c364a66dd13bf7d00a2e520ea&chksm=7e547f174923f60110d8873f928952672f5e5996867145905f8da1541cb309d078c5887dcbf7&scene=58&subscene=0#rd) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Exposing GCHQ's URL Shortening Service - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/exposing-gchqs-url-shortening-service.html) - - [In Retrospective - A New Malware Bot Vector Spotted in the Wild - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-new-malware-bot-vector.html) -- 嘶吼专业版 - - [下周五！首聚元宇宙！DEF CON 30 CHINA Party来了！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547486&idx=1&sn=f9605871b56f9a730a6472c42d44630d&chksm=e915ea64de626372b21fe682c7b28fb21c63412818c4c31d7106f403125f4224c07dd8aadba0&scene=58&subscene=0#rd) - - [Nomad Bridge漏洞利用被窃取1.9亿美元](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547486&idx=2&sn=e0966f8b2f9644ca448d88f4c3904d9f&chksm=e915ea64de6263729e2879bf5732859e9ae4d364d5f66d69723470b7890bb2747883701dc9cd&scene=58&subscene=0#rd) - - [CosmicStrand：发现复杂的 UEFI 固件 rootkit](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547486&idx=3&sn=8b580491c57fb9a002603a5775bb9a7e&chksm=e915ea64de626372a2e4c249acae35aab3fa2b24fedd4a0863a630ffccc022a9e43f7da435d3&scene=58&subscene=0#rd) -- 情报分析师 - - [大数据扫黄](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513358&idx=1&sn=acb042c6075e4e557ead76c59462e6a1&chksm=8716b185b0613893c8006fbfc3a808e3e8cd5b6970bc054b83109b8f042696df915d6aa4f35f&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [下周五！首聚元宇宙！DEF CON 30 CHINA Party来了！](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537356&idx=1&sn=218a98386e48aad7073720c44053b5f3&chksm=8bcba630bcbc2f2663265502d9e39e57c9b6ad5e5df5b86bd1fc65b04a32b287dccd5b62aa35&scene=58&subscene=0#rd) -- 看雪学院 - - [绕过iOS 基于svc 0x80的ptrace反调试](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460908&idx=1&sn=7a583b1f328ed5fa84303e6be7f642f6&chksm=b18e126686f99b70f0cc9958d35f2889f8789936fa1211a865c385f29517af301ee7c034929c&scene=58&subscene=0#rd) - - [【体系课】CTF训练营-Web篇，全方位立体化学习！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458460908&idx=2&sn=b69dbcd62213fa5ea6709759237c367d&chksm=b18e126686f99b70eacf2e4d0f21b323038c1f623ee3e5f7d0f8828414362acb2b2b5aa77b4a&scene=58&subscene=0#rd) -- NOVASEC - - [Java安全学习01-反序列化-入门](https://mp.weixin.qq.com/s?__biz=MzUzODU3ODA0MA==&mid=2247487744&idx=1&sn=5efe59b7f4cdfca711f0b7e283ba98cc&chksm=fad4cc17cda345018665d1023b672d295e235b0e0627f5b9033e15ce24537dfa2829e2ff4eba&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-08.md b/archive/2022/2022-08-08.md deleted file mode 100644 index 40daea669f..0000000000 --- a/archive/2022/2022-08-08.md +++ /dev/null @@ -1,77 +0,0 @@ -# 每日安全资讯（2022-08-08） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [VMware Workspace ONE Access Privilege Escalation](https://cxsecurity.com/issue/WLB-2022080035) -- Security Boulevard - - [Red Team Tools](https://securityboulevard.com/2022/08/red-team-tools/) - - [Aspen Security Forum 2022 – Moderator: Dafna Linzer – ‘A New, Stronger NATO?’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-dafna-linzer-a-new-stronger-nato/) - - [XKCD ‘Asking Scientists Questions’](https://securityboulevard.com/2022/08/xkcd-asking-scientists-questions/) - - [Security Risk by Accepting Policy Exceptions](https://securityboulevard.com/2022/08/security-risk-by-accepting-policy-exceptions/) - - [Aspen Security Forum 2022 – Moderator: Jim Sciutto – Fireside Chat With Richard Moore](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-jim-sciutto-fireside-chat-with-richard-moore/) - - [Is Your Government Organization Cyber Resilient?](https://securityboulevard.com/2022/08/is-your-government-organization-cyber-resilient/) -- HackerOne Hacker Activity - - [HTTP PUT method is enabled downloader.ratelimited.me](https://hackerone.com/reports/545136) - - [Anonymous access control - Payments Status](https://hackerone.com/reports/1546726) -- Twitter @Nicolas Krassas - - [BlackStone - Pentesting Reporting Tool](https://twitter.com/Dinosn/status/1556292828598353921) - - [Re @PortSwigger Thanks I did already.](https://twitter.com/Dinosn/status/1556275615954636801) - - [RT pikpikcu: Logsensor A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning. @Mr_Robert20 #bugbountytips](https://twitter.com/sec715/status/1556232140412846081) - - [Greek intelligence service used surveillance malware to spy on a journalist, Reuters reports](https://twitter.com/Dinosn/status/1556221362674581504) - - [New IoT RapperBot Malware Targeting Linux Servers via SSH Brute-Forcing Attack](https://twitter.com/Dinosn/status/1556221235650076674) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [GootkitLoader的更新策略和CobaltStrike的无文件传播](https://www.4hou.com/posts/LB5X) - - [Okta平台出现认证漏洞](https://www.4hou.com/posts/AO83) -- Recent Commits to cve:main - - [Update Sun Aug 7 17:23:44 UTC 2022](https://github.com/trickest/cve/commit/3d23c6bacee2f4bdc7730d14abc9431d8120e465) -- unSafe.sh - 不安全 - - [Using AVRDUDE with USBASP to flash firmware on Arduino Atmega328P chip](https://buaq.net/go-121116.html) - - [iTerm2 拖文件和目录上传到服务器，不知有没有人感兴趣？ - V2EX](https://buaq.net/go-121104.html) - - [数据合规中的身份和适用范围的简介 - 挖洞的土拨鼠](https://buaq.net/go-121117.html) - - [BlackStone - Pentesting Reporting Tool](https://buaq.net/go-121100.html) - - [Patch now! Cisco VPN routers are vulnerable to remote control](https://buaq.net/go-121096.html) - - [Phishy calls and emails play on energy cost increase fears](https://buaq.net/go-121094.html) -- Sec-News 安全文摘 - - [如何让 JS 代码不可断点](https://wiki.ioin.in/url/q0Xn) - - [2022UIUCTF-Spoink(Pebble最新模板注入)](https://wiki.ioin.in/url/r02k) -- Sploitus.com Exploits RSS Feed - - [Zimbra UnRAR Path Traversal Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37894&utm_source=rss&utm_medium=rss) - - [WordPress Testimonial Slider And Showcase 2.2.6 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37893&utm_source=rss&utm_medium=rss) - - [Online Admission System 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37892&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Glpi-Project Glpi exploit](https://sploitus.com/exploit?id=B9EE9EA6-7592-5D21-B162-6EC71CA332FB&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-08-07 Review](http://www.sec-wiki.com/?2022-08-07) -- scriptkidd1e - - [Hacking Kioptrix Series (All) Vulnerable Machines – Completed Walkthrough](https://scriptkidd1e.wordpress.com/2022/08/07/hacking-kioptrix-series-all-vulnerable-machines-completed-walkthrough/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Enterprise: Active Directory Room From TryHackMe By Hashar Mujahid](https://infosecwriteups.com/enterprise-active-directory-room-from-tryhackme-87f8738efc96?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [How I migrated my on-prem xsa cds3+hana solution to cds6+sqlite and deployed it on cheap linux hosting](https://blogs.sap.com/2022/08/07/how-i-migrated-my-on-prem-xsa-cds3hana-solution-to-cds6sqlite-and-deployed-it-on-cheap-linux-hosting/) - - [Customer Engagement for Lot Size of One (MTO scenario) with Advanced Variant Configuration | Scope Item ’55E’](https://blogs.sap.com/2022/08/07/customer-engagement-for-lot-size-of-one-mto-scenario-with-advanced-variant-configuration-scope-item-55e/) - - [A new way to perform the SAP Homogeneous System Migration on Linux/HP-UX](https://blogs.sap.com/2022/08/07/a-new-way-to-perform-the-sap-homogeneous-system-migration-on-linux-hp-ux/) - - [A Step into the Virtual World](https://blogs.sap.com/2022/08/07/a-step-into-the-virtual-world/) - - [Fast entry of purchase orders in SAP Business ByDesign](https://blogs.sap.com/2022/08/07/fast-entry-of-purchase-orders-in-sap-business-bydesign/) - - [Enhancements to SMIGR_CREATE_DDL for Range Partitioning and User Defined LOB Inline Sizes](https://blogs.sap.com/2022/08/07/enhancements-to-smigr_create_ddl-for-range-partitioning-and-user-defined-lob-inline-sizes/) - - [Run Node.js Applications with Authentication Locally – SAP BTP Security](https://blogs.sap.com/2022/08/07/run-node.js-applications-with-authentication-locally-sap-btp-security/) - - [Sending Project “Piper” log data to the SAP Alert Notification service for SAP BTP](https://blogs.sap.com/2022/08/07/sending-project-piper-log-data-to-the-sap-alert-notification-service-for-sap-btp/) - - [SAP Readiness Check for SAP S/4HANA – Functional Review](https://blogs.sap.com/2022/08/07/sap-readiness-check-for-sap-s-4hana-functional-review/) -- Malwarebytes Labs - - [Patch now! Cisco VPN routers are vulnerable to remote control](https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/patch-now-cisco-vpn-routers-are-vulnerable-to-remote-control/) - - [Phishy calls and emails play on energy cost increase fears](https://blog.malwarebytes.com/cybercrime/2022/08/phishy-calls-and-emails-play-on-energy-cost-increase-fears/) -- 博客园 - 挖洞的土拨鼠 - - [数据合规中的身份和适用范围的简介 - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16560025.html) -- Hacking Articles - - [Containers Vulnerability Scanner: Trivy](https://www.hackingarticles.in/containers-vulnerability-scanner-trivy/) -- Twitter @hakivvi - - [Re @ryotkak Well deserved, congratulations!](https://twitter.com/hakivvi/status/1556264165962137601) -- KitPloit - PenTest & Hacking Tools - - [BlackStone - Pentesting Reporting Tool](http://www.kitploit.com/2022/08/blackstone-pentesting-reporting-tool.html) -- HAHWUL - - [Hex? Imhex and Hexyl](https://www.hahwul.com/2022/08/07/imhex-and-hexyl/) -- 丁爸情报分析师的工具箱 - - [【资料】股神佩罗西近十年财务报告](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131084&idx=1&sn=bb805f9419b20e4d2dcee625a3793f44&chksm=f1af7bf6c6d8f2e03cfa091cb46532a16fde5f0fbcf18a7cf2169d304c7bce9d41b4c19904c3&scene=58&subscene=0#rd) -- 极客公园 - - [在硅谷最大独角兽 Stripe，我学到了哪些管理经验？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963517&idx=1&sn=79f91da9cdfd4aca1dc68c833c18745b&chksm=7e547f0b4923f61dc2afe39bcbf895cdee872bb6f1676d5ccaf1b0397a9d0b7da15511cd55bd&scene=58&subscene=0#rd) - - [马斯克：特斯拉年底产能突破 200 万；苹果手表首个中文表盘上线；上海举办虚拟体育公开赛｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963516&idx=1&sn=85af8235e13d52b97f919ecf985ba2ac&chksm=7e547f0a4923f61c4e1ff98a13e1247402edc350606d6fb3295bfa7c7ae4b10b8ab76100a5a3&scene=58&subscene=0#rd) -- 情报分析师 - - [台积电：2025年推出2nm芯片（附美国2022年芯片与科学法案1034页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513432&idx=1&sn=37d54c64914495bd599b5888be315be1&chksm=87168e53b061074578a83c1a5238b604306ae0ca30cd40f60e16194a6033cc33b5452f793562&scene=58&subscene=0#rd) - - [什么是星链 Starlink？ 成千上万颗低轨卫星布局的背后](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513432&idx=2&sn=bc5f540de72f2e5209867925f64b3ba3&chksm=87168e53b0610745033c29c4e2302c6d41b967c71b4cf6435c0a46410f2dbf04a95f8ab4b759&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-09.md b/archive/2022/2022-08-09.md deleted file mode 100644 index f76150bc6a..0000000000 --- a/archive/2022/2022-08-09.md +++ /dev/null @@ -1,224 +0,0 @@ -# 每日安全资讯（2022-08-09） - -- HackerOne Hacker Activity - - [xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)](https://hackerone.com/reports/1622867) - - [Lack of Rate limit while joining video call in talk section which is password protected](https://hackerone.com/reports/1596673) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5553-1](https://packetstormsecurity.com/files/168002/USN-5553-1.txt) - - [Ubuntu Security Notice USN-5554-1](https://packetstormsecurity.com/files/168001/USN-5554-1.txt) - - [American Fuzzy Lop plus plus 4.02c](https://packetstormsecurity.com/files/168000/AFLplusplus-4.02c.tar.gz) - - [Thingsboard 3.3.1 Cross Site Scripting](https://packetstormsecurity.com/files/167999/thingsboard331-xss.txt) - - [Red Hat Security Advisory 2022-5913-01](https://packetstormsecurity.com/files/167998/RHSA-2022-5913-01.txt) - - [ManageEngine ADAudit Plus Path Traversal / XML Injection](https://packetstormsecurity.com/files/167997/manageengine_adaudit_plus_cve_2022_28219.rb.txt) - - [Ubuntu Security Notice USN-5552-1](https://packetstormsecurity.com/files/167996/USN-5552-1.txt) - - [Red Hat Security Advisory 2022-5915-01](https://packetstormsecurity.com/files/167995/RHSA-2022-5915-01.txt) - - [WordPress Duplicator 1.4.7.1 Backup Disclosure](https://packetstormsecurity.com/files/167994/wpduplicator1471-disclose.txt) - - [Red Hat Security Advisory 2022-5914-01](https://packetstormsecurity.com/files/167993/RHSA-2022-5914-01.txt) - - [Nortek Linear eMerge E3-Series Account Takeover](https://packetstormsecurity.com/files/167992/norteklee3-session.txt) - - [Nortek Linear eMerge E3-Series Command Injection](https://packetstormsecurity.com/files/167991/norteklee3-exec.txt) - - [Nortek Linear eMerge E3-Series Credential Disclosure](https://packetstormsecurity.com/files/167990/norteklee3-disclose.txt) -- Sploitus.com Exploits RSS Feed - - [Thingsboard 3.3.1 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37895&utm_source=rss&utm_medium=rss) - - [Nortek Linear eMerge E3-Series Command Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37898&utm_source=rss&utm_medium=rss) - - [Nortek Linear eMerge E3-Series Credential Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37897&utm_source=rss&utm_medium=rss) - - [ManageEngine ADAudit Plus Path Traversal / XML Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37900&utm_source=rss&utm_medium=rss) - - [Nortek Linear eMerge E3-Series Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167991&utm_source=rss&utm_medium=rss) - - [Nortek Linear eMerge E3-Series Account Takeover XSS Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37899&utm_source=rss&utm_medium=rss) - - [WordPress Duplicator 1.4.7.1 Plugin - Unauthenticated Backup Download Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37896&utm_source=rss&utm_medium=rss) - - [Nortek Linear eMerge E3-Series Credential Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:167990&utm_source=rss&utm_medium=rss) - - [Thingsboard 3.3.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:167999&utm_source=rss&utm_medium=rss) - - [WordPress Duplicator 1.4.7.1 Backup Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:167994&utm_source=rss&utm_medium=rss) - - [Nortek Linear eMerge E3-Series Account Takeover exploit](https://sploitus.com/exploit?id=PACKETSTORM:167992&utm_source=rss&utm_medium=rss) - - [ManageEngine ADAudit Plus Path Traversal / XML Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:167997&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Sonicwall Sma 200 Firmware exploit](https://sploitus.com/exploit?id=77916E79-E02E-5614-8FE7-E108D8A8A7E5&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-08-08 Review](http://www.sec-wiki.com/?2022-08-08) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [CuteEditor For PHP 6.6 Directory Traversal](https://cxsecurity.com/issue/WLB-2022080039) - - [Zoho Password Manager Pro XML-RPC Java Deserialization](https://cxsecurity.com/issue/WLB-2022080038) - - [Backdoor.Win32.Jokerdoor / Remote Stack Buffer Overflow](https://cxsecurity.com/issue/WLB-2022080037) - - [Zimbra UnRAR Path Traversal](https://cxsecurity.com/issue/WLB-2022080036) -- Microsoft Security Blog - - [IT security: An opportunity to raise corporate governance scores](https://www.microsoft.com/security/blog/2022/08/08/it-security-an-opportunity-to-raise-corporate-governance-scores/) -- unSafe.sh - 不安全 - - [How Hash-Based Safe Browsing Works in Google Chrome](https://buaq.net/go-121309.html) - - [Debugging bare-metal STM32 from the seventh level of hell](https://buaq.net/go-121293.html) - - [超短选手如何复盘？ 作为一个合格的超短选手，每天复盘是必须的功课，简单讲下如何复盘。1.复盘涨跌幅榜前列的个股，熊市里面，一般涨幅榜看个前5... - 雪球](https://buaq.net/go-121276.html) - - [3. 超短的复盘框架 - 知乎](https://buaq.net/go-121275.html) - - [Smap - A Drop-In Replacement For Nmap Powered By Shodan.Io](https://buaq.net/go-121281.html) - - [华为机器视觉军团从“新”出发，破解AI落地难题](https://buaq.net/go-121272.html) - - [pamspy - Credentials Dumper for Linux using eBPF](https://buaq.net/go-121280.html) - - [Adding new features to an old game with Frida, Part II](https://buaq.net/go-121277.html) - - [A week in security (August 1 – 7)](https://buaq.net/go-121274.html) - - [BlackStone Project - Pentesting Reporting Tool](https://buaq.net/go-121270.html) -- Twitter @Nicolas Krassas - - [US sanctions crypto mixer Tornado Cash used by North Korean hackers](https://twitter.com/Dinosn/status/1556671124288798720) - - [Phishers Swim Around 2FA in Coinbase Account Heists](https://twitter.com/Dinosn/status/1556671058270453762) - - [7-Eleven stores in Denmark closed due to a cyberattack](https://twitter.com/Dinosn/status/1556667001594167296) - - [Chinese hackers use new Windows malware to backdoor govt, defense orgs](https://twitter.com/Dinosn/status/1556666884216471552) - - [Hackers Using SHARPEXT Browser Malware to Spy on Gmail and Aol Users](https://twitter.com/Dinosn/status/1556666737965268995) - - [Slack leaked hashed passwords from its servers for years](https://twitter.com/Dinosn/status/1556666106932346881) - - [New Orchard Botnet Uses Bitcoin Founder’s Account Info to Generate Malicious Domains](https://twitter.com/Dinosn/status/1556666052205051904) - - [Containers Vulnerability Scanner: Trivy](https://twitter.com/Dinosn/status/1556584950983434241) - - [Blackbird: An OSINT tool to search for accounts by username](https://twitter.com/Dinosn/status/1556584835547791361) - - [CVE-2022-37452: Exim heap-based buffer overflow vulnerability](https://twitter.com/Dinosn/status/1556584754086035462) - - [Codewarrior - open source SAST](https://twitter.com/Dinosn/status/1556584707088912384) - - [Lazarus hackers lure crypto-experts with Coinbase engineer job offers](https://twitter.com/Dinosn/status/1556584385322835970) - - [PersistenceSniper: hunt persistences implanted in Windows machines](https://twitter.com/Dinosn/status/1556578331398635522) - - [Analysis of Dark Web service offerings, lnk delivery patterns & detection opportunities, and more](https://twitter.com/Dinosn/status/1556577877742714881) - - [JF⚡can - Super fast port scanning & service discovery using Masscan and Nmap. Scan large networks with Masscan and use Nmap's scripting abilities to ...](https://twitter.com/Dinosn/status/1556576449611563009) - - [Dark Utilities C2 service draws thousands of cyber criminals](https://twitter.com/Dinosn/status/1556573812581343232) - - [RT @mikko: A new Twilio blog post that starts with «the security of our customers’ data is of paramount importance» means bad news.](https://twitter.com/mikko/status/1556535374624817152) - - [RT Renzon: ZIP > ISO > .LNK > Bumblebee .dll file > Cobalt Strike > AnyDesk > Adfind > VulnRecon > Procdump > Seatbelt > Invoke-kerberoast.ps1 > PS Co...](https://twitter.com/r3nzsec/status/1556514149219328000) -- 先知安全技术社区 - - [Mantis BT CVE-2017-7615任意密码重置+认证后RCE漏洞分析](https://xz.aliyun.com/t/11592) -- Recent Commits to cve:main - - [Update Mon Aug 8 17:17:10 UTC 2022](https://github.com/trickest/cve/commit/081d123f5db69ed76714f5a7a54725cb24ac8363) -- 跳跳糖 - 安全与分享社区 - - [PowerPC PWN从入门到实践](https://tttang.com/archive/1695/) -- cloud world - - [2022 32 Open source weekly report](https://cloudsjhan.github.io/2022/08/08/2022-32-Open-source-weekly-report/) -- 先知安全技术社区 - - [Mantis BT CVE-2017-7615任意密码重置+认证后RCE漏洞分析](https://xz.aliyun.com/t/11592) -- Security Boulevard - - [Release the Kraken: The Battle for the Russian Language Darknet](https://securityboulevard.com/2022/08/release-the-kraken-the-battle-for-the-russian-language-darknet/) - - [Aspen Security Forum 2022 – Moderator: Amy Walter ‘Who Cares? How The World Views Conflict With Russia And Competition With China’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-amy-walter-who-cares-how-the-world-views-conflict-with-russia-and-competition-with-china/) - - [GitHub Zero-Day: From 35K Repos Compromised to False Alarm](https://securityboulevard.com/2022/08/github-zero-day-from-35k-repos-compromised-to-false-alarm/) - - [Slack App Leaked Hashed User Passwords for 5 YEARS](https://securityboulevard.com/2022/08/slack-leaked-passwords-5-years/) - - [Daniel Stori’s ‘Serverless Economic Impact’](https://securityboulevard.com/2022/08/daniel-storis-serverless-economic-impact/) - - [The Tao of Software Engineering](https://securityboulevard.com/2022/08/the-tao-of-software-engineering/) - - [Aspen Security Forum 2022 – Moderator: Peter Spiegel ‘Afghanistan: A Year On’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-peter-spiegel-afghanistan-a-year-on/) - - [Stand Down, Marketers: Zero Trust is Not a Product](https://securityboulevard.com/2022/08/stand-down-marketers-zero-trust-is-not-a-product/) - - [Complete guide to IoT Security](https://securityboulevard.com/2022/08/complete-guide-to-iot-security/) - - [Balbix brings Snow and Ice to Vegas @ BlackHat 2022](https://securityboulevard.com/2022/08/balbix-brings-snow-and-ice-to-vegas-blackhat-2022/) -- 安全客-有思想的安全新媒体 - - [活动｜陌陌&探探夏季作战：花花世界大爆炸](https://www.anquanke.com/post/id/277615) - - [从代码层理解android的重定向漏洞](https://www.anquanke.com/post/id/277156) - - [蓝队防守方战前准备篇（上）](https://www.anquanke.com/post/id/277525) - - [德国工商会遭大规模网络攻击](https://www.anquanke.com/post/id/277587) -- The DFIR Report - - [BumbleBee Roasts Its Way to Domain Admin](https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/) -- Google Online Security Blog - - [How Hash-Based Safe Browsing Works in Google Chrome](http://security.googleblog.com/2022/08/how-hash-based-safe-browsing-works-in.html) -- 安全脉搏 - - [静态防护技术](https://www.secpulse.com/archives/184922.html) - - [再次捕获！重保期间拦截针对Coremail的钓鱼攻击](https://www.secpulse.com/archives/184900.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [API接口是什么？API接口常见的安全问题与安全措施有哪些？](https://www.4hou.com/posts/kMDN) - - [白帽线下集结令！“大湾区白帽论坛”报名启动！](https://www.4hou.com/posts/jJLP) - - [消息应用程序被用作网络犯罪活动的平台](https://www.4hou.com/posts/xjo3) - - [2022年第二季度的DDoS攻击趋势分析](https://www.4hou.com/posts/RBwO) - - [三六零天御加固保第六代QDEX VMP加固引擎重磅发布](https://www.4hou.com/posts/gX6G) - - [谨防“蚁穴效应”，确保云数据中心安全运行](https://www.4hou.com/posts/BERk) - - [如何满足保险集团千亿数据审计要求](https://www.4hou.com/posts/9XOB) -- Securelist - - [Targeted attack on industrial enterprises and public institutions](https://securelist.com/targeted-attack-on-industrial-enterprises-and-public-institutions/107054/) -- SAP Blogs - - [Fieldglass Features: #4 – Email Digest, improve the user experience for your super user hiring managers](https://blogs.sap.com/2022/08/08/fieldglass-features-4-email-digest-improve-the-user-experience-for-your-super-user-hiring-managers/) - - [Flat file upload to SAC Planning model with analytic application and dataset](https://blogs.sap.com/2022/08/08/flat-file-upload-to-sac-planning-model-with-analytic-application-and-dataset/) - - [Adapt UI in SAP S/4HANA Cloud 2208 includes new barcode scanning feature and more](https://blogs.sap.com/2022/08/08/adapt-ui-in-sap-s-4hana-cloud-2208-includes-new-barcode-scanning-feature-and-more/) - - [Managing non-EC data in Compensation worksheets : Lookup table, MDF, or both ?](https://blogs.sap.com/2022/08/08/managing-non-ec-data-in-compensation-worksheets-lookup-table-mdf-or-both/) - - [Asset Management in SAP S/4HANA Cloud 2208](https://blogs.sap.com/2022/08/08/asset-management-in-sap-s-4hana-cloud-2208/) - - [Sustainability with SAP S/4HANA Cloud 2208](https://blogs.sap.com/2022/08/08/sustainability-with-sap-s-4hana-cloud-2208/) - - [SAP Data Warehouse Cloud bulk provisioning – Part 2](https://blogs.sap.com/2022/08/08/sap-data-warehouse-cloud-bulk-provisioning-part-2/) -- CTFするぞ - - [corCTF 2022 Writeups](https://ptr-yudai.hatenablog.com/entry/2022/08/08/144339) -- Twitter @bytehx - - [RT Nicolas Krassas: JF⚡can - Super fast port scanning & service discovery using Masscan and Nmap. Scan large networks with Masscan and use Nmap's scr...](https://twitter.com/Dinosn/status/1556576449611563009) - - [RT 🐞Sara Badran: SSRF, Firewall and forbidden bypass list happy hacking❤🔥 #hackerone #BugBounty #bugbountytips #hackeronereport #writeups #Bugb...](https://twitter.com/SaraBadran18/status/1556568081777950720) - - [RT Pethuraj M: Hacking Methodology, Cheatsheets, Conceptual-Breakdowns](https://twitter.com/Pethuraj/status/1556477355161399296) -- Malwarebytes Labs - - [KMSpico explained: No, KMS is not "kill Microsoft"](https://www.malwarebytes.com/blog/news/2022/08/kmspico-explained-no-kms-is-not-kill-microsoft) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/wj23mj/rreverseengineerings_weekly_questions_thread/) - - [Debugging bare-metal STM32 from the seventh level of hell](https://www.reddit.com/r/ReverseEngineering/comments/wja70n/debugging_baremetal_stm32_from_the_seventh_level/) - - [unblob - accurate, fast, and easy-to-use firmware extraction suite](https://www.reddit.com/r/ReverseEngineering/comments/wj2l3y/unblob_accurate_fast_and_easytouse_firmware/) - - [Adding new features to an old game with Frida, Part II](https://www.reddit.com/r/ReverseEngineering/comments/wj6qag/adding_new_features_to_an_old_game_with_frida/) -- Application Security Blog - - [Secure SDLC 101](https://www.synopsys.com/blogs/software-security/secure-sdlc/) -- The Daily Swig | Cybersecurity news and views - - [The best Black Hat and DEF CON talks of all time](https://portswigger.net/daily-swig/the-best-black-hat-and-def-con-talks-of-all-time) -- daniel.haxx.se - - [How I merge PRs in curl](https://daniel.haxx.se/blog/2022/08/08/how-i-merge-prs-in-curl/) -- Microsoft Security Response Center - - [Congratulations to the MSRC 2022 Most Valuable Researchers!](https://msrc-blog.microsoft.com/2022/08/08/congratulations-to-the-msrc-2022-most-valuable-researchers/) - - [Microsoft Office to publish symbols starting August 2022](https://msrc-blog.microsoft.com/2022/08/08/microsoft-office-to-publish-symbols-starting-august-2022/) -- SentinelOne - - [LABScon | Security Research in Real Time – Talks Not To Miss, Part Two](https://www.sentinelone.com/blog/labscon-security-research-in-real-time-talks-not-to-miss-part-two/) -- Black Hills Information Security - - [Windows Event Logs for Red Teams](https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/) -- 看雪学院 - - [android so文件攻防实战-libDexHelper.so反混淆](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461061&idx=1&sn=ae34ebab6a4902028eaf6347672c2ced&chksm=b18e130f86f99a195003cc9c92e0baeee7278515909c2eeb20bc7451c3a788419809d409f408&scene=58&subscene=0#rd) - - [推特零日漏洞遭利用， 540万个账户数据泄露](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461061&idx=2&sn=510e05c01a9daf99303c2533d446dc58&chksm=b18e130f86f99a19b1beb386becb0cc1cbe4396195ac6207d298610b756d1ecaa6d295893a43&scene=58&subscene=0#rd) - - [Intel CPU漏洞研究，为你深入详解三个史诗级的芯片漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461061&idx=3&sn=c938a6d4e2238e7f16f544a361b68e1e&chksm=b18e130f86f99a19b9dd5df7b9b36730bb7b51ff317a1f2d42e7f6527902f8c204146c62d04e&scene=58&subscene=0#rd) -- 雷神众测 - - [雷神众测助力｜首聚元宇宙！DEF CON 30 CHINA Party来了！](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652498956&idx=1&sn=a4cd4ffedcb6f3214a2cea6c92fcc31e&chksm=f2584fbfc52fc6a90a202be848ce7a7142cb1eba215cef8175accb6ee0e340b60ff3e5459443&scene=58&subscene=0#rd) -- Twitter @hakivvi - - [RT Orange Tsai 🍊: 🔥](https://twitter.com/orange_8361/status/1556663716535365632) -- 慢雾科技 - - [报告解读之 2022 上半年区块链安全态势](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247495973&idx=1&sn=1812017bcf7b92cba4ca6734a2769248&chksm=fdde8fa2caa906b4a98a3b4137280c5145c92e6f6e8ded0da8fafa063c2b1d00078ed64b6e29&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】mruby字节码逆向入门](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774766&idx=1&sn=0dc5e31d4171c66e19e53376237f4775&chksm=88936ac1bfe4e3d713974ff5acdf3de7c63b769f5dfdef2bb7721c2e0f44b7a6d27f29fb2022&scene=58&subscene=0#rd) - - [【安全头条】德国工商会遭大规模网络攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774766&idx=2&sn=1a30bf2de20e5093bec78d3305707177&chksm=88936ac1bfe4e3d7d58b52f857a791c688f387e8da8724b10b3c5f76389e3ba1e33fd51bff19&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [Smap - A Drop-In Replacement For Nmap Powered By Shodan.Io](http://www.kitploit.com/2022/08/smap-drop-in-replacement-for-nmap.html) -- M01NTeam - - [攻击技术研判 | 近期频发钓鱼新手法：伪造弹出登录窗口进行钓鱼攻击](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489166&idx=1&sn=6966012ea6ab217122a634c9cb79fab6&chksm=c187d69ff6f05f896a0cb6d6e90420cd04b20dc13a13a7ec68fc25589dbe85d2cd6313e3d894&scene=58&subscene=0#rd) -- 非尝咸鱼贩 - - [两步验证 App Authy 的厂商 twilio 被黑](https://mp.weixin.qq.com/s?__biz=Mzk0NDE3MTkzNQ==&mid=2247484413&idx=1&sn=0f33af4628e3b24dcbe5ae7048502144&chksm=c329fd0df45e741b6ba028708d8b51dc4e03cf77af428cbe027154720c99bae044c07d40371f&scene=58&subscene=0#rd) -- 中国信息安全 - - [专题·漏洞治理 | 基于漏洞情报的漏洞运营实践](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163407&idx=1&sn=bba90a6df0087ce53b60c6ce39337bca&chksm=8b5eeab6bc2963a065ab8ada4610a998e3f471930ce2ccbcc68dbd398b57b9a1cf66c4ffd759&scene=58&subscene=0#rd) - - [7月辟谣榜综述 | 借热点话题博眼球 编网络谣言带节奏](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163407&idx=2&sn=834dda65041cfe0cba352c695789f609&chksm=8b5eeab6bc2963a07a504f2b8cb7a6c4047449757cea88e711d12e88b40f589f9602aa772f19&scene=58&subscene=0#rd) - - [专家解读 | 提升特殊群体数字素养 弥合使用性数字鸿沟](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163407&idx=3&sn=687cc24bee3572eb424a89af5316b74e&chksm=8b5eeab6bc2963a0d056ad73cae4fe6210e1ef42469bcd4e239d029bebdc99d1a803759ede42&scene=58&subscene=0#rd) - - [会议 | 第十五期网络安全创新发展高端论坛圆满召开](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163407&idx=4&sn=105c40a0d2e0a0d259dcbd67d6f63909&chksm=8b5eeab6bc2963a0e5a4e46833ebe239bec59b109ee9883972ed3858143180d3e1cf93713c89&scene=58&subscene=0#rd) - - [打击网络谣言 共建清朗家园 | 中国互联网联合辟谣平台7月辟谣榜](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163407&idx=5&sn=666622800fada51921ca6d365799e00c&chksm=8b5eeab6bc2963a0a2fa8ab31bd9a7a9a0a2e3fedb8cbbfe83f6e3e00d8c6ba6c509ec8ca14b&scene=58&subscene=0#rd) -- 安全牛 - - [帮助安全红队取得成功的11条建议](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116956&idx=1&sn=16400fc54971c1f27c1b3f0a289c12d0&chksm=bd14654f8a63ec593984bef307197c2f19f3bf6f0f5eccfc60f36e3b8f5dc39a121d7e60d087&scene=58&subscene=0#rd) - - [安全头条 | Google Play发现17款Android 应用程序正在分发银行恶意软件](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116956&idx=2&sn=ce4cf2b24a1d65195f2122d405791eac&chksm=bd14654f8a63ec599ff2c1a8b6a34a9dcdf02587498cc72f69ae599f6ccebb4f16eb3cc0e852&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（38期）：攻防演习之蓝队篇](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651116956&idx=3&sn=e624fd5ed590fda240e5fba97679ea91&chksm=bd14654f8a63ec59e1b9f22f805d9cb4d79fdcdf76ad54664e712cb5924e4f1c451624f5ce78&scene=58&subscene=0#rd) -- 极客公园 - - [我，三线城市小中介，半年直播卖房 7.5 个亿](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963567&idx=1&sn=0906f675519d47fbcb10c25b20278723&chksm=7e547f594923f64f623c68d9a967d97cc6b9f55ca4a99b110695465dfc30282ac28a496a5cb8&scene=58&subscene=0#rd) - - [首个国产抗新冠口服药每瓶不超 300 元；供应链曝料已向华为 Mate 50 供货；《独行月球》金刚鼠让特效团队头秃｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963565&idx=1&sn=b577f1b5a30e9711b7e2d39b045caf9e&chksm=7e547f5b4923f64df581f7d272a4d6a0dad9f46f2b35992208db1f4844b00c284cecb99fcaa3&scene=58&subscene=0#rd) -- 补天平台 - - [本周五！首聚元宇宙！补天平台助力DEF CON 30 CHINA Party来了！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494870&idx=1&sn=d29ca144c8f0c5f1e8ed0d83f98e8fda&chksm=eaf9a49add8e2d8cabd991fca09fa5e62915bdde3d1832fc80a71981972481d1354b6cacd2ad&scene=58&subscene=0#rd) - - [白帽线下集结令！“大湾区白帽论坛”报名启动！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494870&idx=2&sn=a8f619b54200d65f52515f2f194e32a9&chksm=eaf9a49add8e2d8c168f8706e4f39bd5b9309bc7888838909972c73e86bb8851871e79d94cdc&scene=58&subscene=0#rd) -- 情报分析师 - - [【热点资料】台海资料大合集](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513561&idx=1&sn=eb33aaaffe1f25fd11d1c83c873fca97&chksm=87168ed2b06107c4f9f1660116ab93a0a7b53dbbaef1d7bc44fab61f756053bb2dac344950e3&scene=58&subscene=0#rd) - - [【实战技法】莱昂纳多的汽车在哪里？使用OSINT追踪车辆](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513561&idx=2&sn=9ec651b014190b720e505da335d67177&chksm=87168ed2b06107c49fa348d1a2f6c3199eb0c5e62cede2efcfdbf0921a2e6c9c91ee17ba67f6&scene=58&subscene=0#rd) - - [【警务前沿】成功警务改革的四大要素](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513561&idx=3&sn=e428cd89b7d85ddcbcbd0ba80c1b9e4c&chksm=87168ed2b06107c46e554db861c15b383e51acb3f4b86d284e94b287731925d3bc8e0251c742&scene=58&subscene=0#rd) -- 中通安全应急响应中心 - - [超六年零信任实践经验的「飞越云」成立啦](https://mp.weixin.qq.com/s?__biz=MzUyMTcwNTY3Mg==&mid=2247486017&idx=1&sn=8fd1c74c276f747d2191c667784f55d8&chksm=f9d64be6cea1c2f0d6b58044bc4a5f5eeb5025b2f510c6f99744d162c2671971b2d52b39ba44&scene=58&subscene=0#rd) - - [打造零信任访问管理云平台，「飞越云」完成千万元级别的种子轮融资](https://mp.weixin.qq.com/s?__biz=MzUyMTcwNTY3Mg==&mid=2247486017&idx=2&sn=e08c46d67a606254a7635b6a6d2c3512&chksm=f9d64be6cea1c2f02419bb186e71c50d4dd3b36a6ef0b0ec36d0025c26931ca3a1ff57f65c7c&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220808期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529845&idx=1&sn=df4765a58d6db2b8bdfc058ab86c1351&chksm=c1e9f924f69e7032e8c6bf458f2991639744206272bd665d959188e1c1021b886c6c1f617de8&scene=58&subscene=0#rd) - - [工业数据安全能力建设路径与思考](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529845&idx=3&sn=0be3cf51e5ae101e7c170c195c62e8db&chksm=c1e9f924f69e7032390eb7d167faf5420518ce3b23e56434d5cf31927694cf15e47b521c9ef9&scene=58&subscene=0#rd) - - [台湾四大网站遭到DDoS攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529845&idx=4&sn=00c3aa7b07ae6501b2344c3731be79e0&chksm=c1e9f924f69e70324eb855f5b50c76e646f55f6242fda7ea90a474f6ce3e6c744ebf6729b712&scene=58&subscene=0#rd) -- 58安全应急响应中心 - - [58SRC助力｜首聚元宇宙！DEF CON 30 CHINA Party来了！](https://mp.weixin.qq.com/s?__biz=MzU4NTMzNjU4Mw==&mid=2247488863&idx=1&sn=9bba02d63f2b64215a6829441c4d053e&chksm=fd8d4737caface21f8e6c00739c236170231bc909fbbdaafbd3b71501a10c0b2d5da42f4922e&scene=58&subscene=0#rd) -- GeekPwn - - [@所有人｜请查收这封极棒但不是GeekPwn的招新启事](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650345527&idx=1&sn=675b36ba4d85c28c524c262ead6ddc20&chksm=8740abf2b03722e4fa2a61e1a897e938955e6569cfb09093cbb9003764a70cfb9aeab465237d&scene=58&subscene=0#rd) -- 星阑科技 - - [工信部《数据传输安全白皮书》发布，星阑科技CTO解读数据传输视角下的API安全（附白皮书下载）](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494776&idx=1&sn=8f400fa74ff44c0455138efe09e7ab8e&chksm=c00741e4f770c8f278c342a9b6d72d509ed5fb51187c053c9e06e372002302dbb023cf348ddd&scene=58&subscene=0#rd) -- 奇安信CERT - - [安全热点周报|第二百五十六期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496808&idx=1&sn=d59e75b308c89956ba785b2343a9fb37&chksm=fe79d0f0c90e59e61f57cc4b00626ce84145a1248d9cfa77a622abd460b5b860811068620eea&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第31期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492190&idx=1&sn=a5d34ff81f7a66d20199c5624eba8311&chksm=fd74d297ca035b81c4d85fad0854c29f8cabdc8a88f8c8e16a0c396c08545ff8711f660d8fd2&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220801-20220807)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492190&idx=2&sn=2d56b61365ea8d1ccac9b91cfd476a8f&chksm=fd74d297ca035b81cc7dc8fb0954c993c3a8d75d54fe4ea920d6edd8d6edf31c7185ff4bbd9e&scene=58&subscene=0#rd) -- 陌陌安全 - - [陌陌&探探夏季作战：花花世界大爆炸](https://mp.weixin.qq.com/s?__biz=MzI2OTYzOTQzNw==&mid=2247487329&idx=1&sn=ea0d1ee2a019d71eaea3a015a2c12914&chksm=eadc0503ddab8c15cee1fbfb56db75f840178b7a5ae09b4d5e07e85e402acc1547c2d1b43f9f&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [京东SRC助力 ｜ 首聚元宇宙！DEF CON 30 CHINA Party来了！](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727834953&idx=1&sn=36678261e7593c5cc118d156a239ad32&chksm=8050a2c1b7272bd7391c6af9433479c28efea1cc8d910551a75a4498ecc2196eb1180e368d0d&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [抖音 iOS 推荐 Feed 容器化总结](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497215&idx=1&sn=01d89e65e5a37906158ec8122b5145bf&chksm=e9d33e1ddea4b70b9c4c84f1ab3f9775e7fd428d8a66062e2095083de3475fd7f858b345fc35&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】国际黑客组织公布台湾金融机构、台湾核电平台源代码](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012016&idx=1&sn=8abb928c5b9ebdcb338d883f174d290e&chksm=f36f51b0c418d8a6fc4cd87cf258944123f79ba0cf1a0718630211a4c46a734a8159d02a7dd2&scene=58&subscene=0#rd) - - [【安全圈】联通员工贩卖公民信息被抓，每条获利10-30元](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012016&idx=2&sn=0df0ea87f473e2f4f4e3e5b81dd19023&chksm=f36f51b0c418d8a6008991688f1d0f13cde67a73802a29eaa4294615c28edab44b1145947765&scene=58&subscene=0#rd) - - [【安全圈】台湾大学官网被黑客攻击出现“世界上只有一个中国”字样](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012016&idx=3&sn=337df69a7c4775795a9e6adc43cdb3b9&chksm=f36f51b0c418d8a6657afeb431964b35b41ffd40a587523e6bc696ed32e755badd82a05d9730&scene=58&subscene=0#rd) - - [【安全圈】10万越南人的银行账户信息被黑客出售](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012016&idx=4&sn=fe6ecdf569c550e90d59064e9d5d9ffc&chksm=f36f51b0c418d8a6a14892433ef4403a853954e17b35eaffebb0b873da58f1d3b3a04a0d9897&scene=58&subscene=0#rd) -- SecIN技术平台 - - [SecIN助力 | 首聚元宇宙！DEF CON 30 CHINA Party来了！](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494683&idx=1&sn=4a62186ad9b2007d08092ea5e666849e&chksm=eb84b14fdcf33859a20302adb08a1de3e3f9d493b9cfca504de9db3cd08a91d9bc9cbd599add&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [2022年第二季度的DDoS攻击趋势分析](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547557&idx=1&sn=e05473dc280193e869abd9342dcef2a5&chksm=e915ea9fde6263897c8260f0c632fd3bf0cc9f6da23646b957b435a13a97c441641e17bb5f3d&scene=58&subscene=0#rd) - - [消息应用程序被用作网络犯罪活动的平台](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547557&idx=2&sn=d273643f5d4beef930b129072685a3e3&chksm=e915ea9fde62638937ba5c2998a1e30ccb917b09af7297ae116cec62e4651d5a30d51fcc2c57&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [java运行时应用自保护RASP技术浅析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495427&idx=1&sn=5f8bed5c06b737a205d6dc757994d767&chksm=fa523abdcd25b3ab2ec0910d5bcabd49e1333637f9a33c55a65590f9af714b0b763819af9e16&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-10.md b/archive/2022/2022-08-10.md deleted file mode 100644 index 07967b539b..0000000000 --- a/archive/2022/2022-08-10.md +++ /dev/null @@ -1,242 +0,0 @@ -# 每日安全资讯（2022-08-10） - -- HackerOne Hacker Activity - - [[CRITICAL] Full account takeover without user interaction on sign with Apple flow](https://hackerone.com/reports/1639802) - - [Ability to escape database transaction through SQL injection, leading to arbitrary code execution](https://hackerone.com/reports/1663299) -- Tenable Blog - - [Microsoft’s August 2022 Patch Tuesday Addresses 118 CVEs (CVE-2022-34713)](https://www.tenable.com/blog/microsofts-august-2022-patch-tuesday-addresses-118-cves-cve-2022-34713) -- Sploitus.com Exploits RSS Feed - - [Prestashop blockwishlist module 2.1.0 - SQLi exploit](https://sploitus.com/exploit?id=EDB-ID:51001&utm_source=rss&utm_medium=rss) - - [Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:51002&utm_source=rss&utm_medium=rss) - - [Feehi CMS 2.1.1 - Stored Cross-Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37902&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Guptachar.20 MVID-2022-0631 Insecure Credential Storage exploit](https://sploitus.com/exploit?id=PACKETSTORM:168006&utm_source=rss&utm_medium=rss) - - [PAN-OS 10.0 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168008&utm_source=rss&utm_medium=rss) - - [Feehi CMS 2.1.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168012&utm_source=rss&utm_medium=rss) - - [ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:51004&utm_source=rss&utm_medium=rss) - - [ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS) exploit](https://sploitus.com/exploit?id=EDB-ID:51003&utm_source=rss&utm_medium=rss) - - [Matrimonial PHP Script 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37904&utm_source=rss&utm_medium=rss) - - [Prestashop Blockwishlist 2.1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168003&utm_source=rss&utm_medium=rss) - - [PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated) exploit](https://sploitus.com/exploit?id=EDB-ID:51005&utm_source=rss&utm_medium=rss) - - [PAN-OS 10.0 - Remote Code Execution (Authenticated) Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37903&utm_source=rss&utm_medium=rss) - - [Prestashop blockwishlist module 2.1.0 - SQL injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37901&utm_source=rss&utm_medium=rss) - - [Matrimonial PHP Script 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168010&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Prestashop Blockwishlist exploit](https://sploitus.com/exploit?id=51328C9F-D90C-5D08-9A1B-9BE77961DB26&utm_source=rss&utm_medium=rss) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [August 2022 Patch Tuesday | Microsoft Releases 121 Vulnerabilities with 17 Critical, plus 20 Microsoft Edge (Chromium-Based); Adobe Releases 5 Advisories, 25 Vulnerabilities with 15 Critical.](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5555-1](https://packetstormsecurity.com/files/168015/USN-5555-1.txt) - - [Falco 0.32.2](https://packetstormsecurity.com/files/168014/falco-0.32.2.tar.gz) - - [Red Hat Security Advisory 2022-5942-01](https://packetstormsecurity.com/files/168013/RHSA-2022-5942-01.txt) - - [Feehi CMS 2.1.1 Cross Site Scripting](https://packetstormsecurity.com/files/168012/feehicms211-xss.txt) - - [Red Hat Security Advisory 2022-5924-01](https://packetstormsecurity.com/files/168011/RHSA-2022-5924-01.txt) - - [Matrimonial PHP Script 1.0 SQL Injection](https://packetstormsecurity.com/files/168010/matrimonial10-sql.txt) - - [Red Hat Security Advisory 2022-5934-01](https://packetstormsecurity.com/files/168009/RHSA-2022-5934-01.txt) - - [PAN-OS 10.0 Remote Code Execution](https://packetstormsecurity.com/files/168008/panos100-exec.txt) - - [Red Hat Security Advisory 2022-5875-01](https://packetstormsecurity.com/files/168007/RHSA-2022-5875-01.txt) - - [Backdoor.Win32.Guptachar.20 MVID-2022-0631 Insecure Credential Storage](https://packetstormsecurity.com/files/168006/MVID-2022-0631.txt) - - [Red Hat Security Advisory 2022-5928-01](https://packetstormsecurity.com/files/168005/RHSA-2022-5928-01.txt) - - [Red Hat Security Advisory 2022-5923-01](https://packetstormsecurity.com/files/168004/RHSA-2022-5923-01.txt) - - [Prestashop Blockwishlist 2.1.0 SQL Injection](https://packetstormsecurity.com/files/168003/prestashopbwl210-sql.txt) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [货拉拉信息安全技术沙龙来袭！与你相约8月19日~](https://www.4hou.com/posts/q8D0) - - [厚积薄发！安全狗再次获得科技成果转化认证！](https://www.4hou.com/posts/mXG9) - - [全景解析：166个网络安全统计数字和趋势](https://www.4hou.com/posts/pVXp) - - [SolidBit 勒索软件进入 RaaS 领域并通过新变体瞄准游戏玩家和社交媒体用户](https://www.4hou.com/posts/6V2V) - - [相约希壤！DEF CON 30 CHINA Party完全议程攻略](https://www.4hou.com/posts/nJ8W) - - [《数据安全法》语境下 动态脱敏技术的成熟度表现](https://www.4hou.com/posts/oJ7B) -- Recent Commits to cve:main - - [Update Tue Aug 9 17:30:39 UTC 2022](https://github.com/trickest/cve/commit/047a22cc193b09b5ecfb3e13d0d9368b2cdf30c8) -- 先知安全技术社区 - - [Executor内存马的实现](https://xz.aliyun.com/t/11593) -- unSafe.sh - 不安全 - - [Teardown of a quartz crystal oscillator and the tiny IC inside](https://buaq.net/go-121466.html) - - [常见密码哈希离线查询工具](https://buaq.net/go-121451.html) - - [美国总统拜登将签署芯片法案 企业如何在中美间“选边站队” - BBC News 中文](https://buaq.net/go-121444.html) - - [Stored XSS to Account Takeover : Going beyond document.cookie (Dumping IndexedDB)](https://buaq.net/go-121443.html) - - [timwhitez starred msmap](https://buaq.net/go-121452.html) - - [WinAPI Search - Search Utility For Win32 Functions & Error Codes](https://buaq.net/go-121442.html) - - [From Shared Dash to Root Bash :: Pre-Authenticated RCE in VMWare vRealize Operations Manager](https://buaq.net/go-121481.html) -- bunnie's blog - - [Hydroponics: Growing an Appreciation for Plants](https://www.bunniestudios.com/blog/?p=6481) -- 先知安全技术社区 - - [Executor内存马的实现](https://xz.aliyun.com/t/11593) -- SecWiki News - - [SecWiki News 2022-08-09 Review](http://www.sec-wiki.com/?2022-08-09) -- Sucuri Blog - - [Fake Instagram Verification & Twitter Badge Phishing](https://blog.sucuri.net/2022/08/fake-instagram-verification-twitter-badge-phishing.html) -- Twitter @Nicolas Krassas - - [Stored XSS to Account Takeover : Going beyond document.cookie (Dumping IndexedDB)](https://twitter.com/Dinosn/status/1557026615774908417) - - [RT blueblue: GitHub - karthikuj/CVE-2022-31101: Exploit for PrestaShop bockwishlist module 2.1.0 SQLi (CVE-2022-31101) -](https://twitter.com/piedpiper1616/status/1557000537631227906) - - [RT Petrus Viet: This is a detailed technical analysis of two vulnerabilities CVE-2022-31656 and CVE-2022-31659 affecting VMware Workspace ONE Access, ...](https://twitter.com/VietPetrus/status/1556999921320235009) - - [Smap - A Drop-In Replacement For Nmap Powered By](https://twitter.com/Dinosn/status/1556981754552111106) - - [OSRipper: AV evading OSX Backdoor and Crypter Framework](https://twitter.com/Dinosn/status/1556981045467152384) - - [LibAFL: A Framework to Build Modular and Reusable Fuzzers](https://twitter.com/Dinosn/status/1556980954505297921) - - [CVE-2022-36267: Airspan AirSpot unauthenticated remote command injection flaw](https://twitter.com/Dinosn/status/1556974434602422272) - - [RT PT SWARM: 🙀 Our researcher Arseniy Sharoglazov found a new technique for discovering second-level domains! Useful for: 🐞 Bughunters, for disc...](https://twitter.com/ptswarm/status/1556967258253139970) - - [Adding new features to an old game with Frida, Part II](https://twitter.com/Dinosn/status/1556881905664069633) - - [Debugging bare-metal STM32 from the seventh level of hell](https://twitter.com/Dinosn/status/1556881856842416128) - - [Email marketing firm hacked to steal crypto-focused mailing lists](https://twitter.com/Dinosn/status/1556881587832340485) - - [Targeted attack on industrial enterprises and public institutions [Kaspersky]](https://twitter.com/Dinosn/status/1556881534308720640) - - [Windows devices with newest CPUs are susceptible to data damage](https://twitter.com/Dinosn/status/1556881319577149440) - - [deBridge Finance crypto platform targeted by Lazarus hackers](https://twitter.com/Dinosn/status/1556881108486291458) - - [Auditing Crypto Wallets](https://twitter.com/Dinosn/status/1556880973815586817) - - [CVE-2022-2590: Linux kernel privilege escalation vulnerability](https://twitter.com/Dinosn/status/1556880941938839552) - - [Chinese scammers target kids with promise of extra gaming hours](https://twitter.com/Dinosn/status/1556880838821904384) - - [Hackers Compromise Employee Accounts to Access Twilio Internal Systems](https://twitter.com/Dinosn/status/1556880780986646533) - - [RT an0n: probably something similar... made a custom stager (this time for Sliver) useful for EDR bypass: 1.) unhook DLLs (by refreshing them, code st...](https://twitter.com/an0n_r0/status/1556805764811030528) -- 跳跳糖 - 安全与分享社区 - - [WMI调试与检测](https://tttang.com/archive/1640/) -- Security Boulevard - - [VERT Threat Alert: August 2022 Patch Tuesday Analysis](https://securityboulevard.com/2022/08/vert-threat-alert-august-2022-patch-tuesday-analysis/) - - [Microsoft Patch Tuesday, August 2022 Edition](https://securityboulevard.com/2022/08/microsoft-patch-tuesday-august-2022-edition/) - - [Debunking IAST myths](https://securityboulevard.com/2022/08/debunking-iast-myths/) - - [Hybrid Identity Protection with Denis Ontiveros Merlo](https://securityboulevard.com/2022/08/hybrid-identity-protection-with-denis-ontiveros-merlo/) - - [Organizations Deploying NetModule Router Software May Be Vulnerable to Exploitation](https://securityboulevard.com/2022/08/organizations-deploying-netmodule-router-software-may-be-vulnerable-to-exploitation/) - - [Integrity: The Missing Component of Zero Trust](https://securityboulevard.com/2022/08/integrity-the-missing-component-of-zero-trust/) - - [Aspen Security Forum 2022 – The Abraham Accords, Two Years On: A New Middle East? Moderator: Jeffrey Goldberg – Fireside Chat With Abdulla AI Khalifa](https://securityboulevard.com/2022/08/aspen-security-forum-2022-the-abraham-accords-two-years-on-a-new-middle-east-moderator-jeffrey-goldberg-fireside-chat-with-abdulla-ai-khalifa/) - - [Ali Khan Named ReversingLabs’ First Field CISO](https://securityboulevard.com/2022/08/ali-khan-named-reversinglabs-first-field-ciso/) - - [Welcome Our Newest Axion Jill Rosenberg, Director of UX](https://securityboulevard.com/2022/08/welcome-our-newest-axion-jill-rosenberg-director-of-ux/) - - [SOC 2 Compliance: Q&A with Compliance and Security Expert David Carter](https://securityboulevard.com/2022/08/soc-2-compliance-qa-with-compliance-and-security-expert-david-carter/) -- 安全客-有思想的安全新媒体 - - [活动 | 货拉拉信息安全技术沙龙来袭！与你相约8月19日](https://www.anquanke.com/post/id/277712) - - [Chrome V8命令执行漏洞（CVE-2022-1310）分析](https://www.anquanke.com/post/id/276964) - - [蜻蜓点水Binlog](https://www.anquanke.com/post/id/277625) - - [印度将撤回令科技巨头震惊的个人数据保护法案](https://www.anquanke.com/post/id/277634) -- Bug Bounty in InfoSec Write-ups on Medium - - [Stored XSS to Account Takeover : Going beyond document.cookie (Dumping IndexedDB)](https://infosecwriteups.com/stored-xss-to-account-takeover-going-beyond-document-cookie-970e42362f43?source=rss----7b722bfd1b8d--bug_bounty) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [A Compilation of Publicly Accessible URLs Found on Cyber Jihad Forums - Part Thirteen - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/a-compilation-of-publicly-accessible_57.html) - - [A Compilation of Publicly Accessible URLs Found on Cyber Jihad Forums - Part Twelve - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/a-compilation-of-publicly-accessible_49.html) - - [A Compilation of Publicly Accessible URLs Found on Cyber Jihad Forums - Part Eleven - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/a-compilation-of-publicly-accessible_48.html) - - [A Compilation of Publicly Accessible URLs Found on Cyber Jihad Forums - Part Seven - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/a-compilation-of-publicly-accessible_24.html) -- paper - Last paper - - [Fuzzing 之 Grammars](https://paper.seebug.org/1942/) - - [Spring 场景下突破 pebble 模板注入限制](https://paper.seebug.org/1941/) -- Securelist - - [Andariel deploys DTrack and Maui ransomware](https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/) -- SAP Blogs - - [Move your SAP BPC applications to SAP Analytics Cloud](https://blogs.sap.com/2022/08/09/move-your-sap-bpc-applications-to-sap-analytics-cloud/) - - [Transitioning from SAP Cloud Transformation Experts to Intelligent Sustainable Enterprise Transformation Experts](https://blogs.sap.com/2022/08/09/transitioning-from-sap-cloud-transformation-experts-to-intelligent-sustainable-enterprise-transformation-experts/) - - [Seamless Collaboration on legal documents in S/4HANA](https://blogs.sap.com/2022/08/09/seamless-collaboration-on-legal-documents-in-s-4hana/) - - [What’s New in Purchase Contracts – SAP S/4HANA Cloud 2208](https://blogs.sap.com/2022/08/09/whats-new-in-purchase-contracts-sap-s-4hana-cloud-2208/) - - [SAP Data Intelligence – What’s New in 3.3](https://blogs.sap.com/2022/08/09/sap-data-intelligence-whats-new-in-3.3/) - - [Mapping ABAPer (WRICEF) into SAP BTP (Business Technology Platform)](https://blogs.sap.com/2022/08/09/mapping-abaper-wricef-into-sap-btp-business-technology-platform/) - - [SAPURLSession supports async/await](https://blogs.sap.com/2022/08/09/sapurlsession-supports-async-await/) - - [Enterprise-grade B2B Commerce to Enhance Traditional Salesforce](https://blogs.sap.com/2022/08/09/enterprise-grade-b2b-commerce-to-enhance-traditional-salesforce/) - - [Feedback needed for SAP Training!](https://blogs.sap.com/2022/08/09/feedback-needed-for-sap-training/) - - [Address Change of Referenced Sales Document Affects Original Document](https://blogs.sap.com/2022/08/09/address-change-of-referenced-sales-document-affects-original-document/) -- Reverse Engineering - - [WinAPI Search - Search Utility For Win32 Functions & Error Codes](https://www.reddit.com/r/ReverseEngineering/comments/wk4ngu/winapi_search_search_utility_for_win32_functions/) - - [Microsoft Office to publish symbols starting August 2022](https://www.reddit.com/r/ReverseEngineering/comments/wkazdk/microsoft_office_to_publish_symbols_starting/) - - [Teardown of a quartz crystal oscillator and the tiny IC inside](https://www.reddit.com/r/ReverseEngineering/comments/wk6yd4/teardown_of_a_quartz_crystal_oscillator_and_the/) -- blog.avast.com EN - - [Why is device protection for kids valuable?](https://blog.avast.com/back-to-school-protect-devices) - - [Phishing attack adds pressure with countdown clock](https://blog.avast.com/phishing-attack-countdown-clock) -- Sucuri Blog - - [Fake Instagram Verification & Twitter Badge Phishing](https://blog.sucuri.net/2022/08/fake-instagram-verification-twitter-badge-phishing.html) -- Application Security Blog - - [Synopsys and ESG report points to prevalence of software supply chain risks](https://www.synopsys.com/blogs/software-security/esg-survey-findings-software-supply-chain/) -- SAUCERMAN - - [一次垃圾佬3000元装机记录](https://saucer-man.com/operation_and_maintenance/947.html) -- Malwarebytes Labs - - [Twilio breached after social engineering attack on employees](https://www.malwarebytes.com/blog/news/2022/08/twilio-fell-victim-to-a-text-messages-social-engineering-attack) - - [Can your EDR handle a ransomware attack? 6-point checklist for an anti-ransomware EDR](https://www.malwarebytes.com/blog/business/2022/08/can-your-edr-handle-a-ransomware-attack-6-point-checklist-for-an-anti-ransomware-edr) - - [Twitter data breach affects 5.4M users](https://www.malwarebytes.com/blog/news/2022/08/twitter-confirmed-july-2022-data-breach-affecting-5.4m-users) -- Microsoft Security Response Center - - [Security Update Guide Notification System News: Create your profile now](https://msrc-blog.microsoft.com/2022/08/09/security-update-guide-notification-system-news-create-your-profile-now/) -- The Daily Swig | Cybersecurity news and views - - [Microsoft Edge deepens defenses against malicious websites with enhanced security mode](https://portswigger.net/daily-swig/microsoft-edge-deepens-defenses-against-malicious-websites-with-enhanced-security-mode) - - [Simple IDOR vulnerability in Reddit allowed mischief-makers to perform mod actions](https://portswigger.net/daily-swig/simple-idor-vulnerability-in-reddit-allowed-mischief-makers-to-perform-mod-actions) -- HAHWUL - - [GraphQL Injection](https://www.hahwul.com/cullinan/graphql-injection/) -- KitPloit - PenTest & Hacking Tools - - [MrKaplan - Tool Aimed To Help Red Teamers To Stay Hidden By Clearing Evidence Of Execution](http://www.kitploit.com/2022/08/mrkaplan-tool-aimed-to-help-red-teamers.html) -- Exploit-DB.com RSS Feed - - [[remote] PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/51005) - - [[webapps] ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/51004) - - [[webapps] ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/51003) - - [[webapps] Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/51002) - - [[webapps] Prestashop blockwishlist module 2.1.0 - SQLi](https://www.exploit-db.com/exploits/51001) -- 博客园 - sevck - - [腾讯云函数代理 - sevck](https://www.cnblogs.com/sevck/p/16566611.html) -- Source Incite - - [From Shared Dash to Root Bash :: Pre-Authenticated RCE in VMWare vRealize Operations Manager](https://srcincite.io/blog/2022/08/09/from-shared-dash-to-root-bash-pre-authenticated-rce-in-vmware-vrealize-operations-manager.html) -- 安全客 - - [【技术分享】前尘——内存中无处可寻的木马](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774801&idx=1&sn=8438b34ba7ea8c1ee18fd38af1293202&chksm=88936abebfe4e3a89ce6a8a82db98be310767bb0a43ff2ae0d61e935c2aaa9dde10b4caaa270&scene=58&subscene=0#rd) - - [【安全头条】印度将撤回令科技巨头震惊的个人数据保护法案](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774801&idx=2&sn=d8274793dca3987afb4ebada3bd029d6&chksm=88936abebfe4e3a83979cabe458ce7dd6a8e54960120ef7cff51016733c9923208efca6dd9d2&scene=58&subscene=0#rd) -- 看雪学院 - - [C++异常处理控制流下的OLLVM混淆](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461242&idx=1&sn=a4bb445d012983034029dcb1938d4061&chksm=b18e14b086f99da63a540f9e1f2df428e5a4fbd7bdf2c846c3516ea5d8b97e8ba519402a6e7b&scene=58&subscene=0#rd) - - [英国国家医疗服务体系陷入中断！因服务提供商遭受网络攻击](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461242&idx=2&sn=e8aaada84bd2555734b50c7824c29cab&chksm=b18e14b086f99da6c8305e76e9d83d9d52c4277d75b53cb2a006ac48caca7fff06b5f23e3282&scene=58&subscene=0#rd) - - [如何利用高级查杀技术，通杀恶意程序？](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461242&idx=3&sn=4ce2779fa73dcdefee6808412d4d87cd&chksm=b18e14b086f99da6d0d368fb1020e5f852a5ddc5502fd6576a9f775ad1c1fe93803b5f12454d&scene=58&subscene=0#rd) -- Checkmarx.com - - [Understanding the Top API Security Risks](https://checkmarx.com/blog/understanding-the-top-api-security-risks/) -- 暗影安全 - - [白帽线下集结令！“大湾区白帽论坛”报名启动！](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163112&idx=1&sn=ff3636113e7987071d451905704d9717&chksm=f1d4e58dc6a36c9b011d9fa21079b065bda71253f4c47ee2b61f011615fd3ec757f37b71dfc5&scene=58&subscene=0#rd) -- rtl-sdr.com - - [SDR# Co-Channel Canceller and Micro Tuner Updates](https://www.rtl-sdr.com/sdr-co-channel-canceller-and-micro-tuner-updates/) - - [WiFi Grid RTL-SDR Radio Telescopes featured in SARA2022 Conference Talks](https://www.rtl-sdr.com/wifi-grid-rtl-sdr-radio-telescopes-featured-in-sara2022-conference-talks/) -- dotNet安全研究僧 - - [白帽线下集结令！“大湾区白帽论坛”报名启动！](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485881&idx=1&sn=c93634af6122bac60c4710a6b8a1cb4e&chksm=fa5aa754cd2d2e424f3c5aa6f87a55079d7cc39613ed4b11b9030a4e6eadfd89c45278b139b5&scene=58&subscene=0#rd) - - [.NET 启动进程时隐藏cmd窗口](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485881&idx=2&sn=06fc98da4d0b3a6ba46da05f1ae372a9&chksm=fa5aa754cd2d2e42d8ae9558f4205190143d9396ead21d002ef3abebcb2f48bda05f6ec44b31&scene=58&subscene=0#rd) - - [.NET VirtualPathProvider实现虚拟WebShell](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247485881&idx=3&sn=e346506601c7d69dea755f08b905be38&chksm=fa5aa754cd2d2e4261c394c0263450a5c8ee767fe92e820d934451d518537f0d9c142240b444&scene=58&subscene=0#rd) -- Blog - Praetorian - - [Thinking Outside the Mailbox: Modernized Phishing Techniques](https://www.praetorian.com/blog/modernized-phishing-techniques/) -- 三六零CERT - - [安全日报（2022.08.09）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491228&idx=1&sn=c72aa94eccaaf8e1741e86971a5c5ecf&chksm=fe251b9dc952928b9fd77569feda0366cd4bc8c86da4829256610336efd45b96e067fa1a2608&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【资料】谁是美国立法受益者](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131135&idx=1&sn=2dc8ec23e70d373a040b45654a258e24&chksm=f1af7bc5c6d8f2d35bd74b7d68ae03fe4b305e5aaaeaadb499e7a653439fb988dd4bc060ab01&scene=58&subscene=0#rd) -- 互联网安全内参 - - [网络攻击致使英国医疗急救热线“120”发生重大中断](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505116&idx=1&sn=ec1ea2eeca6c2c9f65ae3b209b9e39b5&chksm=ebfa93fcdc8d1aea9c31912458538c33e93ab6aab9ec4740d3c36219ff8ad4a6d38793f67de6&scene=58&subscene=0#rd) - - [丹麦全国7-11便利店遭网络攻击关闭](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505116&idx=2&sn=e77b190b0f402fafa938da44d76aa179&chksm=ebfa93fcdc8d1aea0afd445b86d22875694043c6feb6209c135795924437069a3dbcd356b08f&scene=58&subscene=0#rd) - - [英国下议院引入《数据保护和数字信息法案》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505116&idx=3&sn=56cfec27bc500bc967e6b51272bacc3a&chksm=ebfa93fcdc8d1aead2f9183b779bc15bba40743321500ace02536821fbf8b863e6a3ef37f327&scene=58&subscene=0#rd) - - [工信安全中心发布《美国数据经纪商立法及对我启示》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505116&idx=4&sn=79b222944514aaa48614dc612a828619&chksm=ebfa93fcdc8d1aeaa0e88d1ce36ebbad0be84d5a30362e6748fc59e322a261cfff91cb350d82&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [国家互联网应急中心(CNCERT/CC)勒索软件动态周报-2022年第29期（总第37期）(20220716-20220722)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497001&idx=1&sn=72d55a4868db993dbbf2c5467a06edc4&chksm=973ac64ba04d4f5d695b9651c86078f45f0ef050d1a3ae626c8ffd78b49893711ff1f996e397&scene=58&subscene=0#rd) - - [国家互联网应急中心(CNCERT/CC)勒索软件动态周报-2022年第28期（总第36期）(20220709-20220715)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497001&idx=2&sn=bc7eb6f58aeed95d82e7fae294ce7292&chksm=973ac64ba04d4f5d00f1f3fcc2d33e89da9b84c0a75874553af13ccff20a0eff4ad091e56589&scene=58&subscene=0#rd) - - [国家互联网应急中心(CNCERT/CC)勒索软件动态周报-2022年第27期（总第35期）(20220702-20220708)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497001&idx=3&sn=69b61fa05dd22a35d9b17b158c9a9761&chksm=973ac64ba04d4f5d1703e281b2057cbb351d835113f0f86728e91466c138d4f04fd492782272&scene=58&subscene=0#rd) - - [CNVD漏洞周报2022年第31期](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497001&idx=4&sn=8b1be5437acacb51547fc8495d3c8d04&chksm=973ac64ba04d4f5d873eaea5688ef65bdd3a4fe0c969a9d7ae1c76f6154949d0fb35320be52f&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220801-20220807)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497001&idx=5&sn=ae452782cd545fe0e918e1d5d5ec9574&chksm=973ac64ba04d4f5dbc0ad6773be3e8f450721acc1d91b57c742ad4169a503f1e185e0b5c1ccf&scene=58&subscene=0#rd) - - [每周移动恶意程序传播渠道安全监测报告（2022年08月01日—2022年08月07日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497001&idx=6&sn=b61111769a59227b792f7d9059e41c01&chksm=973ac64ba04d4f5d6c8884b9f78f32c63be36a0fcae636e70da99057cafaec66b1685e2eda60&scene=58&subscene=0#rd) -- FireShell Security Team - - [Google CTF 2022 - Segfault Labyrinth](https://fireshellsecurity.team/googlectf2022-segfault-labyrinth/) -- 极客公园 - - [英特尔不是输给了 AMD 和台积电，而是输给了自己](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963761&idx=1&sn=13ce302ae26ac6517561a6010eb5559d&chksm=7e547e074923f711d92739c8c51322e96fc3d1e19ccc2d68b1b61444bcaed9cbeee974c9b0cc&scene=58&subscene=0#rd) - - [Web 3 时代，如何保护你的网络身份安全？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963630&idx=1&sn=e3b9f1bb26fda1a8d7515831c8436b54&chksm=7e547e984923f78ea67408e502b0d69b0229ce619846186c45ebffe04beb5adf6cda1e89bc7a&scene=58&subscene=0#rd) - - [阿里巴巴双重主要上市获港交所确认；抖音回应 「限流东方甄选」；传 iPhone 14 将在 9 月 13 日发布｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963601&idx=1&sn=7aac5cc7cbb006330891875266822eff&chksm=7e547ea74923f7b1fbc83d8717a181e25876cc5470fc28d2433367a00b16ef95fc0fc8df1c40&scene=58&subscene=0#rd) -- 星阑科技 - - [回顾篇之小阑7月那些事～](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494810&idx=1&sn=5e95d4e2f00196d845c6243ab4bd235c&chksm=c0074106f770c8103e1fdbae435d7b2dc56e2ac911faeb627a69f97e230a316252739e494523&scene=58&subscene=0#rd) -- 安全牛 - - [从滑动标尺模型看企业网络安全能力评估与建设](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117046&idx=1&sn=4849490acedf28ac217708133bb0f2da&chksm=bd1465258a63ec33ebc528dc11acb8a81a4a87f9d45bf1174450ec608d61aa44b8947c3223a7&scene=58&subscene=0#rd) - - [2022年第二批网络安全推荐性国家标准计划下达](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117046&idx=2&sn=bfd674c21f294ee02c4d2cc895926d50&chksm=bd1465258a63ec3354411424f2a6ecb730bc1766287eb9ebb3b7ebdd601b74ba3b2358bb14d7&scene=58&subscene=0#rd) - - [免费ARP与代理ARP在工业场景的应用](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117046&idx=3&sn=a053e4c9f88df4cd14c418ba035dd3b5&chksm=bd1465258a63ec33ac16dd069e976a9da7d7f2fc4cfeb805baec073d151795546acb38ad7dbf&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [山石上榜微软2022年度全球最具价值安全研究员榜单](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495541&idx=1&sn=3c36899bd09a332c4ed3540682b2fa03&chksm=fa523acbcd25b3dd8872c65ac50bc13ead2ee8aecd0f727bfe8e5e4d525dca76c0b2dfc4785a&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [全景解析：166个网络安全统计数字和趋势](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547785&idx=1&sn=3e53c5ec52d43aad436e7940223b2c65&chksm=e915ebb3de6262a5057f3d860d2881458a271b37adb577ae964a8e60d42a8fa093e6cfc21fa7&scene=58&subscene=0#rd) - - [相约希壤！DEF CON 30 CHINA Party完全议程攻略](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547785&idx=2&sn=2113ec71de84f681c3756561e6aa472a&chksm=e915ebb3de6262a5d05be944a02716f4213c3f23bed2a569ded216314341afba3199147b2ace&scene=58&subscene=0#rd) - - [SolidBit 勒索软件进入 RaaS 领域并通过新变体瞄准游戏玩家和社交媒体用户](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547785&idx=3&sn=342bd1ed1491e9281883af6111096d02&chksm=e915ebb3de6262a55a6def1aa9bb7fb47fbcfcd8549f679119b8b098a305ca57a26b9b45f065&scene=58&subscene=0#rd) -- 网安寻路人 - - [印度撤回《个人数据保护法（草案）》](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495705&idx=1&sn=311d8aa7e5ea62331ac5e2c7d1519f2b&chksm=97e94df3a09ec4e5960ea5da2676071b94465fc6ceacb0023bc8097385471e0e2cab59389cb5&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 中外数据出境安全评估的“意同而形不同”](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530341&idx=1&sn=68a6b762d2cdb009e3c4d6c1d67a7f5e&chksm=fa93c1a4cde448b28ae636c5ff1ee60efe9cff7b3d67e0efe9a73e554ab3a1eee39d03e082e9&scene=58&subscene=0#rd) - - [国家工程研究中心安全资讯周报20220808期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530341&idx=2&sn=3d862c6561b654d2d3c4913f1b0d75fd&chksm=fa93c1a4cde448b259998faa7b0d9091b68437f43200c74b1e159b44b5e741d6d3202ffb43fc&scene=58&subscene=0#rd) - - [美军大数据建设及其安全研究](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530341&idx=3&sn=41d3b8a9cf7ee3a9668b451e6b63de44&chksm=fa93c1a4cde448b263257be3b0c6986269ff6c58669d30d2ab853c7aa94e4a81ded9e57271f9&scene=58&subscene=0#rd) - - [Twitter 证实，零日漏洞致540万账户数据泄露](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530341&idx=4&sn=6ec6f56f89a6b1ad2d302fe38c183d72&chksm=fa93c1a4cde448b2ef68770cebf7087e71ce2d2c527321b2a2d3fd9c85c9c4ed4c9da05b0f37&scene=58&subscene=0#rd) - - [乌克兰宣布关闭一处社交农场：超百万账号肆意传播抹黑信息](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530341&idx=5&sn=cdf7cf5b347267063f6b4b588a1d8fa6&chksm=fa93c1a4cde448b2c62a12cb177c0afb1812d002ca2bc11391b58afea6d61d12a29b43037008&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Aug.9th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495723&idx=1&sn=e972c8a8752f326c8699d2c1d87f6ca0&chksm=ce96bd15f9e1340396b4cc79aee2adc2c964c914d739d0973b5b0f5faeae8638f4fbb31b6f0b&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [京东SRC助力 | 货拉拉信息安全技术沙龙来袭！与你相约8月19日~](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727834964&idx=1&sn=58a0225ddee6d63a36f1f951480a2685&chksm=8050a2dcb7272bca75a4d2534fd1c5eda874d67540a2fde9ed93b580843e233ccdc223ecd591&scene=58&subscene=0#rd) -- 情报分析师 - - [重磅319页！美国在亚洲更有效的军事防御战略路线图](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513619&idx=1&sn=02db85ab368458fae64c237b6547573f&chksm=87168e98b061078e1645e3d6a37bc33c806b9c95f39c97eecacf4b8a460878d2657239b9733b&scene=58&subscene=0#rd) - - [【事实核查】朝鲜是否派遣10万名士兵与乌克兰作战？（附《朝鲜常规炮火》）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513619&idx=2&sn=536c048b8b297211c38e8ee493f08597&chksm=87168e98b061078eb2f9b6f25f40775e3fa1d5e50a121a4074093b18470b7e34f11aeee4673e&scene=58&subscene=0#rd) - - [情报分析师技能：10种数据分析工具](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513619&idx=3&sn=01275cd9db4b5fd7fe9cbe300e1bd96d&chksm=87168e98b061078eef66a95a40b4f05bd04eb8405a81f3d7c01066ccf2064436501cd2875302&scene=58&subscene=0#rd) -- 数世咨询 - - [董事会上的网络安全：CISO角色迈向新时代](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494584&idx=1&sn=b0abddea47710be09fb06b1ef8521391&chksm=c1449905f6331013bcfae481fb33c966e78ba96a5f2b52bf1109356d390e83174e30eb5dd4cd&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】网传ToDesk存在安全漏洞，多家企业禁用ToDesk](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012203&idx=1&sn=35dea29c4476aabcccf8b64082b6393c&chksm=f36f52ebc418dbfd7b287c798687e4fdeaf1e40b9b187a280f82bd6707e20f2b4f7b53eaa772&scene=58&subscene=0#rd) - - [【安全圈】针对Windows和Linux ESXi服务器，勒索软件发起攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012203&idx=2&sn=1fafd4dc5f647010f9cfa961cd919805&chksm=f36f52ebc418dbfd552f76646ab71747bb87933fe6c23d7ca00c332b6cd82993a46253663e5c&scene=58&subscene=0#rd) - - [【安全圈】Cameo CEO iCloud 遭入侵损失20 万美元加密资产](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012203&idx=3&sn=d62280e83b5e4c66d106563494fa06d4&chksm=f36f52ebc418dbfdbc169f647157c7b45a2741ee980c96d905de51eef23b7d37f46dc9e4532d&scene=58&subscene=0#rd) - - [【安全圈】警告！美国紧急警报系统发现严重缺陷](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012203&idx=4&sn=99597d0050de24e7c544ffa9e30b6f3f&chksm=f36f52ebc418dbfdb9d4c089bac452e671cab7fff056c2d0baaf3940c4ee1650e657bf3d36aa&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [DevOps风险测绘之代码篇](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247492984&idx=1&sn=98ca1e8acc27bcd373c941daefa5aea0&chksm=e84c43a7df3bcab1a2dbc20d71ce8376b9349585f7a5a8d4202f16f13c051964e819af6e9aad&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-11.md b/archive/2022/2022-08-11.md deleted file mode 100644 index 548799ae02..0000000000 --- a/archive/2022/2022-08-11.md +++ /dev/null @@ -1,204 +0,0 @@ -# 每日安全资讯（2022-08-11） - -- HackerOne Hacker Activity - - [many commands can be manipulated to delete identities or affiliations](https://hackerone.com/reports/348090) - - [Read-only administrator can change agent update settings](https://hackerone.com/reports/1538004) -- Security Boulevard - - [Traditional Security Won’t Cut It for Secure Cloud-Native Applications: Here’s Why](https://securityboulevard.com/2022/08/traditional-security-wont-cut-it-for-secure-cloud-native-applications-heres-why/) - - [Building a modern API security strategy — API components](https://securityboulevard.com/2022/08/building-a-modern-api-security-strategy-api-components/) - - [Aspen Security Forum 2022 – Moderator: Sarah Smith – ‘Food Security Is National Security’](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-sarah-smith-food-security-is-national-security/) - - [Patch Tuesday Advisory – August 2022](https://securityboulevard.com/2022/08/patch-tuesday-advisory-august-2022/) - - [Anti-Vax Dating App Offers Up Admin Privileges](https://securityboulevard.com/2022/08/anti-vax-dating-app-offers-up-admin-privileges/) - - [Firmware Security Realizations – Part 2 – Start Your Management Engine](https://securityboulevard.com/2022/08/firmware-security-realizations-part-2-start-your-management-engine/) - - [What is the Impact of Data Loss on Your Business?](https://securityboulevard.com/2022/08/what-is-the-impact-of-data-loss-on-your-business/) - - [Wallarm at Black Hat USA 2022](https://securityboulevard.com/2022/08/wallarm-at-black-hat-usa-2022/) -- Tenable Blog - - [Accelerate Vulnerability Detection and Response for AWS with Tenable Cloud Security Agentless Assessment](https://www.tenable.com/blog/accelerate-vulnerability-detection-and-response-for-aws-with-tenable-cloud-security-agentless) - - [Introducing Tenable Cloud Security with Agentless Assessment and Live Results](https://www.tenable.com/blog/introducing-tenable-cloud-security-with-agentless-assessment-and-live-results) -- Sploitus.com Exploits RSS Feed - - [Zimbra zmslapd Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:168048&utm_source=rss&utm_medium=rss) - - [Webmin Package Updates Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168049&utm_source=rss&utm_medium=rss) - - [AirSpot 5410 0.3.4.1-4 Remote Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168047&utm_source=rss&utm_medium=rss) - - [Sophos XG115w Firewall 17.0.10 MR-10 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:168046&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Apache Commons Configuration exploit](https://sploitus.com/exploit?id=18F97794-03AA-5BD5-9DAA-663FB07BB6A0&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Authentication in Sophos Sfos exploit](https://sploitus.com/exploit?id=947868DA-07A1-5321-B9E5-13A3645F90B5&utm_source=rss&utm_medium=rss) - - [Exploit for Exposure of Resource to Wrong Sphere in Biostar Racing Gt Evo exploit](https://sploitus.com/exploit?id=903CCFD3-DC5F-504D-AFD5-461A0AACFCDA&utm_source=rss&utm_medium=rss) -- Sec-News 安全文摘 - - [Google Cloud Shell - Command Injection](https://wiki.ioin.in/url/B6M6) -- Files ≈ Packet Storm - - [Webmin Package Updates Command Injection](https://packetstormsecurity.com/files/168049/webmin_package_updates_rce.rb.txt) - - [Zimbra zmslapd Privilege Escalation](https://packetstormsecurity.com/files/168048/zimbra_slapper_priv_esc.rb.txt) - - [AirSpot 5410 0.3.4.1-4 Remote Command Injection](https://packetstormsecurity.com/files/168047/airspot03414-exec.txt) - - [Sophos XG115w Firewall 17.0.10 MR-10 Authentication Bypass](https://packetstormsecurity.com/files/168046/sophosxg115w-bypass.txt) - - [Ubuntu Security Notice USN-5562-1](https://packetstormsecurity.com/files/168045/USN-5562-1.txt) - - [Ubuntu Security Notice USN-5559-1](https://packetstormsecurity.com/files/168044/USN-5559-1.txt) - - [Ubuntu Security Notice USN-5561-1](https://packetstormsecurity.com/files/168043/USN-5561-1.txt) - - [Red Hat Security Advisory 2022-5069-01](https://packetstormsecurity.com/files/168042/RHSA-2022-5069-01.txt) - - [Ubuntu Security Notice USN-5560-2](https://packetstormsecurity.com/files/168041/USN-5560-2.txt) - - [Ubuntu Security Notice USN-5560-1](https://packetstormsecurity.com/files/168040/USN-5560-1.txt) - - [Red Hat Security Advisory 2022-6038-01](https://packetstormsecurity.com/files/168039/RHSA-2022-6038-01.txt) - - [Red Hat Security Advisory 2022-5068-01](https://packetstormsecurity.com/files/168038/RHSA-2022-5068-01.txt) - - [Red Hat Security Advisory 2022-6037-01](https://packetstormsecurity.com/files/168037/RHSA-2022-6037-01.txt) - - [Red Hat Security Advisory 2022-5070-01](https://packetstormsecurity.com/files/168036/RHSA-2022-5070-01.txt) - - [Ubuntu Security Notice USN-5558-1](https://packetstormsecurity.com/files/168035/USN-5558-1.txt) - - [Gentoo Linux Security Advisory 202208-11](https://packetstormsecurity.com/files/168034/glsa-202208-11.txt) - - [Gentoo Linux Security Advisory 202208-06](https://packetstormsecurity.com/files/168033/glsa-202208-06.txt) - - [Gentoo Linux Security Advisory 202208-12](https://packetstormsecurity.com/files/168032/glsa-202208-12.txt) - - [Gentoo Linux Security Advisory 202208-14](https://packetstormsecurity.com/files/168031/glsa-202208-14.txt) - - [Gentoo Linux Security Advisory 202208-10](https://packetstormsecurity.com/files/168030/glsa-202208-10.txt) - - [Gentoo Linux Security Advisory 202208-07](https://packetstormsecurity.com/files/168029/glsa-202208-07.txt) - - [Gentoo Linux Security Advisory 202208-08](https://packetstormsecurity.com/files/168028/glsa-202208-08.txt) - - [Gentoo Linux Security Advisory 202208-13](https://packetstormsecurity.com/files/168027/glsa-202208-13.txt) - - [Gentoo Linux Security Advisory 202208-09](https://packetstormsecurity.com/files/168026/glsa-202208-09.txt) - - [Red Hat Security Advisory 2022-5997-01](https://packetstormsecurity.com/files/168025/RHSA-2022-5997-01.txt) -- SecWiki News - - [SecWiki News 2022-08-10 Review](http://www.sec-wiki.com/?2022-08-10) -- 跳跳糖 - 安全与分享社区 - - [tabby原理分析](https://tttang.com/archive/1696/) -- Twitter @Nicolas Krassas - - [CVE-2022-2586/CVE-2022-2585/CVE-2022-2588: Linux kernel LPE flaw](https://twitter.com/Dinosn/status/1557236938951823361) - - [What is command injection and how to exploit it — StackZero](https://twitter.com/Dinosn/status/1557228762453909507) - - [Creating a basic backdoor on an android mobile](https://twitter.com/Dinosn/status/1557228465115504640) - - [Hackers install Dracarys Android malware using modified Signal app](https://twitter.com/Dinosn/status/1557228345527517184) - - [On Detection: Tactical to Functional](https://twitter.com/Dinosn/status/1557228185779052544) - - [Crypto And The US Government Are Headed For A Decisive Showdown](https://twitter.com/Dinosn/status/1557228049241985025) - - [Cloudflare employees also hit by hackers behind Twilio breach](https://twitter.com/Dinosn/status/1557219271067013120) - - [APIC fail: Intel 'Sunny Cove' chips with SGX spill secrets](https://twitter.com/Dinosn/status/1557219139441287168) - - [Researchers Debut Fresh RCE Vector for Common Google API Tool](https://twitter.com/Dinosn/status/1557218003556630529) - - [Patch Tuesday: Yet another Microsoft RCE bug under active exploit](https://twitter.com/Dinosn/status/1557217926477930497) - - [How hackers are stealing credit cards from classifieds sites](https://twitter.com/Dinosn/status/1557217280928481281) - - [From Shared Dash to Root Bash :: Pre-Authenticated RCE in VMWare vRealize Operations Manager](https://twitter.com/Dinosn/status/1557216136588058627) -- 安全客-有思想的安全新媒体 - - [从权限角度看滴滴处罚事件](https://www.anquanke.com/post/id/277155) - - [xor DDOS木马分析](https://www.anquanke.com/post/id/277186) - - [美国财政部禁止公民使用链上混币器TornadoCash 加密行业对此纷纷作出反应](https://www.anquanke.com/post/id/277719) -- unSafe.sh - 不安全 - - [CVE-2022-35741 Apache CloudStack SAML XXE注入](https://buaq.net/go-121636.html) - - [Day 1 of Black Hat USA 2022 | Asset Intel, Data-Focused Security & the Realities of Cyber War](https://buaq.net/go-121642.html) - - [Dave Piscitello in the Fight Against Phishing | Avast](https://buaq.net/go-121626.html) - - [BrightCloud® Threat Report Mid-Year Update: Reinvention is the Name of the Game](https://buaq.net/go-121637.html) - - [How Mobile AppSec Testing Standards Speed DevSecOps](https://buaq.net/go-121627.html) -- Recent Commits to cve:main - - [Update Wed Aug 10 17:20:35 UTC 2022](https://github.com/trickest/cve/commit/6c96862e8a7e23667051bdc1a9cc0a0f1b41bf49) -- 先知安全技术社区 - - [CVE-2022-35741 Apache CloudStack SAML XXE注入](https://xz.aliyun.com/t/11600) -- 安全脉搏 - - [API接口是什么？API接口常见的安全问题与安全措施有哪些？](https://www.secpulse.com/archives/184959.html) - - [红蓝对抗-安装包钓鱼与反钓鱼](https://www.secpulse.com/archives/185091.html) - - [浅析JWT安全问题](https://www.secpulse.com/archives/185047.html) - - [数据库注入提权总结（一）](https://www.secpulse.com/archives/184972.html) - - [CSDI:培养数字化复合型人才](https://www.secpulse.com/archives/184975.html) -- NowSecure - - [How Mobile AppSec Testing Standards Speed DevSecOps](https://www.nowsecure.com/blog/2022/08/10/how-mobile-appsec-testing-standards-speed-devsecops/) -- Google Online Security Blog - - [Making Linux Kernel Exploit Cooking Harder](http://security.googleblog.com/2022/08/making-linux-kernel-exploit-cooking.html) -- Insinuator.net - - [Whitepaper Endpoint Management & Monitoring Solutions Released](https://insinuator.net/2022/08/whitepaper-endpoint-management-monitoring-solutions-released/) -- Forcepoint - - [A new guide to the DLP market according to Gartner®](https://www.forcepoint.com/blog/insights/gartner-market-guide-dlp) -- 先知安全技术社区 - - [CVE-2022-35741 Apache CloudStack SAML XXE注入](https://xz.aliyun.com/t/11600) -- Securelist - - [VileRAT: DeathStalker’s continuous strike at foreign and cryptocurrency exchanges](https://securelist.com/vilerat-deathstalkers-continuous-strike/107075/) -- blog.avast.com EN - - [Dave Piscitello in the Fight Against Phishing | Avast](https://blog.avast.com/dave-piscitello-combating-phishing) - - [Back to school: Managing your high schooler's digital milestones](https://blog.avast.com/high-school-digital-milestones) -- Malwarebytes Labs - - [5 cybersecurity tips for students going back to school](https://www.malwarebytes.com/blog/news/2022/08/5-cybersecurity-tips-for-students-going-back-to-school) -- Project Zero - - [The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)](https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html) -- SentinelOne - - [Day 1 of Black Hat USA 2022 | Asset Intel, Data-Focused Security & the Realities of Cyber War](https://www.sentinelone.com/blog/sentinelone-black-hat-2022/) -- Reverse Engineering - - [Improving MBA Deobfuscation using Equality Saturation](https://www.reddit.com/r/ReverseEngineering/comments/wl3tal/improving_mba_deobfuscation_using_equality/) -- SAP Blogs - - [Guest Blog Post from IDC: Rethinking HR Document Management for the New Hybrid Work Reality](https://blogs.sap.com/2022/08/10/guest-blog-post-from-idc-rethinking-hr-document-management-for-the-new-hybrid-work-reality/) - - [It’s Always Better When We’re Together!](https://blogs.sap.com/2022/08/10/its-always-better-when-were-together/) - - [5 reasons why process modeling is the operational backbone of your journey to process analytics initiatives](https://blogs.sap.com/2022/08/10/5-reasons-why-process-modeling-is-the-operational-backbone-of-your-journey-to-process-analytics-initiatives/) - - [Automatic Payment Reminder with SAP S/4HANA OnPrem and SAP Conversational AI with Telegram](https://blogs.sap.com/2022/08/10/automatic-payment-reminder-with-s4-hana-onprem-and-sap-conversational-ai-with-telegram/) - - [SAP Concur Localization: Japan Public Transport Upgrade](https://blogs.sap.com/2022/08/10/sap-concur-localization-japan-public-transport-upgrade/) - - [Upgrade Change Impact Analysis (UCIA) in SAP Solution Manager](https://blogs.sap.com/2022/08/10/upgrade-change-impact-analysis-ucia-in-sap-solution-manager/) - - [Solution Order Management in SAP S/4HANA Cloud 2208](https://blogs.sap.com/2022/08/10/solution-order-management-in-sap-s-4hana-cloud-2208/) - - [Improved ETA/ETD Handling](https://blogs.sap.com/2022/08/10/improved-eta-etd-handling/) -- PortSwigger Research - - [Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling](https://portswigger.net/research/browser-powered-desync-attacks) -- The Daily Swig | Cybersecurity news and views - - [Black Hat USA: Former CISA director Chris Krebs warns clouds of cyberwar are circling Taiwan](https://portswigger.net/daily-swig/black-hat-usa-former-cisa-director-chris-krebs-warns-clouds-of-cyberwar-are-circling-taiwan) - - [Cisco router flaw gives patient attackers full access to small business networks](https://portswigger.net/daily-swig/cisco-router-flaw-gives-patient-attackers-full-access-to-small-business-networks) -- daniel.haxx.se - - [IPFS and their gateways](https://daniel.haxx.se/blog/2022/08/10/ipfs-and-their-gateways/) -- Webroot Blog - - [BrightCloud® Threat Report Mid-Year Update: Reinvention is the Name of the Game](https://www.webroot.com/blog/2022/08/10/brightcloud-threat-report-mid-year-update-reinvention-is-the-name-of-the-game/) -- KitPloit - PenTest & Hacking Tools - - [Packj - Large-Scale Security Analysis Platform To Detect Malicious/Risky Open-Source Packages](http://www.kitploit.com/2022/08/packj-large-scale-security-analysis.html) -- Twitter @hakivvi - - [Re @azz_maher Great work Maher, looking forward to the disclosure.](https://twitter.com/hakivvi/status/1557466687414435846) - - [RT Maher: I will disclose three Local Privilege Escalations (two of those are targeting a specific user, the third one is LPE from any user to root wh...](https://twitter.com/azz_maher/status/1557455788314136578) -- rtl-sdr.com - - [SunFounder TS7-Pro Touch Screen Review: Building a Portable RTL-SDR Pi 4 System](https://www.rtl-sdr.com/sunfounder-ts7-pro-touch-screen-review-building-a-portable-rtl-sdr-pi-4-system/) -- HAHWUL - - [Rails (Ruby on Rails)](https://www.hahwul.com/cullinan/rails/) -- 互联网安全内参 - - [Black Hat 2022上最值得关注的十大议题](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505129&idx=1&sn=413a62a6b50adee1abdb1c8f23c7d833&chksm=ebfa93c9dc8d1adfbc9a81525a4138d5f3f4e2f8594bf587c742f25b3b9a8b39d55046a459d5&scene=58&subscene=0#rd) - - [对侵害个人信息权益说不！银保监会开展专项整治](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505129&idx=2&sn=f63d79568a50c5ef349767fec4655390&chksm=ebfa93c9dc8d1adf3eaa59da5c18585b7623647f97607a264e6c9a9fd715ddb3f2ca7147c794&scene=58&subscene=0#rd) - - [沙箱视角看2022攻防演练：样本类攻击手法总结](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505129&idx=3&sn=49f66144be787803dc4da8a00a9f7fda&chksm=ebfa93c9dc8d1adf473e0e2a62d35221773be18f12196cf1cf970e202844659de0a1b1cf4fd1&scene=58&subscene=0#rd) - - [《云计算安全责任共担模型》行业标准正式发布](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505129&idx=4&sn=430aab01c24b50798ecb353ba3ee1bf2&chksm=ebfa93c9dc8d1adf87301ccdc8473873d05b4ed6f15a990dade4835a5af9881d4f57fcc5801c&scene=58&subscene=0#rd) -- 安全分析与研究 - - [谈谈安全对抗的本质](https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247487473&idx=1&sn=1f0c8b065636af079f3fa3f4aba41f01&chksm=902fa0d9a75829cf6874bba1ebd09903c7bd2c0d14dd47a2f8cdbf2fbd418dab57d039efd5e3&scene=58&subscene=0#rd) -- 博客园 - sevck - - [SNAT和DNAT的区别 - sevck](https://www.cnblogs.com/sevck/p/16572505.html) -- 黑奇士 - - [乐视急眼了：代工厂使用劣质面板，超级电视使用半年后20%返修，损失高达2000万](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247487099&idx=1&sn=61a2c7a41de2c5a7eef40c3614c426e1&chksm=eca20197dbd58881243887ee718d1d4153114ba30ab69d4889c3b3a3ca58c325b820826a0aed&scene=58&subscene=0#rd) -- 360Quake空间测绘 - - [Kubernetes实践笔录](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247486341&idx=1&sn=55683e4cc6f9c281a744d98401ed2e7c&chksm=c37b8c6ef40c057817fbad27638e405ec65daa6154b594648e55ab2801df51cb7651da818d3b&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [数据出境安全评估办法：统筹安全与发展的中国实践](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529974&idx=1&sn=a2c24422cfd4b3f739ce0c38fd27fc83&chksm=c1e9f9a7f69e70b1120014385bcfc2dc8cdeccd5f8b9dede2dea1b53f2d5aae626a5483b4760&scene=58&subscene=0#rd) - - [防范数据出境安全风险 筑牢国家数据安全重要防线](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529974&idx=2&sn=c69064de47e606b42ed8316224f2788e&chksm=c1e9f9a7f69e70b1242bb4158695a265c25349abe6057a31e15a81aed2fd97e73b8f34fcaba7&scene=58&subscene=0#rd) - - [SolidBit 勒索软件进入 RaaS 领域并通过新变体瞄准游戏玩家和社交媒体用户](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529974&idx=3&sn=2d3f7757338300b49fd784e3fd992514&chksm=c1e9f9a7f69e70b1988fcd02ae32e8508e8a4a74fe88076e4e4cfa61a2dfacc587afbdc5db24&scene=58&subscene=0#rd) - - [员工被钓鱼，云通讯巨头Twilio客户数据遭泄露](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247529974&idx=4&sn=3ddc4da1d2dbe368c3ff773ed1f878e2&chksm=c1e9f9a7f69e70b10a38e5cf6a8f9b558ab206567824bcfce786d2cb1623864b92000847a037&scene=58&subscene=0#rd) -- 默安科技 - - [默咖时光 | 论“数字化”及“数字化转型”下的企业网络安全](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247492910&idx=1&sn=118c09ddd5932109299d1255fe9f4405&chksm=e93b120cde4c9b1aa258063a947d5e440ba3fa3a285e0e3db6b18e63ff57f6c46b11b400dfea&scene=58&subscene=0#rd) -- 情报分析师 - - [情报分析教程：情报研判红队分析法详解（附情报经典《红队手册》）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513672&idx=1&sn=38e2dec2b2c3eaae2eca5c7a97f33f5b&chksm=87168f43b0610655ed4cb3511f89ebcc03d072fc84afb0906718eff714f6026d619595499a68&scene=58&subscene=0#rd) - - [情报收集指南：利用开源工具进行全面的视频采集](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513672&idx=2&sn=87bd54ac256dc74db8acc914efa9510c&chksm=87168f43b06106555c1d72eb10adbbf702f50997a6a8e91ca2d601c1d13ed543b550020e2998&scene=58&subscene=0#rd) - - [【情报评估】俄罗斯的网络表现](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513672&idx=3&sn=4795cd693367f42f18949436e1b4720a&chksm=87168f43b0610655f099f06c49218ff686a4894ca5487f1a85b0966b5173fe32c8eb12c6003e&scene=58&subscene=0#rd) -- 网安寻路人 - - [中外数据出境安全评估的“意同而形不同”](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495711&idx=1&sn=b334b4417aeba6ac5a4193308be80c98&chksm=97e94df5a09ec4e326ce594213c30ad8b6f0700c9b4582cff0f9d5c29ff292e387be38dbfb1e&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [2022-08微软漏洞通告](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247508324&idx=1&sn=efb7bc67b4d6143aa7b8449055306d09&chksm=eb707f5bdc07f64de7316f698d374456b21b57f9ea95f8d3e964a041f8326ef05778b103f8d1&scene=58&subscene=0#rd) -- 中国信息安全 - - [齐向东出席2022世界5G大会：以“零事故”为目标护航5G融入千行百业](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163496&idx=1&sn=3f1ae38d48a03c6f0de94acdf2d1f143&chksm=8b5eea51bc296347c7b33bd8bd8b6d260e3265e98c8cc59823f76d74b6e39c83021d9382f7a5&scene=58&subscene=0#rd) - - [关注 | 银保监会：开展银行保险机构侵害个人信息权益乱象专项整治](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163496&idx=2&sn=2e88ae481be47f0ad72328bbbfe270ac&chksm=8b5eea51bc2963473e07956e02b40513aa3c883598042eaae1d723383ff76bbe085aaf95e591&scene=58&subscene=0#rd) - - [关注 | 公安部组织指挥对刷单类电信网络诈骗及相关黑灰产犯罪团伙开展集中收网](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163496&idx=3&sn=5f0f06a67477ac2ada6d5f3cca1027d5&chksm=8b5eea51bc2963472528c9dcdc9152dae52b5684201eb7c2c7f017a6a2c795f4e93a4a79fe24&scene=58&subscene=0#rd) - - [关注 | 院士、专家齐聚交流，内存安全技术研讨会成功举办](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163496&idx=4&sn=3303f891fee972fd84204f1f310f038f&chksm=8b5eea51bc2963478164c91835db264dd25dd7732794b39e6c4582041b21b1d4f45c3da26e8b&scene=58&subscene=0#rd) -- 极客公园 - - [败局复盘：当每日优鲜穿上红舞鞋](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963927&idx=1&sn=f65ae64c3b848f10fa4d8e3b2a0a1e8d&chksm=7e5479e14923f0f7ccd8232f899828891d444ce028ac0bafe7716000421bd7ab962304f7ed75&scene=58&subscene=0#rd) - - [拜登正式签署芯片法案；北京市消协约谈每日优鲜；奈飞 CEO 预测传统电视节目将在 5 至 10 年内消亡｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963808&idx=1&sn=d84c60013ccda326078619905585e362&chksm=7e547e564923f740af73a173ab43c3a4f4e9af734aab73ba426b07718e657adf0c983872f5e9&scene=58&subscene=0#rd) -- Checkmarx.com - - [Introducing Checkmarx API Security](https://checkmarx.com/blog/introducing-checkmarx-api-security/) - - [New Checkmarx API Security Empowers the Developer/AppSec Partnership to Secure the Entire API and Software Development Lifecycle](https://checkmarx.com/press-releases/new-checkmarx-api-security-empowers-the-developer-appsec-partnership-to-secure-the-entire-api-and-software-development-lifecycle/) -- 阿里安全响应中心 - - [白帽成长营｜ASRC打卡特别活动](https://mp.weixin.qq.com/s?__biz=MzIxMjEwNTc4NA==&mid=2652992724&idx=1&sn=901600eef4617b1c66184fc9c1b9a898&chksm=8c9efb83bbe97295343e1d87f4dab050b04cc0630863121c775aaa6f918a016f4363dce6bf25&scene=58&subscene=0#rd) -- 渊龙Sec安全团队 - - [白帽线下集结令！“大湾区白帽论坛”报名启动！](https://mp.weixin.qq.com/s?__biz=Mzg4NTY0MDg1Mg==&mid=2247484807&idx=1&sn=24dec53199fda11cd033ede2f3e842ca&chksm=cfa49e7cf8d3176ace2d74eb9623b7bc1fdf6a8d2059bf309051af2a3d426a8a63adae12be14&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】南昌一公司员工利用管理漏洞获利700余万](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012427&idx=1&sn=f05679de579fcad095e0434bfc05b209&chksm=f36f53cbc418dadd46220c3dafcb5260c88d1f289e7081b461c296439c9ce0bd616fd04ac5bc&scene=58&subscene=0#rd) - - [【安全圈】丹麦全国7-11便利店遭网络攻击关闭！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012427&idx=2&sn=ef1348f03f27a1f21100cfaf5011e9a2&chksm=f36f53cbc418dadd9b0e04adf1a78ced3bfeb0f2a085f8275742cce7fe088bdf234111976ff5&scene=58&subscene=0#rd) - - [【安全圈】Meta打击南亚滥用Facebook的网络攻击活动](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012427&idx=3&sn=57ed6d2f196d45d95d91938304f5c9dc&chksm=f36f53cbc418dadd257cca03b0b66c8b3cd7fb39f84c383461b5cec58949149962e0b2ac22e6&scene=58&subscene=0#rd) - - [【安全圈】周鸿祎称某超级大国曾入侵360没成功](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012427&idx=4&sn=58a25cded4f72c8c44e405d979addf2b&chksm=f36f53cbc418dadda183c8115c34f7a5a737d059489b3c4c6ed30fc4c8b390cdec9cd9d760e7&scene=58&subscene=0#rd) - - [【安全圈】Twilio披露数据泄露事件 起因是员工误入短信钓鱼陷阱](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012427&idx=5&sn=06e457cdf3796e9310e1723c8fdc3fa6&chksm=f36f53cbc418daddfd947f9f4aea9e5f69a79c533eb835288abb338c3a683edbee0b9c5ff71c&scene=58&subscene=0#rd) -- 安全牛 - - [区块链技术在金融行业的应用与风险管理](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117196&idx=1&sn=1050c42e75d37d6cf4a85987c5ca7498&chksm=bd14665f8a63ef498572190ac48c8f1de7145ebe33df71a249f8ee25c58f8724eee88f4696c1&scene=58&subscene=0#rd) - - [新一代网络安全防护体系的五个关键特征](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117196&idx=2&sn=9638f3272d47c7df7d97b90f46c0ccf3&chksm=bd14665f8a63ef4917c1d74684f1e4ca564b00c1040ac97e1d6eceb1f8d8df2b4a6d606264bd&scene=58&subscene=0#rd) - - [安全牛课堂 丨 聊聊注册CISP-PTS渗透测试专家那些事儿](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117196&idx=3&sn=3f248c12c50d11df11bd98a59cbe4c4f&chksm=bd14665f8a63ef4956e11e481e37b3ae008bbc3f508d1a4650324eb039c72e1284f5a71284dd&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [DrayTek 路由器爆远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547895&idx=1&sn=93f90d03d6e504c583339f273f69b217&chksm=e915ebcdde6262db69ffbde94137c4b8d783f071d43de32961fd686762ad577c1978ed262266&scene=58&subscene=0#rd) - - [纸上谈兵非极客！DEF CON 30 CHINA Party两大实战单元揭秘](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547895&idx=2&sn=c56e521b2b4e515514729ca81d4ad145&chksm=e915ebcdde6262dbc0281c8cb2e08b2af4d082c4f24a7f51c2f6a3972615760c1ab81943aca9&scene=58&subscene=0#rd) - - [CloudGuard Spectral 在 PyPI上检测到多个恶意包](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247547895&idx=3&sn=292ef094570345fc3fc86680d22e2893&chksm=e915ebcdde6262db0964bccbe6aca588b86f3b5d78a81bd507c9afcd7e28634811114fc8b217&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于微软8月安全更新中重要漏洞的风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495737&idx=1&sn=91d6a514c349a96a5292e13a1bc88d7d&chksm=ce96bd07f9e13411213f9ee71f4dce47ecbfd84584294ce3da003b35c6edd74f156fc0cf68f6&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Aug.10th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495737&idx=2&sn=3419628b0255089d018a688cb56918be&chksm=ce96bd07f9e134118fbf03650da5b3c7c8249c9cc9e27fb32d1db618632f47c867973a3c1901&scene=58&subscene=0#rd) -- 绿盟科技CERT - - [【安全更新】微软8月安全更新多个产品高危漏洞通告](https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247487458&idx=1&sn=ffcca5f2a5186e2fd492ce9b96b14fc0&chksm=c2c658e9f5b1d1ff5267e2acd785efdc592f692eb77737aeaa68ea4377943049a3dc570c8ce7&scene=58&subscene=0#rd) -- Wallarm - - [Wallarm at Black Hat USA 2022](https://lab.wallarm.com/wallarm-at-black-hat-usa-2022/) diff --git a/archive/2022/2022-08-12.md b/archive/2022/2022-08-12.md deleted file mode 100644 index 233a4868cb..0000000000 --- a/archive/2022/2022-08-12.md +++ /dev/null @@ -1,246 +0,0 @@ -# 每日安全资讯（2022-08-12） - -- HackerOne Hacker Activity - - [Disabling context isolation, nodeIntegrationInSubFrames using an unauthorised frame.](https://hackerone.com/reports/1647287) - - [Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php](https://hackerone.com/reports/1417288) - - [Wordpress Users Disclosure (/wp-json/wp/v2/users/)](https://hackerone.com/reports/1663363) - - [fix(security):Path Traversal Bug](https://hackerone.com/reports/1664244) - - [Disable xmlrpc.php file](https://hackerone.com/reports/712321) - - [Redirection in Repeater & Intruder Tab](https://hackerone.com/reports/1541301) -- Twitter @Nicolas Krassas - - [PowerHuntShares is designed to automatically inventory, analyze, and report excessive privilege assigned to SMB shares on Active Directory domain join...](https://twitter.com/Dinosn/status/1557599622897586176) - - [BlueHound combines information about user permissions, network access and unpatched vulnerabilities to reveal the paths attackers would take if they w...](https://twitter.com/Dinosn/status/1557599574147174400) - - [Packj - Large-Scale Security Analysis Platform To Detect Malicious/Risky Open-Source Packages](https://twitter.com/Dinosn/status/1557599410485354497) - - [CVE-2022-35741 Apache CloudStack SAML XXE注入](https://twitter.com/Dinosn/status/1557599185087651842) - - [Former Twitter Employee Convicted As Saudi Spy](https://twitter.com/Dinosn/status/1557597979271434240) - - [Hunting webshell with NeoPI](https://twitter.com/Dinosn/status/1557597874703269889) - - [Microsoft 365 outage triggered by Meraki firewall false positive](https://twitter.com/Dinosn/status/1557597809465085952) - - [Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925](https://twitter.com/Dinosn/status/1557597731182477316) - - [Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling](https://twitter.com/Dinosn/status/1557597560130486272) - - [AWSGoat is a vulnerable by design infrastructure on AWS featuring the latest released OWASP Top 10 web application security risks (2021) and other mis...](https://twitter.com/Dinosn/status/1557597517361168385) - - [Automotive supplier breached by 3 ransomware gangs in 2 weeks](https://twitter.com/Dinosn/status/1557597485073371141) - - [How Cisco got hacked - insights on what the attackers did](https://twitter.com/Dinosn/status/1557596876614111233) - - [7-Eleven Denmark confirms ransomware attack behind store closures](https://twitter.com/Dinosn/status/1557596735106695168) - - [The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)](https://twitter.com/Dinosn/status/1557594406420713473) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Matrimonial PHP Script 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022080044) - - [Sophos XG115w Firewall 17.0.10 MR-10 Authentication Bypass](https://cxsecurity.com/issue/WLB-2022080043) - - [AirSpot 5410 0.3.4.1-4 Remote Command Injection](https://cxsecurity.com/issue/WLB-2022080042) - - [Fiberhome AN5506-02-B Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022080041) - - [Intelbras ATA 200 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022080040) -- unSafe.sh - 不安全 - - [Day 2 of Black Hat USA | People vs. Cybersecurity – Exploring Enhanced Email Protection and Surveillance Abuse](https://buaq.net/go-121780.html) - - [Sample Downloader Package](https://buaq.net/go-121797.html) - - [Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study](https://buaq.net/go-121795.html) - - [AppSec Decoded: An introduction to the Synopsys Cybersecurity Research Center](https://buaq.net/go-121781.html) - - [Mind the Gap – Security at the IT/OT Boundary](https://buaq.net/go-121778.html) - - [SnakeYaml反序列化](https://buaq.net/go-121777.html) - - [IAM Whoever I Say IAM :: Infiltrating VMWare Workspace ONE Access Using a 0-Click Exploit](https://buaq.net/go-121799.html) -- Recent Commits to cve:main - - [Merge pull request #50 from trickest/feat/hackerone_source](https://github.com/trickest/cve/commit/5684f626e77634f56894790fa7ce2f332820d5ad) - - [Merge branch 'main' into feat/hackerone_source](https://github.com/trickest/cve/commit/8d3c8c93d145e7a95e042bddbea9661b12c9252b) - - [Update Thu Aug 11 11:59:40 UTC 2022](https://github.com/trickest/cve/commit/7a28a67be7b02473f668dba443f937a17a124425) - - [Add hackerone source as references.txt](https://github.com/trickest/cve/commit/7b682f38ea0ee4836f8cc22a08570032c30eaf7d) -- Files ≈ Packet Storm - - [Fiberhome AN5506-02-B Cross Site Scripting](https://packetstormsecurity.com/files/168065/fiberhomean550602b-xss.txt) - - [Intelbras ATA 200 Cross Site Scripting](https://packetstormsecurity.com/files/168064/intelbrasata200-xss.txt) - - [Ubuntu Security Notice USN-5556-1](https://packetstormsecurity.com/files/168063/USN-5556-1.txt) - - [Gentoo Linux Security Advisory 202208-16](https://packetstormsecurity.com/files/168062/glsa-202208-16.txt) - - [Gentoo Linux Security Advisory 202208-18](https://packetstormsecurity.com/files/168061/glsa-202208-18.txt) - - [Gentoo Linux Security Advisory 202208-19](https://packetstormsecurity.com/files/168060/glsa-202208-19.txt) - - [Gentoo Linux Security Advisory 202208-15](https://packetstormsecurity.com/files/168059/glsa-202208-15.txt) - - [Gentoo Linux Security Advisory 202208-17](https://packetstormsecurity.com/files/168058/glsa-202208-17.txt) - - [Ubuntu Security Notice USN-5567-1](https://packetstormsecurity.com/files/168057/USN-5567-1.txt) - - [Ubuntu Security Notice USN-5566-1](https://packetstormsecurity.com/files/168056/USN-5566-1.txt) - - [Ubuntu Security Notice USN-5563-1](https://packetstormsecurity.com/files/168055/USN-5563-1.txt) - - [Red Hat Security Advisory 2022-6040-01](https://packetstormsecurity.com/files/168054/RHSA-2022-6040-01.txt) - - [Red Hat Security Advisory 2022-6042-01](https://packetstormsecurity.com/files/168053/RHSA-2022-6042-01.txt) - - [Red Hat Security Advisory 2022-6043-01](https://packetstormsecurity.com/files/168052/RHSA-2022-6043-01.txt) - - [Ubuntu Security Notice USN-5565-1](https://packetstormsecurity.com/files/168051/USN-5565-1.txt) - - [Ubuntu Security Notice USN-5564-1](https://packetstormsecurity.com/files/168050/USN-5564-1.txt) -- 安全客-有思想的安全新媒体 - - [活动 | 2022字节跳动“安全范儿”高校挑战赛报名开启！三大赛道全面升级！](https://www.anquanke.com/post/id/277807) - - [真刑啊！男子破解博彩网站漏洞，每月“薅羊毛”10多万，凭技术走上歪路](https://www.anquanke.com/post/id/277462) - - [Xposed框架食用指南](https://www.anquanke.com/post/id/276896) - - [2022年7月勒索病毒态势分析](https://www.anquanke.com/post/id/277768) - - [不明人士向名人发送0.1 ETH 疑似抗议美国制裁混币器Tornado](https://www.anquanke.com/post/id/277771) - - [2022-08 补丁日: 微软多个漏洞安全更新通告](https://www.anquanke.com/post/id/277767) -- 先知安全技术社区 - - [SnakeYaml反序列化](https://xz.aliyun.com/t/11599) -- Trustwave Blog - - [Seven Steps the Healthcare Industry Must Take to Protect Against Cyberattacks](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/seven-steps-the-healthcare-industry-must-take-to-protect-against-cyberattacks/) -- Sucuri Blog - - [The Importance of Website Logs](https://blog.sucuri.net/2022/08/importance-of-website-logs-for-security.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [预测元宇宙威胁：它会变得更糟糕吗？](https://www.4hou.com/posts/wgZ1) - - [如何发现信标（一）](https://www.4hou.com/posts/kMDE) - - [DEF CON 30 CHINA Party元宇宙探索指南：这10件事儿必打卡！](https://www.4hou.com/posts/KEzY) - - [信息隐蔽分类及特点](https://www.4hou.com/posts/xj8q) - - [构建数据安全防护的“新基建”——数据运行环境安全保护](https://www.4hou.com/posts/yk7P) - - [什么是网络安全？6个特性又是什么？](https://www.4hou.com/posts/zlQm) - - [银保监会开展专项整治，对侵害个人信息权益说不！](https://www.4hou.com/posts/GKz8) -- Envato Tuts+ Code - Mobile Development - - [Easier React Native Development With Expo](https://code.tutsplus.com/tutorials/easier-react-native-development-with-expo--cms-30546) - - [Android From Scratch: How to Run Your Application on a Physical Device](https://code.tutsplus.com/tutorials/android-from-scratch-how-to-run-your-application-on-a-physical-device--cms-26219) -- 跳跳糖 - 安全与分享社区 - - [The Poor Man's Obfuscator](https://tttang.com/archive/1697/) -- SecWiki News - - [SecWiki News 2022-08-11 Review](http://www.sec-wiki.com/?2022-08-11) -- Security Boulevard - - [Detecting Follina (CVE-2022-30190): Microsoft Office Zero-Day Exploit](https://securityboulevard.com/2022/08/detecting-follina-cve-2022-30190-microsoft-office-zero-day-exploit/) - - [Hybrid Security Threats and Malign Influence Campaigns](https://securityboulevard.com/2022/08/hybrid-security-threats-and-malign-influence-campaigns/) - - [Three UK-based Nigerian BEC Scammers Used Construction Intelligence Service to Target Victims](https://securityboulevard.com/2022/08/three-uk-based-nigerian-bec-scammers-used-construction-intelligence-service-to-target-victims/) - - [Applying Identity to DevSecOps Processes](https://securityboulevard.com/2022/08/applying-identity-to-devsecops-processes/) - - [Aspen Security Forum 2022 – Moderator: David Sanger – Technology and National Security](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-david-sanger-technology-and-national-security/) - - [73 NPS—How to Get a High Net Promoter Score in Bot Protection](https://securityboulevard.com/2022/08/73-nps-how-to-get-a-high-net-promoter-score-in-bot-protection/) - - [Excited to be Taking Arkose Labs to the Next Stage of Growth](https://securityboulevard.com/2022/08/excited-to-be-taking-arkose-labs-to-the-next-stage-of-growth/) - - [Purple Knight Proves Essential for Securing AD at Southern Utah University](https://securityboulevard.com/2022/08/purple-knight-proves-essential-for-securing-ad-at-southern-utah-university/) - - [The state of cybersecurity: ‘Things are going to get worse before they get better,’ Krebs tells Black Hat 2022](https://securityboulevard.com/2022/08/the-state-of-cybersecurity-things-are-going-to-get-worse-before-they-get-better-krebs-tells-black-hat-2022/) -- 先知安全技术社区 - - [SnakeYaml反序列化](https://xz.aliyun.com/t/11599) -- Sploitus.com Exploits RSS Feed - - [Intelbras ATA 200 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168064&utm_source=rss&utm_medium=rss) - - [Fiberhome AN5506-02-B Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168065&utm_source=rss&utm_medium=rss) - - [Exploit for Use After Free in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=4C3A6395-A40A-538E-BE67-F3B2B7B887C3&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Encoding or Escaping of Output in Webmin exploit](https://sploitus.com/exploit?id=49548C54-8CD8-566E-830C-0A2EEAC7A6AC&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-31262 exploit](https://sploitus.com/exploit?id=C4AB29B4-E500-57EF-8CF0-D831B7B0C5B1&utm_source=rss&utm_medium=rss) -- 安全脉搏 - - [远控免杀专题(71)-Donut免杀任意可执行文件(VT免杀率30-67)](https://www.secpulse.com/archives/185179.html) - - [从0开始ByPass之Mysql注入篇](https://www.secpulse.com/archives/185166.html) - - [【Ya！一刻】正式上线](https://www.secpulse.com/archives/185158.html) - - [数据库注入提权总结（下）](https://www.secpulse.com/archives/185136.html) -- Cerbero Blog - - [Sample Downloader Package](https://blog.cerbero.io/?p=2462) -- Securelist - - [OpenTIP, command line edition](https://securelist.com/opentip-command-line-edition/107109/) -- Fox-IT International blog - - [Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study](https://blog.fox-it.com/2022/08/11/detecting-dns-implants-old-kitten-new-tricks-a-saitama-case-study/) -- GuidePoint Security - - [GRIT Ransomware Report: July 2022](https://www.guidepointsecurity.com/blog/grit-ransomware-report-july-2022/) -- blog.avast.com EN - - [Digital milestones for elementary schoolers](https://blog.avast.com/digital-milestones-elementary-school) -- Forcepoint - - [Mind the Gap – Security at the IT/OT Boundary](https://www.forcepoint.com/blog/insights/security-it-ot-boundary) -- SentinelOne - - [Day 2 of Black Hat USA | People vs. Cybersecurity – Exploring Enhanced Email Protection and Surveillance Abuse](https://www.sentinelone.com/blog/day-2-of-black-hat-usa-people-vs-cybersecurity-exploring-enhanced-email-protection-and-surveillance-abuse/) -- Reverse Engineering - - [Decomperson: How Humans Decompile and What We Can Learn From It](https://www.reddit.com/r/ReverseEngineering/comments/wm4sbl/decomperson_how_humans_decompile_and_what_we_can/) - - [From Oscilloscope to Wireshark - A UDP Story](https://www.reddit.com/r/ReverseEngineering/comments/wlzyiq/from_oscilloscope_to_wireshark_a_udp_story/) - - [OFRAK (Open Firmware Reverse Analysis Konsole): a recently released new tool for analysing embedded firmware](https://www.reddit.com/r/ReverseEngineering/comments/wllljb/ofrak_open_firmware_reverse_analysis_konsole_a/) - - [Django web applications with enabled Debug Mode, DB accounts information and API Keys of more than 3,100 applications were exposed on internet.](https://www.reddit.com/r/ReverseEngineering/comments/wll1c3/django_web_applications_with_enabled_debug_mode/) -- SAP Blogs - - [wdi5 dialect in UI5’s Test Recorder](https://blogs.sap.com/2022/08/11/wdi5-dialect-in-ui5s-test-recorder/) - - [Configuring SAP Master Data Integration service for Business Partner replication using SOAP API’s – 2022](https://blogs.sap.com/2022/08/11/configuring-sap-master-data-integration-service-for-business-partner-replication-using-soap-apis-2022/) - - [Sending S/4HANA Cloud eDocument File Data using BTP Cloud Integration](https://blogs.sap.com/2022/08/11/sending-s-4hana-cloud-edocument-file-data-using-btp-cloud-integration/) - - [SAP BTP and AWS: driving more value from your SAP ERP journey to the cloud](https://blogs.sap.com/2022/08/11/sap-btp-and-aws-driving-more-value-from-your-sap-erp-journey-to-the-cloud/) - - [Flex Working at SAP](https://blogs.sap.com/2022/08/11/flex-working-at-sap/) - - [Secondary School Students Visit SAP Walldorf](https://blogs.sap.com/2022/08/11/secondary-school-students-visit-sap-walldorf/) - - [Agenda highlights of upcoming International Conference for Chemicals](https://blogs.sap.com/2022/08/11/agenda-highlights-of-upcoming-international-conference-for-chemicals/) - - [Asynchronous microservices and its impact on UX](https://blogs.sap.com/2022/08/11/asynchronous-microservices-and-its-impact-on-ux/) - - [All about Excel uploads for Tasks, Requirements and Defects in SAP Cloud ALM](https://blogs.sap.com/2022/08/11/all-about-excel-uploads-and-updates-for-tasks-requirements-and-defects-in-sap-cloud-alm/) -- Malwarebytes Labs - - [Slack flaw exposed users' hashed passwords](https://www.malwarebytes.com/blog/news/2022/08/slack-flaw-exposed-users-hashed-passwords) -- Application Security Blog - - [AppSec Decoded: An introduction to the Synopsys Cybersecurity Research Center](https://www.synopsys.com/blogs/software-security/appsec-decoded-cybersecurity-research-center/) -- Sucuri Blog - - [The Importance of Website Logs](https://blog.sucuri.net/2022/08/importance-of-website-logs-for-security.html) -- Microsoft Security Response Center - - [Microsoft Bug Bounty Programs Year in Review: $13.7M in Rewards](https://msrc-blog.microsoft.com/2022/08/11/microsoft-bug-bounty-programs-year-in-review-13-7-in-rewards/) -- The Daily Swig | Cybersecurity news and views - - [Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA](https://portswigger.net/daily-swig/browser-powered-desync-new-class-of-http-request-smuggling-attacks-showcased-at-black-hat-usa) - - [ReNgine upgrade: New subscan feature, PDF reports, expanded toolbox showcased at Black Hat USA](https://portswigger.net/daily-swig/rengine-upgrade-new-subscan-feature-pdf-reports-expanded-toolbox-showcased-at-black-hat-usa) - - [Black Hat USA: Deliberately vulnerable AWS, Azure cloud infrastructure is a pen tester’s playground](https://portswigger.net/daily-swig/black-hat-usa-deliberately-vulnerable-aws-azure-cloud-infrastructure-is-a-pen-testers-playground) - - [Black Hat USA: Log4j de-obfuscator Ox4Shell ‘dramatically’ reduces analysis time](https://portswigger.net/daily-swig/black-hat-usa-log4j-de-obfuscator-ox4shell-dramatically-reduces-analysis-time) -- Source Incite - - [IAM Whoever I Say IAM :: Infiltrating VMWare Workspace ONE Access Using a 0-Click Exploit](https://srcincite.io/blog/2022/08/11/i-am-whoever-i-say-i-am-infiltrating-vmware-workspace-one-access-using-a-0-click-exploit.html) -- 君哥的体历 - - [论“数字化”及“数字化转型”背景下企业信息安全建设路径](https://mp.weixin.qq.com/s?__biz=MzI2MjQ1NTA4MA==&mid=2247488719&idx=1&sn=4da3630877935b8ae4265e34c49820f0&chksm=ea4bbe88dd3c379e6a1fb636b51aa677b1e1acb8d4fa515e4ffd0d11fb810c65ad8d0b720ddd&scene=58&subscene=0#rd) -- 互联网安全内参 - - [网络巨头思科遭数据勒索：VPN访问权限被窃取，2.8GB数据泄露](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505152&idx=1&sn=5ffff5ec24e52fb82408e0abd7f2c50f&chksm=ebfa9220dc8d1b36f288c38ff8b5e8a9ca9dd2d704405128b938f852bb3e3d35403f3f1b6355&scene=58&subscene=0#rd) - - [美的工厂多处电脑中勒索病毒？官方称与事实不符](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505152&idx=2&sn=42c422be694f70a917fd1e4640b3986f&chksm=ebfa9220dc8d1b3668d2cf91e8054d0991da86a72b03bb29843604d98ce677ad755d65edb5a0&scene=58&subscene=0#rd) - - [台湾大学、电视台等多家机构被网络攻击](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505152&idx=3&sn=a4a6e8cb452facaa797ad7aec76311cd&chksm=ebfa9220dc8d1b3609d12b9c6881fcb9d3c7d5ab33ce6edecc7adc09f32093fbf8e91465f2eb&scene=58&subscene=0#rd) - - [VMware vRealize Operations多个漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505152&idx=4&sn=a769ee5add4ccdd2ba325772f6493061&chksm=ebfa9220dc8d1b368aa7e5d1386f2f2bf4f06dd67f14ec1c437b98f74663d07fed3fd2fc5286&scene=58&subscene=0#rd) -- 看雪学院 - - [CVE-2018-8453提权漏洞学习笔记](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461724&idx=1&sn=7d6ba28997f645f74b3c8d692fb7dd9f&chksm=b18e169686f99f80223eeb9691f49b066081214ac3fbc568ffdd0274b7330902071b9d2f5ae0&scene=58&subscene=0#rd) - - [文件五重加密！Sophos首次发现三种勒索软件同时攻击同一个网络](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461724&idx=2&sn=a0186e05572726c3b941af411dc7fe39&chksm=b18e169686f99f80f60dfb9ffdb71ba92b6d6198f2377b9322edd4fa73e22b2a4c485484e44c&scene=58&subscene=0#rd) - - [实战CVE漏洞分析与防范（第一季）](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458461724&idx=3&sn=b01accf72a94dd6b078b746f74279f73&chksm=b18e169686f99f800a393c906225f4048977ee3cf48008688649eb86e1063e11ef9a69242919&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [Faraday Community - Open Source Penetration Testing and Vulnerability Management Platform](http://www.kitploit.com/2022/08/faraday-community-open-source.html) - - [Kali Linux 2022.3 - Penetration Testing and Ethical Hacking Linux Distribution](http://www.kitploit.com/2022/08/kali-linux-20223-penetration-testing.html) -- 腾讯玄武实验室 - - [每日安全动态推送(08-11)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958618&idx=1&sn=0ddabfc317353c36259fd6be20d232e0&chksm=8baecdc5bcd944d327d1fe2d68fb3b372d44f130593d6efde0dbc5d8e7c5ee66058740b8f9a4&scene=58&subscene=0#rd) -- Tide安全团队 - - [远控免杀专题(74)-基于Go的条件触发式免杀](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247500018&idx=1&sn=eb0ef9f8334f6b43e2e895168b48f058&chksm=ce5de293f92a6b856655be0fe1f8117f731281bb9b5b30303a8e9f0a5d522d807a51e36781c3&scene=58&subscene=0#rd) -- 三六零CERT - - [2022年7月勒索病毒态势分析](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491238&idx=1&sn=a4764301bde8ffb26773d1bd8cd48e95&chksm=fe251ba7c95292b12918807ea73ce01fe16508b22a6a5dd1db6d0d66c76e257ca0ca447066b8&scene=58&subscene=0#rd) - - [安全日报（2022.08.11）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491238&idx=2&sn=c6d61de599ca5d61c68c2b396bfaf36e&chksm=fe251ba7c95292b129a5e0ceecf1c11e2eae48cbbd3653ef2f7eaf4bc1d7d624331c777c6038&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】万字长文：盘点2022全球10大数据泄漏事件（文末安全圈粉丝赠书福利）](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012756&idx=1&sn=4b58e42b117afe893c8f8170fe98e32b&chksm=f36fac94c418258271ae5f367b3a1f7d0e50caec6efb66f03743e2cb5ac297767b994fa3a1ff&scene=58&subscene=0#rd) - - [【安全圈】国家网信办重拳出击 虚拟货币炒作该“凉”了！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012756&idx=2&sn=2c3429b4c6c133ede0fba6384b87b72a&chksm=f36fac94c4182582db02432c06fd9f58431088979656a492afbba8a94371ada09e22d1fee318&scene=58&subscene=0#rd) - - [【安全圈】网络攻击致使英国医疗急救热线 “120” 发生重大中断](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012756&idx=3&sn=72da32e046949ad3988a4106797c8be9&chksm=f36fac94c4182582c23b7e45d52611b93881c1f18f52959748e046760436b073ae185916fabf&scene=58&subscene=0#rd) - - [【安全圈】警惕！黑客正在从分类信息网站上窃取信用卡](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012756&idx=4&sn=89f7607e61b4aebc11f3d24214760ff7&chksm=f36fac94c4182582b20585676cb4a8f2a115f9c620bb76efc6b311b208a0cbdc906bcfba9e06&scene=58&subscene=0#rd) - - [【安全圈】黑客利用域名开放重导向漏洞，发送骗取M365凭证的信件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012756&idx=5&sn=193718d31969d1d6318c050364810afc&chksm=f36fac94c4182582f22a1acc0703473cfc657d17fd9827ce601db45d9c025414ecb6ed07ce2f&scene=58&subscene=0#rd) - - [【安全圈】PyPI 中发现新恶意 Python 库](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652012756&idx=6&sn=f4f48016ca4398a1f7b7982b11579df8&chksm=f36fac94c418258255af4860fda095fb1ba0153956c97192d39b17bf2742f0ad9e9e8cecd673&scene=58&subscene=0#rd) -- 火线安全平台 - - [落地实战笔记——IAST融入DevSecOps的最佳实践](https://mp.weixin.qq.com/s?__biz=MzU4MjEwNzMzMg==&mid=2247491801&idx=1&sn=4bd93a3e0e9d1ff1757c4cfaf7f12b90&chksm=fdbfc972cac840642fc6da072c6d29ca8a838d8a70dd4564b6f0839a00a491cb675051beaedc&scene=58&subscene=0#rd) -- 情报分析师 - - [【爆料】照片显示佩洛西的儿子保罗以不知名客人的身份随行窜台，捞金数十亿美元](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513877&idx=1&sn=7249f942615494c6470765afd139203e&chksm=87168f9eb061068846a574042966d399166fc3624e0e4c41a240d1008b33301766e59adf2662&scene=58&subscene=0#rd) - - [【最新发布】《美中之间系统性冲突的情景》（智库报告共156页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513877&idx=2&sn=b898331f5ad5ee8830c7e256fd89acd7&chksm=87168f9eb0610688142daeda64457da479131126b4c81c43826fc34e6af51515e771d22bd527&scene=58&subscene=0#rd) - - [OSINT 工具推荐](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513877&idx=3&sn=498f9a8fc252e7ee9a80fc2029178697&chksm=87168f9eb0610688af6cdffc8a2db415152949c43dabef0ce10b7bf258f331edb8b3848169f4&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [来！秋招投递字节跳动安全与风控，快人一步拿offer！](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489295&idx=1&sn=4fe450db7518b803cd69123203cc5a4d&chksm=fa9eec59cde9654fe91ca4cdaec30ea100f51f99b2269d02660d738d135cad8548bf9dac8e0c&scene=58&subscene=0#rd) -- 吾爱破解论坛 - - [【原创】激光雕刻切割控制系统 V7.92.2 网络通信添加状态显示](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651138113&idx=1&sn=b45fb2c082562a44e2d14460f53c2964&chksm=bd50b8158a273103f0b776598448e994456f698c5e1afc4574cf042ea1fb5e131e82fdadddc8&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [数据出境评估：为全球数据跨境流动贡献中国智慧和中国方案](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530015&idx=1&sn=e0d0d1920d336a6da1e31a23028b1bdc&chksm=c1e9fa4ef69e7358df4d7281c0afb23123c00a01c6c49b0f6d55ddcb4f8523e4dff05d81d7bd&scene=58&subscene=0#rd) - - [Black Hat 2022上最值得关注的十大议题](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530015&idx=2&sn=3c75418e3dab3746966874ed8b1dfdec&chksm=c1e9fa4ef69e7358eb2c0cb5081d6f976fb21c1a0078064bb0ef03fb9791111ce3e7f3356ff3&scene=58&subscene=0#rd) - - [DrayTek 路由器爆远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530015&idx=3&sn=99deb500f6cb30b84e55c5ea79d0295b&chksm=c1e9fa4ef69e7358935b77cdca673c0482418be794a9fca7e52712b91344cc40efe8e8484a58&scene=58&subscene=0#rd) - - [警惕！黑客正在从分类信息网站上窃取信用卡](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530015&idx=4&sn=629b142a1e000631c8d4e5c403ec1618&chksm=c1e9fa4ef69e735833d9a6b49e2ac0cb6e4825b558a0c75b67a8995a65fd035443c1cf06225a&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [密码学赛题复现：2021-CryptoCTF（二）](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495634&idx=1&sn=2667a54fafa67a8ec6888265bc6c113a&chksm=fa523a6ccd25b37a64085f117f3e92cd9179c37875dc3459701260314944f4e9c7d6c79575a4&scene=58&subscene=0#rd) -- 极客公园 - - [苹果停止「买买买」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964027&idx=1&sn=0dd4a66e1908c2413515d6846899d488&chksm=7e54790d4923f01b838f256b1f5617e5f6334501284ba4bffdd17603f5c0c20e63ba37d786d2&scene=58&subscene=0#rd) - - [美国爆火的电动滑板车，如何重复 ofo 败局](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963981&idx=1&sn=484fdc0985754f1bdc47f4ffd2a05057&chksm=7e54793b4923f02daa36918da7f5dd02a018a1ee4aca3b4bb40284133c5c747e3bdb70f20347&scene=58&subscene=0#rd) - - [马斯克套现 68.9 亿美元；黄仁勋：不裁员，会加薪；中国今年将发射超 50 颗商业卫星｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652963980&idx=1&sn=0a4a7a7d76ee60a64bc0c3a3495dece0&chksm=7e54793a4923f02ca81bbb1779181ff8dd9433a636564f9f8486bf8b9690b303b9fdfb6cfe11&scene=58&subscene=0#rd) -- 星阑科技 - - [星阑科技再获认可，荣登《数字靶场能力点阵图2022》](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494871&idx=1&sn=00de3b7f4d91d41505c56d4d16932bec&chksm=c007414bf770c85dbaaf7dc211e0a28f35cba916be450312e2c1d0d836d34c67c6c2ce206a68&scene=58&subscene=0#rd) -- 网安杂谈 - - [讲座信息：《IM数据解读与模型分析》](https://mp.weixin.qq.com/s?__biz=MzAwMTMzMDUwNg==&mid=2650886946&idx=1&sn=aa5b4ea08d5db8a954beb43379a2ce1b&chksm=812eaf07b6592611df35554ba68558384e047def2116b2d975a9018604207a86f5bb01e92673&scene=58&subscene=0#rd) -- 乐枕迭代日志 - - [安全厂商刷新SaaS圈最快增长记录，Wiz做了什么](https://mp.weixin.qq.com/s?__biz=MzA3NTMyNDg3OQ==&mid=2652519376&idx=1&sn=8dfe2929fb0117ff36ccfb29476898dd&chksm=849cd770b3eb5e667ec1b3707cf01f1eed2540f944563d2bedf8b3909ef99f0a90067f1d6c6e&scene=58&subscene=0#rd) -- 小米安全中心 - - [【第十二期】手机守护计划倒计时18天！](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247514122&idx=1&sn=2ad17e927c10beafca98c534c7c01749&chksm=ea839e9fddf41789ccbe5e906cbd1807e708bc06ccb8ea884d79b23e92d3e3729dff9176eed2&scene=58&subscene=0#rd) -- 数世咨询 - - [来了！第二届数字安全大会亮点前瞻](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494604&idx=1&sn=86c30c100d2b70c2f51cbc2afbfca1c9&chksm=c1449971f6331067880bfcf56720a647dd97e859a578f3df387495b1a7526a4611f735af6708&scene=58&subscene=0#rd) - - [如何做一名机器学习工程师？](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494604&idx=2&sn=2b7f7cdbacc757958772cbac1cad9815&chksm=c1449971f6331067298d87bcaed0c17296d8a17374ade9a3531be15444ef1d8bedd15061d0c9&scene=58&subscene=0#rd) -- OPPO安全应急响应中心 - - [【重大更新】OSRC评分规则升级啦，奖金提升不止一点点……](https://mp.weixin.qq.com/s?__biz=MzUyNzc4Mzk3MQ==&mid=2247490083&idx=1&sn=187301f6b4546bb02789e4aafa522f80&chksm=fa7b1b6fcd0c92794f4e0b18a529535484200a2917ae3db56d08ad6cfd2266ad0034e94268b7&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [前端监控系列1｜ 字节的前端监控 SDK 是怎样设计的](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497407&idx=1&sn=217376a862e10ca96f7fc6c615429cb1&chksm=e9d33d5ddea4b44bfc654fdf311ae0230c67e396edd729a89aac655d5fb1a444ee9ba51c571b&scene=58&subscene=0#rd) - - [2022 字节跳动安全范儿“高校挑战赛”开启！20 万奖励 30+字节 offer 等你来战！](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497407&idx=2&sn=d679ef1829293b0546dcdfd487b93e07&chksm=e9d33d5ddea4b44be6d69024b134ad5a77787ac98f67acdad49211d6bebb728d0e61e0fbd83e&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-08-10 Cooper](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492272&idx=1&sn=6aa0f9524deb7df44284b05d729f87da&chksm=c063cc69f714457f4f713b0ff62755b23c747adab3ed7ada722fe6352ba5910084447de33835&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Aug.11th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495739&idx=1&sn=e6987bb6e153dff8eae609538faf23f8&chksm=ce96bd05f9e134132a1d8e1a96ee5bb67935746b935f461fb4200f014c53a18962ea636e89b2&scene=58&subscene=0#rd) -- 美团技术团队 - - [提升资源利用率与保障服务质量，鱼与熊掌不可兼得？](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651770506&idx=1&sn=22f31e7806a7e20beab66156f42ff6cc&chksm=bd1217c78a659ed1ec848a5e86048955dbb5d49ba844b4500f457fa574bb4efdc8107fb7177c&scene=58&subscene=0#rd) - - [美团搜索粗排优化的探索与实践](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651770506&idx=2&sn=53df7e69852b53b8e9a78704250a3f59&chksm=bd1217c78a659ed1fe25caf2f387dd5adf7543c0d18aa9404a68dedc4393d3f75bdbc08d0097&scene=58&subscene=0#rd) - - [报名 | 美团技术沙龙：基于领域驱动设计（DDD）的架构演进和实践](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651770506&idx=3&sn=62f6b6b124520a19211f43a4214ebcac&chksm=bd1217c78a659ed176494036a95ebde3a721b2612d1769d80908cf90cdb8dae8a7ce2b885737&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 数据出境评估：为全球数据跨境流动贡献中国智慧和中国方案](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530422&idx=1&sn=123bf2dee4c4f6856a7f61d2e37072b6&chksm=fa93c177cde44861ef35ec5bbead06157e4a6bfc0cb35c19b54764f06ddf8374e9b596691a8c&scene=58&subscene=0#rd) - - [CISO必须知道的安全管理五大基线](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530422&idx=2&sn=c086c1b74af981836da6e703e2fdd441&chksm=fa93c177cde44861e1c990ef549446052f60ba151e44b9708355ea2938fe9e820e66e07b49ee&scene=58&subscene=0#rd) - - [CISA 警告：2021 年的顶级恶意软件已经使用多年](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530422&idx=3&sn=f45766f4d317a99d6ca55aa48a81825d&chksm=fa93c177cde448616499640d1208fbaf01039f8606b6030132b82055f6060d0ed641638ceda7&scene=58&subscene=0#rd) - - [阿卡迈阻止了欧洲最大型DDoS攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530422&idx=4&sn=67256ebe9a9468cc109b3b59c0630636&chksm=fa93c177cde44861971fa731fdd4e07968f3ca0600c1f5f509c1f2334f2e5edd019a554a70ca&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [专家观点|强化金融数据安全治理 夯实金融行业发展基础](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491724&idx=1&sn=ea35fdbe40896ba492e6a99f30434fd3&chksm=feb6619fc9c1e889de99d2b37e78dbb8ff87033efe85db451dbbf9e800ed9bee89780ef5ac89&scene=58&subscene=0#rd) - - [打击网络犯罪的新武器：隔离和清零](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491724&idx=2&sn=c0d932b117a8172a5bb9bcdfe25a64f2&chksm=feb6619fc9c1e889e81fe073ad8002b4a61d86474f5bec9cbb65992fda8531e12fb5ca095a03&scene=58&subscene=0#rd) -- 青藤技术服务 - - [“阎罗王”勒索再现！思科中招过程披露](https://mp.weixin.qq.com/s?__biz=MzUyOTkwNTQ5Mg==&mid=2247485896&idx=1&sn=5e6d949972def73bb8805aaa62370ca8&chksm=fa58abf3cd2f22e558d63e2cb0b3b995e2f3ce847e9691d85d7fdf69888941281d705d444477&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [预测元宇宙威胁：它会变得更糟糕吗？](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548030&idx=1&sn=c58515418680ecfc181eec8fc01ff619&chksm=e915ec44de62655201da678f2a638b958ef6b7cf0d9961522d941da9a72d3eb4a60bef8c367a&scene=58&subscene=0#rd) - - [DEF CON 30 CHINA Party元宇宙探索指南：这10件事儿必打卡！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548030&idx=2&sn=6bfdd93b2c09fb34acee40e967d6dd45&chksm=e915ec44de626552d9f3439f77aa3f0d481b7889bb5c9520d181ecfb7ced95a4b88185c716cd&scene=58&subscene=0#rd) - - [如何发现信标（一）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548030&idx=3&sn=1b7487ba6426dbce52f5799404f8d647&chksm=e915ec44de626552a072198f6e9250e70bcaef2306a46bf17954617f76afa5bd6444dbde4e32&scene=58&subscene=0#rd) -- 安全牛 - - [Black Hat 2022最值得期待的十大热门演讲](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117221&idx=1&sn=b8ec33daca5533301c2dee1a26e3fc6e&chksm=bd1466768a63ef6039e033f3bb805a8d4952f23316affd50571b550e62c287533d6eee318966&scene=58&subscene=0#rd) - - [选择成为CISO的七个理由](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117221&idx=2&sn=3a445fcebbe7109fd1c077a9f5bc2c7e&chksm=bd1466768a63ef60acfaa26919be5f019b829a7418b9cf0c2e074ea161ecba2c40656a560eb7&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（39期）：高校科研单位保密管理工作分享](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117221&idx=3&sn=0f9a2b74e40e4303a5b49bb439312f88&chksm=bd1466768a63ef60c5866dd9ae5f6bc01adf268edd452dba46b86eb2c51f812e6e35a1def017&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-13.md b/archive/2022/2022-08-13.md deleted file mode 100644 index 534acdae0d..0000000000 --- a/archive/2022/2022-08-13.md +++ /dev/null @@ -1,167 +0,0 @@ -# 每日安全资讯（2022-08-13） - -- unSafe.sh - 不安全 - - [在极米投屏设备上安装百度网盘](https://buaq.net/go-121975.html) - - [玄武盾的几种绕过姿势](https://buaq.net/go-121953.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 33](https://buaq.net/go-121944.html) - - [How I fixed the new password on NuttX](https://buaq.net/go-121937.html) - - [软件界的平替到底是什么？](https://buaq.net/go-121958.html) - - [The road to the apprenticeship](https://buaq.net/go-121932.html) - - [Chromecast Protocol](https://buaq.net/go-121929.html) - - [OffensiveVBA - Code Execution And AV Evasion Methods For Macros In Office Documents](https://buaq.net/go-121934.html) - - [The dream of auto-detecting proxies](https://buaq.net/go-121933.html) - - [Avoid the worst of the internet with cyber hygiene](https://buaq.net/go-121931.html) - - [Reverse "Shining Mask"](https://buaq.net/go-121930.html) - - [文末赠书 | 积极防御体系进阶：《DevSecOps敏捷安全》](https://buaq.net/go-121961.html) - - [WordPress網站遭植後門網頁](https://buaq.net/go-121911.html) - - [派周报 | 本周会员内容提要；跑题：扎网恢恢](https://buaq.net/go-121922.html) - - [【免费领】挖漏洞赚钱宝典：网安大佬漏洞挖掘实战技巧总结](https://buaq.net/go-121925.html) - - [Burpsuite双层代理的抓包小技巧](https://buaq.net/go-121927.html) - - [陇东学院领导专家一行莅临蚁景科技开展产教融合交流](https://buaq.net/go-121926.html) - - [IAM Whoever I Say IAM :: Infiltrating VMWare Workspace ONE Access Using a 0-Click Exploit](https://buaq.net/go-121896.html) - - [The cloud has an isolation problem: PostgreSQL vulnerabilities affect multiple cloud vendors](https://buaq.net/go-121897.html) - - [本周看什么 | 最近值得一看的 8 部作品](https://buaq.net/go-121923.html) -- Sploitus.com Exploits RSS Feed - - [Windows sxssrv!BaseSrvActivationContextCacheDuplicateUnicodeString Heap Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:168069&utm_source=rss&utm_medium=rss) - - [Readymade Job Portal Script SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168066&utm_source=rss&utm_medium=rss) - - [Windows sxs!CNodeFactory::XMLParser_Element_doc_assembly_assemblyIdentity Heap Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:168068&utm_source=rss&utm_medium=rss) - - [Gas Agency Management 2022 SQL Injection / XSS / Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168067&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [A Modern Database Meets a Modern DevOps Data Platform](https://securityboulevard.com/2022/08/a-modern-database-meets-a-modern-devops-data-platform/) - - [SafeBreach Coverage for US-CERT Alert (AA22-223A) – Zeppelin Ransomware](https://securityboulevard.com/2022/08/safebreach-coverage-for-us-cert-alert-aa22-223a-zeppelin-ransomware/) - - [Aspen Security Forum 2022 – Imagining The Next 9/11: What Future Scares Us Most, What Can We Do to Prevent It from Coming True?](https://securityboulevard.com/2022/08/aspen-security-forum-2022-imagining-the-next-9-11-what-future-scares-us-most-what-can-we-do-to-prevent-it-from-coming-true/) - - [This Week in Malware – Fileless Linux Cryptominer, 100 Packages](https://securityboulevard.com/2022/08/this-week-in-malware-fileless-linux-cryptominer-100-packages/) - - [Black Hat 2022: from cyberwarfare to the rise of RCE](https://securityboulevard.com/2022/08/black-hat-2022-from-cyberwarfare-to-the-rise-of-rce/) - - [Cisco Pwned by ‘Russian’ Gang — Data Leaked, Egg on Face](https://securityboulevard.com/2022/08/cisco-russian-data-leak-richixbw/) - - [This was H1 2022: Part 2 – Cyber War](https://securityboulevard.com/2022/08/this-was-h1-2022-part-2-cyber-war/) - - [Daniel Stori’s ‘arduino project’](https://securityboulevard.com/2022/08/daniel-storis-arduino-project/) - - [Black Hat 2022 — End-to-End Fun and API Security](https://securityboulevard.com/2022/08/black-hat-2022-end-to-end-fun-and-api-security/) -- Files ≈ Packet Storm - - [GNUnet P2P Framework 0.17.4](https://packetstormsecurity.com/files/168070/gnunet-0.17.4.tar.gz) - - [Windows sxssrv!BaseSrvActivationContextCacheDuplicateUnicodeString Heap Buffer Overflow](https://packetstormsecurity.com/files/168069/GS20220812145348.txt) - - [Windows sxs!CNodeFactory::XMLParser_Element_doc_assembly_assemblyIdentity Heap Buffer Overflow](https://packetstormsecurity.com/files/168068/GS20220812145103.txt) - - [Gas Agency Management 2022 SQL Injection / XSS / Shell Upload](https://packetstormsecurity.com/files/168067/gam2022-sqlshellxss.txt) - - [Readymade Job Portal Script SQL Injection](https://packetstormsecurity.com/files/168066/rjps-sql.txt) -- Twitter @Nicolas Krassas - - [FBI: Zeppelin ransomware may encrypt devices multiple times in attacks](https://twitter.com/Dinosn/status/1557960983989157888) - - [Concealed code execution: Techniques and detection](https://twitter.com/Dinosn/status/1557959502669955072) - - [Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study](https://twitter.com/Dinosn/status/1557958797355876353) - - [Zimbra auth bypass bug exploited to breach over 1,000 servers](https://twitter.com/Dinosn/status/1557958689885229057) - - [New HTTP Request Smuggling Attacks Target Web Browsers](https://twitter.com/Dinosn/status/1557958284698652672) - - [NHS IT Supplier Held To Ransom By Hackers](https://twitter.com/Dinosn/status/1557957741267804163) - - [US govt will pay you $10 million for info on Conti ransomware members](https://twitter.com/Dinosn/status/1557957522383937536) - - [Cisco Confirms It's Been Hacked by Yanluowang Ransomware Gang](https://twitter.com/Dinosn/status/1557957233685708805) - - [Starlink Successfully Hacked Using $25 Modchip](https://twitter.com/Dinosn/status/1557957146553335809) - - [Attacking Titan M with Only One Byte](https://twitter.com/Dinosn/status/1557957088139165696) - - [From Oscilloscope to Wireshark - A UDP Story](https://twitter.com/Dinosn/status/1557956884757348353) - - [Microsoft shares workarounds for Outlook crashing after launch](https://twitter.com/Dinosn/status/1557955991676796928) - - [SQUIP vulnerability affects AMD Zen-series processors](https://twitter.com/Dinosn/status/1557955212958105600) -- Trustwave Blog - - [Executive Order on Improving the Nation’s Cybersecurity: One Year Later](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/executive-order-on-improving-the-nations-cybersecurity-one-year-later/) -- Recent Commits to cve:main - - [Update Fri Aug 12 05:23:03 UTC 2022](https://github.com/trickest/cve/commit/0741f6073a04c235273792ad492073e517fccfbe) -- obaby@mars - - [Django 代码保护](http://h4ck.org.cn/2022/08/django-%e4%bb%a3%e7%a0%81%e4%bf%9d%e6%8a%a4/) -- 安全客-有思想的安全新媒体 - - [数字安全观察-每周简报(2022.08.03-2022.08.09)](https://www.anquanke.com/post/id/277982) - - [挖矿木马分析](https://www.anquanke.com/post/id/277185) - - [卡塔尔犯罪组织疑似登录暗网市场](https://www.anquanke.com/post/id/277798) -- 先知安全技术社区 - - [玄武盾的几种绕过姿势](https://xz.aliyun.com/t/11607) -- Sec-News 安全文摘 - - [IAM Whoever I Say IAM :: Infiltrating VMWare Workspace ONE Access Using a 0-Click Exploit](https://wiki.ioin.in/url/3JBG) - - [The cloud has an isolation problem: PostgreSQL vulnerabilities affect multiple cloud vendors](https://wiki.ioin.in/url/akX6) -- 先知安全技术社区 - - [玄武盾的几种绕过姿势](https://xz.aliyun.com/t/11607) -- 安全脉搏 - - [Java代码审计之ofcms | 技术精选0140](https://www.secpulse.com/archives/185233.html) - - [数据库注入提权总结（三）](https://www.secpulse.com/archives/185215.html) - - [【漏洞预警】Apache Avro-rs整数溢出漏洞](https://www.secpulse.com/archives/185216.html) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things that Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-aug-12) -- Hack Inn - - [BlackHat USA 2022](https://www.hackinn.com/index.php/archives/798/) -- SAP Blogs - - [SAP Finance and COPA standard report](https://blogs.sap.com/2022/08/12/sap-finance-and-copa-standard-report/) - - [Monitoring Table Size in SAP HANA](https://blogs.sap.com/2022/08/12/monitoring-table-size-in-sap-hana/) - - [Create a CDS Entity in SAP BTP, Expose the Entity as an OData Service to Outside world, Deploy to HANA DB and CF as an application and Create a chatbot by consuming the API in SAP CAI & Facebook Messenger (Part 2)](https://blogs.sap.com/2022/08/12/create-a-cds-entity-in-sap-btp-expose-the-entity-as-an-odata-service-to-outside-world-deploy-to-hana-db-and-cf-as-an-application-and-create-a-chatbot-by-consuming-the-api-in-sap-cai-facebook-messe/) - - [ABAP SDK for SAP Cloud Identity Services](https://blogs.sap.com/2022/08/12/abap-sdk-for-sap-cloud-identity-services/) - - [CDO Talk at ACHEMA 2022: Making Process Industry 4.0 a reality](https://blogs.sap.com/2022/08/12/cdo-talk-at-achema-2022-making-process-industry-4.0-a-reality/) - - [Sustainability Control Towerの始め方](https://blogs.sap.com/2022/08/12/sustainability-control-tower%e3%81%ae%e5%a7%8b%e3%82%81%e6%96%b9/) - - [Create a CDS Entity in SAP BTP, Expose the Entity as an OData Service to Outside world, Deploy to HANA DB and CF as an application and Create a chatbot by consuming the API in SAP CAI (Part 1)](https://blogs.sap.com/2022/08/12/create-a-cds-entity-in-sap-btp-expose-the-entity-as-an-odata-service-to-outside-world-deploy-to-hana-db-and-cf-as-an-application-and-create-a-chatbot-by-consuming-the-api-in-sap-cai-part-1/) - - [Learn how to use SAP Work Zone |Summer Tutorial Series |Lesson 2: Page Builder](https://blogs.sap.com/2022/08/12/learn-how-to-use-sap-work-zone-summer-tutorial-series-lesson-2-page-builder/) - - [SAP Fiori and SAP GUI Differences In Reporting](https://blogs.sap.com/2022/08/12/sap-fiori-and-sap-gui-differences-in-reporting/) - - [S/4HANA Cloud の 2-Tier モデルについて調べてみた](https://blogs.sap.com/2022/08/12/s-4hana-cloud-2-tier/) -- Twitter @bytehx - - [RT 🐞Sara Badran: How to exploit SQL injection without comma = 10,000$ bounty By @0x4148 #hackerone #BugBounty #bugbountytips #hackeronereport #writ...](https://twitter.com/SaraBadran18/status/1558028289083691008) -- Hex Rays - - [Igor’s tip of the week #102: Resetting decompiler information](https://hex-rays.com/blog/igors-tip-of-the-week-102-resetting-decompiler-information/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 33](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-33-4/) -- Reverse Engineering - - [Chromecast Protocol](https://www.reddit.com/r/ReverseEngineering/comments/wmkmx7/chromecast_protocol/) -- blog.avast.com EN - - [Avoid the worst of the internet with cyber hygiene](https://blog.avast.com/avoid-the-worst-of-the-internet-with-cyber-hygiene) - - [Pay with just your palm at Whole Foods](https://blog.avast.com/whole-foods-palm-scanning) - - [Fake Elon Musk TeslaCoin investment scam costs victims at least $250](https://blog.avast.com/teslacoin-crypto-scam) -- Trail of Bits Blog - - [The road to the apprenticeship](https://blog.trailofbits.com/2022/08/12/the-road-to-the-apprenticeship/) -- The Daily Swig | Cybersecurity news and views - - [IT industry guilty of ‘lack of imagination’ in failure to anticipate cyber-attack evolution](https://portswigger.net/daily-swig/it-industry-guilty-of-lack-of-imagination-in-failure-to-anticipate-cyber-attack-evolution) - - [BHUSA: Make sure your security bug bounty program doesn’t create a data leak of its own](https://portswigger.net/daily-swig/bhusa-make-sure-your-security-bug-bounty-program-doesnt-create-a-data-leak-of-its-own) - - [GoTestWAF adds API attack testing via OpenAPI support](https://portswigger.net/daily-swig/gotestwaf-adds-api-attack-testing-via-openapi-support) - - [Black Hat USA: Pen testing tool that aims to ‘keep the fun in hacking’ unveiled](https://portswigger.net/daily-swig/black-hat-usa-pen-testing-tool-that-aims-to-keep-the-fun-in-hacking-unveiled) -- 吾爱破解论坛 - - [【Web逆向】记一个有趣的防红网站反复横跳](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651138135&idx=1&sn=15383dc5cefc45f50ee44f46231e5f3a&chksm=bd50b8038a2731152cd72ba31f49c84c360ce5144078d1de00df4764ef46c1a253542a1a094c&scene=58&subscene=0#rd) -- 看雪学院 - - [使用AFL++复现历史CVE](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463012&idx=1&sn=168bcf8ed4e910a3ea4cfdea4541cc63&chksm=b18e1bae86f992b85098a855dbb9a8e410ee97441d13ad958d3d0840f94379f170e98a5f2fb6&scene=58&subscene=0#rd) - - [文末赠书 | 积极防御体系进阶：《DevSecOps敏捷安全》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463012&idx=2&sn=c79088b2ec6354634f2a85be6e054e64&chksm=b18e1bae86f992b8a82df7970a2f126a0a44f7e063e6f8d6795a23a586a69b2bdf3d340bf46f&scene=58&subscene=0#rd) - - [4850万！上海随申码数据泄露并遭兜售](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463012&idx=3&sn=59d5cef7d058e20e06f7be2205953cc2&chksm=b18e1bae86f992b8e6a621cd27a68a0b8e608d34b15ae8ceaba6406d5d20158f1a4b3df48087&scene=58&subscene=0#rd) - - [夏日找工作不用愁，来这看看？](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463012&idx=4&sn=236cb524fd33c11fbe91248ea3cde8e1&chksm=b18e1bae86f992b8d23810a6d1d15e38ea07a10a2b362f7fef2a79ee4b7126e0fdf8609bcd26&scene=58&subscene=0#rd) - - [《IDA插件开发入门》为你的逆向工作添砖加瓦](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463012&idx=5&sn=495f460f510ff70ae92e8c35fab9e756&chksm=b18e1bae86f992b878b13d0c7dff2994822cf8e67ef35530ed6d6b7196a51cb7b4e7c89a60f0&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [你好，交个朋友，我叫猎鹰](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247491042&idx=1&sn=0bf62ee9b245edb0e7111688c16212d9&chksm=ec6a6dcadb1de4dca215cefbc224fc5fb769d77adf8d5da50b728fa50030ae0e0323b95ad2c2&scene=58&subscene=0#rd) - - [每周勒索威胁摘要](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247491042&idx=2&sn=3c8ba4d0599c192df70eba6639cd4bfb&chksm=ec6a6dcadb1de4dc9f5f0cbf3d905601bd7efe1ff2fabdb345ec9501227751e578997372fbef&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [OffensiveVBA - Code Execution And AV Evasion Methods For Macros In Office Documents](http://www.kitploit.com/2022/08/offensivevba-code-execution-and-av.html) -- 山石网科安全技术研究院 - - [​密码学赛题复现：2021-CryptoCTF（三）](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495666&idx=1&sn=f651ce4168131bbeeec06f4dbe8c6eb9&chksm=fa523a4ccd25b35a464ca9791fe44b8fc80ed231b7100f12a7d29d7479361ce5c39eb096ba99&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [安恒信息入选2022 BlackHat USA议题《Windows本地提权在野0day狩猎之旅》大揭密](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247489695&idx=1&sn=73ddd0afa6d28f251f1587df081a1710&chksm=f9ee7420ce99fd36aeb156bbf64be632a5a657ff3064b5d96ae568973c17df268b11fbcd77a0&scene=58&subscene=0#rd) -- 默安科技 - - [看不见尽头的40℃，这里有一份“清凉套餐”待查收](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247493293&idx=1&sn=44f6bfbdccd817f469c4725935a7d5f7&chksm=e93b118fde4c9899bf4a9980dc1cafc345f4104adda03a6a4cea509a96ca1924eec6e695fc8e&scene=58&subscene=0#rd) -- 复旦白泽战队 - - [我实验室杨珉教授受邀出席2022北京网络安全大会](https://mp.weixin.qq.com/s?__biz=MzU4NzUxOTI0OQ==&mid=2247485764&idx=1&sn=4b6ef0566c9c1b448865150ef3009efc&chksm=fdeb8d3aca9c042c8eb8eb92746ffa4fc1d5fbe396f0c25f1de0c2d8f8ac4859d9ec53f26d0e&scene=58&subscene=0#rd) -- 安全牛 - - [Gartner对MIM机器身份管理发展的6个观点](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117239&idx=1&sn=3b8f0c19e7bbc68aceb70ac1d86e8df4&chksm=bd1466648a63ef72b393c460c25815bd956830fa6d8585269b0beb8c7c38511b2cf0734f73de&scene=58&subscene=0#rd) - - [选型统一终端管理方案的九个建议](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117239&idx=2&sn=1da8db1a959f9ee524db788dbe0a9c4d&chksm=bd1466648a63ef7268a2e6000da23f509d5b1be1d3d5bc6ab01249405ec302a4315d5cea481b&scene=58&subscene=0#rd) -- 信安之路 - - [黑产团伙正在利用 ES 未授权访问漏洞实施勒索](https://mp.weixin.qq.com/s?__biz=MzI5MDQ2NjExOQ==&mid=2247497793&idx=1&sn=4b04a57f780fb94bc221502b2f5d4840&chksm=ec1dc869db6a417f5eb71be95987804cf2f726b02cff5d5ca95364b9cc80685508b1cdc4175d&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-08-12](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492300&idx=1&sn=9af9934fa2e089bc6ac7f90c0f6ab37c&chksm=c063cc15f71445036fc226285e3bf18ffbee1df4f81d3dacc26c632e69599def3b99acbc4a1d&scene=58&subscene=0#rd) -- 情报分析师 - - [斩首行动及其实现模式（附《美国陆军侦察和监视手册》中英文各256页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513992&idx=1&sn=d7b72c9df8b3ea183c1b115e65aeea36&chksm=87168c03b06105155edb09f24159cc6bb34591a6328ea3f336724ce22e0baf40535dbb87c319&scene=58&subscene=0#rd) - - [与智能手机作战：战争中的小工具如何模糊平民和战斗员之间的界限](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513992&idx=2&sn=87935442161d9144b3f4f14c7fe137ac&chksm=87168c03b061051548304a6b23d9a1bfb6c6722aa24a35d8ae0cec1efc4835b36942f288f66d&scene=58&subscene=0#rd) - - [OSINT工具推荐](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650513992&idx=3&sn=99afe4382fa8d0561dc14650865bf3db&chksm=87168c03b06105152347e791bd8d035e7ef9aa6de7d98223099792640eea136de8fc65fa379b&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [活动 ｜ 广告业务专项测试活动，等的就是你！](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247490325&idx=1&sn=dfe78db069d784c5f51f545d9e05ff9d&chksm=ec1bfac6db6c73d05c32c1ade644f2af111938e48f264ae9b8cefeabbc3c58ec1ced5f567240&scene=58&subscene=0#rd) -- 极客公园 - - [超越奈飞，迪士尼只用了 5 年](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964488&idx=1&sn=1514b7bc1f0ad232bea5ed491787bda2&chksm=7e547b3e4923f2282a641e443648ffba403c19c60f27cddbe4220601e2506377f4959c0e99ce&scene=58&subscene=0#rd) - - [他们想用 AI，批量生产「中供铁军」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964140&idx=1&sn=2e673176910c3de265764bb413acf944&chksm=7e54789a4923f18c837e6856218054a9916c0fc7595f119133e12711f129ce0cda4dc1222e0c&scene=58&subscene=0#rd) - - [马斯克暗示可能自建社交平台；迪士尼订阅用户总数首超奈飞；小米发布全尺寸人形机器人，成本每台六、七十万｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964080&idx=1&sn=7a12e7068fe47fba710eca6c0e92e26c&chksm=7e5479464923f0503a5aedeaf4397ebae75df583acc2d53f956e916cc70f4b275f5fb04ee231&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [【火绒安全周报】思科被勒索攻击/15岁开发黑客工具获利30万美元](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247508517&idx=1&sn=455c8802a53a48e526997393edd90875&chksm=eb707c1adc07f50ce30b329c3ed21bdd1652b068b5b44dac9258efaeb79b5a74ddc204fde1ae&scene=58&subscene=0#rd) -- XCTF联赛 - - [惊喜警报！Mini XMan线上快闪活动即将来袭！](https://mp.weixin.qq.com/s?__biz=MjM5NDU3MjExNw==&mid=2247507532&idx=1&sn=853ed5f362999dfb7d7bd9bdd0cd309c&chksm=a6872c7691f0a56095f39048fba5f08a426f6dd5be2d3d18b8cfc4025267d4db94126f876987&scene=58&subscene=0#rd) -- daniel.haxx.se - - [The dream of auto-detecting proxies](https://daniel.haxx.se/blog/2022/08/12/the-dream-of-auto-detecting-proxies/) -- 字节跳动安全中心 - - [​千呼万唤！字节中秋礼盒&全域3倍激励一起奉上！](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489298&idx=1&sn=a977cf3adbd1ae0322cc0f70fda5d659&chksm=fa9eec44cde965525738b9aa25304875c87b3c1c0760de4fac0d05459286d66ba5cd5d0c2a11&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [Golang 中 map 探究](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497430&idx=1&sn=0f338419235e0f53b4c4a9d8dd715733&chksm=e9d33d34dea4b4228004da8726ae98e6775487c688a2619e247de083c13a5678bdb5c812eeeb&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [【技术原创】Sophos UTM利用分析——导出配置文件](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548144&idx=1&sn=5c6aec87bc143eb4c623dacece1b7f6a&chksm=e915eccade6265dcbe9a4ca227aba6a4fe6841ac84225fbebc2702bfc7a32ca309f16d937a20&scene=58&subscene=0#rd) - - [6大赛道闯关战！DEF CON 30百度安全BCTF·AutoDriving待高手过招](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548144&idx=2&sn=b654fe5b1817c42349ce7736881542cf&chksm=e915eccade6265dc606a4dc13282581838b878cef999cf9dcbcd3b41c0c5ecd8876b7850c537&scene=58&subscene=0#rd) - - [网络钓鱼者绕过2FA以接管Coinbase账户](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548144&idx=3&sn=68ac7354de84b0d91cfaceb2c037d560&chksm=e915eccade6265dc6b721aef70a9c17e52119975fc474350b40951ed69ce76ee722888ab8436&scene=58&subscene=0#rd) -- 专注安管平台 - - [Forrester将SOAR列入安全分析平台的关键能力集合](https://mp.weixin.qq.com/s?__biz=MzUyNzMxOTAwMw==&mid=2247484513&idx=1&sn=36739ae447e070bbe70ba52a3f73f274&chksm=fa002ed5cd77a7c3609048c1c346c21d1808b5da9e7da06ace4ae5031faf778ad3ded9cf8484&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-14.md b/archive/2022/2022-08-14.md deleted file mode 100644 index e9a671ad6b..0000000000 --- a/archive/2022/2022-08-14.md +++ /dev/null @@ -1,69 +0,0 @@ -# 每日安全资讯（2022-08-14） - -- unSafe.sh - 不安全 - - [timwhitez starred DotNetTracer](https://buaq.net/go-122055.html) - - [timwhitez starred AceLdr](https://buaq.net/go-122056.html) - - [NimGetSyscallStub - Get Fresh Syscalls From A Fresh Ntdll.Dll Copy](https://buaq.net/go-122039.html) - - [预览 | .NET VirtualPath实现内存马和工具](https://buaq.net/go-122037.html) - - [周日公开课直播预告 | JNI函数与脱壳分析实战](https://buaq.net/go-122036.html) - - [How I Hacked my Car](https://buaq.net/go-122033.html) - - [Server Side Template Injections By Hashar Mujahid.](https://buaq.net/go-122021.html) - - [你的日子有几种过法？聊聊日历应用中的阳历与阴历](https://buaq.net/go-122023.html) - - [就这样，祝各位都有一个好腰](https://buaq.net/go-122024.html) - - [App+1｜DailyBeen 日记说：你的所有小事，都值得铭记](https://buaq.net/go-122019.html) - - [Desk Height Calculator – 站立式办公桌高度计算器](https://buaq.net/go-122011.html) - - [如何发现信标（二）](https://buaq.net/go-122009.html) - - [单核CPU一小时破解抗量子加密算法](https://buaq.net/go-122010.html) -- Security Boulevard - - [Aspen Security Forum 2022 – Moderator: Edward Luce – Global Economy: Recovery Or Recession Bound?](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-edward-luce-global-economy-recovery-or-recession-bound/) - - [Aspen Security Forum 2022 – Led By Penny Pritzkerl – Virtual Fireside Chat with Secretary Gina Raimondo](https://securityboulevard.com/2022/08/aspen-security-forum-2022-led-by-penny-pritzkerl-virtual-fireside-chat-with-secretary-gina-raimondo/) - - [What is the Automated Certificate Management Environment (ACME) Protocol?](https://securityboulevard.com/2022/08/what-is-the-automated-certificate-management-environment-acme-protocol/) -- Twitter @Nicolas Krassas - - [Django web applications with enabled Debug Mode, DB accounts information and API Keys of more than 3,100 applications were exposed on internet.](https://twitter.com/Dinosn/status/1558339024154251264) - - [OFRAK (Open Firmware Reverse Analysis Konsole): a recently released new tool for analysing embedded firmware](https://twitter.com/Dinosn/status/1558338995985305600) - - [scodescanner: scan the source code for finding the Critical Vulnerabilities](https://twitter.com/Dinosn/status/1558338952116961281) - - [Faraday Community - Open Source Penetration Testing and Vulnerability Management Platform](https://twitter.com/Dinosn/status/1558338912195678210) - - [IAM Whoever I Say IAM :: Infiltrating VMWare Workspace ONE Access Using a 0-Click Exploit](https://twitter.com/Dinosn/status/1558338631563153409) - - [DeathStalker’s continuous strike at foreign and cryptocurrency exchanges](https://twitter.com/Dinosn/status/1558337076101349376) - - [DNSMonitor leverages Apple's Network Extension Framework to monitor DNS requests and responses](https://twitter.com/Dinosn/status/1558333256029855744) - - [crAPI: help you to understand the ten most critical API security risks](https://twitter.com/Dinosn/status/1558332955558395905) - - [Researching Xiaomi’s TEE to get to Chinese money](https://twitter.com/Dinosn/status/1558332901015654400) - - [Stats Say Chinese Researchers Not Deterred By China's Vulnerability Law](https://twitter.com/Dinosn/status/1558332743544610816) - - [OffensiveVBA - Code Execution And AV Evasion Methods For Macros In Office Documents](https://twitter.com/Dinosn/status/1558319144071749633) - - [FAANGs Failing On Keeping User Data Safe From Bug Hunters](https://twitter.com/Dinosn/status/1558318927565955072) - - [Researchers Use Invisible Finger To Remotely Control Touchscreens](https://twitter.com/Dinosn/status/1558318838554443777) - - [Intel ups protection against physical chip attacks in Alder Lake](https://twitter.com/Dinosn/status/1558318764848021507) - - [Twilio: 125 customers affected by data breach, no passwords stolen](https://twitter.com/Dinosn/status/1558317740523458560) - - [Feds: Zeppelin Ransomware Resurfaces with New Compromise, Encryption Tactics](https://twitter.com/Dinosn/status/1558317674006028288) - - [US reveals 'Target' pic of Conti man with $10m reward offer](https://twitter.com/Dinosn/status/1558317622256615424) - - [RT siri@fu4k1: about SMB RCE CVE-2022-35804](https://twitter.com/sirifu4k1/status/1558303364731240451) -- Sploitus.com Exploits RSS Feed - - [Exploit for Improper Initialization in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=5A75201B-3448-5168-A938-2E71C7C5F2CE&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Apache Spark exploit](https://sploitus.com/exploit?id=60081279-7DD1-5967-B70A-14F531A30F89&utm_source=rss&utm_medium=rss) -- Recent Commits to cve:main - - [Update Sat Aug 13 05:20:16 UTC 2022](https://github.com/trickest/cve/commit/4a1aa66aaf56c89081c6c76ced115df44072240f) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [如何发现信标（二）](https://www.4hou.com/posts/l6Dr) - - [单核CPU一小时破解抗量子加密算法](https://www.4hou.com/posts/O9qY) -- Bug Bounty in InfoSec Write-ups on Medium - - [Server Side Template Injections By Hashar Mujahid.](https://infosecwriteups.com/server-side-template-injections-by-hashar-mujahid-e5a1a383027e?source=rss----7b722bfd1b8d--bug_bounty) -- Reverse Engineering - - [How I Hacked my Car](https://www.reddit.com/r/ReverseEngineering/comments/wna951/how_i_hacked_my_car/) -- SAP Blogs - - [Calculation of net due date for credit memo.](https://blogs.sap.com/2022/08/13/calculation-of-net-due-date-for-credit-memo./) -- KitPloit - PenTest & Hacking Tools - - [NimGetSyscallStub - Get Fresh Syscalls From A Fresh Ntdll.Dll Copy](http://www.kitploit.com/2022/08/nimgetsyscallstub-get-fresh-syscalls.html) -- 看雪学院 - - [周日公开课直播预告 | JNI函数与脱壳分析实战](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463453&idx=1&sn=a3cd0e10066918a4161ffa34b995506a&chksm=b18e1c5786f99541058a6411508032a3dfd59795ac1f1cf6a7b5b888bf33dfe7ae1de9f018ce&scene=58&subscene=0#rd) - - [CVE-2018-18708 TENDA缓冲区溢出漏洞](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463453&idx=2&sn=aafc9c9a5d35924c81bedf54574f7f40&chksm=b18e1c5786f9954158614d47027a32601e9f0b8bdea361f4aaa4acd4c8646a97a1c24ff0bbdc&scene=58&subscene=0#rd) -- 互联网安全内参 - - [美太空军构筑“太空网络安全”最新举措](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505189&idx=1&sn=eb7836630757dbae9e4bc19c8a18d404&chksm=ebfa9205dc8d1b13f6afe0535ed22e8967736b74bda8e623deea7ca4adc86b7a1d294bff0cd1&scene=58&subscene=0#rd) -- 虎符智库 - - [黑帽大会：关注供应链安全与资产漏洞管理](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247488054&idx=1&sn=9a46b6d32b1d251728973404afc5eaa8&chksm=971e7f34a069f622f44331b371851c2fb75d99c065a1bd2cea80c67c4d218c7c151eb2b92514&scene=58&subscene=0#rd) -- 极客公园 - - [一个 Web3 小白的「DAO漂流」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964515&idx=1&sn=4b83eb05789cf3101c742a036b9fbaa8&chksm=7e547b154923f2033a21bbfc5066032d96d719c374bd7e0153eec24fce88efbf06bd2bee6fac&scene=58&subscene=0#rd) - - [倒计时 3 天｜极客公园创世系列盲盒：限时福利活动火热进行中！](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964515&idx=2&sn=c1f22bbbc8bcca2aa719fb9f69594ece&chksm=7e547b154923f2037197c18357e6622b7e6fea2de8e22fba8b6a90ad0fe1805ca8772c010681&scene=58&subscene=0#rd) - - [中石油等 5 家中国企业启动自美退市；华为上半年营收 3016 亿元；搜狗 App 正式停止服务｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964514&idx=1&sn=318162e44763f143a57bba2d6c485028&chksm=7e547b144923f20243760534e2f0f913ae5fddac9c64d7866865d421628a001c9cf857d638ad&scene=58&subscene=0#rd) -- 情报分析师 - - [丧心病狂，美国中央情报局成立中国任务中心！附《CIA情报分析思维与演示培训手册》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514027&idx=1&sn=fc2dfd176ee2d791db34d51a15fa4d8f&chksm=87168c20b0610536872d4dc1eafe68f9ab5a6271d4204a8d3717762acfd27139060c61ca97d0&scene=58&subscene=0#rd) - - [【实战技法】如何使用新技术调查旧照片](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514027&idx=2&sn=290eaa9ce5a937153e280ec23db814d3&chksm=87168c20b061053631b2a85ad6cbf11ba53b670fa263052e16ba4c88fc3b5f4c32b350f335af&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-15.md b/archive/2022/2022-08-15.md deleted file mode 100644 index c910e8c999..0000000000 --- a/archive/2022/2022-08-15.md +++ /dev/null @@ -1,81 +0,0 @@ -# 每日安全资讯（2022-08-15） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Gas Agency Management 2022 SQL Injection / XSS / Shell Upload](https://cxsecurity.com/issue/WLB-2022080051) - - [Prestashop Blockwishlist 2.1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022080050) - - [PAN-OS 10.0 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022080049) - - [Webmin Package Updates Command Injection](https://cxsecurity.com/issue/WLB-2022080048) - - [Windows sxssrv!BaseSrvActivationContextCacheDuplicateUnicodeString Heap Buffer Overflow](https://cxsecurity.com/issue/WLB-2022080047) - - [Readymade Job Portal Script SQL Injection](https://cxsecurity.com/issue/WLB-2022080046) - - [Win32.Ransom.BlueSky / Arbitrary Code Execution](https://cxsecurity.com/issue/WLB-2022080045) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-31269 exploit](https://sploitus.com/exploit?id=ED380246-8DD1-58AB-8557-4C562A88EDC9&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Zimbra Collaboration exploit](https://sploitus.com/exploit?id=11DEDDB4-6148-5800-86D0-BF20A0453109&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [RT Steve Eckels: Introducing STrace & PDBReSym! An MIT licensed reimplantation of dtrace and rust symbolicating tool. Allows system call hooks in a pa...](https://twitter.com/stevemk14ebr/status/1558897025067823104) -- SecWiki News - - [SecWiki News 2022-08-14 Review](http://www.sec-wiki.com/?2022-08-14) -- Recent Commits to cve:main - - [Update Sun Aug 14 05:24:08 UTC 2022](https://github.com/trickest/cve/commit/7f60d16b2ff6ed04d6efb96eb5a4e5d18f13872f) -- 世事难料，保持低调 - - [(三)大话深度学习编译器中的自动调优·Empirical Search](https://blog.csdn.net/ariesjzj/article/details/126311326) -- unSafe.sh - 不安全 - - [FreeBuf早报 | 首批针对星链卫星网的攻击手法曝光；Instagram被曝跟踪用户网络活动](https://buaq.net/go-122187.html) - - [键盘布局持久化技术 - FreeBuf网络安全行业门户](https://buaq.net/go-122112.html) - - [Python爬虫编程思想（162）： 综合爬虫项目：可视化爬虫](https://buaq.net/go-122130.html) - - [Chisel-Strike - A .NET XOR Encrypted Cobalt Strike Aggressor Implementation For Chisel To Utilize Faster Proxy And Advanced Socks5 Capabilities](https://buaq.net/go-122107.html) - - [Python爬虫编程思想（161）：Scrapy中的通用爬虫](https://buaq.net/go-122131.html) - - [有人不满意昨天的那个腰，硬要再来一个...](https://buaq.net/go-122115.html) - - [Python爬虫编程思想（159）：Scrapy中的爬虫中间件](https://buaq.net/go-122132.html) - - [Clicknium 自动操作网页和应用 - V2EX](https://buaq.net/go-122106.html) - - [Python爬虫编程思想（158）：Scrapy中的下载器中间件](https://buaq.net/go-122133.html) - - [Python爬虫编程思想（157）：使用Scrapy从CSV格式转换到JSON格式](https://buaq.net/go-122134.html) - - [Python爬虫编程思想（156）：使用Scrapy抓取天气预报数据](https://buaq.net/go-122135.html) - - [Python爬虫编程思想（155）：使用Scrapy处理带隐藏文本框的登录页面](https://buaq.net/go-122136.html) - - [Python爬虫编程思想（154）：使用Scrapy处理登录页面](https://buaq.net/go-122105.html) -- 一个被知识诅咒的人 - - [Python爬虫编程思想（162）： 综合爬虫项目：可视化爬虫](https://blog.csdn.net/nokiaguy/article/details/126335818) - - [Python爬虫编程思想（161）：Scrapy中的通用爬虫](https://blog.csdn.net/nokiaguy/article/details/126335515) - - [Python爬虫编程思想（159）：Scrapy中的爬虫中间件](https://blog.csdn.net/nokiaguy/article/details/126335217) - - [Python爬虫编程思想（158）：Scrapy中的下载器中间件](https://blog.csdn.net/nokiaguy/article/details/126335151) - - [Python爬虫编程思想（157）：使用Scrapy从CSV格式转换到JSON格式](https://blog.csdn.net/nokiaguy/article/details/126335100) - - [Python爬虫编程思想（156）：使用Scrapy抓取天气预报数据](https://blog.csdn.net/nokiaguy/article/details/126334951) - - [Python爬虫编程思想（155）：使用Scrapy处理带隐藏文本框的登录页面](https://blog.csdn.net/nokiaguy/article/details/126334758) - - [Python爬虫编程思想（154）：使用Scrapy处理登录页面](https://blog.csdn.net/nokiaguy/article/details/126334527) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [Andariel 部署 DTrack 和 Maui 勒索软件](https://www.4hou.com/posts/q8DG) - - [Zimbra认证绕过漏洞成功入侵超过1000台服务器](https://www.4hou.com/posts/XVqA) -- Security Boulevard - - [Aspen Security Forum 2022 – Moderator: Dafna Linzer – The 21st Century Nuclear Arms Race](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-dafna-linzer-the-21st-century-nuclear-arms-race/) - - [XKCD ‘Coffee Cup Holes’](https://securityboulevard.com/2022/08/xkcd-coffee-cup-holes/) - - [Aspen Security Forum 2022 – Moderator: Courtney Kube – Niamh King’s Opening Remarks & National Security Today: Emerging Challenges and Opportunities](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-courtney-kube-niamh-kings-opening-remarks-national-security-today-emerging-challenges-and-opportunities/) - - [CISA Releases Free ‘Cybersecurity Toolkit to Protect Elections’](https://securityboulevard.com/2022/08/cisa-releases-free-cybersecurity-toolkit-to-protect-elections/) -- SAP Blogs - - [Purchase Quotation Gets More Flexible](https://blogs.sap.com/2022/08/14/purchase-quotation-gets-more-flexible/) - - [Process / Production Order Component / Operation Changes](https://blogs.sap.com/2022/08/14/process-production-order-component-operation-changes/) - - [REST-JSON integration between AppGyver and SAP ERP or S/4 HANA](https://blogs.sap.com/2022/08/14/rest-json-integration-between-appgyver-and-sap-erp-or-s-4-hana/) - - [SAP S/4HANA Finance for group reporting: Data Volume – What you need to consider to keep the data clean – On-Premise](https://blogs.sap.com/2022/08/14/sap-s-4hana-finance-for-group-reporting-data-volume-what-you-need-to-consider-to-keep-the-data-clean-on-premise/) - - [Offline Update of Pricing Scales for Purchasing Info Record via Microsoft Excel](https://blogs.sap.com/2022/08/14/offline-update-of-pricing-scales-for-purchasing-info-record-via-microsoft-excel/) - - [Dropping multiple HDI containers asynchronously with SAP HANA Client for Python](https://blogs.sap.com/2022/08/14/dropping-multiple-hdi-containers-asynchronously-with-sap-hana-client-for-python/) -- Reverse Engineering - - [Expanding on Existing IoCs to Leverage Immediate Threats Simulations](https://www.reddit.com/r/ReverseEngineering/comments/wo17hm/expanding_on_existing_iocs_to_leverage_immediate/) -- KitPloit - PenTest & Hacking Tools - - [Chisel-Strike - A .NET XOR Encrypted Cobalt Strike Aggressor Implementation For Chisel To Utilize Faster Proxy And Advanced Socks5 Capabilities](http://www.kitploit.com/2022/08/chisel-strike-net-xor-encrypted-cobalt.html) -- 看雪学院 - - [uds诊断协议-逆向题 WP](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463454&idx=1&sn=6832f219233dc5e0cf8b010b6e7779fe&chksm=b18e1c5486f9954229d3277c2300f6c225dd3d090ff3d8f3b86a3b27f5de2251bffed63c6afb&scene=58&subscene=0#rd) - - [LLVM与代码混淆技术，详解3种经典代码混淆方式+2种变体](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463454&idx=2&sn=15bec9910a8fafc836bdd010ef732841&chksm=b18e1c5486f99542e1905668dacf98622333655642742646c0bb140ca6e0c5eeee08e45933f6&scene=58&subscene=0#rd) - - [看雪课程 讲师招募！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463454&idx=3&sn=c75832c0aa99d628571709672f2b12cf&chksm=b18e1c5486f995426b87cb3e758551cf5e43a103f2521c996cd98e13b5360120aea8faadbd26&scene=58&subscene=0#rd) -- 暗影安全 - - [议题征集 | 寻识首届技术沙龙奖励再升级！](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163134&idx=1&sn=cedd685b5c9c8fe8fdefda30934e4c87&chksm=f1d4e59bc6a36c8d7805090ca053636553b659383ce45613979871da81dda9cca09f89b78487&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】诱导下载木马病毒软件敲诈，厦门警方一举23人被抓，涉案金额数亿！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652013257&idx=1&sn=af68fd41a7832b78277f6125641858e7&chksm=f36fae89c418279f688f34cbe5a1c394fed05ddf4f47d0e9a5fb274bb6a3ab1ce3f0d3347af4&scene=58&subscene=0#rd) - - [【安全圈】暂停交易和存取款！一币圈平台爆雷，涉用户超200万](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652013257&idx=2&sn=6b83af733d8a04dfa7c4c20e37ac6fab&chksm=f36fae89c418279fbcf2735d32b77796ad8e8ea151b30eeedd7db668ade5025f33ba0217d9d9&scene=58&subscene=0#rd) - - [【安全圈】Zimbra认证绕过漏洞成功入侵超过1000台服务器](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652013257&idx=3&sn=bbd76c87449818524b67a03a78ca112e&chksm=f36fae89c418279f7137a4859870d6a2b6141cb797a50230cddb5fb807e52708af0fd25b73df&scene=58&subscene=0#rd) - - [【安全圈】卡塔尔犯罪组织疑似登录暗网市场](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652013257&idx=4&sn=0eeba3b210781122fae6641973cfaedf&chksm=f36fae89c418279fcc7c250d0de613554d47431dbb779934801d680416d1613c9817996456b0&scene=58&subscene=0#rd) - - [【安全圈】利用macOS端Zoom安装器漏洞 黑客可以接管你的Mac](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652013257&idx=5&sn=1eae8bc64e361fc9871088b4fd2ac4f2&chksm=f36fae89c418279f9a3cf14da27802193fd029d79ffcbd5092f45aa49632d6799805060852ea&scene=58&subscene=0#rd) -- Checkmarx.com - - [Typosquatting Campaign Targeting Python’s Top Packages, Dropping GitHub Hosted Malware with DGA Capabilities](https://checkmarx.com/blog/typosquatting-campaign-targeting-pythons-top-packages-dropping-github-hosted-malware-with-dga-capabilities/) -- RASP安全技术 - - [RASP| Apache Spark Shell(CVE-2022-33891)](https://mp.weixin.qq.com/s?__biz=Mzg5MjQ1OTkwMg==&mid=2247484482&idx=1&sn=5df912a24492a1c3be497a005720057c&chksm=c03c8a53f74b034542dcc9923e67153cf02a3fd045514bcca5fdbc3aec65659a7561f15dd1de&scene=58&subscene=0#rd) -- 极客公园 - - [元宇宙人才遭疯抢，500 万年薪不稀奇；特斯拉在北美停收 Model 3 长续航版订单；8 月 15 日上演土星冲日｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964542&idx=1&sn=9ea652b19a33de5f874d05f9e02c421c&chksm=7e547b084923f21e826009233d52b9cccd4885079443bd85b35073592e3c9ae2148df8ab6e6a&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-16.md b/archive/2022/2022-08-16.md deleted file mode 100644 index 236ade6206..0000000000 --- a/archive/2022/2022-08-16.md +++ /dev/null @@ -1,211 +0,0 @@ -# 每日安全资讯（2022-08-16） - -- unSafe.sh - 不安全 - - [从JDBC attack到detectCustomCollations利用范围扩展](https://buaq.net/go-122313.html) - - [Detecting a Rogue Domain Controller – DCShadow Attack](https://buaq.net/go-122298.html) - - [timwhitez starred Burp2Malleable](https://buaq.net/go-122300.html) - - [timwhitez starred FakeTLS](https://buaq.net/go-122301.html) - - [A Magic Way of XSS in HTTP/2](https://buaq.net/go-122296.html) - - [Attacking Titan M with Only One Byte](https://buaq.net/go-122297.html) - - [万字长文：盘点2022全球10大数据泄漏事件（红蓝攻防角度）- 文末福利抽奖](https://buaq.net/go-122317.html) - - [工具 | friTap - 动态解密 TLS](https://buaq.net/go-122319.html) - - [职等你来 | 某甲方安全岗位热招中 L7-L9](https://buaq.net/go-122318.html) - - [最佳实践 | API 令牌：一项乏味的调查](https://buaq.net/go-122320.html) - - [FreeBuf早报 | 网信办公布微信淘宝抖音等算法备案；两款红米手机被曝存在安全漏洞](https://buaq.net/go-122369.html) -- Recent Commits to cve:main - - [Update README.md](https://github.com/trickest/cve/commit/b6591b81573520d5e402e329fa02a85169c37b1e) - - [Update Mon Aug 15 05:26:55 UTC 2022](https://github.com/trickest/cve/commit/d69454edda2733e25653839e8043665707efeedd) -- Microsoft Security Blog - - [Disrupting SEABORGIUM’s ongoing phishing operations](https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/) -- Security Boulevard - - [Lacework Adds Time Series Modeling to Cybersecurity Platform](https://securityboulevard.com/2022/08/lacework-adds-time-series-modeling-to-cybersecurity-platform/) - - [Twilio’s lack of consistency in security documentation](https://securityboulevard.com/2022/08/twilios-lack-of-consistency-in-security-documentation/) - - [Global News: CBPR Forum](https://securityboulevard.com/2022/08/global-news-cbpr-forum/) - - [Aspen Security Forum 2022 – Moderator: Jim Sciutto – American Foreign Policy Challenges: Russia and Beyond](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-jim-sciutto-american-foreign-policy-challenges-russia-and-beyond/) - - [Social Media Intelligence: Addressing National Security Challenges with SOCMINT](https://securityboulevard.com/2022/08/social-media-intelligence-addressing-national-security-challenges-with-socmint/) - - [Gmail Lets Candidates Spam You — FEC FAIL](https://securityboulevard.com/2022/08/gmail-candidates-spam-you-fec-richixbw/) - - [Black Hat insights: Getting bombarded by multiple ransomware attacks has become commonplace](https://securityboulevard.com/2022/08/black-hat-insights-getting-bombarded-by-multiple-ransomware-attacks-has-become-commonplace/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 394’](https://securityboulevard.com/2022/08/robert-m-lees-jeff-haas-little-bobby-comic-week-394/) - - [Black Hat: We Should Have Seen The Colonial Ransomware Attack Coming](https://securityboulevard.com/2022/08/black-hat-we-should-have-seen-the-colonial-ransomware-attack-coming/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [HP LaserJet Professional M1210 MFP Series Receive Fax Service Unquoted Service Path](https://cxsecurity.com/issue/WLB-2022080056) - - [Windows sxs!CNodeFactory::XMLParser_Element_doc_assembly_assemblyIdentity Heap Buffer Overflow](https://cxsecurity.com/issue/WLB-2022080055) - - [Inout RealEstate 2.1.2 SQL Injection](https://cxsecurity.com/issue/WLB-2022080054) - - [Inout SiteSearch 2.0.1 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022080053) - - [Gigaland NFT Marketplace 1.9 Shell Upload / Key Disclosure](https://cxsecurity.com/issue/WLB-2022080052) -- Sploitus.com Exploits RSS Feed - - [Gigaland NFT Marketplace 1.9 Shell Upload / Key Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:168090&utm_source=rss&utm_medium=rss) - - [Inout RealEstate 2.1.2 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168092&utm_source=rss&utm_medium=rss) - - [Win32.Ransom.BlueSky MVID-2022-0632 Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168093&utm_source=rss&utm_medium=rss) - - [Readymade Job Portal Script SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37908&utm_source=rss&utm_medium=rss) - - [Gas Agency Management 2022 SQL Injection / XSS / Shell Upload Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-37909&utm_source=rss&utm_medium=rss) - - [Inout SiteSearch 2.0.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168091&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=EDC74223-EBC7-5EB3-824D-20BC92E78C05&utm_source=rss&utm_medium=rss) - - [Exploit for Incorrect Conversion between Numeric Types in Apache Xalan-Java exploit](https://sploitus.com/exploit?id=8EB751A4-B8A2-5393-AA52-266560429527&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [TOR Virtual Network Tunneling Tool 0.4.7.10](https://packetstormsecurity.com/files/168095/tor-0.4.7.10.tar.gz) - - [Windows Credential Guard Domain-Joined Device Public Key Privilege Escalation](https://packetstormsecurity.com/files/168094/GS20220815161337.tgz) - - [Win32.Ransom.BlueSky MVID-2022-0632 Code Execution](https://packetstormsecurity.com/files/168093/MVID-2022-0632.txt) - - [Inout RealEstate 2.1.2 SQL Injection](https://packetstormsecurity.com/files/168092/inoutrealestate212-sql.txt) - - [Inout SiteSearch 2.0.1 Cross Site Scripting](https://packetstormsecurity.com/files/168091/inoutsitesearch201-xss.txt) - - [Gigaland NFT Marketplace 1.9 Shell Upload / Key Disclosure](https://packetstormsecurity.com/files/168090/gigaland19-shelldisclose.txt) - - [Ubuntu Security Notice USN-5568-1](https://packetstormsecurity.com/files/168089/USN-5568-1.txt) - - [Red Hat Security Advisory 2022-6061-01](https://packetstormsecurity.com/files/168088/RHSA-2022-6061-01.txt) - - [Red Hat Security Advisory 2022-6065-01](https://packetstormsecurity.com/files/168087/RHSA-2022-6065-01.txt) - - [Red Hat Security Advisory 2022-6062-01](https://packetstormsecurity.com/files/168086/RHSA-2022-6062-01.txt) - - [Red Hat Security Advisory 2022-6066-01](https://packetstormsecurity.com/files/168085/RHSA-2022-6066-01.txt) - - [Red Hat Security Advisory 2022-6057-01](https://packetstormsecurity.com/files/168084/RHSA-2022-6057-01.txt) - - [Red Hat Security Advisory 2022-6058-01](https://packetstormsecurity.com/files/168083/RHSA-2022-6058-01.txt) - - [Gentoo Linux Security Advisory 202208-31](https://packetstormsecurity.com/files/168082/glsa-202208-31.txt) - - [Gentoo Linux Security Advisory 202208-30](https://packetstormsecurity.com/files/168081/glsa-202208-30.txt) - - [Gentoo Linux Security Advisory 202208-29](https://packetstormsecurity.com/files/168080/glsa-202208-29.txt) - - [Gentoo Linux Security Advisory 202208-28](https://packetstormsecurity.com/files/168079/glsa-202208-28.txt) - - [Gentoo Linux Security Advisory 202208-26](https://packetstormsecurity.com/files/168078/glsa-202208-26.txt) - - [Gentoo Linux Security Advisory 202208-27](https://packetstormsecurity.com/files/168077/glsa-202208-27.txt) - - [Gentoo Linux Security Advisory 202208-23](https://packetstormsecurity.com/files/168076/glsa-202208-23.txt) - - [Gentoo Linux Security Advisory 202208-25](https://packetstormsecurity.com/files/168075/glsa-202208-25.txt) - - [Gentoo Linux Security Advisory 202208-24](https://packetstormsecurity.com/files/168074/glsa-202208-24.txt) - - [Gentoo Linux Security Advisory 202208-21](https://packetstormsecurity.com/files/168073/glsa-202208-21.txt) - - [Gentoo Linux Security Advisory 202208-20](https://packetstormsecurity.com/files/168072/glsa-202208-20.txt) - - [Gentoo Linux Security Advisory 202208-22](https://packetstormsecurity.com/files/168071/glsa-202208-22.txt) -- Twitter @Nicolas Krassas - - [Starlink-FI: Starlink User Terminal Modchip](https://twitter.com/Dinosn/status/1559252160239603714) - - [A flaw in Xiaomi phones using MediaTek Chips could allow to forge transactions](https://twitter.com/Dinosn/status/1559251890801606662) - - [Cisco Confirms Network Breach After Employee’s Google Account was Hacked](https://twitter.com/Dinosn/status/1559251791195283456) - - [Chinese Hackers Backdoored MiMi Chat App to Target Windows, Linux, macOS Users](https://twitter.com/Dinosn/status/1559251704427724801) - - [Killnet Claim They’ve Stolen Employee Data from Lockheed Martin](https://twitter.com/Dinosn/status/1559251477709078528) - - [Threatest, a Go framework for end to end testing threat detection rules](https://twitter.com/Dinosn/status/1559251416899805185) - - [Hacking Zyxel IP cameras to gain a root shell](https://twitter.com/Dinosn/status/1559251366723338240) - - [Over 9,000 VNC servers exposed online without a password](https://twitter.com/Dinosn/status/1559251316240797699) - - [wtfis - A commandline tool that gathers information about a domain or FQDN using various OSINT services and displays them formatted for human consumpt...](https://twitter.com/Dinosn/status/1559251271126761478) - - [Process injection: breaking all macOS security layers with a single vulnerability](https://twitter.com/Dinosn/status/1559251210305212419) - - [Evade Windows Defender Mimikatz detection by patching the amsi.dll](https://twitter.com/Dinosn/status/1559251066121773057) - - [NthLink VPN found to be regular shadowsocks using same pre-shared keys for all users](https://twitter.com/Dinosn/status/1559250988229337088) - - [STrace: MIT Licensed Windows Reimplementation of DTrace](https://twitter.com/Dinosn/status/1559250918985580545) - - [HijackLibs: an open-source, community-driven project tracking DLL Hijacking opportunities in in Windows](https://twitter.com/Dinosn/status/1559250884839837698) - - [veinmind-tools: container security toolset](https://twitter.com/Dinosn/status/1559250848575782914) - - [RPCMon: RPC Monitor tool based on Event Tracing for Windows](https://twitter.com/Dinosn/status/1559250764664553475) - - [Irremovable guest in facebook event — Facebook bug bounty](https://twitter.com/Dinosn/status/1559250597005742080) - - [Salesforce bug hunting to Critical bug](https://twitter.com/Dinosn/status/1559250441426321408) - - [riskscanner: Open source multi-cloud security compliance scanning platform](https://twitter.com/Dinosn/status/1559250408937242625) - - [Fault-Injection Countermeasures, Deployed at Scale: Intel's design, and calibration for a fault-injection detection circuit for their 12th generation ...](https://twitter.com/Dinosn/status/1559250338800189440) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [Fortinet发布2022年第二季度财报，再现强劲增长！](https://www.4hou.com/posts/vJRX) - - [国际研究报告：建设智慧城市面临多重安全挑战 奇安信助力打造城市安全运营中心](https://www.4hou.com/posts/r7BK) - - [网域嫁接（Pharming）全解析：含义、运作方式、危害及防御措施](https://www.4hou.com/posts/r7M4) - - [小米手机可信执行环境安全漏洞](https://www.4hou.com/posts/50Vv) - - [首登元宇宙！DEF CON 30 CHINA Party开幕，极客再相聚！](https://www.4hou.com/posts/nJ7E) - - [2022年8月叙利亚再次因国考全国断网](https://www.4hou.com/posts/mX8r) -- 先知安全技术社区 - - [Executor内存马的实现（二）](https://xz.aliyun.com/t/11613) - - [从JDBC attack到detectCustomCollations利用范围扩展](https://xz.aliyun.com/t/11610) -- 安全客-有思想的安全新媒体 - - [红蓝对抗-安装包钓鱼与反钓鱼](https://www.anquanke.com/post/id/277739) - - [利用 Windows 垫片机制进行提权的 Dridex v3 银行木马分析](https://www.anquanke.com/post/id/277960) - - [美国国务院公布部分Conti组织成员信息并悬赏千万美元](https://www.anquanke.com/post/id/277941) -- SecWiki News - - [SecWiki News 2022-08-15 Review](http://www.sec-wiki.com/?2022-08-15) -- 先知安全技术社区 - - [Executor内存马的实现（二）](https://xz.aliyun.com/t/11613) - - [从JDBC attack到detectCustomCollations利用范围扩展](https://xz.aliyun.com/t/11610) -- 安全脉搏 - - [【漏洞预警】Zimbra任意文件上传漏洞](https://www.secpulse.com/archives/185321.html) - - [常用渗透脚本的特征免杀方式](https://www.secpulse.com/archives/185303.html) - - [玄武盾的几种绕过姿势](https://www.secpulse.com/archives/185292.html) - - [Windows10 渗透套件工具包](https://www.secpulse.com/archives/185285.html) - - [数据库注入提权总结（四）](https://www.secpulse.com/archives/185273.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [Salesforce bug hunting to Critical bug](https://infosecwriteups.com/salesforce-bug-hunting-to-critical-bug-b5da44789d3?source=rss----7b722bfd1b8d--bug_bounty) - - [Irremovable guest in facebook event — Facebook bug bounty](https://infosecwriteups.com/irremovable-guest-in-facebook-event-facebook-bug-bounty-e10e03c98cd5?source=rss----7b722bfd1b8d--bug_bounty) -- Securelist - - [IT threat evolution in Q2 2022. Mobile statistics](https://securelist.com/it-threat-evolution-in-q2-2022-mobile-statistics/107123/) - - [IT threat evolution in Q2 2022. Non-mobile statistics](https://securelist.com/it-threat-evolution-in-q2-2022-non-mobile-statistics/107133/) - - [IT threat evolution Q2 2022](https://securelist.com/it-threat-evolution-q2-2022/107099/) -- blog.avast.com EN - - [Comparing Twilio and Slack breach responses](https://blog.avast.com/twilio-slack-breaches) -- Twitter @bytehx - - [RT 1bdool492: Bug : Blind SQL Injection Tips : X-Forwarded-For: 0'XOR(if(now()=sysdate(),sleep(10),0))XOR'Z #bugbountytip](https://twitter.com/1bdool492/status/1559093689149964288) - - [RT _0xf4n9x_: #CVE-2022-27925 #Zimbra Unauth #RCE vulnerability is being exploited on a mass scale.](https://twitter.com/_0xf4n9x_/status/1559010571458326529) -- SentinelOne - - [Detecting a Rogue Domain Controller – DCShadow Attack](https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack/) -- Malwarebytes Labs - - [A week in security (August 8 - August 14)](https://www.malwarebytes.com/blog/news/2022/08/a-week-in-security-august-8-august-14) - - [Donut breach: Lessons from pen-tester Mike Miller: Lock and Code S03E17](https://www.malwarebytes.com/blog/podcast/2022/08/donut-breach-lessons-from-pen-tester-mike-miller-lock-and-code-s03e17) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/wostuv/rreverseengineerings_weekly_questions_thread/) - - [Attacking Titan M with Only One Byte](https://www.reddit.com/r/ReverseEngineering/comments/wp0tdr/attacking_titan_m_with_only_one_byte/) - - [How to Reverse Engineer and Patch an iOS Application for Beginners: Part I](https://www.reddit.com/r/ReverseEngineering/comments/woyog7/how_to_reverse_engineer_and_patch_an_ios/) -- SAP Blogs - - [Discover How HR Can Play a Strategic Role in Sales Performance Management at SuccessConnect 2022](https://blogs.sap.com/2022/08/15/discover-how-hr-can-play-a-strategic-role-in-sales-performance-management-at-successconnect-2022/) - - [SAP Solutions for Finance and Cybersecurity Up Close: Highlights from SAP Insider’s Mastering SAP Event](https://blogs.sap.com/2022/08/15/sap-solutions-for-finance-and-cybersecurity-up-close-highlights-from-sap-insiders-mastering-sap-event/) - - [SAP Process Automation, Workflow, DMS: Streamlining Data Entry Tasks](https://blogs.sap.com/2022/08/15/sap-process-automation-workflow-dms-streamlining-data-entry-tasks/) - - [SLT Réplication Server for Central Finance (cFIN) scenarios – DMC_FM_RESTART](https://blogs.sap.com/2022/08/15/slt-replication-server-for-central-finance-cfin-scenarios-dmc_fm_restart/) - - [What’s New in SAP Analytics Cloud Release 2022.17](https://blogs.sap.com/2022/08/15/whats-new-in-sap-analytics-cloud-release-2022.17/) - - [Order to Invoice Sales Cycle using FM/BAPI’s](https://blogs.sap.com/2022/08/15/order-to-invoice-sales-cycle-using-fm-bapis/) - - [The New Competency Framework: 10 Basics Partners Need to Know](https://blogs.sap.com/2022/08/15/the-new-competency-framework-10-basics-partners-need-to-know/) - - [Secure Login Client installation](https://blogs.sap.com/2022/08/15/secure-login-client-installation/) -- Offensive OSINT - - [Offensive OSINT s04e03 - Tracking Internet facing Industrial Control System devices with Kamerka Lite](https://www.offensiveosint.io/offensive-osint-s04-e03-tracking-internet-facing-industrial-control-system-devices-with-kamerka-lite/) -- KitPloit - PenTest & Hacking Tools - - [RedGuard - C2 Front Flow Control Tool, Can Avoid Blue Teams, AVs, EDRs Check](http://www.kitploit.com/2022/08/redguard-c2-front-flow-control-tool-can.html) -- The Daily Swig | Cybersecurity news and views - - [Germany to mandate minimum security standards for web browsers in government](https://portswigger.net/daily-swig/germany-to-mandate-minimum-security-standards-for-web-browsers-in-government) - - [Healthcare provider Novant issues data breach warning after site tracking pixels sent patients’ information to Meta servers](https://portswigger.net/daily-swig/healthcare-provider-novant-issues-data-breach-warning-after-site-tracking-pixels-sent-patients-information-to-meta-servers) -- daniel.haxx.se - - [QUIC and HTTP/3 with wolfSSL](https://daniel.haxx.se/blog/2022/08/15/quic-and-http-3-with-wolfssl/) -- Twitter @hakivvi - - [RT Connor McGarr: (1/3) Undoubtedly MANY ways to do this, so please don't crucify me for simplicity. I was recently in this same situation (](https://twitter.com/33y0re/status/1558985942488256512) -- 安全客 - - [【技术分享】CVE-2020-6828：Firefox for Android任意文件覆盖漏洞分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774945&idx=1&sn=5ea02bfc392d1efea15fd93b16cb6d35&chksm=88936b0ebfe4e2187888ddab92206f38d872b106ec59f9307dc5b77e5a2721e3f6cea3661872&scene=58&subscene=0#rd) - - [【安全头条】美国国务院公布部分Conti组织成员信息并悬赏千万美元](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649774945&idx=2&sn=e5604417ba37b691e8176a7301b4f33d&chksm=88936b0ebfe4e218269f80379f8db96a8e312a5fdb2e1fc0c8af13b56c060c380f7e084b4950&scene=58&subscene=0#rd) -- Sec-News 安全文摘 - - [A Magic Way of XSS in HTTP/2](https://wiki.ioin.in/url/ZQX9) -- 雷神众测 - - [雷神众测漏洞周报2022.8.8-2022.8.14](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652499130&idx=1&sn=497230524a0219419fcd2da31163b695&chksm=f2584f09c52fc61facea882b3dd75e362a2cba34b5e0b2489d9300e09e6dcaac60afc85ed3a4&scene=58&subscene=0#rd) -- 看雪学院 - - [Android APP 漏洞之战——WebView 漏洞详解](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463986&idx=1&sn=465f3de16b425a0c11683f9d79a85add&chksm=b18e1e7886f9976e0317b3e4e976c03799a7172268e01db399a64421ca76e9793ce131d3a85b&scene=58&subscene=0#rd) - - [前Twitter员工因向沙特阿拉伯移交数据被定罪](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463986&idx=2&sn=765667a9b135ce27eb06b38d13d5b74a&chksm=b18e1e7886f9976e8bf83fd859c626f98f7a2e64bf6e1ee35c626d908b016ad3a6ba16b38e1d&scene=58&subscene=0#rd) - - [《安卓逆向入门》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458463986&idx=3&sn=a3ebbeb6e82a4d4fd1aaf4fb011e77ef&chksm=b18e1e7886f9976e0ca15867b20ae21c2188d9429770bf38e257ad449eab49ca368622b2a2bd&scene=58&subscene=0#rd) -- 威胁棱镜 - - [SANS 2022 年威胁狩猎调查报告](https://mp.weixin.qq.com/s?__biz=MzkyMzE5ODExNQ==&mid=2247485692&idx=1&sn=2994f8d5451269e4c09f616e23373de8&chksm=c1e9ff30f69e76263a0027278fce6940e6712517904e114643ebf78e9d90fbff72683c4149ae&scene=58&subscene=0#rd) -- 数世咨询 - - [为什么外部攻击面管理至关重要](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494688&idx=1&sn=d41ff8d2e4be095c4d3c81268c6c9b47&chksm=c1449e9df633178ba7ac41da05e3ce744a86c87db2616b23e449fa706dddb055e1266dcbf8e3&scene=58&subscene=0#rd) - - [“六方座谈”分享推进落地关键问题](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494688&idx=2&sn=fb1c9e0443e51c1d5ee5dcdd02330d7a&chksm=c1449e9df633178b4da520087aaba849b7932bb60e5314060b77850af99a5fd10cbee34264d8&scene=58&subscene=0#rd) - - [8月16日直播！斗象科技「新一代漏洞情报与应急响应」新品发布会](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494688&idx=3&sn=5fc2c6e9372f299b65b9232c9c28a2f9&chksm=c1449e9df633178b7a2a182925114d38c55f2fdd68d4eb0fe6969e1889f6e73e88a5d16a0749&scene=58&subscene=0#rd) - - [首届“安全可信领军人物”“安全可信解决方案”“安全可信突出贡献企业”评选表彰活动进行中](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494688&idx=4&sn=049841f12992ef6f4173911e898bd705&chksm=c1449e9df633178bffe9abfb9fd63440aebbf6d4707806768c25f564f6f20e7844b60d73151f&scene=58&subscene=0#rd) -- 安全牛 - - [2022 Black Hat大会：11款备受关注的创新安全产品](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117279&idx=1&sn=4de7959faf7c84d1d5b10b5741164c31&chksm=bd14660c8a63ef1a716b77c272f0c46a32ad5db7abcf46208985fe2f4fa3a69d9ecb60811fc1&scene=58&subscene=0#rd) - - [安全头条 | 谷歌诱导用户提供隐私数据被罚6000万美元；美的集团正式回应勒索攻击传言](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117279&idx=2&sn=1264495b9880f742a673497f1cfa7d2f&chksm=bd14660c8a63ef1a857666baecc005c7532444b6d33c60c84ba30c4a9e647a1ff87be44907be&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（40期）：从滑动标尺模型看企业网络安全能力评估与建设](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117279&idx=3&sn=534d2a807a703f3b8c9fbd4bcc6b1123&chksm=bd14660c8a63ef1aac89240e87109c971f97b70636895390a377322d225964050796f62d8976&scene=58&subscene=0#rd) -- 星阑科技 - - [【技术干货】CVE-2022-26135 Atlassian Jira Mobile Plugin SSRF漏洞分析](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494971&idx=1&sn=c95cc0ed47f8d072f9a8424953f8c838&chksm=c00740a7f770c9b187c52d870302fffbd6ad853efbbff7d808b9e5252f4131c58ee8c43a5350&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-08-15](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492332&idx=1&sn=d8259ba6c0936da59dcfb4897d96a076&chksm=c063cc35f714452372f6fa2b8335bda0991051f782d100213eb474ed25eb365d38f07e86ac45&scene=58&subscene=0#rd) - - [《科研与英文学术论文写作》 from 中科院信工所于静老师！](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492332&idx=2&sn=d98ae5b409151532477c3b6ecc252f07&chksm=c063cc35f71445235f1aff4a0bfcfa1222e74d45337be6d8f3f0e7c6e43e757047428a248152&scene=58&subscene=0#rd) -- 锦行信息安全 - - [【国家认证】锦行科技入选“国家级专精特新‘小巨人’企业”](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247490394&idx=1&sn=fbcfb0b9399043b079eabaea4b3b20ac&chksm=9799e0ffa0ee69e9603da3e6e185d90ee851d1c7080caebefb63c1bedddc3a01711b83c0e8cf&scene=58&subscene=0#rd) -- Checkmarx.com - - [Checkmarx Wins Best Application Security Solution in the 2022 Tech Ascension Awards](https://checkmarx.com/press-releases/checkmarx-wins-best-application-security-solution-in-the-2022-tech-ascension-awards/) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220815期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530121&idx=1&sn=f3eb01543c41208657fa21515005a873&chksm=c1e9fad8f69e73cecb4d570890677b87b2a709773b63d40017b1339bd735423301ce986c2cae&scene=58&subscene=0#rd) - - [国家互联网信息办公室关于发布互联网信息服务算法备案信息的公告](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530121&idx=2&sn=cd9c7927f1a62e7662fe14335accc47b&chksm=c1e9fad8f69e73cea6bdd0dafc87c98abbd89c9f0888b9a52dc85812cbf51501c0679877d8a2&scene=58&subscene=0#rd) - - [黑帽大会：关注供应链安全与资产漏洞管理](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530121&idx=3&sn=fd9da0b9b13c169a3c7a0366c6769918&chksm=c1e9fad8f69e73ce73e5a1cd8e7355fa413adcc0ea1308697f323af36a9aeeb9f1a682415f53&scene=58&subscene=0#rd) - - [Zimbra认证绕过漏洞成功入侵超过1000台服务器](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530121&idx=4&sn=f7fed57e6aef63a8dff0064ff5940592&chksm=c1e9fad8f69e73ce519a8670a2894cc3650b74753ab656f52bc29ad5807b27e289776c5c8dcf&scene=58&subscene=0#rd) -- 斗象智能安全 - - [8月16日直播！斗象科技「新一代漏洞情报与应急响应」新品发布会](https://mp.weixin.qq.com/s?__biz=MzIwMjcyNzA5Mw==&mid=2247489799&idx=1&sn=6b3842493bbaaed6eb55b155889b696b&chksm=96db12dda1ac9bcb075903d9ce33ecadd6fb55bd00546a567f0910643bdbe7b4690547b02bb2&scene=58&subscene=0#rd) -- 极客公园 - - [亚马逊 17 亿美元收购 iRobot，图的并不是你的「两室一厅」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964651&idx=1&sn=ac002854156d599a01456b8ba92e2a3d&chksm=7e547a9d4923f38b66d1030686ed6c5b43985a69462a2f3abec5516a6390bdda1817bc473b61&scene=58&subscene=0#rd) - - [工业外骨骼，人类进化新方向](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964651&idx=2&sn=3157f12858117114c3bdbdf9b100744f&chksm=7e547a9d4923f38bab7e6c96d773c383f2cfd29d6d4978e634870f01e1f501ae0face54c3d96&scene=58&subscene=0#rd) - - [极客公园首款数字藏品，明日 10:24 创世首发 ！](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964621&idx=1&sn=87b61cb2ae66cdf902ceb88427e16e88&chksm=7e547abb4923f3ad0d7f1cf22a18c737942e6d9f3bc97ae1e6d85272c25670b1e94895bb5def&scene=58&subscene=0#rd) - - [广汽埃安：跟华为合作没有议价能力；特斯拉订单积压，不再接受部分预订；三星：折叠屏手机出货将达 2000 万｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964574&idx=1&sn=615cb314238b073039c4bab6076dcfcf&chksm=7e547b684923f27e6ce4d430a316d797703eca489b81c377724b9882eee51d539ce77e39048f&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [智能插帧，打造丝滑视频体验](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497463&idx=1&sn=61834d679dcdd30d2fbe459eae659647&chksm=e9d33d15dea4b4037fd3e9d2f79a1d4f394f1b85276a5e590abf8ffc20d5e04786520dd449a9&scene=58&subscene=0#rd) - - [直播预告丨字节产品增长实战——如何优化产品，跨越增长瓶颈](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497463&idx=2&sn=217673a36fc36cec8d400077b45da687&chksm=e9d33d15dea4b4032c08e97eebbad3e1be1adb12b4dc21ce237eb414ce1f88308d21654eae0e&scene=58&subscene=0#rd) -- 奇安信CERT - - [安全热点周报|第二百五十七期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496841&idx=1&sn=a5d527acd583e144d2cf047c6b5eb852&chksm=fe79d011c90e5907a1e3173305b1b1c05ab3703115061f15df5cc6335765066fec630104bf38&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [详解PHP反序列化字符逃匿](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495677&idx=1&sn=8b5d7efcb290219f1af7029078d81012&chksm=fa523a43cd25b355f2220fd613dc144cfb4abe5f796f1f7110e00bbf9c29ce1ab6ffaa29a3c9&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [小米手机可信执行环境安全漏洞](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548434&idx=1&sn=b3bf5f9241784ef67399678e53f24149&chksm=e915ee28de62673e936ee21e9ac95f10be78561eec0e8a7599ead8c6743641ee92040f00dd0a&scene=58&subscene=0#rd) - - [首登元宇宙！DEF CON 30 CHINA Party开幕，极客再相聚！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548434&idx=2&sn=6a8a3ef07f08fa77dfad5c5ab3acd4cc&chksm=e915ee28de62673e0a31fc16551b130c95edd88363b6460d4da060aa407866bd5808d328aa54&scene=58&subscene=0#rd) - - [网域嫁接（Pharming）全解析：含义、运作方式、危害及防御措施](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548434&idx=3&sn=d4d0751b04c8a65a1979cdd9874d7587&chksm=e915ee28de62673ec270531a0aa82308d8ec0525c9596b4a26a00dae4679699c1faa31dc87e8&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-17.md b/archive/2022/2022-08-17.md deleted file mode 100644 index c00c5b4b60..0000000000 --- a/archive/2022/2022-08-17.md +++ /dev/null @@ -1,204 +0,0 @@ -# 每日安全资讯（2022-08-17） - -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5569-1](https://packetstormsecurity.com/files/168098/USN-5569-1.txt) - - [Race Against The Sandbox](https://packetstormsecurity.com/files/168097/race-against-the-sandbox.pdf) - - [TypeORM 0.3.7 Information Disclosure](https://packetstormsecurity.com/files/168096/typeorm037-disclose.txt) -- Sploitus.com Exploits RSS Feed - - [TypeORM 0.3.7 Information Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:168096&utm_source=rss&utm_medium=rss) - - [TypeORM 0.3.7 Information Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37912&utm_source=rss&utm_medium=rss) - - [Inout RealEstate 2.1.2 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37911&utm_source=rss&utm_medium=rss) - - [Powershell Code Arbitary Execution Builder FUD Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37910&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Read in Google Android exploit](https://sploitus.com/exploit?id=BF09EDF9-3A6C-5330-BF63-B7729A617676&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Google Android exploit](https://sploitus.com/exploit?id=8A7995AD-8EDC-5211-8404-3220FE98DD9D&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-3452 exploit](https://sploitus.com/exploit?id=FFA38865-6146-59C1-AA63-DC65C0852807&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-36271 exploit](https://sploitus.com/exploit?id=775DA422-346E-5319-AB84-4DBEF106B57C&utm_source=rss&utm_medium=rss) -- Sec-News 安全文摘 - - [Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling](https://wiki.ioin.in/url/gdX3) -- unSafe.sh - 不安全 - - [Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling](https://buaq.net/go-122464.html) - - [The most hated people on the internet: Where are they now?](https://buaq.net/go-122451.html) - - [CISA and FBI issue alert about Zeppelin ransomware](https://buaq.net/go-122493.html) - - [A Deep Dive Into Black Basta Ransomware](https://buaq.net/go-122450.html) - - [VLANPWN - VLAN Attacks Toolkit](https://buaq.net/go-122444.html) - - [Two more malicious Python packages in the PyPI](https://buaq.net/go-122440.html) - - [首款国产新冠口服药，一场煤老板与科学家的孤注一掷](https://buaq.net/go-122438.html) - - [FreeBuf早报 | “抄家”特朗普后网络威胁激增；抖音上线溯源等功能治理不实信息](https://buaq.net/go-122512.html) - - [思源笔记 - 开源免费支持自建服务器 Markdown 笔记应用 (替代 Notion 印象笔记 / 可离线)](https://buaq.net/go-122441.html) - - [Hijack Libs](https://buaq.net/go-122426.html) - - [The curl release cycle](https://buaq.net/go-122437.html) - - [某安全设备frp流量告警分析](https://buaq.net/go-122466.html) -- SecWiki News - - [SecWiki News 2022-08-16 Review](http://www.sec-wiki.com/?2022-08-16) -- Trustwave Blog - - [Planning and Deploying Security Automation Leveraging MITRE ATT&CK and SHIELD with Microsoft Sentinel](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/planning-and-deploying-security-automation-leveraging-mitre-attck-and-shield-with-microsoft-sentinel/) - - [Trustwave Security Colony Noted as a Differentiator in Managed Detection and Response Market According to IDC Link Report](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-security-colony-noted-as-a-differentiator-in-managed-detection-and-response-market-according-to-idc-link-report/) -- 安全客-有思想的安全新媒体 - - [还不清楚CCS大会怎么玩？赶紧收藏这版漫游指南！](https://www.anquanke.com/post/id/278125) - - [APP合规实践3000问之三](https://www.anquanke.com/post/id/278000) - - [PHP代码审计](https://www.anquanke.com/post/id/277446) - - [CVE-2022-26135 Atlassian Jira Mobile Plugin SSRF漏洞分析](https://www.anquanke.com/post/id/277824) - - [ShitExpress匿名粪便礼宾网站遭攻击顾客信息泄露](https://www.anquanke.com/post/id/277995) -- paper - Last paper - - [南亚 Patchwork APT 组织新活动特点分析](https://paper.seebug.org/1943/) -- Recent Commits to cve:main - - [Update Tue Aug 16 05:21:23 UTC 2022](https://github.com/trickest/cve/commit/fffed2e8f0d2191387d876e9673916ec456d78c3) -- Sucuri Blog - - [SocGholish: 5+ Years of Massive Website Infections](https://blog.sucuri.net/2022/08/socgholish-5-years-of-massive-website-infections.html) -- obaby@mars - - [自己发给自己的垃圾邮件](http://h4ck.org.cn/2022/08/%e8%87%aa%e5%b7%b1%e5%8f%91%e7%bb%99%e8%87%aa%e5%b7%b1%e7%9a%84%e5%9e%83%e5%9c%be%e9%82%ae%e4%bb%b6/) - - [PHP升级记](http://h4ck.org.cn/2022/08/php%e5%8d%87%e7%ba%a7%e8%ae%b0/) -- Tenable Blog - - [Ransomware Preparedness: Why Organizations Should Plan for Ransomware Attacks Like Disasters](https://www.tenable.com/blog/ransomware-preparedness-why-organizations-should-plan-for-ransomware-attacks-like-disasters) -- Security Boulevard - - [AuditBoard Adds Ability to Assess Third-Party Risk](https://securityboulevard.com/2022/08/auditboard-adds-ability-to-assess-third-party-risk/) - - [ThreatMapper Integrates Steampipe to Enhance Security Observability](https://securityboulevard.com/2022/08/threatmapper-integrates-steampipe-to-enhance-security-observability/) - - [What the SEC Can Tell Us About Board Governance of Cyber Risk](https://securityboulevard.com/2022/08/what-the-sec-can-tell-us-about-board-governance-of-cyber-risk/) - - [Techstrong TV: GitGuardian Reports Leaked Secrets Doubled](https://securityboulevard.com/2022/08/gitguardian-reports-github-leaked-secrets-doubled/) - - [Cybersecurity in the Wake of Ukraine](https://securityboulevard.com/2022/08/cybersecurity-in-the-wake-of-ukraine/) - - [Nominations Now Open for Product Security Executive of the Year Awards!](https://securityboulevard.com/2022/08/nominations-now-open-for-product-security-executive-of-the-year-awards/) - - [New Awards Recognize Software Product Security Executives](https://securityboulevard.com/2022/08/new-awards-recognize-software-product-security-executives/) - - [Aspen Security Forum 2022 – Moderator: Peter Baker – Former U.S. National Security Advisors Reflect On The State Of The World](https://securityboulevard.com/2022/08/aspen-security-forum-2022-moderator-peter-baker-former-u-s-national-security-advisors-reflect-on-the-state-of-the-world/) - - [GUEST ESSAY: The key to a successful cloud migration – embrace a security-first strategy](https://securityboulevard.com/2022/08/guest-essay-the-key-to-a-successful-cloud-migration-embrace-a-security-first-strategy/) - - [1.5 Million Customers Impacted By US Bank Data Breach – Possible Lessons Learned](https://securityboulevard.com/2022/08/1-5-million-customers-impacted-by-us-bank-data-breach-possible-lessons-learned/) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [AsyncRAT C2 Framework: Overview, Technical Analysis & Detection](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Twitter @Nicolas Krassas - - [Hack365 – Day “One”](https://twitter.com/Dinosn/status/1559636136422772736) - - [Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling](https://twitter.com/Dinosn/status/1559635983406071809) - - [Microsoft Employees Exposed Own Company's Internal Logins](https://twitter.com/Dinosn/status/1559635050366484480) - - [StepSecurity releases tool that it used to improve security of 30 critical open-source projects…](https://twitter.com/Dinosn/status/1559634957127110659) - - [VLANPWN - VLAN Attacks Toolkit](https://twitter.com/Dinosn/status/1559605648295337987) - - [AEPIC Leak: Intel SGX PoC/exploit](https://twitter.com/Dinosn/status/1559605594381815809) - - [New MailChimp breach exposed DigitalOcean customer email addresses](https://twitter.com/Dinosn/status/1559605476278550529) - - [Microsoft's macOS Tamper Protection hits general availability](https://twitter.com/Dinosn/status/1559605386440761347) - - [ÆPIC and SQUIP Vulnerabilities Found in Intel and AMD Processors](https://twitter.com/Dinosn/status/1559605220925218818) - - [Windows Vulnerability Could Crack DC Server Credentials Open](https://twitter.com/Dinosn/status/1559605106584215553) - - [CS:GO trading site hacked to steal $6 million worth of skins](https://twitter.com/Dinosn/status/1559543695497650177) - - [Remotely Controlling Touchscreens](https://twitter.com/Dinosn/status/1559537542541754370) - - [Researcher details Apple Safari ICU Out-Of-Bounds Write (CVE-2022-32787) Flaw](https://twitter.com/Dinosn/status/1559537508437921792) - - [Concealed Code Execution: Tools and technical write-ups describing attacking techniques](https://twitter.com/Dinosn/status/1559537452179652608) - - [New Evil PLC Attack Weaponizes PLCs to Breach OT and Enterprise Networks](https://twitter.com/Dinosn/status/1559532229751148545) - - [CVE-2022-28756: Zoom Client for Meetings for macOS Privilege Escalation Flaw](https://twitter.com/Dinosn/status/1559532028693028864) - - [RT Jonathan Metzman: OSS-Fuzz recently found a trivial remote code execution exploit in tinygltf:](https://twitter.com/metzmanj/status/1559509125003972609) - - [Cobalt Strike UDRL for memory scanner evasion.](https://twitter.com/Dinosn/status/1559503517206953984) - - [An automatic unpacker and logger for DotNet Framework targeting files](https://twitter.com/Dinosn/status/1559503359345938432) - - [Hackers attack UK water supplier with 1.6 million customers](https://twitter.com/Dinosn/status/1559499385670705155) -- 跳跳糖 - 安全与分享社区 - - [XStream通览漏洞分析](https://tttang.com/archive/1699/) -- ZecOps Blog - - [Fake Droids: Your New Android Device is Actually an Old Android 6](https://blog.zecops.com/research/fake-droids-your-new-android-device-is-actually-an-old-android-6/) -- 安全脉搏 - - [记录一次wordpress渗透测试实战](https://www.secpulse.com/archives/185362.html) - - [红队快速打点工具](https://www.secpulse.com/archives/185346.html) - - [实战 | 记一次HOSTS碰撞突破边界](https://www.secpulse.com/archives/185335.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [齐向东：破解六大漏洞难题 夯实数字基建核心底座](https://www.4hou.com/posts/LBWA) - - [戳穿基于硬件的安全的四大流言](https://www.4hou.com/posts/8YWL) - - [联邦调查局：Zeppelin勒索软件使用了新的破坏方式和加密策略](https://www.4hou.com/posts/jJ5l) - - [南亚Patchwork APT组织新活动特点分析](https://www.4hou.com/posts/yk2P) - - [超大城市交通出行App个人信息合规评估实践](https://www.4hou.com/posts/wg2M) -- cloud world - - [2022 33 Open source weekly report](https://cloudsjhan.github.io/2022/08/16/2022-33-Open-source-weekly-report/) -- 小刀志 - - [基于海量样本数据的高级威胁发现](https://xiaodaozhi.com/security/195.html) -- ElcomSoft blog - - [Probing Linux Disk Encryption: LUKS2, Argon 2 and GPU Acceleration](https://blog.elcomsoft.com/2022/08/probing-linux-disk-encryption-luks2-argon-2-and-gpu-acceleration/) - - [Breaking Windows Passwords: LM, NTLM, DCC and Windows Hello PIN Compared](https://blog.elcomsoft.com/2022/08/breaking-windows-passwords-lm-ntlm-dcc-and-windows-hello-pin-compared/) -- Securelist - - [Two more malicious Python packages in the PyPI](https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218/) - - [Threat in your browser: what dangers innocent-looking extensions hold for users](https://securelist.com/threat-in-your-browser-extensions/107181/) -- SAP Blogs - - [Delimit EC Recurring Payments Using File Loads](https://blogs.sap.com/2022/08/16/delimit-ec-recurring-payments-using-file-loads/) - - [How a Futurist Works and Impacts the Future Direction of SAP](https://blogs.sap.com/2022/08/16/how-a-futurist-works-and-impacts-the-future-direction-of-sap/) - - [SAP S/4 HANA – Superordinate-Subordinate Relationships for Credit Limit Check](https://blogs.sap.com/2022/08/16/sap-s-4-hana-superordinate-subordinate-relationships-for-credit-limit-check/) - - [Copy Inspection Lot Results from One Lot to Other Lot](https://blogs.sap.com/2022/08/16/copy-inspection-lot-results-from-one-lot-to-other-lot/) - - [Managing credit memos for unplanned landed cost in Business ByDesign](https://blogs.sap.com/2022/08/16/managing-credit-memos-for-unplanned-landed-cost-in-business-bydesign/) - - [The Imperative of Green CX](https://blogs.sap.com/2022/08/16/the-imperative-of-green-cx/) - - [SAP Featured at Gartner Data and Analytics Summit 2022 as Premier Plus Sponsor](https://blogs.sap.com/2022/08/16/sap-featured-at-gartner-data-and-analytics-summit-2022-as-premier-plus-sponsor/) - - [Provide excellent customer service with SAP Service Ticket Intelligence](https://blogs.sap.com/2022/08/16/provide-excellent-customer-service-with-sap-service-ticket-intelligence/) - - [Next Generation Partnering for PDE in Utilities (partner demo environment)](https://blogs.sap.com/2022/08/16/next-generation-partnering-for-pde-in-utilities-partner-demo-environment/) -- Bug Bounty in InfoSec Write-ups on Medium - - [IW Weekly #16: AWS Vulnerability, Threat Hunting, Reflected XSS, Pentesting Resource, Command…](https://infosecwriteups.com/iw-weekly-16-aws-vulnerability-threat-hunting-reflected-xss-pentesting-resource-command-1b172801f2b7?source=rss----7b722bfd1b8d--bug_bounty) -- Reverse Engineering - - [Code execution exploit to run Doom inside Doom (for DOS)](https://www.reddit.com/r/ReverseEngineering/comments/wq0cxa/code_execution_exploit_to_run_doom_inside_doom/) - - [A Deep Dive Into Black Basta Ransomware](https://www.reddit.com/r/ReverseEngineering/comments/wpv46e/a_deep_dive_into_black_basta_ransomware/) -- Sucuri Blog - - [SocGholish: 5+ Years of Massive Website Infections](https://blog.sucuri.net/2022/08/socgholish-5-years-of-massive-website-infections.html) -- Hex Rays - - [IDA Teams: Documentation published](https://hex-rays.com/blog/ida-teams-documentation-published/) -- Zeddy's Blog - - [A Magic Way of XSS in HTTP/2](https://blog.zeddyu.info/2022/08/16/2022-08-10-h2-push/) -- Malwarebytes Labs - - [CISA and FBI issue alert about Zeppelin ransomware](https://www.malwarebytes.com/blog/news/2022/08/cisa-and-fbi-issue-alert-about-zeppelin-ransomware) -- The Daily Swig | Cybersecurity news and views - - [Legitimate hacking activities under UK law proposed by ‘expert consensus’](https://portswigger.net/daily-swig/legitimate-hacking-activities-under-uk-law-proposed-by-expert-consensus) - - [Multiple cloud vendors impacted by PostgreSQL vulnerability that exposed enterprise databases](https://portswigger.net/daily-swig/multiple-cloud-vendors-impacted-by-postgresql-vulnerability-that-exposed-enterprise-databases) -- daniel.haxx.se - - [The curl release cycle](https://daniel.haxx.se/blog/2022/08/16/the-curl-release-cycle/) -- r2c website - - [Shoulda, Woulda...Coulda](https://r2c.dev/blog/2022/shoulda-woulda-coulda/) -- blog.avast.com EN - - [The most hated people on the internet: Where are they now?](https://blog.avast.com/most-hated-people-internet-where-are-they-now) - - [Sharing personal information online: Do young people overdo it?](https://blog.avast.com/sharing-personal-information-online) -- 看雪学院 - - [Tenda摄像头分析](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464200&idx=1&sn=7c8ec0116459ab51017a7bd6ed796a28&chksm=b18e1f4286f99654fe7d34eeba171aeb169d393c2e120877dbf1de42198443961656759139a7&scene=58&subscene=0#rd) - - [因遭勒索软件攻击，阿根廷司法机构IT系统及门户网站关闭](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464200&idx=2&sn=5a54b86fba307bf7759e79d2c601028f&chksm=b18e1f4286f996540af7f15f0505e03570fb0cf394f7e3211323e49816f4f2473f263a533a0d&scene=58&subscene=0#rd) - - [《物联网安全入门》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464200&idx=3&sn=f646ffaf62d7df002026d238f2bd21e6&chksm=b18e1f4286f996549ee9897ceb27b593ae453d8ded1176e6099b04260c238fea55b264be79e3&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [VLANPWN - VLAN Attacks Toolkit](http://www.kitploit.com/2022/08/vlanpwn-vlan-attacks-toolkit.html) -- 信安之路 - - [零基础小白的信息安全奋斗史](https://mp.weixin.qq.com/s?__biz=MzI5MDQ2NjExOQ==&mid=2247497798&idx=1&sn=4be9377a54c445f208ca8c6d617b3486&chksm=ec1dc86edb6a4178ff439cec01a3e6a4d4d7611584640a4e26be220b6f07e1b5c63fd2b11716&scene=58&subscene=0#rd) -- 互联网安全内参 - - [阿根廷地方司法机构遭勒索软件攻击：IT系统全部关闭 被迫纸笔办公](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505288&idx=1&sn=bb5e8347316ddbdd6e3876a72862054d&chksm=ebfa92a8dc8d1bbe7a97e9b4561dc8239886570b99e609f9b559d9b50705e3be5df96c60700c&scene=58&subscene=0#rd) - - [德国政府强制实施安全浏览器](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505288&idx=2&sn=54b46ad0627ba453b1a9f42a55bf5999&chksm=ebfa92a8dc8d1bbe5dccb31cae25d2eeececed139a96feecf691bf03af8519b1249d5476966e&scene=58&subscene=0#rd) - - [邪恶PLC攻击：将PLC武器化，化作攻击跳板](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505288&idx=3&sn=7eb63af0ace36812b5ad6b98cb8c1209&chksm=ebfa92a8dc8d1bbec00fcf26904776c786742eb4f6d2a7181ce3df91a6d84f1c2edb393cdea1&scene=58&subscene=0#rd) - - [《网络安全标准实践指南——健康码防伪技术指南》公开征求意见](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505288&idx=4&sn=e6271e460be7616d7cd4c0067d1073fa&chksm=ebfa92a8dc8d1bbe49817ba7977e824c62467e133757dc6352bc4608852f2f7ced3daf3af55d&scene=58&subscene=0#rd) -- Twitter @hakivvi - - [RT Yarden Shafir: Getting lots of questions lately about how I approach a new research project. So here's a new post documenting the research process ...](https://twitter.com/yarden_shafir/status/1559583025398153222) -- 奇安信威胁情报中心 - - [BCS2022|大湾区网络安全峰会8月17日即将在深圳前海启幕](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247503269&idx=1&sn=c0b6271880e717a75cf319953b125be4&chksm=ea663ad2dd11b3c46adaf9f319fa48526c86c9d41487adac270563db0870d97a3b1744acc519&scene=58&subscene=0#rd) -- M01NTeam - - [直播预告 | 2023绿盟科技校园招聘在线答疑](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489304&idx=1&sn=d5a49263c884fc9975cfef60ad45e76b&chksm=c187d709f6f05e1fbc5248652172536f1b2650ff3412007ea8a8f438d5ddc6078205066c54aa&scene=58&subscene=0#rd) -- 安全牛 - - [从思科数据泄露看体系化勒索防护能力构建](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117343&idx=1&sn=3264c13de6a848af11979de4f65e3b71&chksm=bd1467cc8a63eeda22fa6164c993fc091933c665ff0905ff06eb604ac0c2e3ece4707a3bc756&scene=58&subscene=0#rd) - - [多因素身份验证（MFA）面临的安全挑战与应对](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117343&idx=2&sn=66f1e440d7df0805fa0f9ce116c098f7&chksm=bd1467cc8a63eeda01ab16cbce16fd070f6ac93587757cf9076afb4a6608f737dbd77b9da04b&scene=58&subscene=0#rd) - - [CNNVD通报微软多个安全漏洞，涉高危及以上等级漏洞56个](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117343&idx=3&sn=5519e317564cb5a4a7ad2dc77c2e34ab&chksm=bd1467cc8a63eeda4165f8620f83ceef479bbf2b850795bb70dd0f21503e63faf22621f3eae5&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [Django SQL注入漏洞分析｜CVE-2022-34265](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495711&idx=1&sn=067094678019f8e91b3b0beabf0ed95c&chksm=fa5225a1cd25acb7c61b649de2e23e1af8f442864375ac1ef6143675f0f541d5c49db72dfae5&scene=58&subscene=0#rd) -- 补天平台 - - [BCS2022|大湾区网络安全峰会8月17日即将在深圳前海启幕](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247494962&idx=1&sn=737a931fe4ad0538fb422bb8f64b3fdd&chksm=eaf9a57edd8e2c68638eadabaf4ceaff1843041b7bafe32996c8160e73f6ddaa69bd7ef55a2d&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [戳穿基于硬件的安全的四大流言](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548462&idx=1&sn=771f4e187657c9492b852e8a1fb2695b&chksm=e915ee14de6267021740d28a43b2454f6dd365013aab532d8d0f26913e36c89298cdece18fe6&scene=58&subscene=0#rd) - - [联邦调查局：Zeppelin勒索软件使用了新的破坏方式和加密策略](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548462&idx=2&sn=2f71c90b47c8154dfad55f2d2ca8ccde&chksm=e915ee14de626702418c5eff7e1c7483d43ad8a0a30043c2425674faadf5b220ce1981263f5e&scene=58&subscene=0#rd) -- 星阑科技 - - [星阑科技受邀第三届GIEC科技创新峰会进行主题演讲](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247494989&idx=1&sn=5099f809056ba52aa18726703969c2be&chksm=c00740d1f770c9c7be0b229eaa275eb16929703eeb2accc39eedadffa68ad88dcdbe29cf6b89&scene=58&subscene=0#rd) -- 极客公园 - - [「捕碳利用」，碳中和风口最热的「赔钱货」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964813&idx=1&sn=6794e562de4d438adde2c3151e15c90b&chksm=7e547a7b4923f36d17dd595bf4867b81e6ec90c2867257e59d3a937dba84bbe7f43bc3d113bb&scene=58&subscene=0#rd) - - [Keep 杀入运动综艺](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964813&idx=2&sn=9fe03bc833220f5ff83a8cdeffbffc79&chksm=7e547a7b4923f36d78751ab44f0b0f66ffccd217138ddd18f34c7c01aa88e2b75fb9d2a03ed1&scene=58&subscene=0#rd) - - [视频网站，不再是好生意](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964700&idx=1&sn=7871771e0cc3ca59d84199a8a54a443e&chksm=7e547aea4923f3fcb1a93135dc680f8779be119f66a3bd57db663f1d58aa9ba902b6d66cf714&scene=58&subscene=0#rd) - - [花钱买飞书，值不值？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964700&idx=2&sn=8a5f68bb72ff571233326b0a5c13ff11&chksm=7e547aea4923f3fca7658f7fb36e635147b8f9064f36aa224c6986543874773edc7f65522853&scene=58&subscene=0#rd) - - [Unity 拒绝 175 亿美元天价收购；周杰伦站台 NFT 暴跌 99%；特斯拉上海工厂 100 万辆车下线｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964675&idx=1&sn=c427f1ad8732f89361851c0039af542a&chksm=7e547af54923f3e364fc05a3874071a15b173984bd5ccd5be3c53336689a33e5aaa476859859&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [一文了解字节跳动 KubeZoo 的核心理念 —— 协议转换](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497519&idx=1&sn=59b4e5c716ba1d9296dc20a481bf7c77&chksm=e9d33ccddea4b5dbd27a27a21f4112924ec1afd90ea71ff9628f48d22f703619cdb79ac26bac&scene=58&subscene=0#rd) - - [【活动推荐】企业级大数据平台构建的思考与实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497519&idx=2&sn=1b0e5aa3561cfc6362ef861fd5a486b3&chksm=e9d33ccddea4b5db285b689639ef373e322371faf353834c8adc03eabcd8fccd9b6286a5b477&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Aug.16th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495749&idx=1&sn=379c5fac88ae4dd28ff2ede68918fe39&chksm=ce96bd7bf9e1346d0070ada0d818215eec4869f807464b9b74c155ca6710fb94b1728df614a0&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [今日“开战”，速来围观](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489332&idx=1&sn=454e12be5f178e984ec645208f0b72cc&chksm=fa9eec62cde96574eca4d306e2b6d5cb28ed188360f1aca4a4c26ecbdf5039fda6a806e6d821&scene=58&subscene=0#rd) -- 复旦白泽战队 - - [我实验室荣获网络安全顶会USENIX杰出论文奖！](https://mp.weixin.qq.com/s?__biz=MzU4NzUxOTI0OQ==&mid=2247485785&idx=1&sn=9f8ef35c902cf973117716f22dd966a3&chksm=fdeb8d27ca9c04315caf67837707a7b37f6c51fad3cd10da5a8d67af47380dd0bd4722edac20&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 全球数据跨境流动标准合同条款研究-香港篇](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530557&idx=1&sn=fa2ac1b96f86141d517573c4de37cd3e&chksm=fa93cefccde447ea41b29b28144d23dc39a01a4d471577ce889a8c82d794aeebb243acde2eaa&scene=58&subscene=0#rd) - - [PLC成攻击跳板--邪恶的PLC攻击：将PLC武器化](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530557&idx=2&sn=1b7fead602769b072c6318fb7e0e600b&chksm=fa93cefccde447ea6636c6c583eced54a0fd36a8dbc38fb4cb34a96094f543609fb2f17dc797&scene=58&subscene=0#rd) - - [为什么外部攻击面管理至关重要](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530557&idx=3&sn=db7027388378270b5c33b6d4ae4579b5&chksm=fa93cefccde447eaae8805cb5d34535465facb3497d67d081ad009339aae4112fe25f86cf329&scene=58&subscene=0#rd) - - [超过9000台VNC服务器在没有密码的情况下暴露](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530557&idx=4&sn=ac7dd8e62ca04b26a49936ca4f0e6a66&chksm=fa93cefccde447ea294c8139378fea3a1c25266f0e812a1e8928df9c92eab6d9fa4cfedb207d&scene=58&subscene=0#rd) -- 中国信息安全 - - [专题·医疗数据安全 | 健康医疗数据安全服务体系建设思考](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163715&idx=1&sn=57458bae101cb1fa19a0d73c1cd7c6db&chksm=8b5eeb7abc29626c190f199e5aba5737dc38839767ede54a85e83fbbdcc41ee30c68287c2517&scene=58&subscene=0#rd) - - [通知 | 《网络安全标准实践指南——健康码防伪技术指南（征求意见稿）》公开征求意见](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163715&idx=2&sn=b7f63d7bc39b19e04095cf6cae9409b0&chksm=8b5eeb7abc29626cc57fd5d46531185164c1f75be0f5723f586ebedad3f755e6189773206105&scene=58&subscene=0#rd) - - [票交所：各会员机构应加强自身信息系统安全保障措施](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163715&idx=3&sn=bf5972338776732bb4faa9f1b79dbbbe&chksm=8b5eeb7abc29626c36395436f8326507b974a6a24ff5d04193afa57e2b910c5e56a984b9ce6d&scene=58&subscene=0#rd) - - [前沿 | 关口前移，防患于未然——5G时代的网络安全风险趋势与产业应对思考](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163715&idx=4&sn=3b823de28bac1003f24c90bc77f86468&chksm=8b5eeb7abc29626c630678d4db3283470b23c5a580901277c55bf37d7de9aeebda68feffb055&scene=58&subscene=0#rd) - - [关注 | 首届“安全可信领军人物”“安全可信解决方案”“安全可信突出贡献企业”评选表彰活动进行中](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163715&idx=5&sn=b9193619c95816e5e5eb7df986845096&chksm=8b5eeb7abc29626ca75b922d8557dab0019e850ccc292b84228056df8797107cafb29486e9bd&scene=58&subscene=0#rd) -- 三六零CERT - - [Xanthe挖矿僵尸网络卷土重来](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491319&idx=1&sn=4b3ee846826c83582e816b6f89513d88&chksm=fe251bf6c95292e0a9c25f86966aa09dc0064dfc0e671859b50601c7dd1526eff165e68ed04e&scene=58&subscene=0#rd) - - [安全日报（2022.08.16）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491319&idx=2&sn=1edf44c37e283f522466beb32f3596ff&chksm=fe251bf6c95292e04c7543083d8aedbb0985dc54608ac72dba91138177dca1c9aa522bfe6e85&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-18.md b/archive/2022/2022-08-18.md deleted file mode 100644 index beed065bbc..0000000000 --- a/archive/2022/2022-08-18.md +++ /dev/null @@ -1,179 +0,0 @@ -# 每日安全资讯（2022-08-18） - -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5526-2](https://packetstormsecurity.com/files/168104/USN-5526-2.txt) - - [Red Hat Security Advisory 2022-6079-01](https://packetstormsecurity.com/files/168103/RHSA-2022-6079-01.txt) - - [Red Hat Security Advisory 2022-6073-01](https://packetstormsecurity.com/files/168102/RHSA-2022-6073-01.txt) - - [Red Hat Security Advisory 2022-6075-01](https://packetstormsecurity.com/files/168101/RHSA-2022-6075-01.txt) - - [Red Hat Security Advisory 2022-6078-01](https://packetstormsecurity.com/files/168100/RHSA-2022-6078-01.txt) - - [Hacking Zyxel IP Cameras To Get A Root Shell](https://packetstormsecurity.com/files/168099/hacking-zyxel-ip-cameras.pdf) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [TypeORM 0.3.7 Information Disclosure](https://cxsecurity.com/issue/WLB-2022080057) -- Recent Commits to cve:main - - [Update Wed Aug 17 05:24:44 UTC 2022](https://github.com/trickest/cve/commit/61105fc4127b4a8212833df4351b5d704d618913) -- SecWiki News - - [SecWiki News 2022-08-17 Review](http://www.sec-wiki.com/?2022-08-17) -- paper - Last paper - - [AdobeReader 逻辑漏洞分享 (CVE-2021-21037)](https://paper.seebug.org/1944/) -- obaby@mars - - [Cravatar替代Gravatar](http://h4ck.org.cn/2022/08/cravatar%e6%9b%bf%e4%bb%a3gravatar/) -- 先知安全技术社区 - - ["容器逃逸失败"案例分析](https://xz.aliyun.com/t/11623) - - [【云攻防系列】玩转eBPF---关于内核运行时安全的那些事儿](https://xz.aliyun.com/t/11636) - - [记一次web登录通杀渗透测试](https://xz.aliyun.com/t/11612) -- Twitter @Nicolas Krassas - - [Hack365 – Day Two](https://twitter.com/Dinosn/status/1559988785185804289) - - [Several powerful primitives for exploiting the macOS kernel may never get fixed](https://twitter.com/Dinosn/status/1559973204105601025) - - [Spammers use Google Translate to bypass Domain-Blacklists](https://twitter.com/Dinosn/status/1559965865147355136) - - [North Korean hackers use signed macOS malware to target IT job seekers](https://twitter.com/Dinosn/status/1559954332686098433) - - [Malware devs already bypassed Android 13's new security feature](https://twitter.com/Dinosn/status/1559954203535151106) - - [Thoma Bravo Closes $6.9B Acquisition of Identity-Security Vendor SailPoint](https://twitter.com/Dinosn/status/1559954124745097216) - - [RT Orange Tsai 🍊: Just wrote a short write-up on my latest research at #BHUSA and #DEFCON! You can check the slides and video there! Let's Dance in...](https://twitter.com/orange_8361/status/1559950649806438401) - - [RT Ali Beydoun | 19: 3 Months Ago I Started Hacking: - Built A FUD RAT with @kaangultekin01 With An Insane Amount Of Features! -Playing CTFS & Bypassi...](https://twitter.com/itscyberali/status/1559908063712346112) - - [RT PT SWARM: 🐳 Red Hat fixed an Unauth XXE (CVE-2022-2414) in FreeIPA found by our researcher @elk0kc. In some cases, it allows attackers to read t...](https://twitter.com/ptswarm/status/1559893047327997954) - - [Cisco ASA Software and ASDM Security Research](https://twitter.com/Dinosn/status/1559888167314112512) - - [Researchers Link Multi-Year Mass Credential Theft Campaign to Chinese Hackers](https://twitter.com/Dinosn/status/1559886102932103169) - - [New Google Chrome Zero-Day Vulnerability Being Exploited in the Wild](https://twitter.com/Dinosn/status/1559880600860884993) - - [SitePoint - 1,021,790 breached accounts](https://twitter.com/Dinosn/status/1559880507952926721) - - [North Korea Hackers Spotted Targeting Job Seekers with macOS Malware](https://twitter.com/Dinosn/status/1559814592385224705) - - [Russian military uses Chinese drones and bots in combat, over manufacturers' protests](https://twitter.com/Dinosn/status/1559814504388632576) - - [Windows KB5012170 update causing BitLocker recovery screens, boot issues](https://twitter.com/Dinosn/status/1559814101068554242) - - [Threatest is a Go framework for end-to-end testing threat detection rules.](https://twitter.com/Dinosn/status/1559813189382160384) - - [A DTrace on Windows Reimplementation](https://twitter.com/Dinosn/status/1559809428744011776) -- WeiyiGeek Blog - - [Gitalk-基于Github项目issue的评论系统在博客系统中实践](https://blog.weiyigeek.top/2022/8-17-682.html) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Atlassian Confluence : Questions for Confluence App – Hardcoded Credentials (CVE-2022-26138)](https://blog.qualys.com/category/vulnerabilities-threat-research) -- 先知安全技术社区 - - ["容器逃逸失败"案例分析](https://xz.aliyun.com/t/11623) - - [【云攻防系列】玩转eBPF---关于内核运行时安全的那些事儿](https://xz.aliyun.com/t/11636) - - [记一次web登录通杀渗透测试](https://xz.aliyun.com/t/11612) -- unSafe.sh - 不安全 - - [【云攻防系列】玩转eBPF---关于内核运行时安全的那些事儿](https://buaq.net/go-122610.html) - - [记一次web登录通杀渗透测试](https://buaq.net/go-122611.html) - - [$6 million heist targets video game skin trading site](https://buaq.net/go-122631.html) - - [Nearly 2,000 Signal users affected by Twilio phishing attack](https://buaq.net/go-122633.html) - - [Cobalt Strike 4.7: The 10th Anniversary Edition](https://buaq.net/go-122597.html) - - [Black Hat USA 2022 and DEF CON 30](https://buaq.net/go-122591.html) - - [Using mutants to improve Slither](https://buaq.net/go-122592.html) - - [Hoaxshell - An Unconventional Windows Reverse Shell, Currently Undetected By Microsoft Defender And Various Other AV Solutions, Solely Based On Http(S) Traffic](https://buaq.net/go-122586.html) - - [FreeBuf早报 | 卡巴斯基实验室开发防黑客手机；微软为 Mac 推出篡改保护](https://buaq.net/go-122670.html) -- 安全客-有思想的安全新媒体 - - [2022CCS大会议题前瞻 CCS&字节跳动安全中心 - 云安全实战分论坛](https://www.anquanke.com/post/id/278192) - - [HVV 样本：一个只能在 x64 中运行的 x32 Cobalt Strike](https://www.anquanke.com/post/id/277961) - - [EGD被黑客攻击损失超3.6万 BUSD，事件分析](https://www.anquanke.com/post/id/278035) - - [基于边界节点链路交互C2流量](https://www.anquanke.com/post/id/278140) - - [俄罗斯Gamaredon黑客组织对乌克兰发动钓鱼攻击](https://www.anquanke.com/post/id/278031) -- 跳跳糖 - 安全与分享社区 - - [CodeQL数据库构建原理分析](https://tttang.com/archive/1704/) - - [二次反序列化 看我一命通关](https://tttang.com/archive/1701/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [BCS2022齐向东：网安市场将现规模扩容和占比增大双轮驱动](https://www.4hou.com/posts/RBjK) - - [物联网僵尸网络已成为助长DDoS攻击的土壤](https://www.4hou.com/posts/wgn1) - - [朝鲜黑客攻击deBridge加密货币平台](https://www.4hou.com/posts/EQ10) -- 安全脉搏 - - [干货 | 渗透中403/401页面绕过的思路总结](https://www.secpulse.com/archives/185440.html) - - [电子数据取证](https://www.secpulse.com/archives/185392.html) - - [某安全设备frp流量告警分析](https://www.secpulse.com/archives/185408.html) - - [【云攻防系列】玩转eBPF—关于内核运行时安全的那些事儿](https://www.secpulse.com/archives/185357.html) -- Security Boulevard - - [Security Automation Crash Course: Which Workflows Should I Automate?](https://securityboulevard.com/2022/08/security-automation-crash-course-which-workflows-should-i-automate/) - - [Close the DevSecOps divide with Ted Lassos](https://securityboulevard.com/2022/08/close-the-devsecops-divide-with-ted-lassos/) - - [Techstrong TV: Addressing Cybersecurity Tool Sprawl](https://securityboulevard.com/2022/08/techstrong-tv-addressing-cybersecurity-tool-sprawl/) - - [Facing the Shift-Left Security Conundrum. A True Story](https://securityboulevard.com/2022/08/facing-the-shift-left-security-conundrum-a-true-story/) - - [Aspen Security Forum 2022 – Anja Manuel – Aspen Security Forum Closing Remarks](https://securityboulevard.com/2022/08/aspen-security-forum-2022-anja-manuel-aspen-security-forum-closing-remarks/) - - [Techstrong TV: Anomali Reveals Current Threat Landscape](https://securityboulevard.com/2022/08/techstrong-tv-anomali-reveals-current-threat-landscape/) - - [How FICO Gained Visibility and Control to Secure its Atomized Network](https://securityboulevard.com/2022/08/how-fico-gained-visibility-and-control-to-secure-its-atomized-network/) - - [DevSecOps is no longer a consideration—it’s a necessity](https://securityboulevard.com/2022/08/devsecops-is-no-longer-a-consideration-its-a-necessity/) - - [Daniel Stori’s ‘terminal transparency’](https://securityboulevard.com/2022/08/daniel-storis-terminal-transparency/) - - [LogonBox SSPR 2.3.16](https://securityboulevard.com/2022/08/logonbox-sspr-2-3-16/) -- 博客园 - 挖洞的土拨鼠 - - [隐私协议那些事 - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16593856.html) - - [实战还原--从大黄蜂样本到域控管理员技术解析 - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16595912.html) -- SpiderLabs Blog from Trustwave - - [Overview of the Cyber Weapons Used in the Ukraine - Russia War](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/) -- SAP Blogs - - [Crowd-sourced tips for getting started with SAP Screen Personas](https://blogs.sap.com/2022/08/17/crowd-sourced-tips-for-getting-started-with-sap-screen-personas/) - - [Five Reasons Companies Should Attend ASUG Best Practices for Oil, Gas, and Energy Conference](https://blogs.sap.com/2022/08/17/five-reasons-companies-should-attend-asug-best-practices-for-oil-gas-and-energy-conference/) - - [Unlock the power of hyperautomation for financial management processes](https://blogs.sap.com/2022/08/17/unlock-the-power-of-hyperautomation-for-financial-management-processes/) - - [Day in the life of a Material Buyer – 1](https://blogs.sap.com/2022/08/17/day-in-the-life-of-a-material-buyer-1/) - - [SAP BTP Serverless Runtime to SAP BTP Kyma Runtime Migration Examples](https://blogs.sap.com/2022/08/17/sap-btp-serverless-runtime-to-sap-btp-kyma-runtime-migration-examples/) - - [SAP Analytics Cloud – Passing URL Parameters between Analytic Applications](https://blogs.sap.com/2022/08/17/sap-analytics-cloud-passing-url-parameters-between-analytic-applications/) - - [Supply Chain in SAP S/4HANA Cloud 2208](https://blogs.sap.com/2022/08/17/supply-chain-in-sap-s-4hana-cloud-2208/) - - [Was sind die zentralen Bereiche im SAP Organizational Change Management?](https://blogs.sap.com/2022/08/17/was-sind-die-zentralen-bereiche-im-sap-organizational-change-management/) -- Malwarebytes Labs - - [$6 million heist targets video game skin trading site](https://www.malwarebytes.com/blog/business/2022/08/6m-heist-targets-video-game-skin-trading-site) - - [Nearly 2,000 Signal users affected by Twilio phishing attack](https://www.malwarebytes.com/blog/news/2022/08/nearly-2000-signal-users-compromised-after-twilio-phishing-attack) - - [Update Chrome now! Google issues patch for zero day spotted in the wild](https://www.malwarebytes.com/blog/news/2022/08/update-chrome-now-google-issues-patch-for-zero-day-spotted-in-the-wild) - - [Ransomwater confusion, does the criminal know who the victim is?](https://www.malwarebytes.com/blog/news/2022/08/ransomwater-confusion-does-the-criminal-know-who-the-victim-is) - - [How to secure a Windows PC for your kids](https://www.malwarebytes.com/blog/personal/2022/08/back-to-school-how-to-secure-your-childs-windows-pc) -- SentinelOne - - [More Evil Markets | How It’s Never Been Easier To Buy Initial Access To Compromised Networks](https://www.sentinelone.com/blog/more-evil-markets-how-its-never-been-easier-to-buy-initial-access-to-compromised-networks/) -- Reverse Engineering - - [1day to 0day(CVE-2022-30024) on TP-Link TL-WR841N](https://www.reddit.com/r/ReverseEngineering/comments/wr0333/1day_to_0daycve202230024_on_tplink_tlwr841n/) - - [USENIX Paper: Augmenting Decompiler Output with Learned Variable Names and Types](https://www.reddit.com/r/ReverseEngineering/comments/wqiw5j/usenix_paper_augmenting_decompiler_output_with/) - - [Launched a new blog series on reverse engineering PALs](https://www.reddit.com/r/ReverseEngineering/comments/wqgb06/launched_a_new_blog_series_on_reverse_engineering/) -- Securelist - - [Black Hat USA 2022 and DEF CON 30](https://securelist.com/black-hat-usa-2022-and-def-con-30/107184/) -- blog.avast.com EN - - [Improve Your Middle Schooler's Digital Literacy | Avast](https://blog.avast.com/improve-middle-schoolers-digital-literacy) -- Toooold - - [Zero hacking problem: do we really protect the customers?](https://toooold.com/2022/08/17/one_hundred_machines.html) -- Application Security Blog - - [DevSecOps is no longer a consideration—it’s a necessity](https://www.synopsys.com/blogs/software-security/gartner-critical-capabilities-appsec-devsecops/) -- Didier Stevens - - [Update: 1768.py Version 0.0.15](https://blog.didierstevens.com/2022/08/17/update-1768-py-version-0-0-15/) -- RET2 Systems Blog - - [The LDT, a Perfect Home for All Your Kernel Payloads](https://blog.ret2.io/2022/08/17/macos-dblmap-kernel-exploitation/) -- Orange - - [Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!](http://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html) -- The Daily Swig | Cybersecurity news and views - - [Swiss Post relaunches e-voting bug bounty program](https://portswigger.net/daily-swig/swiss-post-relaunches-e-voting-bug-bounty-program) - - [Developers still struggling with security issues during code reviews, study finds](https://portswigger.net/daily-swig/developers-still-struggling-with-security-issues-during-code-reviews-study-finds) -- Twitter @hakivvi - - [RT Orange Tsai 🍊: Just wrote a short write-up on my latest research at #BHUSA and #DEFCON! You can check the slides and video there! Let's Dance in...](https://twitter.com/orange_8361/status/1559950649806438401) - - [RT ‌Renwa: Asana Electron desktop app open redirect to local file read Did you knew local files in Electron have file:// origin not null, with anothe...](https://twitter.com/RenwaX23/status/1559794523773218816) -- KitPloit - PenTest & Hacking Tools - - [Hoaxshell - An Unconventional Windows Reverse Shell, Currently Undetected By Microsoft Defender And Various Other AV Solutions, Solely Based On Http(S) Traffic](http://www.kitploit.com/2022/08/hoaxshell-unconventional-windows.html) -- 酒仙桥六号部队 - - [远控免杀从入门到实践 | 技术精选0141](https://mp.weixin.qq.com/s?__biz=MzAwMzYxNzc1OA==&mid=2247500717&idx=1&sn=173a8ab3c26ec92fd78efb72be891993&chksm=9b3ae51cac4d6c0a332b691fa10dd362a7ceafdee28ccdc054a6241e54a6142fbd6be0258c94&scene=58&subscene=0#rd) -- Trail of Bits Blog - - [Using mutants to improve Slither](https://blog.trailofbits.com/2022/08/17/using-mutants-to-improve-slither/) -- Chen's Blog - - [我眼中的红队](https://gh0st.cn/archives/2022-08-18/1) -- 奇安信病毒响应中心 - - [加密币应用的疯狂增长](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247491119&idx=1&sn=fb5e3d823787aa5d342cb40e4debd1ff&chksm=ec6a6e07db1de711936c35e82c3a362cb2c703a22c4aafdefa4ea21e66f3f233a666573cd50c&scene=58&subscene=0#rd) -- Checkmarx.com - - [Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#](https://checkmarx.com/blog/malicious-pypi-user-strikes-again-with-typosquatting-starjacking-and-unpacks-tailor-made-malware-written-in-c/) -- 奇安信CERT - - [Google Chrome 代码执行漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496847&idx=1&sn=a8f69c0983e07ffffa3d5e187eeb09b2&chksm=fe79d017c90e5901dec562d02ce090efadb4c9c87928eb4ee3c2b684a6fe2443f07d22abee20&scene=58&subscene=0#rd) -- 安全牛 - - [深度伪造Deepfakes正在打开网络安全的“潘多拉魔盒”](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117628&idx=1&sn=6efc990fcfb313d01836d7a34ff350c9&chksm=bd1468ef8a63e1f96942784b413cfe265867a43de333058823f269ece0c0bd2a4ab415ba1418&scene=58&subscene=0#rd) - - [《关键信息基础设施安全保护条例》颁布一周年，不断推动条例落地意义重大](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117628&idx=2&sn=beff7b359d72033c32ffcbd5ddbe9f11&chksm=bd1468ef8a63e1f9acee3ce112504f70f827e9cabf7f72b5fd4dc93884094fc504c33a9d9df0&scene=58&subscene=0#rd) - - [发布会预告 丨 《安全SD-WAN应用指南》线上发布会](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117628&idx=3&sn=24aca171819f5cd2f1e49ab9b94e90a6&chksm=bd1468ef8a63e1f9ffbc57081dd1e1343a77c3403568a12df5b672f074fba6923259c88568ab&scene=58&subscene=0#rd) -- SecIN技术平台 - - [原创 | 如何对登录接口加密字段进行暴破？](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494824&idx=1&sn=fede258a15dd544b03be182c1f8592ed&chksm=eb84b1fcdcf338ea0943f91a15d191ada35725650790a75778f0f8e4ac85eb5a89c2c9c73271&scene=58&subscene=0#rd) -- 无害实验室sec - - [【年度神卡】29元/月：70G全国流量+30G定向，20年长期套餐（不套路，限时领取）](https://mp.weixin.qq.com/s?__biz=MzkwMTE4NDM5NA==&mid=2247485998&idx=1&sn=d140d1640ff0df40bc23e90d3873bfd5&chksm=c0b9e4cbf7ce6dddd4ecf12375074380ec51a3e1b61a91adee784bbb3ae5faef5fa43798272a&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [议题曝光|2022CCS安全范儿云安全实战论坛](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489359&idx=1&sn=c6bd1416ec77a6e537002576f6957952&chksm=fa9eec19cde9650f2ecdb246108190c0c1506af2531a7652afc8134344e6713ccb01c0df9baf&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [安全通告 | PyPI近期遭若干恶意包投毒](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247490362&idx=1&sn=4880a5f0208c45a84a1f31ce8ec947f1&chksm=ec1bfae9db6c73ff8e2d8ca3d872231d8c6605627815234bad879d81c5b7dba203e6cfc258b9&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [3.7 Smooth Numbers Sieves Building Relations for Factorization](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495782&idx=1&sn=45b051047d5b28996d0cbdd8a4c4b360&chksm=fa5225d8cd25accebf0f09d91f402c7459e05232fbdf2ece986343ac37c9706b2de245774561&scene=58&subscene=0#rd) -- Akkuman 的博客 - - [frp 源码阅读](//hacktech.cn/2022/08/17/frp-source-read/) -- 青藤云安全 - - [打了15天，如何做到在容器权限上不失一分？](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650836583&idx=1&sn=73cf14f530ed2edd9ab11b819a63eef3&chksm=80dbedc2b7ac64d4a6f8d9c7c7e75a2c7c02d68199e56075ec07b17ad718cbf7ca2baa4f42d8&scene=58&subscene=0#rd) -- 中国信息安全 - - [发布 | 中共中央办公厅 国务院办公厅印发《“十四五”文化发展规划》](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163773&idx=1&sn=75f1a159cdee600ac362576617c7a957&chksm=8b5eeb44bc29625254f7f524003f6f662e69ab524d266f7aff76eeff80e6381d6021fd9cd9e8&scene=58&subscene=0#rd) - - [专题·漏洞治理 | 面向实战的漏洞运营实践](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163773&idx=2&sn=58c0dc18583d05daace5aefc8ca52f88&chksm=8b5eeb44bc2962526f98098ccc1f8d4596492aa86ceaf679145f8760a89d7a5e54494acb3cb7&scene=58&subscene=0#rd) - - [观点 | 数据安全管理关乎智能汽车竞争胜负](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163773&idx=3&sn=94accb916d299b5798a6e74a2ebf6708&chksm=8b5eeb44bc29625210a5ae32414fb5d73feb2b7fa28f68453b56ad64a0caaf21b27c0c0dd23b&scene=58&subscene=0#rd) - - [关注 | 2022年7月全国受理网络违法和不良信息举报1441.4万件](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163773&idx=4&sn=001d8c965de0933a5f0ae085a8b18302&chksm=8b5eeb44bc29625235809907c5db90210b77bc2063023a40a7bd7ec7fbf8a034b313e815e1c0&scene=58&subscene=0#rd) -- 极客公园 - - [汽车行业，躲不过「高通税」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964955&idx=1&sn=40e5fb3296d6d0aea95b9cefb049e0a6&chksm=7e5475ed4923fcfbf079c9d72060a91ce42121c727bf80373916cdf6a3b4e23f0ebfce9db550&scene=58&subscene=0#rd) - - [量子计算+AI，未来已来](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964955&idx=2&sn=6f76298bcc340920adb626ed1091dbd1&chksm=7e5475ed4923fcfb0b5f97c7121f8cca44e48bf461d69e3d9ad360b6ba0d6041bb1c3f0e5f91&scene=58&subscene=0#rd) - - [传腾讯将减持美团，后者股价大跌；WeWork 创始人新项目融资，继续做「地产」；「权游」前传《龙之家族》本周末开播｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964850&idx=1&sn=ed1e6d96b2ea05b954629192ff4f238b&chksm=7e547a444923f35264cdd918fc00f24682c0de74f3b27f94b18f287735eba81a91f1dcc7344f&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [物联网僵尸网络已成为助长DDoS攻击的土壤](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548504&idx=1&sn=ae93ddcc3400535a66d4013182f2629a&chksm=e915ee62de626774ee8b6cd38641139531bb2f9b2a5e6c7246a87f65dedbcc1f4c32e618a232&scene=58&subscene=0#rd) - - [朝鲜黑客攻击deBridge加密货币平台](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548504&idx=2&sn=857225dfed6cff8c34410637bff0c065&chksm=e915ee62de62677457899ffe4c3e886ab5afe01cf3375b19d0bffef883c36fa3d3868f4d8b66&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-19.md b/archive/2022/2022-08-19.md deleted file mode 100644 index 22f3f342cf..0000000000 --- a/archive/2022/2022-08-19.md +++ /dev/null @@ -1,187 +0,0 @@ -# 每日安全资讯（2022-08-19） - -- Sploitus.com Exploits RSS Feed - - [Polar Flow Android 5.7.1 Secret Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:168106&utm_source=rss&utm_medium=rss) - - [Advantech iView NetworkServlet Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168108&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Read in Google Android exploit](https://sploitus.com/exploit?id=BF09EDF9-3A6C-5330-BF63-B7729A617676&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Google Android exploit](https://sploitus.com/exploit?id=8A7995AD-8EDC-5211-8404-3220FE98DD9D&utm_source=rss&utm_medium=rss) -- Sec-News 安全文摘 - - [Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!](https://wiki.ioin.in/url/lEXp) -- Twitter @Nicolas Krassas - - [Intercept Flutter traffic on iOS and Android (HTTP/HTTPS/Dio Pinning)](https://twitter.com/Dinosn/status/1560336254788685825) - - [XOpcodeCalc 0.05 x86/64 Opcode calculator for macOS, Linux and Windows.](https://twitter.com/Dinosn/status/1560336088132206595) - - [Hardware-based threat defense against increasingly complex cryptojackers](https://twitter.com/Dinosn/status/1560334285458087937) - - [Summertime Blues: TA558 Ramps Up Attacks on Hospitality, Travel Sectors](https://twitter.com/Dinosn/status/1560333799166283776) - - [Janet Jackson's music video is now a vulnerability for crashing hard disks](https://twitter.com/Dinosn/status/1560333022309785601) - - [Google blocks largest HTTPS DDoS attack 'reported to date'](https://twitter.com/Dinosn/status/1560332566292561922) - - [Forking Ethereum](https://twitter.com/Dinosn/status/1560317135808856065) - - [Winnti hackers splits Cobalt Strike into 154 pieces to evade detection](https://twitter.com/Dinosn/status/1560298311508041728) - - [BlackByte ransomware v2 is out with new extortion novelties](https://twitter.com/Dinosn/status/1560298111196663808) - - [USB “Rubber Ducky” Attack Tool](https://twitter.com/Dinosn/status/1560273673486880769) - - [PoC exploit code for critical Realtek RCE flaw released online](https://twitter.com/Dinosn/status/1560176279567089669) - - [RT Pentagrid AG: Our colleague Ole (@forkwerks) found vulnerabilities in the @printixnet Cloud Print Management that lead to an elevation of privilege...](https://twitter.com/pentagridsec/status/1560172197892788230) - - [RT Qazeer: Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandb...](https://twitter.com/_Qazeer/status/1560155242796404739) - - [RT dozer: The Aruba AP CLI support password calculation script from my #defcon30 presentation is available here:](https://twitter.com/dozernz/status/1560153448024121345) - - ['DarkTortilla' Malware Wraps in Sophistication for High-Volume RAT Infections](https://twitter.com/Dinosn/status/1560139185830371328) - - [Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!](https://twitter.com/Dinosn/status/1560137204806066177) - - [Software developer cracks Hyundai car security with Google search](https://twitter.com/Dinosn/status/1560137132852789248) -- Security Boulevard - - [PwC Survey Finds C-Level Execs View Cybersecurity as Biggest Risk](https://securityboulevard.com/2022/08/pwc-survey-finds-c-level-execs-view-cybersecurity-as-biggest-risk/) - - [Building a modern API security strategy — API protection](https://securityboulevard.com/2022/08/building-a-modern-api-security-strategy-api-protection/) - - [How to scan for cybersecurity risks on every commit with CodeSec & Git Hooks](https://securityboulevard.com/2022/08/how-to-scan-for-cybersecurity-risks-on-every-commit-with-codesec-git-hooks/) - - [CyRC Case Study: Exploitable memory corruption using CVE-2020-25669 and Linux Kernel](https://securityboulevard.com/2022/08/cyrc-case-study-exploitable-memory-corruption-using-cve-2020-25669-and-linux-kernel/) - - [Secure serverless code for free with CodeSec – Now available in AWS Marketplace](https://securityboulevard.com/2022/08/secure-serverless-code-for-free-with-codesec-now-available-in-aws-marketplace/) - - [What is CSPM? Why Is It Important?](https://securityboulevard.com/2022/08/what-is-cspm-why-is-it-important/) - - [Client-Side Security: A Win, Win, Win in Cyber Security Risk Mitigation](https://securityboulevard.com/2022/08/client-side-security-a-win-win-win-in-cyber-security-risk-mitigation/) - - [BSidesTLV 2022 – Marina Krotofil’s ‘Kinetic And Cyberwarfare: Twins, Siblings Or Distant Relatives? Or Why Bombs Speak Louder Than Electronic Bits’](https://securityboulevard.com/2022/08/bsidestlv-2022-marina-krotofils-kinetic-and-cyberwarfare-twins-siblings-or-distant-relatives-or-why-bombs-speak-louder-than-electronic-bits/) - - [The Week in Cybersecurity: Cybercrime growth outpaces the security industry](https://securityboulevard.com/2022/08/the-week-in-cybersecurity-cybercrime-growth-outpaces-the-security-industry/) - - [Debunking myths around RASP (Runtime Application Self-Protection) technology](https://securityboulevard.com/2022/08/debunking-myths-around-rasp-runtime-application-self-protection-technology/) -- Microsoft Security Blog - - [Hardware-based threat defense against increasingly complex cryptojackers](https://www.microsoft.com/security/blog/2022/08/18/hardware-based-threat-defense-against-increasingly-complex-cryptojackers/) - - [Connect with Microsoft Security experts at the 2022 Gartner Identity & Access Management Summit](https://www.microsoft.com/security/blog/2022/08/18/connect-with-microsoft-security-experts-at-the-2022-gartner-identity-access-management-summit/) -- Recent Commits to cve:main - - [Update Thu Aug 18 05:23:06 UTC 2022](https://github.com/trickest/cve/commit/23cfc86000973a8e3a374f1792dd80944244c412) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [在企业 EDR 环境中模拟 Phineas Phisher 发起的对 Hacking Team 的攻击](https://www.4hou.com/posts/N1Wp) - - [关键基础设施攻击剧增：英国水务公司遭遇Clop勒索软件攻击](https://www.4hou.com/posts/WBov) - - [漏洞预警|Apache OpenOffice 密码加密强度不足漏洞](https://www.4hou.com/posts/XVpA) -- 安全客-有思想的安全新媒体 - - [Chainalysis报告：市场低迷对加密货币犯罪活动有什么影响？](https://www.anquanke.com/post/id/278289) - - [俄罗斯统一俄罗斯党官网近期多次遭黑客攻击](https://www.anquanke.com/post/id/278286) - - [微软员工在GitHub上意外泄露内部敏感登录凭据](https://www.anquanke.com/post/id/278283) - - [肯尼亚落选总统候选人称选举系统遭黑客攻击](https://www.anquanke.com/post/id/278279) - - [苹果发布iOS/iPadOS/macOS维护更新 修复多处高危安全漏洞](https://www.anquanke.com/post/id/278276) - - [记一次APP登录爆破](https://www.anquanke.com/post/id/277766) - - [南亚Patchwork APT组织新活动特点分析](https://www.anquanke.com/post/id/278029) - - [远控免杀专题(71)-Donut免杀任意可执行文件(VT免杀率30-67)](https://www.anquanke.com/post/id/277806) - - [黑客成功攻击英国供水商却敲诈到另一家头上](https://www.anquanke.com/post/id/278136) -- 安全脉搏 - - [浅谈API安全的应用](https://www.secpulse.com/archives/185579.html) - - [android中webview的安全攻防](https://www.secpulse.com/archives/185553.html) - - [远控免杀从入门到实践 | 技术精选0141](https://www.secpulse.com/archives/185533.html) - - [细说从0开始挖掘cms-](https://www.secpulse.com/archives/185481.html) -- Files ≈ Packet Storm - - [Advantech iView NetworkServlet Command Injection](https://packetstormsecurity.com/files/168108/advantech_iview_networkservlet_cmd_inject.rb.txt) - - [Ubuntu Security Notice USN-5570-1](https://packetstormsecurity.com/files/168107/USN-5570-1.txt) - - [Polar Flow Android 5.7.1 Secret Disclosure](https://packetstormsecurity.com/files/168106/TRSA-2110-01.txt) - - [FreeBSD 13.0 aio_aqueue Kernel Refcount Local Privilege Escalation](https://packetstormsecurity.com/files/168105/freebsd-escalate.pdf) -- unSafe.sh - 不安全 - - [But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1)](https://buaq.net/go-122772.html) - - [Back to school: Are your kids' devices ready for school?](https://buaq.net/go-122752.html) - - [ZoomIt v6.01 更新，支持屏幕放大镜、屏幕涂鸦，新增录屏功能[Windows]](https://buaq.net/go-122773.html) - - [Hooking Go from Rust - Hitchhiker’s Guide to the Go-laxy](https://buaq.net/go-122751.html) -- Trustwave Blog - - [Protecting the Modern Healthcare Industry Requires Human Expertise and Innovative Partnerships](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/protecting-the-modern-healthcare-industry-requires-human-expertise-and-innovative-partnerships/) -- Sucuri Blog - - [Fake DDoS Pages On WordPress Sites Lead to Drive-By-Downloads](https://blog.sucuri.net/2022/08/fake-ddos-pages-on-wordpress-lead-to-drive-by-downloads.html) -- SecWiki News - - [SecWiki News 2022-08-18 Review](http://www.sec-wiki.com/?2022-08-18) -- NVISO Labs - - [Intercept Flutter traffic on iOS and Android (HTTP/HTTPS/Dio Pinning)](https://blog.nviso.eu/2022/08/18/intercept-flutter-traffic-on-ios-and-android-http-https-dio-pinning/) -- SpiderLabs Blog from Trustwave - - [Overview of the Cyber Weapons Used in the Ukraine - Russia War](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/) -- GuidePoint Security - - [How to Get Started in Cybersecurity: Learning Some Tools](https://www.guidepointsecurity.com/blog/how-to-get-started-in-cybersecurity-learning-some-tools/) -- blog.avast.com EN - - [Back to school: Are your kids' devices ready for school?](https://blog.avast.com/kids-devices-ready-school) - - [Online scams: The majority of Americans have been targeted](https://blog.avast.com/majority-americans-targeted-scammers) -- Malwarebytes Labs - - [Business Services industry targeted across the country for backdoor access](https://www.malwarebytes.com/blog/threat-intelligence/2022/08/business-services-targeted-across-the-country-for-backdoor-access) - - [Attackers waited until holidays to hit US government](https://www.malwarebytes.com/blog/threat-intelligence/2022/08/government-attacks-wait-until-the-holidays-to-strike) - - [How IT teams can prevent phishing attacks with Malwarebytes DNS filtering](https://www.malwarebytes.com/blog/business/2022/08/how-it-teams-can-prevent-phishing-attacks-with-malwarebytes-dns-filtering) - - [Bad rhythm: Janet Jackson song resonates poorly with some old hard drives](https://www.malwarebytes.com/blog/news/2022/08/bad-rhythm-janet-jackson-song-resonates-poorly-with-some-old-hard-drives) - - [Urgent update for macOS and iOS! Two actively exploited zero-days fixed](https://www.malwarebytes.com/blog/news/2022/08/urgent-update-for-macos-and-ios-two-actively-exploited-zero-days-fixed) -- 博客园 - 挖洞的土拨鼠 - - [CVE-2022-26923 从普通域账户到Krbtgt - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16598187.html) -- Reverse Engineering - - [Hooking Go from Rust - Hitchhiker’s Guide to the Go-laxy](https://www.reddit.com/r/ReverseEngineering/comments/wrkza2/hooking_go_from_rust_hitchhikers_guide_to_the/) - - [But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1)](https://www.reddit.com/r/ReverseEngineering/comments/wrpj2o/but_you_told_me_you_were_safe_attacking_the/) - - [XOpcodeCalc 0.05 x86/64 Opcode calculator for macOS, Linux and Windows.](https://www.reddit.com/r/ReverseEngineering/comments/wrpt0t/xopcodecalc_005_x8664_opcode_calculator_for_macos/) -- Application Security Blog - - [CyRC Case Study: Exploitable memory corruption using CVE-2020-25669 and Linux Kernel](https://www.synopsys.com/blogs/software-security/cyrc-case-study-linux-kernel-vulnerability/) -- Sucuri Blog - - [Fake DDoS Pages On WordPress Sites Lead to Drive-By-Downloads](https://blog.sucuri.net/2022/08/fake-ddos-pages-on-wordpress-lead-to-drive-by-downloads.html) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [In Retrospective - Random ATM Skimming Screenshots - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-random-atm-skimming.html) - - [In Retrospective - A Peek Inside A Popular Cybercrime Friendly Doorway Generator - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-peek-inside-popular.html) - - [In Retrospective - A Peek Inside the Pony Loader Cybercrime-Friendly Malicious Software Release - An OSINT Analysis](http://ddanchev.blogspot.com/2022/08/in-retrospective-peek-inside-pony.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [IW Weekly #17: $30,000 Bounty, Instagram Account Takeover, AWS Security Series, Google…](https://infosecwriteups.com/iw-weekly-17-30-000-bounty-instagram-account-takeover-aws-security-series-google-a0f3e6f980fb?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [Ferramenta de feedback: Quase como fazer um pedido para o gênio da lâmpada, mas no jeito de SAP S/4HANA Cloud](https://blogs.sap.com/2022/08/18/ferramenta-de-feedback-quase-como-fazer-um-pedido-para-o-genio-da-lampada-mas-no-jeito-de-sap-s-4hana-cloud/) - - [Demystify SAP SuccessFactors Role Based Permission APIs](https://blogs.sap.com/2022/08/18/demystify-sap-successfactors-role-based-permission-apis/) - - [Time Sheet? Fill it in the Web Client!](https://blogs.sap.com/2022/08/18/time-sheet-fill-it-in-the-web-client/) - - [How Business Transformation can influence SAP Implementations](https://blogs.sap.com/2022/08/18/how-business-transformation-can-influence-sap-implementations/) - - [Are you a RISE with SAP customer or just got SAP Signavio Process Insights subscription?](https://blogs.sap.com/2022/08/18/are-you-a-rise-with-sap-customer-or-just-got-sap-signavio-process-insights-subscription/) - - [C0 Developer Extensibility for CDS Data Models](https://blogs.sap.com/2022/08/18/c0-developer-extensibility-for-cds-data-models/) - - [SAP on IBM i: Webcast on September 29th – IBM Navigator for i](https://blogs.sap.com/2022/08/18/sap-on-ibm-i-webcast-on-september-29th-ibm-navigator-for-i/) - - [What are REST APIs in SAP AppGyver?](https://blogs.sap.com/2022/08/18/what-are-rest-apis-in-sap-appgyver/) - - [Generate Custom Supplier Certificates via Generic Withholding Tax in SAP Document and Reporting Compliance(formerly known as Advanced Compliance Reporting – ACR)](https://blogs.sap.com/2022/08/18/generate-custom-supplier-certificates-via-generic-withholding-tax-in-sap-document-and-reporting-complianceformerly-known-as-advanced-compliance-reporting-acr/) -- Intigriti - - [Intigriti chats to Will Chilcutt of Yahoo’s Infosecurity team about their upcoming live hacking event](https://blog.intigriti.com/2022/08/18/intigriti-chats-will-chilcutt-yahoos-infosecurity-team-about-their-upcoming-live-hacking-event/) -- The Daily Swig | Cybersecurity news and views - - [Vulnerability in open source identity management system Free IPA could lead to XXE attacks](https://portswigger.net/daily-swig/vulnerability-in-open-source-identity-management-system-free-ipa-could-lead-to-xxe-attacks) - - [Secure Open Source Rewards program launched to help protect critical upstream software](https://portswigger.net/daily-swig/secure-open-source-rewards-program-launched-to-help-protect-critical-upstream-software) -- daniel.haxx.se - - [Uncurled – the presentation](https://daniel.haxx.se/blog/2022/08/18/uncurled-the-presentation/) -- SentinelOne - - [Chronicle of an Identity-Based Attack | Singularity™ Identity vs. Cisco Breach](https://www.sentinelone.com/blog/chronicle-of-an-identity-based-attack-singularity-identity-vs-cisco-breach/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 8/18/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-8-18-2022/) -- KitPloit - PenTest & Hacking Tools - - [Ropr - A Blazing Fast Multithreaded ROP Gadget Finder. Ropper / Ropgadget Alternative](http://www.kitploit.com/2022/08/ropr-blazing-fast-multithreaded-rop.html) -- rtl-sdr.com - - [Open-Weather: A Browser Based NOAA APT Satellite Image Decoder](https://www.rtl-sdr.com/open-weather-a-browser-based-noaa-apt-satellite-image-decoder/) - - [An off-grid wind and solar powered APT/LRPT satellite image receiver with RTL-SDR](https://www.rtl-sdr.com/an-off-grid-wind-and-solar-powered-apt-lrpt-satellite-image-receiver-with-rtl-sdr/) - - [Highlighting Major Software Issues with the RX888 SDR](https://www.rtl-sdr.com/highlighting-major-software-issues-with-the-rx888-sdr/) -- 代码卫士 - - [苹果紧急修复两个0day](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513606&idx=1&sn=7ef2bbe710ecd61f87d32d3a53d28db7&chksm=ea94876cdde30e7a698417a1e60f215d5f74440aeb15e6238bef618870a8d31d953006005405&scene=58&subscene=0#rd) - - [谷歌修复今年第五个Chrome 0day](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513606&idx=2&sn=eb7c5b8b8637ed62d0be305f14e2ba9e&chksm=ea94876cdde30e7ac31840c96b22a9c1872036aff023b5d8f88d53f211f15811f84aede4f150&scene=58&subscene=0#rd) - - [DevSecOps道路曲折：开发人员在代码审计时仍困于安全](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513606&idx=3&sn=a29ace9f925dccc0d29e525df1b30a2b&chksm=ea94876cdde30e7a0c47ef735daa659efb38ea2fd40efda2fa8ac59aeb0f58b1372c866bcf3d&scene=58&subscene=0#rd) -- Checkmarx.com - - [Amazon Quickly Fixed a Vulnerability in Ring Android App That Could Expose Users’ Camera Recordings](https://checkmarx.com/blog/amazon-quickly-fixed-a-vulnerability-in-ring-android-app-that-could-expose-users-camera-recordings/) -- Blog - Praetorian - - [Part 3 – Trends in the Cybersecurity Talent Marketplace in the Face of Sustained Shortages](https://www.praetorian.com/blog/marketplace-talent-shortage/) -- vivo千镜安全实验室 - - [密码困境与无密码认证](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247489268&idx=1&sn=6e5105132a8b0791c9ce0ab58bed5202&chksm=e9b93098deceb98ed40847374f841cb2faedda58678a457cc4d7e3172489209da7e3e4858f59&scene=58&subscene=0#rd) -- DataCon大数据安全分析比赛 - - [DataCon特训营｜向上青年，扬帆起航～](https://mp.weixin.qq.com/s?__biz=MzU5Njg1NzMyNw==&mid=2247485192&idx=1&sn=093d33df48aca03e1dad2ba156dda6c3&chksm=fe5d1f88c92a969e4108e26985362e85dbdbbf7d2ad50a2af06302d5df01bef8b63888e893d6&scene=58&subscene=0#rd) -- Twitter @hakivvi - - [RT Shir: From file overwrite with uncontrolled content to root shell 🏴 How to elevate Linux privileges to root when it's only possible to overwrite...](https://twitter.com/shirtamari/status/1560325267389825025) -- 关键基础设施安全应急响应中心 - - [适用于物联网数据共享的区块链节点存储优化方案](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530283&idx=1&sn=3c490961d9ebdc2b10a506e330ef1f6f&chksm=c1e9fb7af69e726c8c17e890828eb7a36006f8db307445e3f321fff8775d2f5ab51725e2e86a&scene=58&subscene=0#rd) - - [2022年应用安全报告：重要趋势与挑战](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530283&idx=2&sn=32ecb157b80886ac7d859fad90990320&chksm=c1e9fb7af69e726ce8f0d83deed7b0d1516bf0375f2d6ee5bd9636a46d602f4b60bb349fe61d&scene=58&subscene=0#rd) - - [Realtek爆出关键漏洞，影响多款网络设备](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530283&idx=3&sn=3a534193323cbc338ece358594931aa1&chksm=c1e9fb7af69e726ca9095249cd5f172361743fc9f7e2268e4fa72b7d2d1c2ed4966d142ffd76&scene=58&subscene=0#rd) -- 黑奇士 - - [赵长鹏被FBI逮捕？很可能是个愚人节玩笑](https://mp.weixin.qq.com/s?__biz=MzI5ODYwNTE4Nw==&mid=2247487117&idx=1&sn=79a84ad52933654e633221f9bf7bc157&chksm=eca20161dbd5887730b5e398ddb124368d9c93d3da832bf7849c6641bfc3a17bbafe06173963&scene=58&subscene=0#rd) -- 慢雾科技 - - [报告解读之 Ronin Network 安全事件及反洗钱分析](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247496049&idx=1&sn=435554e3dcee5353553b98e4d32350fd&chksm=fdde8ff6caa906e025bf6fe9b9b66f0aeb06caba0cd5572125c85ca8d608da2bf88465ea45fb&scene=58&subscene=0#rd) -- 极客公园 - - [腾讯二季度净利润 186 亿，同比下滑 56%；小米汽车选定电池供应商；超 4 成「00 后」想要编制内工作｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652964984&idx=1&sn=33ec8b3a285ccae9268158e4621650c6&chksm=7e5475ce4923fcd861746ff21def0022da3a432d8105cee39cf713bb367bc81fdcf903eceaaf&scene=58&subscene=0#rd) -- 互联网安全内参 - - [微软近一年发放了1亿元漏洞赏金：平均每个漏洞8.5万元](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505349&idx=1&sn=d475739315f4bbf0af1813cdc103bf31&chksm=ebfa92e5dc8d1bf33451f3621992026d670b74cdb70071e89fe9977e52d3b9ab20628d1c4a55&scene=58&subscene=0#rd) - - [建行宣布停止ATM二维码存款服务，或与安全有关](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505349&idx=2&sn=32c5c2de6e9fda2d872a40a5b50006f6&chksm=ebfa92e5dc8d1bf3f8dcc2c26a6fcd558e103241f73ff59db9987c92a3295dba74b5e7fb1909&scene=58&subscene=0#rd) - - [苹果iOS设备上的VPN是一场骗局？](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505349&idx=3&sn=db088686d7861483c901775eb92298bb&chksm=ebfa92e5dc8d1bf3dbb345dae3b093969b7740eb9c104a48be3f7e48ebd97927886211527153&scene=58&subscene=0#rd) - - [2022医疗卫生行业网络安全报告：恶意程序和漏洞利用是主要风险](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505349&idx=4&sn=ae48c8ca9ac705ebb8f4ec7ae7053544&chksm=ebfa92e5dc8d1bf33164d3b90f7bb4b678aedebaef542b1db2c403f05d09aa562e351337ac5b&scene=58&subscene=0#rd) -- 默安科技 - - [武汉国际安全应急博览会 | 小默向您发出一封邀请函](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247493383&idx=1&sn=434ced6612885e64b041a5ab88f2419b&chksm=e93b1025de4c9933e6d99e707005578e48f1668ed80b4502e54e8fd590b0a2cf08f2f5726e02&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于Google Chrome代码执行漏洞风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495757&idx=1&sn=25169da36ad2f4164f1c03cb1c202c0e&chksm=ce96bd73f9e1346597b6a681d3f12e540a5cd1e26b24299d65e98bc73c41c234a79b905291bc&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Aug.18th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495757&idx=2&sn=673ca3aba52d37a376fc078bd56f46b9&chksm=ce96bd73f9e134653b81b6c6af30fa8b40f7ee44e1034534ae8e71ae1e477f8530d9cd91f9c5&scene=58&subscene=0#rd) -- KCon黑客大会 - - [8月27日-28日，KCon 2022 即将线上开幕！参会攻略请查收～](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135670&idx=1&sn=2bf642a36cdbc8d57bb1ba867a2b4f95&chksm=f2c11fd6c5b696c09b4297d86b75efa233b67f3a34e2d720fc5cde87fc3530c6d72d6ea7270d&scene=58&subscene=0#rd) -- 情报分析师 - - [【学习资料】《警方情报行动》（206页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514034&idx=1&sn=cc3bfb01bbcc666261c011b3336bb556&chksm=87168c39b061052f0c14b52e9abb6ee1387e276cd63233e8b0e38457f9882d44f9ac13ee2c58&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】微软员工在GitHub上意外泄露内部敏感登录凭据](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652014237&idx=1&sn=dc32e3bea0c218b7c013ac343623f48b&chksm=f36faaddc41823cbf125f0ef48576eb0ac7148ba2f32fb25dcd2500af3fc5ef9aeb7bd8fc2ff&scene=58&subscene=0#rd) - - [【安全圈】新谷歌 Chrome 零日漏洞已遭在野利用](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652014237&idx=2&sn=bf27c24ad2592e96f9ccad3bb4fd7b1a&chksm=f36faaddc41823cb36f29938ef9f0c8961a09a0acd067de77f78563dd6758a9715c4345d6e30&scene=58&subscene=0#rd) - - [【安全圈】俄罗斯统一俄罗斯党官网近期多次遭黑客攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652014237&idx=3&sn=84677eb9ea02b4591d8a06f354b06afe&chksm=f36faaddc41823cb747a448599f551539e88e8342976e7dfb6ab0170ff6b649ea7e01d61b0d6&scene=58&subscene=0#rd) - - [【安全圈】朝鲜黑客攻击 deBridge 加密货币平台](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652014237&idx=4&sn=2b6604c5f737f284bdb11b90f8652eaa&chksm=f36faaddc41823cb994da9771a4713f0119605b46338a6a9b2a0bdfed85d92f55036e7ddf592&scene=58&subscene=0#rd) - - [【安全圈】英国水厂疑遭勒索软件攻击，IT系统中断 敏感数据或泄露](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652014237&idx=5&sn=8de57ca03e9017bee8fe2e18ceea7327&chksm=f36faaddc41823cb2059f05c60a35f3cd8b56af894ffc90d96739a56668abf74856909812caa&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(08-18)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958626&idx=1&sn=6ae7a27b1dc00e2218711bdef1880ae3&chksm=8baecdfdbcd944eb12c498c69232d83436431927ba2271f055a4445bd711e84cce03980b7d29&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [关键基础设施攻击剧增：英国水务公司遭遇Clop勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548536&idx=1&sn=a0182350d9095f238968d0732481594a&chksm=e915ee42de6267547cace0cbf7d73cc61927b7362b3145e2c33566330baafe2570eb2c3174f7&scene=58&subscene=0#rd) - - [在企业 EDR 环境中模拟 Phineas Phisher 发起的对 Hacking Team 的攻击](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548536&idx=2&sn=5d2f3c3eb3f4116751a5a9dd66079bcd&chksm=e915ee42de626754976b7aaeeb78a9c8c9ba29a441647cf02ff12cc4aedbb8f36b5c6498fc3a&scene=58&subscene=0#rd) -- Dhole Moments - - [Burning Trust at the Quantum Village at DEFCON 30](https://soatok.blog/2022/08/18/burning-trust-at-the-quantum-village-at-defcon-30/) diff --git a/archive/2022/2022-08-20.md b/archive/2022/2022-08-20.md deleted file mode 100644 index b0b7f34e15..0000000000 --- a/archive/2022/2022-08-20.md +++ /dev/null @@ -1,205 +0,0 @@ -# 每日安全资讯（2022-08-20） - -- Sukka's Blog - - [为什么你不应该在 React 中直接使用 useEffect 从 API 获取数据](https://blog.skk.moe/post/why-you-should-not-fetch-data-directly-in-use-effect/) -- Files ≈ Packet Storm - - [Transposh WordPress Translation 1.0.8.1 Incorrect Authorization](https://packetstormsecurity.com/files/168120/wptransposh1081-authz.txt) - - [Apple Security Advisory 2022-08-18-1](https://packetstormsecurity.com/files/168119/APPLE-SA-2022-08-18-1.txt) - - [Apple Security Advisory 2022-08-17-1](https://packetstormsecurity.com/files/168118/APPLE-SA-2022-08-17-1.txt) - - [Apple Security Advisory 2022-08-17-2](https://packetstormsecurity.com/files/168117/APPLE-SA-2022-08-17-2.txt) - - [FLIR AX8 1.46.16 Traversal / Access Control / Command Injection / XSS](https://packetstormsecurity.com/files/168116/flirax8-traversalexecxss.txt) - - [Chrome content::ServiceWorkerVersion::MaybeTimeoutRequest Heap Use-After-Free](https://packetstormsecurity.com/files/168115/GS20220819151235.tgz) - - [FLIX AX8 1.46.16 Remote Command Execution](https://packetstormsecurity.com/files/168114/AX8-exec.py.txt) - - [Ubuntu Security Notice USN-5573-1](https://packetstormsecurity.com/files/168113/USN-5573-1.txt) - - [Red Hat Security Advisory 2022-6051-01](https://packetstormsecurity.com/files/168112/RHSA-2022-6051-01.txt) - - [Red Hat Security Advisory 2022-6113-01](https://packetstormsecurity.com/files/168111/RHSA-2022-6113-01.txt) - - [Ubuntu Security Notice USN-5572-1](https://packetstormsecurity.com/files/168110/USN-5572-1.txt) - - [Ubuntu Security Notice USN-5571-1](https://packetstormsecurity.com/files/168109/USN-5571-1.txt) -- Security Boulevard - - [Anton’s Security Blog Quarterly Q3 2022](https://securityboulevard.com/2022/08/antons-security-blog-quarterly-q3-2022/) - - [July Tesla Sales Crashed in Germany and Norway: Not Even on Chart](https://securityboulevard.com/2022/08/july-tesla-sales-crashed-in-germany-and-norway-not-even-on-chart/) - - [Friday Squid Blogging: The Language of the Jumbo Flying Squid](https://securityboulevard.com/2022/08/friday-squid-blogging-the-language-of-the-jumbo-flying-squid/) - - [Data Protection Solutions: Safeguard Your Data From Cyberattacks & Other Threats](https://securityboulevard.com/2022/08/data-protection-solutions-safeguard-your-data-from-cyberattacks-other-threats/) - - [Analysis of Clop’s Attack on South Staffordshire Water – UK](https://securityboulevard.com/2022/08/analysis-of-clops-attack-on-south-staffordshire-water-uk/) - - [Black Hat Fireside Chat: Replacing VPNs with ZTNA that leverages WWII battlefield tactics](https://securityboulevard.com/2022/08/black-hat-fireside-chat-replacing-vpns-with-ztna-that-leverages-wwii-battlefield-tactics/) - - [BSidesTLV 2022 – Vera Mens’ ‘Total Flaw: Hacking Flow Computers For Fun And Free Gas’](https://securityboulevard.com/2022/08/bsidestlv-2022-vera-mens-total-flaw-hacking-flow-computers-for-fun-and-free-gas/) - - [Understanding eBPF for API Security](https://securityboulevard.com/2022/08/understanding-ebpf-for-api-security/) - - [Deepfence Open Source Community Update – August 2022](https://securityboulevard.com/2022/08/deepfence-open-source-community-update-august-2022/) - - [The four most important aspects of software due diligence audits](https://securityboulevard.com/2022/08/the-four-most-important-aspects-of-software-due-diligence-audits/) -- Microsoft Security Blog - - [Uncovering a ChromeOS remote memory corruption vulnerability](https://www.microsoft.com/security/blog/2022/08/19/uncovering-a-chromeos-remote-memory-corruption-vulnerability/) -- Trustwave Blog - - [Webinar – Briefing on the Cyber Weapons Used in the Ukraine-Russia War – Overview and Lessons Learned](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/webinar-briefing-on-the-cyber-weapons-used-in-the-ukraine-russia-war-overview-and-lessons-learned/) -- 安全通告 - - [安全通告 - 涉及华为部分产品的权限绕过漏洞](//www.huawei.com/cn/psirt/security-advisories/2022/huawei-sa-20220819-01-7e0a6103-cn) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-aug-19) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [8月27日-28日，KCon 2022 即将线上开幕！参会攻略请查收～](https://www.4hou.com/posts/pVLN) - - [星舆实验室获评AutoCS 2022年度杰出智能网联汽车安全研究实验室](https://www.4hou.com/posts/oJX3) - - [BCS2022〡重磅干货分享！多名白帽安全专家共同促进前沿技术能力提升](https://www.4hou.com/posts/kMXE) - - [攻防后记|XDM，收好这份攻防演练“摸鱼指南”](https://www.4hou.com/posts/4KGn) - - [Active Directory环境网络共享配置权限不当问题的分析和利用](https://www.4hou.com/posts/2J2N) - - [软件开发人员用谷歌搜索突破现代汽车安全防线](https://www.4hou.com/posts/YXqn) -- Sploitus.com Exploits RSS Feed - - [FLIX AX8 1.46.16 Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168114&utm_source=rss&utm_medium=rss) - - [Advantech iView NetworkServlet Command Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37914&utm_source=rss&utm_medium=rss) - - [FLIR AX8 1.46.16 Traversal / Access Control / Command Injection / XSS exploit](https://sploitus.com/exploit?id=PACKETSTORM:168116&utm_source=rss&utm_medium=rss) - - [Transposh WordPress Translation 1.0.8.1 Incorrect Authorization exploit](https://sploitus.com/exploit?id=PACKETSTORM:168120&utm_source=rss&utm_medium=rss) - - [Polar Flow Android 5.7.1 Secret Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37913&utm_source=rss&utm_medium=rss) -- 跳跳糖 - 安全与分享社区 - - [从偶遇Flarum开始的RCE之旅](https://tttang.com/archive/1714/) -- paper - Last paper - - [论如何优雅的注入 Java Agent 内存马](https://paper.seebug.org/1945/) -- 安全客-有思想的安全新媒体 - - [诈骗作案工具新披露！境外遥控诈骗手段曝光，人机分离、远程操控…](https://www.anquanke.com/post/id/275675) - - [数字安全观察-每周简报（2022.08.10-2022.08.16）](https://www.anquanke.com/post/id/278451) - - [CISA：两个Windows和UnRAR漏洞已遭黑客利用](https://www.anquanke.com/post/id/278441) - - [谷歌挡住了最强HTTPS DDoS攻击？](https://www.anquanke.com/post/id/278430) - - [爱沙尼亚打响网络“阻击战”](https://www.anquanke.com/post/id/278353) - - [电子数据取证](https://www.anquanke.com/post/id/278110) - - [不满硬件付费订阅，黑客挥刀“砍”宝马？](https://www.anquanke.com/post/id/278339) - - [印度大使馆官网遭克什米尔黑客入侵](https://www.anquanke.com/post/id/278333) - - [浅谈云上攻防系列——云IAM原理&风险以及最佳实践](https://www.anquanke.com/post/id/278236) - - [IT求职者小心！黑客组织Lazarus冒充Coinbase盯上你](https://www.anquanke.com/post/id/278328) - - [渗透测试之只有一个登录框](https://www.anquanke.com/post/id/278158) - - [CVE-2022-2856: Google Chrome 远程代码执行漏洞](https://www.anquanke.com/post/id/278300) - - [BlackByte勒索软件2.0“隆重登场”](https://www.anquanke.com/post/id/278253) -- Sec-News 安全文摘 - - [BlackHat USA 2022会议资料](https://wiki.ioin.in/url/EoPV) - - [聊一聊基于"ebpf xdp"的rootkit](https://wiki.ioin.in/url/4Va1) - - [Java安全攻防之从wsProxy到AbstractTranslet](https://wiki.ioin.in/url/LXxB) - - [从偶遇Flarum开始的RCE之旅](https://wiki.ioin.in/url/G7ON) -- Recent Commits to cve:main - - [Update Fri Aug 19 05:23:55 UTC 2022](https://github.com/trickest/cve/commit/2fb4a7fc71f49afdc44cc3e46d1d5be2d01ba00c) -- unSafe.sh - 不安全 - - [BlackHat USA 2022会议资料](https://buaq.net/go-122924.html) - - [聊一聊基于"ebpf xdp"的rootkit](https://buaq.net/go-122925.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 34](https://buaq.net/go-122926.html) - - [hoaxshell - An unconventional Windows reverse shell, currently undetected by Microsoft Defender and various other AV solutions, solely based on http(s) traffic](https://buaq.net/go-122915.html) - - [Back in Black: Unlocking a LockBit 3.0 Ransomware Attack](https://buaq.net/go-122914.html) - - [加入“红队攻击手特训营”享永久观看特权，第8期已准备就绪~](https://buaq.net/go-122907.html) - - [开学季Web渗透测试工程师精英班“第5期”来袭，加入即永久观看！](https://buaq.net/go-122906.html) - - [crAPI - Completely Ridiculous API](https://buaq.net/go-122905.html) - - [Spying on the spies. See what JavaScript commands get injected by in-app browsers](https://buaq.net/go-122966.html) -- 安全脉搏 - - [GetInfo windows应急响应信息采集工具](https://www.secpulse.com/archives/185648.html) - - [Goblin 红蓝对抗钓鱼攻击演练系统](https://www.secpulse.com/archives/185637.html) - - [pingcastle – Active Directory域控安全检测工具](https://www.secpulse.com/archives/185620.html) - - [一次恶意样本分析](https://www.secpulse.com/archives/185589.html) -- Twitter @Nicolas Krassas - - [crAPI - Completely Ridiculous API](https://twitter.com/Dinosn/status/1560615508033974273) - - [stegowiper: powerful and flexible active attack for disrupting stegomalware](https://twitter.com/Dinosn/status/1560582891708379138) - - [CVE-2022-35278: Apache ActiveMQ Artemis HTML Injection Vulnerability](https://twitter.com/Dinosn/status/1560582809827217416) - - [Ropr - A Blazing Fast Multithreaded ROP Gadget Finder. Ropper / Ropgadget Alternative](https://twitter.com/Dinosn/status/1560571205270114304) - - [New Amazon Ring Vulnerability Could Have Exposed All Your Camera Recordings](https://twitter.com/Dinosn/status/1560569109510623233) - - [RT HAHWUL: I reengineered WHW struct, code, and all the things. Now, visibility is better and addition of ./weapons/.yaml makes it easy to contri...](https://twitter.com/hahwul/status/1560553547649134593) - - [RT starlabs: Today, our team member, @tuanit96 , shared his analysis on: "Exploiting CVE-2021-1789 : WebKit JSPropertyNameEnumerator Out-of-Bounds Rea...](https://twitter.com/starlabs_sg/status/1560546139664896002) - - [Android malware apps with 2 million installs found on Google Play](https://twitter.com/Dinosn/status/1560537648573415425) - - [Safari 15.6.1 addresses a zero-day flaw actively exploited in the wild](https://twitter.com/Dinosn/status/1560535649828093954) - - [Banorte - 2,107,000 breached accounts](https://twitter.com/Dinosn/status/1560535525617975296) - - [Oh SSH-it, what's my fingerprint? A Large-Scale Analysis of SSH Host Key Fingerprint Verification Records in the DNS](https://twitter.com/Dinosn/status/1560535486262829057) - - [Two years on, Apple iOS VPNs still leak IP addresses](https://twitter.com/Dinosn/status/1560535378079227904) - - [Stealing Signatures and Making One Invalid Signature at a Time](https://twitter.com/Dinosn/status/1560535246210228224) - - [Invoke-ACLpwn is a tool that automates the discovery and pwnage of ACLs in Active Directory that are unsafe configured.](https://twitter.com/Dinosn/status/1560524149931610112) - - [AD ACL Scanner](https://twitter.com/Dinosn/status/1560521732942970881) -- Blog & What's New | Offensive Security - - [Offensive Security Online Community BBQ Event](https://www.offensive-security.com/offsec/offensive-security-online-community-bbq-event/) -- Hexacorn - - [What to know, what to learn? What are useful skills for cyber in 2022?](https://www.hexacorn.com/blog/2022/08/19/what-to-know-what-to-learn-what-are-useful-skills-for-cyber-in-2022/) - - [Password as a (Yara) Service](https://www.hexacorn.com/blog/2022/08/19/password-as-a-yara-service/) -- blog.avast.com EN - - [Back to school shopping cybersecurity 101](https://blog.avast.com/back-to-school-tips-the-abcs-of-online-security) - - [Fitbit’s having a bad summer](https://blog.avast.com/fitbit-tech-trouble) -- Application Security Blog - - [The four most important aspects of software due diligence audits](https://www.synopsys.com/blogs/software-security/four-aspects-software-due-diligence-audits/) -- Malwarebytes Labs - - [Tech support scammers target Microsoft users with fake Office 365 USB sticks](https://www.malwarebytes.com/blog/news/2022/08/tech-support-scammers-target-microsoft-users-with-fake-office-365-usb-sticks) - - [Explained: Steganography](https://www.malwarebytes.com/blog/news/2022/08/explained-steganography) - - [Spying on the spies. See what JavaScript commands get injected by in-app browsers](https://www.malwarebytes.com/blog/news/2022/08/spying-on-the-spies-see-what-javascript-commands-get-injected-by-an-in-app-browser) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 34](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-34-4/) -- SAP Blogs - - [Data Architecture with SAP – Data Fabric](https://blogs.sap.com/2022/08/19/data-architecture-with-sap-data-fabric/) - - [HOT & Trending content enhanced within Support Assistant](https://blogs.sap.com/2022/08/19/hot-trending-content-enhanced-within-support-assistant/) - - [Shelf Life Inspection Process- Option 1](https://blogs.sap.com/2022/08/19/shelf-life-inspection-process-option-1/) - - [Activity Area in Extended Warehouse Management](https://blogs.sap.com/2022/08/19/activity-area-in-extended-warehouse-management/) - - [CDS Views – selection on date plus or minus a number of days or months](https://blogs.sap.com/2022/08/19/cds-views-selection-on-date-plus-or-minus-a-number-of-days-or-months/) - - [Create a Fiori Application using RESTful Application programming model(RAP) on S/4 HANA cloud platform and Business transaction platform(BTP)](https://blogs.sap.com/2022/08/19/create-a-fiori-application-using-restful-application-programming-modelrap-on-s-4-hana-cloud-platform-and-business-transaction-platformbtp/) - - [ABAP CDS View Client Handing: Consuming data from different clients in ABAP CDS view](https://blogs.sap.com/2022/08/19/abap-cds-view-client-handing-consuming-data-from-different-clients-in-abap-cds-view/) - - [How Hack2Build Accelerates Customer Approach for YASH Technologies](https://blogs.sap.com/2022/08/19/how-hack2build-accelerates-customer-approach-for-yash-technologies/) - - [SAP MaxAttention Innovation Workshop ‘Financial Accounting and Central Finance’ (Virtual, September 15, 2022)](https://blogs.sap.com/2022/08/19/sap-maxattention-innovation-workshop-financial-accounting-and-central-finance-virtual-september-15-2022/) - - [SAP Sales Cloud and SAP Service Cloud Training Courses Updated – Release 2205](https://blogs.sap.com/2022/08/19/sap-sales-cloud-and-sap-service-cloud-training-courses-updated-release-2205/) -- Hex Rays - - [Igor’s tip of the week #103: Sharing plugins between IDA installs](https://hex-rays.com/blog/igors-tip-of-the-week-103-sharing-plugins-between-ida-installs/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-08-19 - Files for an ISC diary (Astaroth/Guildma)](https://www.malware-traffic-analysis.net/2022/08/19/index.html) -- The Daily Swig | Cybersecurity news and views - - [API security: Broken access controls, injection attacks plague the enterprise security landscape in 2022](https://portswigger.net/daily-swig/api-security-broken-access-controls-injection-attacks-plague-the-enterprise-security-landscape-in-2022) -- SecPulse安全脉搏 - - [【文末福利】万字长文：盘点2022全球10大数据泄漏事件（红蓝攻防角度）](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044709&idx=1&sn=7f8b9527fe3cb4a33545fd0ed2f9871f&chksm=803fa83bb748212d7adeeb9f4fbda62dd5234ca16ca0b2bc40c94fab3a087aa54414e37a09cc&scene=58&subscene=0#rd) -- Twitter @Keiran Smith (Affix) - - [Re @ThatPodcastChap I’m just happy I don’t have nvidia driver issues any more 😂😂](https://twitter.com/cli/status/1560638080607850496) - - [Re @ThatPodcastChap I recently switched to Ubuntu when 22.04 released makes life so much easier, everything just works](https://twitter.com/cli/status/1560634751542669313) -- 腾讯玄武实验室 - - [每日安全动态推送(08-19)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958630&idx=1&sn=d4868cc77bc4c08be484c5c5fcd727c3&chksm=8baecdf9bcd944ef8fa21520f69942b33bfd5dce6d789bf3fc017154019a18adce61627948ca&scene=58&subscene=0#rd) -- daniel.haxx.se - - [100,000 words](https://daniel.haxx.se/blog/2022/08/19/100000-words/) -- KitPloit - PenTest & Hacking Tools - - [crAPI - Completely Ridiculous API](http://www.kitploit.com/2022/08/crapi-completely-ridiculous-api.html) -- rtl-sdr.com - - [Using RTL-SDR to Detect Weak Vibrations in Nanomechanical Resonators Based on Graphene Drums](https://www.rtl-sdr.com/using-rtl-sdr-to-detect-weak-vibrations-in-nanomechanical-resonators-based-on-graphene-drums/) -- 丁爸情报分析师的工具箱 - - [【情报】警惕索罗斯的开放社会基金会在尼泊尔民权运动中的投入翻倍](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131469&idx=1&sn=66c70c65cb9f094f1d8df44c8de23bc3&chksm=f1af7977c6d8f0615ea020f6734c817a54e7f3001e06bc9fb15cefdc34fbcec9ad475ce45d73&scene=58&subscene=0#rd) -- 安全客 - - [计客蓝牙魔方协议逆向分析](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649775632&idx=1&sn=4bcac065817161e479f1416797fe75a4&chksm=88936e7fbfe4e769cd3a08bbb47c6c9f901bf0dec5bf8b2f012c9cf31c0094db1a2424ea287a&scene=58&subscene=0#rd) - - [【安全头条】BlackByte勒索软件2.0“隆重登场”](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649775632&idx=2&sn=97abf6efe4f0da5939ccd672446e1a6e&chksm=88936e7fbfe4e769aac261abf841cc7858656ad6c41666f4569192832316ac1e78ce99225066&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [每周高级威胁情报解读(2022.08.11~08.18)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247503321&idx=1&sn=5cd642ab7a1050f8861af661ba7ab71c&chksm=ea663aaedd11b3b8e50ea7296536f74acf6b19e691a09714d78f73b2129469a552b2a573effa&scene=58&subscene=0#rd) -- 中国信息安全 - - [中国这十年 | 新时代网络强国建设取得历史性成就](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163877&idx=1&sn=3a7d0cde6fa7bf7fa00c209efafe9df8&chksm=8b5ee8dcbc2961ca33e107e44ca91f133b87f831f50200ccf7d1856042f0d5cdf5315f353747&scene=58&subscene=0#rd) - - [工信部：持续加强网络安全保障体系和能力建设](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163877&idx=2&sn=5bcac2eb9f2e9c89db9e8fc289ea5f87&chksm=8b5ee8dcbc2961ca3bb1ce98f86b50765e79c8ef3e75866d16e3b9d72325e7a0a0d9497984a9&scene=58&subscene=0#rd) - - [网信办回应审查滴滴后续：指导督促做好整改工作](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163877&idx=3&sn=fb869e02a159c4999ba3ba1028847b39&chksm=8b5ee8dcbc2961ca2e7bb25a6bbcbe2b404c8307e9a0a3277fb61133712457b53bff7b8eabcf&scene=58&subscene=0#rd) - - [关注 | 网络安全人才供不应求 今年市场端有可喜变化](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163877&idx=4&sn=90ecc5ff83af4786b0dcf59a6e0d919a&chksm=8b5ee8dcbc2961cabaa208087a44440128435f826d510384ca7299d60a500a0277847ddcd9ce&scene=58&subscene=0#rd) - - [关注 | 上海警方破获首例非法控制手机系统案](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664163877&idx=5&sn=3c4f4740d335ae2548e613f006a5ddeb&chksm=8b5ee8dcbc2961cad14a4d8ab7de7eb52b5a2b9dbbbe68d8ca106a02ec460c8106027c181b29&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [BlackHat USA 2022议题解读：蓝牙Mesh中的安全攻击面](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537408&idx=1&sn=b8a5c418bca165a7b41345b90ed72bdb&chksm=8bcba67cbcbc2f6a7555c8ddd2eca979d6a98169a352f19a3fc11edb831e0e7270cf71e6da06&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [逆向工程系列 | Ghidra for Beginner II](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495834&idx=1&sn=e522f60861b32bd497522ca8f976d5d0&chksm=fa522524cd25ac32b2cfb43fa91466e3cc4301f80eeb454cde0643e1576d764cced8371569cb&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.08.19）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491327&idx=1&sn=234bf4f6ef6ff1337ecb480f9f1e00ec&chksm=fe251bfec95292e87b737494895741b3ba3bd7a00dbbafa2817881088102e035db1dcb1db94a&scene=58&subscene=0#rd) -- Yak Project - - [安全研发启蒙课：低成本实现的被动扫描工具](https://mp.weixin.qq.com/s?__biz=Mzk0MTM4NzIxMQ==&mid=2247489623&idx=1&sn=be69400c7ce1d373ce723f049e445b81&chksm=c2d264f3f5a5ede52a340c06095b61904882233ed75d6be2c8b3e93f30d9740f529c0ef24a69&scene=58&subscene=0#rd) -- 互联网安全内参 - - [美军探索网络安全新范式！由合规清单转向自动化红队](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505357&idx=1&sn=06928cd5497f44d4bd685bcadd22bbed&chksm=ebfa92eddc8d1bfbac8647017cda4ef3b7568240a7f062289e8152cd1aa3d3a2309ac32edc0a&scene=58&subscene=0#rd) - - [以色列国家网络安全防御体系建设及启示](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505357&idx=2&sn=ecf81efa158cabe92844dc9b3b5b9e8e&chksm=ebfa92eddc8d1bfb031f8810857edb4c264bfcd950e9baf11455f6f53a6d7755b6121b7c2bb2&scene=58&subscene=0#rd) - - [情报认知战新时代：美国在俄乌冲突中成功塑造“困俄”环境](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505357&idx=3&sn=98d0e2733cb2b98617742f1e28b03fc5&chksm=ebfa92eddc8d1bfb4151d3cb4aa9d7abe075deb570867fd407af1b8ee7aea9f8290f65b20534&scene=58&subscene=0#rd) - - [大湾区：守护数据生态再发力——BCS2022大湾区网络安全峰会观察](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505357&idx=4&sn=c645883e2d3bcf28f91f18af5de3fe84&chksm=ebfa92eddc8d1bfb002bf97f06e4fc7dbe984800cd473a7b26075f2dd02bf4fb67c12af9c498&scene=58&subscene=0#rd) -- 情报分析师 - - [【专业报告】狩猎灰犀牛和黑天鹅：政治稳定和恐怖主义的统计和机器学习模型](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514096&idx=1&sn=2ad97cf5be7551e4c8b42ca971522ea2&chksm=87168cfbb06105ed8a05eb1399ca53b6c8c1ce3f023ea642446b82c6eae5a7da07c757f41472&scene=58&subscene=0#rd) - - [【情报研究】国家情报大学（NIU）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514096&idx=2&sn=73ef5fc83cfacce9d8e372d527ea13ff&chksm=87168cfbb06105ed42e6b3c9f6ba281bec6ea13d94b8cfe845fafc08e4ef7b9f29372464fb8d&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [智甲首批入选 Windows 7 加固产品目录](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530319&idx=1&sn=bcc6191e5be24feeff7051fd830cedca&chksm=c1e9fb1ef69e7208ab078dc0e5ac3db21d5a1cdd150775f70bf3f0d2c2309ec87541e7277e54&scene=58&subscene=0#rd) - - [以色列国家网络安全防御体系建设及启示](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530319&idx=2&sn=d58e015180e108b693fa68627f185db9&chksm=c1e9fb1ef69e7208e0e7cb3672f6e90f8514076d30976ade61e491c0f87f6d1f166c7fea7faf&scene=58&subscene=0#rd) - - [深度解析美国《芯片与科学法案》](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530319&idx=3&sn=be0cff80221fe43c6f1d78f9dbbd5f31&chksm=c1e9fb1ef69e72088ce61ea09253ef6cee8a54c4dceb76c5dc37f4a7228b63bd7ba24e3e825b&scene=58&subscene=0#rd) - - [关键基础设施攻击剧增：英国水务公司遭遇Clop勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530319&idx=4&sn=8ec41d4c875e00b8a1f5a57528f70a7a&chksm=c1e9fb1ef69e7208a7b7157b0e94311a15a7408222e6010acc49609e479e96197ec16a87ef62&scene=58&subscene=0#rd) -- GeekPwn - - [在谷歌搜到几段密钥，就破解了自己的汽车？](https://mp.weixin.qq.com/s?__biz=MzA3Nzc2MjIxOA==&mid=2650345603&idx=1&sn=e1bf2815c4a31f98944124ae1b545b4a&chksm=8740ab46b03722502e6f70e2ed91a3314fc01d46232cfd59a5e8180064ac346304c1addbefd1&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [数据血缘图谱升级方案设计与实现](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497706&idx=1&sn=61766b29a827ff633b64c4027d954fe1&chksm=e9d33c08dea4b51e447f76e685cd7faf9f142e6e5ba4e26065fd2f9af870589ee22ae87ba770&scene=58&subscene=0#rd) -- 极客公园 - - [国家电网：试推电动汽车错峰充电；大疆曝光「室内无人机」新品；世卫组织：猴痘将更名，不然对猴不公平｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965020&idx=1&sn=0fb9d18fe84d14ba404c016433f3bcb6&chksm=7e54752a4923fc3c344dd1aa7727a230014ddff2e0f8eb87cfbee0495c7938927422f80a2b17&scene=58&subscene=0#rd) -- 百度安全实验室 - - [BlackHat USA 2022议题解读：蓝牙Mesh中的安全攻击面](https://mp.weixin.qq.com/s?__biz=MzA3NTQ3ODI0NA==&mid=2247486849&idx=1&sn=97d0303fea620ac5ed446cdeca52d91d&chksm=9f6ea80aa819211ca6532b3d80b24b230c2e01cb71f0d43e471e35b9cee449b7df82fc3c0e4d&scene=58&subscene=0#rd) -- 星阑科技 - - [8月宠粉抽奖，怎么会不期待呢](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495084&idx=1&sn=bb4d2b7a29a265a1ae7b5781ad434492&chksm=c0074030f770c92620abff3d8094fb91133f93369133311f414f8db2202c03a21a32e5719391&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [智甲首批入选 Windows 7 加固产品目录](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530674&idx=1&sn=591d30e1c1ef4ed59a56fa93980084ff&chksm=fa93ce73cde44765b75a51951d8b8dc268156e543e52be9146d08ba36cdb7dadfed157693a9a&scene=58&subscene=0#rd) - - [英特尔新型CPU漏洞可致敏感数据泄露](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530674&idx=2&sn=d6e155446a1958e88299b54f47ff5b3b&chksm=fa93ce73cde4476502cb06f01f20f1e3ca80fb8e2fee81464406b63ec2eacaebe8b76520b269&scene=58&subscene=0#rd) - - [[黑帽大会]：破解星链卫星天线](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530674&idx=3&sn=610a5f5e712d08b05607cbaa6f4e7102&chksm=fa93ce73cde44765200c587a6d06941457888ed16b5e0b80314eae8e1c6f2c92ecf11cc9c2eb&scene=58&subscene=0#rd) - - [美军将乌克兰当作网络战和电子战的“试验场”](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530674&idx=4&sn=b0b808dfbe25ac064f32cdb1c0af8cd6&chksm=fa93ce73cde447657ad04e25ce672e0c6190674320f9d63358d2a493a7db0c8dbc57b4775955&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [软件开发人员用谷歌搜索突破现代汽车安全防线](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548715&idx=1&sn=c842cd810145e3349ed6e8e752380fb4&chksm=e915ef11de62660767570cd7b0217af9c9a73c336760449753761cef9f933bf01fbbf7fb053c&scene=58&subscene=0#rd) - - [Active Directory环境网络共享配置权限不当问题的分析和利用](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548715&idx=2&sn=608d6b12850142e692ce8d45a1d14342&chksm=e915ef11de62660710b79a9e63d7df7a236db29b83357d50cebc45ad1d53118643b9cbde92ee&scene=58&subscene=0#rd) -- Tide安全团队 - - [任意文件下载](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247500027&idx=1&sn=3da0cd3cc13dba15eb6897360ee2c55d&chksm=ce5de29af92a6b8c7d219e8548ec2e323ba1b14148820b4b6b51e474eb36bb30ae1cde359a68&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-21.md b/archive/2022/2022-08-21.md deleted file mode 100644 index eef33ecb56..0000000000 --- a/archive/2022/2022-08-21.md +++ /dev/null @@ -1,67 +0,0 @@ -# 每日安全资讯（2022-08-21） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [FLIX AX8 1.46.16 Remote Command Execution](https://cxsecurity.com/issue/WLB-2022080063) - - [Advantech iView NetworkServlet Command Injection](https://cxsecurity.com/issue/WLB-2022080062) - - [Polar Flow Android 5.7.1 Secret Disclosure](https://cxsecurity.com/issue/WLB-2022080061) - - [Transposh WordPress Translation 1.0.8.1 Incorrect Authorization](https://cxsecurity.com/issue/WLB-2022080060) - - [FLIR AX8 1.46.16 Traversal / Access Control / Command Injection / XSS](https://cxsecurity.com/issue/WLB-2022080059) - - [Foodiee 1.0.1 unauthorized administrative access Vulnerability](https://cxsecurity.com/issue/WLB-2022080058) -- Twitter @Nicolas Krassas - - [Automated All-in-One OS Command Injection Exploitation Tool.](https://twitter.com/Dinosn/status/1560894040924737538) - - [RT j j: Had fun writing an exploit for CVE-2022-1802 @thezdi](https://twitter.com/mistymntncop/status/1560842583563444224) -- SecWiki News - - [SecWiki News 2022-08-20 Review](http://www.sec-wiki.com/?2022-08-20) -- Sec-News 安全文摘 - - [论如何优雅的注入 Java Agent 内存马](https://wiki.ioin.in/url/YDX0) - - [Celer Network cBridge 跨链桥事故真相：BGP 劫持](https://wiki.ioin.in/url/bkyq) -- Security Boulevard - - [BSidesTLV 2022 – Gal Bitensky’s ‘SS-Oh No!’](https://securityboulevard.com/2022/08/bsidestlv-2022-gal-bitenskys-ss-oh-no/) - - [BSidesTLV 2022 – Asaf Eitani’s & Itamar Maouda Kochavi’s ‘Hunting Kernel Rootkits With eBPF’](https://securityboulevard.com/2022/08/bsidestlv-2022-asaf-eitanis-itamar-maouda-kochavis-hunting-kernel-rootkits-with-ebpf/) - - [ohq2quarto — Rust-Based CLI For Turning Observable Notebooks Into Quarto Projects](https://securityboulevard.com/2022/08/ohq2quarto-rust-based-cli-for-turning-observable-notebooks-into-quarto-projects/) -- unSafe.sh - 不安全 - - [Cybersecurity Attack and Defense Strategies eBook](https://buaq.net/go-123003.html) - - [论如何优雅的注入 Java Agent 内存马](https://buaq.net/go-122995.html) - - [Celer Network cBridge 跨链桥事故真相：BGP 劫持](https://buaq.net/go-122996.html) - - [dnsReaper - Subdomain Takeover Tool For Attackers, Bug Bounty Hunters And The Blue Team!](https://buaq.net/go-122997.html) - - [aFreeRDP – 远程桌面协议（RDP）客户端 FreeRDP 的 Android 版本](https://buaq.net/go-122992.html) - - [Noptcha – 鉴于越来越离谱的人机验证（Captcha），是时候用机器人反击了](https://buaq.net/go-122986.html) - - [任意键｜蜘蛛侠登陆 PC；141 特遣队再次出击；海绵宝宝多元宇宙及其他](https://buaq.net/go-122983.html) - - [ÆPIC Leak漏洞影响Intel CPU](https://buaq.net/go-122976.html) - - [云容器是裹着糖衣的威胁吗？](https://buaq.net/go-122977.html) - - [重新认识拼音与发音：聊聊汉语拼音与注音符号方案的差异](https://buaq.net/go-122980.html) - - [What to know, what to learn? What are useful skills for cyber in 2022?](https://buaq.net/go-122949.html) - - [Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More](https://buaq.net/go-122950.html) - - [Password as a (Yara) Service](https://buaq.net/go-122937.html) - - [Tech support scammers target Microsoft users with fake Office 365 USB sticks](https://buaq.net/go-122964.html) - - [The four most important aspects of software due diligence audits](https://buaq.net/go-122934.html) - - [赵老哥](https://buaq.net/go-122932.html) - - [闻少（上）](https://buaq.net/go-122931.html) -- 安全客-有思想的安全新媒体 - - [从GDPR和个保法看，为什么要做数据合规？](https://www.anquanke.com/post/id/277203) -- Recent Commits to cve:main - - [Update Sat Aug 20 05:30:19 UTC 2022](https://github.com/trickest/cve/commit/cd8fd06753d2091bbe7af3393b17d9fcd353b9e7) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [ÆPIC Leak漏洞影响Intel CPU](https://www.4hou.com/posts/O96L) - - [云容器是裹着糖衣的威胁吗？](https://www.4hou.com/posts/oJ83) -- No Headback - - [aws 上 kafka 服务更新导致断连一例](http://xargin.com/aws-produce-hang-case/) -- SAP Blogs - - [Day in the life of a Material Buyer – 3- Purchasing](https://blogs.sap.com/2022/08/20/day-in-the-life-of-a-material-buyer-3-purchasing/) - - [SLT Réplication Server for Central Finance (cFIN) scenarios – Replication Content Update](https://blogs.sap.com/2022/08/20/slt-replication-server-for-central-finance-cfin-scenarios-replication-content-update/) - - [Version Bill of Material creation ´(SAP PEO)](https://blogs.sap.com/2022/08/20/version-bill-of-material-creation-sap-peo/) -- 看雪学院 - - [议题征集中！10.23上海，2022 SDC 期待相见](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464923&idx=1&sn=b6d32cf2cf22d9434581f377593ac7c3&chksm=b18e021186f98b079b2fa45ed750fbb97853b669dc8654a654bb61c7c2c66c58c2082d544ba0&scene=58&subscene=0#rd) - - [[安全运维向]模拟搭建小型企业内网](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464923&idx=2&sn=23855cc68fcc93c5ad43c41656efe14f&chksm=b18e021186f98b0793796c961a042f090bc6adba0b9b8b751ee18b48227e923836303f8fae5d&scene=58&subscene=0#rd) - - [反勒索软件开发实战篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464923&idx=3&sn=33665ecd064d94977d8c2150e0072fca&chksm=b18e021186f98b071531f7c71b93a22cd76578ad55f850ae9c8c9dfb10bff382fd981d709b5c&scene=58&subscene=0#rd) -- Dhole Moments - - [Cryptographic Agility and Superior Alternatives](https://soatok.blog/2022/08/20/cryptographic-agility-and-superior-alternatives/) -- 数世咨询 - - [中国网络安全股权投资50强（2021）](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494760&idx=1&sn=2a1a3046fecc026e90b880f33f66c09e&chksm=c1449ed5f63317c364634648b624481a30238d8b418d30c0455310b5e7a527ed1c8dea8fc772&scene=58&subscene=0#rd) -- 网安国际 - - [网络安全实践教学与高水平人才培养研讨会在山东大学（青岛）成功召开](https://mp.weixin.qq.com/s?__biz=MzA4ODYzMjU0NQ==&mid=2652311512&idx=1&sn=c120c60e4989885e0080c05c8cf82634&chksm=8bc49256bcb31b408c386f96c5d9f30de6e37a5afc7c69dbe7a0fb07d62038d0a313641a1494&scene=58&subscene=0#rd) -- 极客公园 - - [扎克伯格 100 亿美元烧出来的元宇宙，被欧美网友群嘲](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965322&idx=1&sn=2fbbe7970801615171889f9ad51d49cd&chksm=7e54747c4923fd6a19f486b6bd0299fe20f6903f276c274ad2a9f0aefccb0ef6814f114b94fa&scene=58&subscene=0#rd) - - [川渝「高温限电」特斯拉、蔚来受影响；扎克伯格 VR 社交虚拟人自拍遭群嘲；世界最大蚊子工厂每周生产 3000 万只｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965299&idx=1&sn=d9acb92a513a4965b948022c99b514c9&chksm=7e5474054923fd1319643cda489dea26be85f9727b78584094e91b5c97d2efd6e5f254959848&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [dnsReaper - Subdomain Takeover Tool For Attackers, Bug Bounty Hunters And The Blue Team!](http://www.kitploit.com/2022/08/dnsreaper-subdomain-takeover-tool-for.html) diff --git a/archive/2022/2022-08-22.md b/archive/2022/2022-08-22.md deleted file mode 100644 index a77b767e52..0000000000 --- a/archive/2022/2022-08-22.md +++ /dev/null @@ -1,89 +0,0 @@ -# 每日安全资讯（2022-08-22） - -- Recent Commits to cve:main - - [Update Sun Aug 21 05:30:26 UTC 2022](https://github.com/trickest/cve/commit/9de944d11d6969ec8ff6c2b3efe9ea72d459e943) -- Sploitus.com Exploits RSS Feed - - [Exploit for Code Injection in Amazon Sockeye exploit](https://sploitus.com/exploit?id=A5418392-390B-50F2-A443-89A2B7B61DD3&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [BSidesTLV 2022 – Amichai’s And Stav Shulman’s ‘Now You C(&C), Now You Don’t’](https://securityboulevard.com/2022/08/bsidestlv-2022-amichais-and-stav-shulmans-now-you-cc-now-you-dont/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 235’ (2019 Repost)](https://securityboulevard.com/2022/08/robert-m-lees-jeff-haas-little-bobby-comic-week-235-2019-repost/) - - [Vulnerability management – we’re doing it wrong](https://securityboulevard.com/2022/08/vulnerability-management-were-doing-it-wrong/) - - [BSidesTLV 2022 – Rotem Reiss’ ‘Code C.A.I.N – Keeping Your Source Code Under Control’](https://securityboulevard.com/2022/08/bsidestlv-2022-rotem-reiss-code-c-a-i-n-keeping-your-source-code-under-control/) - - [How to Mitigate Insider Threat Using Internal Controls](https://securityboulevard.com/2022/08/how-to-mitigate-insider-threat-using-internal-controls/) - - [Hacktivism and DDOS Attacks Rise Dramatically in 2022](https://securityboulevard.com/2022/08/hacktivism-and-ddos-attacks-rise-dramatically-in-2022/) -- obaby@mars - - [WordPress 评论显示IP归属地](http://h4ck.org.cn/2022/08/wordpress-%e8%af%84%e8%ae%ba%e6%98%be%e7%a4%baip%e5%bd%92%e5%b1%9e%e5%9c%b0/) - - [微图坊爬虫 [Chrome Support]【22.08.21】【Windows】](http://h4ck.org.cn/2022/08/%e5%be%ae%e5%9b%be%e5%9d%8a%e7%88%ac%e8%99%ab-chrome-support%e3%80%9022-08-21%e3%80%91%e3%80%90windows%e3%80%91/) -- Twitter @Nicolas Krassas - - [LockBit claims ransomware attack on security giant Entrust, leaks data](https://twitter.com/Dinosn/status/1561398526030266368) - - [Replicant: Reproducing a Fault Injection Attack on the Trezor One](https://twitter.com/Dinosn/status/1561398496573661184) - - [An encrypted ZIP file can have two correct passwords — here's why](https://twitter.com/Dinosn/status/1561398425844719616) - - [Concealed_Code_Execution - Tools And Technical Write-Ups Describing Attacking Techniques That Rely On Concealing Code Execution On Windows](https://twitter.com/Dinosn/status/1561377372133376000) - - [FreeBSD 11.0-13.0 LPE via aio_aqueue Kernel Refcount Bug](https://twitter.com/Dinosn/status/1561354768714440705) - - [Back in Black: Unlocking a LockBit 3.0 Ransomware Attack](https://twitter.com/Dinosn/status/1561354639920054273) - - [OSINT automation for hackers.](https://twitter.com/Dinosn/status/1561344107150249984) - - [RT Vulns Security: Dear Researchers we are starting our payout program for the following weaponized 0days : MS Office/ Adobe Acrobat / Windows RCE/LPE...](https://twitter.com/vulns_sec/status/1561340408914903041) - - [Russian APT29 hackers abuse Azure services to hack Microsoft 365 users](https://twitter.com/Dinosn/status/1561294717974978561) - - [DoNot Team Hackers Updated its Malware Toolkit with Improved Capabilities](https://twitter.com/Dinosn/status/1561294613549293570) - - [White hat hackers broadcasted talks and hacker movies through a decommissioned satellite](https://twitter.com/Dinosn/status/1561286932012957697) - - [Grandoreiro banking malware targets Mexico and Spain](https://twitter.com/Dinosn/status/1561286901956595712) - - [GraphQL Security Testing Without a Schema](https://twitter.com/Dinosn/status/1561278538615062529) - - [RT j j: Oh wow, I didn't realize that the Lazarus Group's (old) Chrome SBX had been captured.](https://twitter.com/mistymntncop/status/1561239376440754176) - - [Re @_r_netsec Low quality post. This is sqlmap in use.](https://twitter.com/Dinosn/status/1561224439097966593) - - [CISA added SAP flaw to its Known Exploited Vulnerabilities Catalog](https://twitter.com/Dinosn/status/1561224035937255425) - - [BlackByte Ransomware Gang Returns With Twitter Presence, Tiered Pricing](https://twitter.com/Dinosn/status/1561223876985737216) - - [About That Draft Law Banning Uncle Sam Buying Insecure Software](https://twitter.com/Dinosn/status/1561223813483954177) - - [dnsReaper - Subdomain Takeover Tool For Attackers, Bug Bounty Hunters And The Blue Team!](https://twitter.com/Dinosn/status/1561222604274470915) -- unSafe.sh - 不安全 - - [Replicant: Reproducing a Fault Injection Attack on the Trezor One](https://buaq.net/go-123078.html) - - [Concealed_Code_Execution - Tools And Technical Write-Ups Describing Attacking Techniques That Rely On Concealing Code Execution On Windows](https://buaq.net/go-123073.html) - - [每周市场点评（2022.8.21）](https://buaq.net/go-123067.html) - - [A Python script to exploit CVE-2022-36446 Software Package Updates RCE (Authenticated) on Webmin < 1.997.](https://buaq.net/go-123064.html) - - [升级也要图个明白：8000 字详解 Android 13 正式版的 9 个新变化](https://buaq.net/go-123065.html) - - [glibc and DT_GNU_HASH](https://buaq.net/go-123131.html) - - [PopFrame – 为 iPhone 截图、录屏添加背景与外壳](https://buaq.net/go-123055.html) - - [corCTF 2022 writeup - modernblog](https://buaq.net/go-123056.html) - - [币安还安全吗？](https://buaq.net/go-123049.html) - - [timwhitez starred go-memexec](https://buaq.net/go-123050.html) - - [timwhitez starred compress](https://buaq.net/go-123051.html) - - [timwhitez starred BOF-patchit](https://buaq.net/go-123052.html) -- SecWiki News - - [SecWiki News 2022-08-21 Review](http://www.sec-wiki.com/?2022-08-21) -- Sec-News 安全文摘 - - [A Python script to exploit CVE-2022-36446 Software Package Updates RCE (Authenticated) on Webmin < 1.997.](https://wiki.ioin.in/url/J4vo) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [微软修复"DogWalk "0 day漏洞和其他的17个关键性的漏洞](https://www.4hou.com/posts/QLjL) - - [2022 年第二季度IT威胁演变](https://www.4hou.com/posts/GKW8) -- MaskRay - - [glibc and DT_GNU_HASH](https://maskray.me/blog/2022-08-21-glibc-and-dt-gnu-hash) -- Reverse Engineering - - [Replicant: Reproducing a Fault Injection Attack on the Trezor One](https://www.reddit.com/r/ReverseEngineering/comments/wu0kk2/replicant_reproducing_a_fault_injection_attack_on/) -- SAP Blogs - - [Implementation and discussion on combining of import data ad Live data in SAC.](https://blogs.sap.com/2022/08/21/implementation-and-discussion-on-combining-of-import-data-ad-live-data-in-sac./) - - [‘Embedded Steampunk’: the Monolith strikes back](https://blogs.sap.com/2022/08/21/embedded-steampunk-the-monolith-strikes-back/) - - [Day in the life of a Material Buyer – 6 -Managing Excess/Obsolete inventory](https://blogs.sap.com/2022/08/21/day-in-the-life-of-a-material-buyer-6-managing-excess-obsolete-inventory/) -- KitPloit - PenTest & Hacking Tools - - [Concealed_Code_Execution - Tools And Technical Write-Ups Describing Attacking Techniques That Rely On Concealing Code Execution On Windows](http://www.kitploit.com/2022/08/concealedcodeexecution-tools-and.html) -- 看雪学院 - - [对一个随身WIFI设备的漏洞挖掘尝试](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464924&idx=1&sn=49bdcb7acd7abb1eda7ad1781278f309&chksm=b18e021686f98b004f5f9c7b20fa0ab4019cec2fbf77d02c0326286f0c82ef74520314fcb24c&scene=58&subscene=0#rd) - - [视频 | 600万美元游戏皮肤失窃！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464924&idx=2&sn=80988d84f26b70143f2d1d1963975866&chksm=b18e021686f98b00ac66c9bf9013db646b549170e6f0c5c2d8912e260ac321f8131c62a6ed6b&scene=58&subscene=0#rd) - - [精品新课！Windows内核漏洞分析与EXP编写技巧](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458464924&idx=3&sn=cc3a9b9f7d7faaab16da6cc313b77172&chksm=b18e021686f98b00463c9ca812dd7383d635165c16a960f30d7e0be25fb65dbee51e3a357902&scene=58&subscene=0#rd) -- 网络安全观 - - [美国国防工业网络保护框架和启示](https://mp.weixin.qq.com/s?__biz=MzIxNzUxNzA2NQ==&mid=2247494863&idx=1&sn=fa7a0f699a289a1b99178c5d2e2e81bb&chksm=97fa31a9a08db8bf3f49223f372dcf12a988ead6ad6a16c445cad6faee3a77dd7151b1c40d97&scene=58&subscene=0#rd) -- 互联网安全内参 - - [入侵太空：超越地球的网络威胁](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505363&idx=1&sn=5b0110feec4aae14c32d64d163fad582&chksm=ebfa92f3dc8d1be51758c3a984ea7e6c61b8968bc3c39fb439e654f4bdfdc8fedfdfc3ae0e5a&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【资料】情报分析师职业发展路线图](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131540&idx=1&sn=0ad3d4c922d36b140cf95985b1ad5df4&chksm=f1af79aec6d8f0b84b867a4816f021231428466c9b051c3fb9811b7419dd7bf87464c5c0ddcd&scene=58&subscene=0#rd) - - [【资料】思维与写作:认知科学与情报分析](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131540&idx=2&sn=a96c90ba331bf20463c22b337d6390ac&chksm=f1af79aec6d8f0b8d0494c6c1d787dd8716297b2a76cace8cf0278db0dc210408cf6724928d7&scene=58&subscene=0#rd) -- 奇安信CERT - - [Apple 多个高危漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496858&idx=1&sn=3ebee0d102cacc44bca58f2407829c82&chksm=fe79d002c90e5914d23e646d2f60046e75daa8623d45d945ea819c799aa75dd051494a301a95&scene=58&subscene=0#rd) -- 情报分析师 - - [如何分析一个人的心理（16个分步指南）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514154&idx=1&sn=a71bdafdd2a9f0168beecb39fc4b5bff&chksm=87168ca1b06105b7e786784128353ad487c4b6a5b5307c4514e4b8826ccb9d678c5baa0a434a&scene=58&subscene=0#rd) - - [【分析报告】美国总统乔·拜登的性格特征和领导风格](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514154&idx=2&sn=5463e0527ae6dd62e7ed343d40a85eb2&chksm=87168ca1b06105b78e4384d7ce797835dd938fa1d814d7e7c7fde9e29040f615a1c25c7df12b&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [关于Apple操作系统越界写入漏洞和Apple WebKit越界写入漏洞的安全公告](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492256&idx=1&sn=194aa7c5c515750109b74663c7a34c64&chksm=fd74d269ca035b7f1c7dd50c9563f2151e807ed87ed85cf24f08f23cefce528170932f6e67e9&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【漏洞通告】Apple多个漏洞安全通告](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650263530&idx=1&sn=283b5a15e526b19004b10a6fd8ca1e58&chksm=f3e2759ec495fc8815a1f0566b7d1ef3a2292dbd660e63e99519300d5f82d4db481ba9246b3d&scene=58&subscene=0#rd) - - [“黑猫”又伸出恶魔之手？揭秘BlackCat病毒的三重勒索](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650263503&idx=1&sn=92fc1eb62cb338ab2c3e1d368790a02e&chksm=f3e275bbc495fcad1be5c5c62833862460e998a09aaedb0fde11c8ef0ceedf5c640d549e1860&scene=58&subscene=0#rd) -- 极客公园 - - [传吉利收购图森中国无人卡车业务；新东方：欢迎离职老师「回家」；30 年内 700 座冰川将消失｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965531&idx=1&sn=96b8076bfe45d86a07b576e3631d115a&chksm=7e54772d4923fe3b4dfc961008aca64aabb27de9af7dc7d2e0e3d58a45002d8f742a8a14d2a4&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-23.md b/archive/2022/2022-08-23.md deleted file mode 100644 index 7f217cd61a..0000000000 --- a/archive/2022/2022-08-23.md +++ /dev/null @@ -1,230 +0,0 @@ -# 每日安全资讯（2022-08-23） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [macOS RawCamera Out-Of-Bounds Write](https://cxsecurity.com/issue/WLB-2022080066) - - [Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution](https://cxsecurity.com/issue/WLB-2022080065) - - [Personnel Property Equipment 2015-2022 SQL Injection](https://cxsecurity.com/issue/WLB-2022080064) -- Recent Commits to cve:main - - [Update Mon Aug 22 05:28:48 UTC 2022](https://github.com/trickest/cve/commit/d16641e491be50c060489c5de7c55e61118a8137) -- Files ≈ Packet Storm - - [Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution](https://packetstormsecurity.com/files/168131/exchange_chainedserializationbinder_rce.rb.txt) - - [Ubuntu Security Notice USN-5575-1](https://packetstormsecurity.com/files/168130/USN-5575-1.txt) - - [Red Hat Security Advisory 2022-6119-01](https://packetstormsecurity.com/files/168129/RHSA-2022-6119-01.txt) - - [Ubuntu Security Notice USN-5574-1](https://packetstormsecurity.com/files/168128/USN-5574-1.txt) - - [Gentoo Linux Security Advisory 202208-34](https://packetstormsecurity.com/files/168127/glsa-202208-34.txt) - - [Gentoo Linux Security Advisory 202208-35](https://packetstormsecurity.com/files/168126/glsa-202208-35.txt) - - [Gentoo Linux Security Advisory 202208-33](https://packetstormsecurity.com/files/168125/glsa-202208-33.txt) - - [Gentoo Linux Security Advisory 202208-32](https://packetstormsecurity.com/files/168124/glsa-202208-32.txt) - - [Personnel Property Equipment 2015-2022 SQL Injection](https://packetstormsecurity.com/files/168123/ppe20152022-sql.txt) - - [AppleAVD AVC_RBSP::parseSliceHeader ref_pic_list_modification Overflow](https://packetstormsecurity.com/files/168122/GS20220822155421.tgz) - - [macOS RawCamera Out-Of-Bounds Write](https://packetstormsecurity.com/files/168121/GS20220822155207.txt) -- Microsoft Security Blog - - [Microsoft recognized as a Leader in the 2022 Gartner® Magic Quadrant™ for Unified Endpoint Management Tools](https://www.microsoft.com/security/blog/2022/08/22/microsoft-recognized-as-a-leader-in-the-2022-gartner-magic-quadrant-for-unified-endpoint-management-tools/) - - [Cyber Signals: Defend against the new ransomware landscape](https://www.microsoft.com/security/blog/2022/08/22/cyber-signals-defend-against-the-new-ransomware-landscape/) -- Twitter @Nicolas Krassas - - [Java libraries are riddled with deserialization security holes](https://twitter.com/Dinosn/status/1561808115766534144) - - [8-year-old Linux Kernel flaw DirtyCred is nasty as Dirty Pipe](https://twitter.com/Dinosn/status/1561793108240637952) - - [Misconfigured Meta Pixel exposed healthcare data of 1.3M patients](https://twitter.com/Dinosn/status/1561793014921666562) - - [RPCMon - RPC Monitor Tool Based On Event Tracing For Windows](https://twitter.com/Dinosn/status/1561774627688517634) - - [Greek natural gas operator suffers ransomware-related data breach](https://twitter.com/Dinosn/status/1561774307797262343) - - [Researchers Find Counterfeit Phones with Backdoor to Hack WhatsApp Accounts](https://twitter.com/Dinosn/status/1561774199378743297) - - [RT Onapsis: Critical SAP CVE-2022-22536 vulnerability was disclosed by Onapsis Research Labs in February and assigned a 10/10 severity rating. @CISAgo...](https://twitter.com/onapsis/status/1561766002303672320) - - [RT Ivan Kwiatkowski: I'm very happy to share a project I've been working on for a long time now. A 🔥 scathing 🔥 three-part series on cryptocurre...](https://twitter.com/JusticeRage/status/1561740220244041728) - - [LockBit ransomware blames Entrust for DDoS attacks on leak sites](https://twitter.com/Dinosn/status/1561727486517563393) - - [RT Zak: If you're interested by an alternative way to dump domain users' NT hashes and TGT without touching LSASS, take a look at the new Masky tool :...](https://twitter.com/_ZakSec/status/1561708530046050305) - - [Create a simple phishing website and a Javascript keylogger](https://twitter.com/Dinosn/status/1561701718936756224) - - [WhiskeySAML and Friends: GoldenSAML Attack Libraries and Framework](https://twitter.com/Dinosn/status/1561677882933612546) - - [Account takeover worth $1000](https://twitter.com/Dinosn/status/1561677782157070338) - - [Fancy SQL (froscon2022)](https://twitter.com/Dinosn/status/1561645083065257989) - - [codewarrior: detect sinks of SQL injection, SSTI, XXE, LFI, XSS](https://twitter.com/Dinosn/status/1561637228316704770) - - [GitHub Cache Poisoning](https://twitter.com/Dinosn/status/1561620617245384704) - - [Zoom patches make-me-root security flaw, patches patch](https://twitter.com/Dinosn/status/1561609979756412928) - - [RT Security BSides Ahmedabad: Thank you everyone, we sold out early bird passes and regular-student passes , within a month . Only limited individual ...](https://twitter.com/bsidesahmedabad/status/1561570055917146113) -- Sploitus.com Exploits RSS Feed - - [Personnel Property Equipment 2015-2022 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168123&utm_source=rss&utm_medium=rss) - - [Transposh WordPress Translation 1.0.8.1 Incorrect Authorization Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37915&utm_source=rss&utm_medium=rss) - - [FLIR AX8 1.46.16 Traversal / Access Control / Command Injection / XSS Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-37916&utm_source=rss&utm_medium=rss) - - [FLIR AX8 1.46.16 Remote Command Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37917&utm_source=rss&utm_medium=rss) - - [macOS RawCamera Out-Of-Bounds Write Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37919&utm_source=rss&utm_medium=rss) - - [Personnel Property Equipment 2015-2022 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37918&utm_source=rss&utm_medium=rss) - - [Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168131&utm_source=rss&utm_medium=rss) - - [Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37920&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [5 Techniques To Protect Open-Source Software](https://securityboulevard.com/2022/08/5-techniques-to-protect-open-source-software/) - - [Black Hat Fireside Chat: Deploying ‘AI’ as a weapon to win the ‘attack surface management’ war](https://securityboulevard.com/2022/08/black-hat-fireside-chat-deploying-ai-as-a-weapon-to-win-the-attack-surface-management-war/) - - [MFA vs. SSO Explained](https://securityboulevard.com/2022/08/mfa-vs-sso-explained/) - - [BSidesTLV 2022 – Dina Treves’ Security Mindset – For The Selected Few, Or An Acquired (Required) Skill?’](https://securityboulevard.com/2022/08/bsidestlv-2022-dina-treves-security-mindset-for-the-selected-few-or-an-acquired-required-skill/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – “WEEK 395”](https://securityboulevard.com/2022/08/robert-m-lees-jeff-haas-little-bobby-comic-week-395/) - - [NSO Group Fires CEO — and 100 Staff — in Spyware ‘Streamlining’](https://securityboulevard.com/2022/08/nso-group-fires-ceo-richixbw/) - - [Want to get an edge in the competitive banking and financial market? Consider unifying your payment card portfolio.](https://securityboulevard.com/2022/08/want-to-get-an-edge-in-the-competitive-banking-and-financial-market-consider-unifying-your-payment-card-portfolio/) - - [US Aims to Revitalize Semiconductor Production With CHIPS Act](https://securityboulevard.com/2022/08/us-aims-to-revitalize-semiconductor-production-with-chips-act/) - - [Getting Ahead of Certificate-Related Outages With Automation and Visibility](https://securityboulevard.com/2022/08/getting-ahead-of-certificate-related-outages-with-automation-and-visibility/) - - [NIST Post-Quantum Competition: And the round 3 finalists are…](https://securityboulevard.com/2022/08/nist-post-quantum-competition-and-the-round-3-finalists-are/) -- 先知安全技术社区 - - [Mysql蜜罐反制Cobalt Strike](https://xz.aliyun.com/t/11631) - - [对云函数隐藏C2技术的防御反制思路](https://xz.aliyun.com/t/11625) -- paper - Last paper - - [Chrome 沙箱绕过研究](https://paper.seebug.org/1947/) - - [从偶遇 Flarum 开始的 RCE 之旅](https://paper.seebug.org/1946/) -- 跳跳糖 - 安全与分享社区 - - [基于USMA的内核通用EXP编写思路在 CVE-2022-34918 上的实践](https://tttang.com/archive/1706/) -- 先知安全技术社区 - - [Mysql蜜罐反制Cobalt Strike](https://xz.aliyun.com/t/11631) - - [对云函数隐藏C2技术的防御反制思路](https://xz.aliyun.com/t/11625) -- SecWiki News - - [SecWiki News 2022-08-22 Review](http://www.sec-wiki.com/?2022-08-22) -- unSafe.sh - 不安全 - - [OpenVPN Connect v3 密码恢复](https://buaq.net/go-123254.html) - - [CISA wants you to patch these actively exploited vulnerabilities before September 8](https://buaq.net/go-123289.html) - - [呼吁国家严厉打击：当医生拿起手术刀抢劫，病人无从还手](https://buaq.net/go-123268.html) - - [Why are Millennials are more likely to engage in trolling?](https://buaq.net/go-123248.html) - - [RPCMon - RPC Monitor Tool Based On Event Tracing For Windows](https://buaq.net/go-123251.html) - - [Mysql蜜罐反制Cobalt Strike](https://buaq.net/go-123245.html) - - [对云函数隐藏C2技术的防御反制思路](https://buaq.net/go-123246.html) - - [Cryptojackers growing in numbers and sophistication](https://buaq.net/go-123290.html) - - [First Bug Bounty from DOS: Taking the service down](https://buaq.net/go-123249.html) - - [Account takeover worth $1000](https://buaq.net/go-123250.html) - - [派评 | 近期值得关注的 App](https://buaq.net/go-123243.html) - - [FreeBuf早报 | 谷歌曝光有史以来最大DDoS攻击；一根USB线就能偷走韩系车](https://buaq.net/go-123285.html) - - [药不能停的方法有几种：9 款服药 app 横评](https://buaq.net/go-123244.html) -- 安全客-有思想的安全新媒体 - - [男子非法倒卖获利数亿，快看看到底是什么赚钱的大买卖](https://www.anquanke.com/post/id/274445) - - [活动 | ISRC中秋众测，让你乐不思蜀](https://www.anquanke.com/post/id/278507) - - [安全事件周报 (08.15-08.21)](https://www.anquanke.com/post/id/278553) - - [假负责真撕票，LockBit扬言公开安全巨头Entrust数据](https://www.anquanke.com/post/id/278549) - - [CVE-2022-0540 Jira身份验证绕过漏洞分析](https://www.anquanke.com/post/id/278301) - - [乌克兰黑客入侵克里米亚电视台，播放泽伦斯基演说](https://www.anquanke.com/post/id/278492) - - [Grandoreiro 银行木马“洗劫”西班牙、墨西哥制造商](https://www.anquanke.com/post/id/278545) - - [黑客利用0Day从General Bytes旗下比特币ATM中窃取加密货币](https://www.anquanke.com/post/id/278495) - - [赛博拖拉机！DefCon上黑客为大型农业设备刷机越狱](https://www.anquanke.com/post/id/278498) - - [甘肃公安机关严打“黑客”犯罪成效显著](https://www.anquanke.com/post/id/278500) - - [基于RDP协议识别主机操作系统版本与用户名](https://www.anquanke.com/post/id/278122) - - [印度大使馆官网遭克什米尔黑客入侵？](https://www.anquanke.com/post/id/278459) - - [苹果曝严重安全漏洞，黑客或可接管设备](https://www.anquanke.com/post/id/278488) -- obaby@mars - - [WordPress 评论显示IP归属地插件](http://h4ck.org.cn/2022/08/wordpress-%e8%af%84%e8%ae%ba%e6%98%be%e7%a4%baip%e5%bd%92%e5%b1%9e%e5%9c%b0%e6%8f%92%e4%bb%b6/) -- cloud world - - [2022 34 Open source weekly report](https://cloudsjhan.github.io/2022/08/22/2022-34-Open-source-weekly-report/) -- 安全脉搏 - - [拦截93亿4855万次暴力破解攻击！Coremail&中睿天下发布2022年企业邮箱安全报告](https://www.secpulse.com/archives/185818.html) - - [物联网安全技术丨固件模拟下的patch与hook](https://www.secpulse.com/archives/185772.html) - - [OAuth2-0协议安全学习](https://www.secpulse.com/archives/185691.html) - - [ISRC中秋众测，让你乐不思蜀](https://www.secpulse.com/archives/185682.html) -- Sec-News 安全文摘 - - [OpenVPN Connect v3 密码恢复](https://wiki.ioin.in/url/9NGl) -- mod%log - - [Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor](https://www.modzero.ch/modlog/archives/2022/08/22/ridiculous_vulnerability_disclosure_process_with_crowdstrike_falcon_sensor/index.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [Coremail&中睿天下：2022年第二季度企业邮箱安全报告](https://www.4hou.com/posts/oJJj) - - [在登录 OAuth 流程中使用”OAuth-dance”方法进行帐户劫持（上）](https://www.4hou.com/posts/9XGZ) - - [「数澈软件」获5300万元种子轮融资，构建新一代软件供应链防火墙](https://www.4hou.com/posts/ZXrR) - - [亚马逊Ring安卓app漏洞可窃取个人信息](https://www.4hou.com/posts/nJ6E) -- modexp - - [Shellcode: Base-N Decoding for Text-Only Compression and Obfuscation](https://modexp.wordpress.com/2022/08/22/base_n_compression/) -- Blog - Atredis Partners - - [Part 1: Ransomware – To Pay or Not to Pay](https://www.atredis.com/blog/2022/5/10/part-1-ransomware-to-pay-or-not-to-pay) -- hn security - - [Useless path traversals in Zyxel admin interface (CVE-2022-2030)](https://security.humanativaspa.it/useless-path-traversals-in-zyxel-admin-interface-cve-2022-2030/) -- Reusable Security - - [More Password Cracking Tips: A Defcon 2022 Crack Me If You Can Roundup](https://reusablesec.blogspot.com/2022/08/more-password-cracking-tips-defcon-2022.html) -- blog.avast.com EN - - [Why are Millennials are more likely to engage in trolling?](https://blog.avast.com/millennials-more-likely-trolling) -- SAP Blogs - - [The Universe of SAP Business Technology Platform in a Nutshell](https://blogs.sap.com/2022/08/22/the-universe-of-sap-business-technology-platform-in-a-nutshell/) - - [Leverage the full potential of the SAP Business Technology Platform by building a Center of Excellence](https://blogs.sap.com/2022/08/22/leverage-the-full-potential-of-the-sap-business-technology-platform-by-building-a-center-of-excellence/) - - [Converting project working hrs to person day with embedded steampunk extensibility](https://blogs.sap.com/2022/08/22/converting-project-working-hrs-to-person-day-with-embedded-steampunk-extensibility/) - - [HANA Cloud – Highlight production](https://blogs.sap.com/2022/08/22/hana-cloud-highlight-production/) - - [How to Use Spaces and Pages in SAP S/4HANA Cloud 2208 Release](https://blogs.sap.com/2022/08/22/how-to-use-spaces-and-pages-in-sap-s-4hana-cloud-2208-release/) - - [SAP Private Link service use cases for SAP Cloud Integration and SAP Launchpad](https://blogs.sap.com/2022/08/22/sap-private-link-service-use-cases-for-sap-cloud-integration-and-sap-launchpad/) - - [Why can enterprise architecture accelerate your business process transformation?](https://blogs.sap.com/2022/08/22/why-can-enterprise-architecture-accelerate-your-business-process-transformation/) - - [The ABAP Detective Gets a Timeout](https://blogs.sap.com/2022/08/22/the-abap-detective-gets-a-timeout/) - - [The Link Between the Competency Framework, CLTV, and Recurring Revenue](https://blogs.sap.com/2022/08/22/the-link-between-the-competency-framework-cltv-and-recurring-revenue/) - - [3 Best SAP HANA Technical Tips | Champion Spotlight Jens Gleichmann](https://blogs.sap.com/2022/08/22/3-best-sap-hana-technical-tips-champion-spotlight-jens-gleichmann/) -- SentinelOne - - [XCSSET Malware Update | macOS Threat Actors Prepare for Life Without Python](https://www.sentinelone.com/blog/xcsset-malware-update-macos-threat-actors-prepare-for-life-without-python/) -- Bug Bounty in InfoSec Write-ups on Medium - - [First Bug Bounty from DOS: Taking the service down](https://infosecwriteups.com/first-bug-bounty-from-dos-taking-the-service-down-30f9ad4e0246?source=rss----7b722bfd1b8d--bug_bounty) - - [Account takeover worth $1000](https://infosecwriteups.com/account-takeover-worth-1000-611452063cf?source=rss----7b722bfd1b8d--bug_bounty) -- Malwarebytes Labs - - [Criminals socially engineer their way to bank details with fake arrest warrants](https://www.malwarebytes.com/blog/news/2022/08/criminals-socially-engineer-their-way-to-bank-details-with-fake-arrest-warrants) - - [Reddit users crowdsourcing explicit images and identities](https://www.malwarebytes.com/blog/news/2022/08/reddit-users-crowdsourcing-explicit-images-and-identities) - - [CISA wants you to patch these actively exploited vulnerabilities before September 8](https://www.malwarebytes.com/blog/news/2022/08/cisa-wants-you-to-patch-these-actively-exploited-vulnerabilities-before-september-8) - - [Cryptojackers growing in numbers and sophistication](https://www.malwarebytes.com/blog/news/2022/08/cryptojackers-are-growing-in-numbers-and-sophistication) - - [A week in security (August 15 - August 21)](https://www.malwarebytes.com/blog/news/2022/08/a-week-in-security-august-15-august-21) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/wumhlp/rreverseengineerings_weekly_questions_thread/) - - [Solving my truck’s TPMS sensor problem with the help of an RTL-SDR dongle](https://www.reddit.com/r/ReverseEngineering/comments/wv6f3n/solving_my_trucks_tpms_sensor_problem_with_the/) -- daniel.haxx.se - - [Increased CVE activity in curl?](https://daniel.haxx.se/blog/2022/08/22/increased-cve-activity-in-curl/) -- KitPloit - PenTest & Hacking Tools - - [RPCMon - RPC Monitor Tool Based On Event Tracing For Windows](http://www.kitploit.com/2022/08/rpcmon-rpc-monitor-tool-based-on-event.html) -- HAHWUL - - [Hugo to Jekyll](https://www.hahwul.com/2022/08/22/hugo-to-jekyll/) -- Twitter @hakivvi - - [RT Axel Souchet: I just released the source code of Paracosme: a zero-click remote memory corruption exploit I demonstrated at Pwn2Own 2022 Miami 🐛...](https://twitter.com/0vercl0k/status/1561748323429539841) -- 雷神众测 - - [雷神众测漏洞周报2022.8.15-2022.8.21](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652499286&idx=1&sn=071258b97a3a9f3c83d39050bbcc4644&chksm=f2584ee5c52fc7f3a4b5b99e55a399ac4c3fb134bd822efcd448c6aff17ae6e998328405095e&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【情报实战】起底台湾民主基金会（TFD）](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131584&idx=1&sn=c55d2d4ea7eec82f8a6d807e87c1ed86&chksm=f1af79fac6d8f0ecf46f6ac8eff4320e14d91ada39e42436edbe87161447b2ac708c9f60f69f&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】基于边界节点链路交互C2流量](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649775755&idx=1&sn=9bf337d94189840a4606a4b482cf1c89&chksm=88936ee4bfe4e7f2f0fcc3a3902f466e07f6c2546ed7fa278a4a62eb9de20ba5ddbd1bb6839b&scene=58&subscene=0#rd) - - [【安全头条】印度大使馆官网遭克什米尔黑客入侵](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649775755&idx=2&sn=c631d14cbef53d258d8be3c3656f3243&chksm=88936ee4bfe4e7f29c149b099a9f84dbe72f9a6bdb3e4f16b7e4ffab0c768a28ddc2545563de&scene=58&subscene=0#rd) -- 奇安信CERT - - [安全热点周报|第二百五十八期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496863&idx=1&sn=a6b233771201d72e6278302ce82b0309&chksm=fe79d007c90e5911a721004e8313198eb075c56330105f768d2b921c5f858ec7f101af30427c&scene=58&subscene=0#rd) -- 安恒信息安全研究院 - - [2022钓鱼利器！LNK文件攻击为何广受青睐](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247491173&idx=1&sn=8ca032328fd4e6d1df6d3d5843e278de&chksm=f9ee72dace99fbcc434dd72678b65139e9a1aa2b52c34446abe2d247861c2bc4069cad67875f&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(08-22)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958634&idx=1&sn=ca7f71315ed3a84e3446f1bd7a99cef7&chksm=8baecdf5bcd944e3af6d1e8db5f72672aa48e1a07d34e1784799a87f21a915fab673c76b0a87&scene=58&subscene=0#rd) -- Checkmarx.com - - [Most Dangerous CWEs of 2021](https://checkmarx.com/blog/most-dangerous-cwes-of-2021/) -- 安全威胁情报 - - [助力政务安全，微步在线与国信安全共建首个政务专属安全DNS服务平台](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173584&idx=1&sn=b0a14e3525d805e6ca9604604cdde53e&chksm=f4488b2cc33f023a6503e3e904978b2c9fa262e5b53f97cfe62b00b9611313fe20dfbe552247&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [CNVD漏洞周报2022年第33期](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497254&idx=1&sn=b1d0d4f0a90a23e38c8f1d50c971b9bd&chksm=973ac544a04d4c52391876d2c3a42f1c30e5692313ac1b1351ff1c453780635fa1fd089da4e3&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220815-20220821)](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497254&idx=2&sn=c315e26c488784c125e48118b051cd2f&chksm=973ac544a04d4c5299ff6d62e0deba5fc665978537da0f02d672180a2d41af31ebd49475e66d&scene=58&subscene=0#rd) -- 看雪学院 - - [带加密字符串的.NET样本分析的一些技巧](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465022&idx=1&sn=d6988433d911407f5417a678b854fa00&chksm=b18e027486f98b624d76ecdb93b0623a9cdb5b83568db00c8795e71a57fda5edc08d467ea52a&scene=58&subscene=0#rd) - - [【线下“鉴黄一日体验官”招募中】互联网生态“守门人”，专业度超乎你的想象](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465022&idx=2&sn=a95c66e139719b695e94aab3f1cdea74&chksm=b18e027486f98b62eb6f96d5e65a365acab76308ea4af748ca4b03126abc22d22c5dd68b4553&scene=58&subscene=0#rd) - - [苹果曝严重漏洞冲上热搜第一，黑客或可完全接管设备](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465022&idx=3&sn=34e5fb35ba5d37300b751f6348f1a016&chksm=b18e027486f98b620d51813f78145575aa0fb0b8df9b3e5feb89ffbdd93ee5e5d7adf707c15e&scene=58&subscene=0#rd) - - [Unicorn 高级逆向与反混淆](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465022&idx=4&sn=6618ed45edc265699a39c513527f2579&chksm=b18e027486f98b62d882fe86e8bc9b2f8ac36806e01b2cf9b9758d83df3993aef66da9ce1570&scene=58&subscene=0#rd) -- NOVASEC - - [记录有趣的CTF题目：WMCTF2020_gogogo](https://mp.weixin.qq.com/s?__biz=MzUzODU3ODA0MA==&mid=2247487969&idx=1&sn=4e3c9ef752ad2ebe39ad7e2e0523b988&chksm=fad4ccf6cda345e08f762526111248eba81c7b3ca5bfb47599dc03370dea7377539ee573d6a6&scene=58&subscene=0#rd) -- 极客公园 - - [杜兰特、贝佐斯、a16z 凑钱，搞了个 5 亿美金的「小 NBA」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965648&idx=1&sn=8c2835de07479adb2aa441170a6942f3&chksm=7e5476a64923ffb036fcdc8602761117d784bf74b85f24b3baf30b9982c68deb4ae6fbc83fe2&scene=58&subscene=0#rd) - - [TikTok 否认监控用户传闻；特斯拉自动驾驶功能将涨价 25%；传 iPhone 14 仍有 mini 机型｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965560&idx=1&sn=312a18fa51b2971c02490c9c9606cf89&chksm=7e54770e4923fe186097ba81bddb020effdd94a4bae1b1328cbf45507d60a5afc91b70644ae7&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | 如何使用云原生方法来提高 API 安全性](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495147&idx=1&sn=7d5fad61e5ed47faf127727e64543766&chksm=c0074077f770c9617f5fb9fe71c8335476ffbfa0061bc36382a1e60b6fdbdb7bde4e89443aea&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [EMUX仿真RV130的栈溢出整型利用](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495867&idx=1&sn=4fd1f76459a06039734f667417b5090f&chksm=fa522505cd25ac1386e9f3379918f40aaad9a67f81d3e4076b0787cfb01ce010b602467bada6&scene=58&subscene=0#rd) -- 暗影安全 - - [倒计时三天 | 寻识首届技术沙龙议题公布！](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163140&idx=1&sn=3a764f52269d8b896b85b005ad24f1d0&chksm=f1d4e561c6a36c7784498582436c8da5d19c21dce4bf1d52cfabf1bf5d50f44dbd3b5b20e26e&scene=58&subscene=0#rd) - - [ISRC中秋众测，让你乐不思蜀](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163140&idx=2&sn=7285b2e719c4ebb4b64b1eeb9964a6f6&chksm=f1d4e561c6a36c7750204082efd329eabca4fc807800abbf2471e11a2d438e6ddc976faee23b&scene=58&subscene=0#rd) -- Tide安全团队 - - [Selenuim自动入坑指南二](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247500055&idx=1&sn=001a103d23660eeab5ff60dfef0902f2&chksm=ce5de376f92a6a60b4bd04a0f6295f76109349d7a8b89d420993fddbc96ca261538eb67791a3&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [ByteCTF报名&答题有礼！组队集结齐上分！](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489366&idx=1&sn=75261d0790a4256ee136b32f2a8de4e6&chksm=fa9eec00cde96516588d6e2ade4d82da8377c5e914c42fae21a835fa9a69e9bff51fc241f9f5&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-08-22 BreakMi](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492446&idx=1&sn=4694bd85d5441cc3e0fca3296317c4d5&chksm=c063cd87f7144491a9295bbc485d700ad2e20f31afcf1a5b2ff9ba4321a63be9d966d0fd7eb0&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [Strategy Pattern 教你秒变“神枪手”](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247497717&idx=1&sn=86bf27cdd17cb6f89306dc504292923a&chksm=e9d33c17dea4b501e009988af0da04216ff1a810f0505e818f965ac71989705d726b04fe53a1&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [亚马逊Ring安卓app漏洞可窃取个人信息](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548798&idx=1&sn=804550d22ddb8f6f520f01faa3ee1e29&chksm=e915ef44de626652c6d637c900f777e5cea90d6e37031fe58837055b25ea4c5394408383a155&scene=58&subscene=0#rd) - - [「数澈软件」获5300万元种子轮融资，构建新一代软件供应链防火墙](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548798&idx=2&sn=df30ec14d44a159e0131986229fbc951&chksm=e915ef44de626652b19bc667e7ce7764f38208c203875341ddcbbf2eaca0a1f5439cb8c008a3&scene=58&subscene=0#rd) - - [在登录 OAuth 流程中使用”OAuth-dance”方法进行帐户劫持（上）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548798&idx=3&sn=f08beb1767380c39922f44abb5e4e1df&chksm=e915ef44de626652452a839a66869d1c32590969fa0afb676f2bb698ea7cf97e7cb033d4daf8&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [【活动】JSRC中秋礼品已上线，敬请查收！](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727834983&idx=1&sn=9abec4105c342be1b025afbc2728356b&chksm=8050a2efb7272bf928c157f013501add960fac73ea11b09d905103a516b215d8269ebf072239&scene=58&subscene=0#rd) -- M01NTeam - - [攻击技术研判 | 绕过Chrome安全首选项无交互安装恶意扩展](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489386&idx=1&sn=82729f756602200bb93752d1be4acfa0&chksm=c187d77bf6f05e6d0a960aebe9851c851263b83a90503ee69a09fe67e954f56fa29833fc4a8e&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Aug.22th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495761&idx=1&sn=a2430fb1c97734054c11f873c914a50c&chksm=ce96bd6ff9e134799dee5e61480ea1cc4f16ceb1c978279f421e244e51e39b9bf7bdfc002efb&scene=58&subscene=0#rd) -- 安全牛 - - [2022年度eSecurity Planet网络安全评选花落谁家？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117782&idx=1&sn=234e70f0cb4f4c0cfeb90e4abb9fd83f&chksm=bd1468058a63e1135c27cfa727f67da00ecf374e4c5d14cdca16d623181cb37ec41b0ab249f4&scene=58&subscene=0#rd) - - [软件供应链安全初创公司数澈软件宣布完成5300万元种子轮融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117782&idx=2&sn=2f3c87f20f0143e488fb8169e6754bb2&chksm=bd1468058a63e113bddd22bc71bb14d82d888ee94a6675bc42807006fc0a6a59acab3c8ddbcb&scene=58&subscene=0#rd) - - [安全头条 |中央网信办：正在加快推动《未成年人网络保护条例》出台；《安全SD-WAN应用指南》报告发布](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117782&idx=3&sn=2b83bc2286bef0e0288e8d0a4cf9f39d&chksm=bd1468058a63e1139e365ae4e71fdf55f26d455685fff66d3960abf751a890fc6947af736b6e&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [国家工程研究中心安全资讯周报20220822期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530712&idx=1&sn=e7b15da89431f7e8c04b1310d88bfb0c&chksm=fa93ce19cde4470f7afe5496dda1ea2fa2d7f5080ccbfe2c9115dddc66c76efb48f5a1aa36ac&scene=58&subscene=0#rd) - - [微软修复"DogWalk "0 day漏洞和其他的17个关键性的漏洞](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530712&idx=2&sn=a8b2fec722331dbb746248d9408859ce&chksm=fa93ce19cde4470f51e918ec054323e06fae1819ed63fa196a3b58d0957036016ef459730564&scene=58&subscene=0#rd) - - [工信部：持续加强网络安全保障体系和能力建设](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530712&idx=3&sn=e7d9bc1c632178b4ac76f4bd4e52ae89&chksm=fa93ce19cde4470fda27be168f646da3e2b545fdf63964e6f38ae2e9b11978d270d80d621adf&scene=58&subscene=0#rd) -- 情报分析师 - - [重磅《特种作战资料合集》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514226&idx=1&sn=5e22f44c78b1db0f42e806529586714f&chksm=87168d79b061046f1cc0b4ea56cbc743057c12981af1fc2f0852d36d9d04234aac4a30c5201d&scene=58&subscene=0#rd) - - [【情报】乌克兰特种作战部队指挥链和训练](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514226&idx=2&sn=ae0f19b72770d460946b87af79b5f8f8&chksm=87168d79b061046f652f738973512ab8599970169f31630e378890ce035f0dccd838d6bfc102&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-24.md b/archive/2022/2022-08-24.md deleted file mode 100644 index 70041b9c38..0000000000 --- a/archive/2022/2022-08-24.md +++ /dev/null @@ -1,192 +0,0 @@ -# 每日安全资讯（2022-08-24） - -- Files ≈ Packet Storm - - [I2P 1.9.0](https://packetstormsecurity.com/files/168138/i2psource_1.9.0.tar.bz2) - - [Teleport 9.3.6 Command Injection](https://packetstormsecurity.com/files/168137/teleport936-exec.txt) - - [Red Hat Security Advisory 2022-6053-01](https://packetstormsecurity.com/files/168136/RHSA-2022-6053-01.txt) - - [Ubuntu Security Notice USN-5575-2](https://packetstormsecurity.com/files/168135/USN-5575-2.txt) - - [WordPress Duplicator 1.4.7.2 Backup Disclosure](https://packetstormsecurity.com/files/168134/wpduplicator1472-disclose.txt) - - [10-Strike Network Inventory Explorer 9.3 Buffer Overflow](https://packetstormsecurity.com/files/168133/10strikenim93-overflow.txt) -- Sec-News 安全文摘 - - [一种新的Tomcat内存马 - Upgrade内存马](https://wiki.ioin.in/url/k4XV) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Teleport 9.3.6 Command Injection](https://cxsecurity.com/issue/WLB-2022080069) - - [10-Strike Network Inventory Explorer 9.3 Buffer Overflow](https://cxsecurity.com/issue/WLB-2022080068) - - [WordPress Duplicator 1.4.7.2 Backup Disclosure](https://cxsecurity.com/issue/WLB-2022080067) -- Microsoft Security Blog - - [A multidimensional approach to journalism security](https://www.microsoft.com/security/blog/2022/08/23/a-multidimensional-approach-to-journalism-security/) -- Envato Tuts+ Code - Mobile Development - - [Android Sensors in Depth: Proximity and Gyroscope](https://code.tutsplus.com/tutorials/android-sensors-in-depth-proximity-and-gyroscope--cms-28084) -- Security Boulevard - - [SIEM and SOAR—and Identity Security](https://securityboulevard.com/2022/08/siem-and-soar-and-identity-security/) - - [Techstrong TV: How to Prepare for Highly Destructive Malware](https://securityboulevard.com/2022/08/techstrong-tv-how-to-prepare-for-highly-destructive-malware/) - - [Reading a URL to Tell if It’s Real or Fake](https://securityboulevard.com/2022/08/reading-a-url-to-tell-if-its-real-or-fake/) - - [The Rise of Mobile Phishing and How to Handle It](https://securityboulevard.com/2022/08/the-rise-of-mobile-phishing-and-how-to-handle-it/) - - [AWS Streamlines Data Protection by Simplifying Snapshot Creation](https://securityboulevard.com/2022/08/aws-streamlines-data-protection-by-simplifying-snapshot-creation/) - - [A Potential GDPR Nightmare Hiding in the 3rd Party Digital Supply Chain](https://securityboulevard.com/2022/08/a-potential-gdpr-nightmare-hiding-in-the-3rd-party-digital-supply-chain/) - - [GUEST ESSAY: A breakdown of the cyber risks intrinsic to ubiquitous social media apps](https://securityboulevard.com/2022/08/guest-essay-a-breakdown-of-the-cyber-risks-intrinsic-to-ubiquitous-social-media-apps/) -- unSafe.sh - 不安全 - - [论如何优雅的注入Java Agent内存马](https://buaq.net/go-123404.html) - - [Shiro 历史漏洞分析](https://buaq.net/go-123405.html) - - [AppSec Decoded: The NIST guidance on supply chain risk management](https://buaq.net/go-123400.html) -- Twitter @Nicolas Krassas - - [[CVE-2020-2733] Technical overview and PoC of bypassing admin authentication of JD Edwards EnterpriseOne](https://twitter.com/Dinosn/status/1562148160637640705) - - [System Informer - A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware](https://twitter.com/Dinosn/status/1562148076558622727) - - [New 'Donut Leaks' extortion gang linked to recent ransomware attacks](https://twitter.com/Dinosn/status/1562147457240383489) - - [Apache shiro Historical Vulnerability Analysis](https://twitter.com/Dinosn/status/1562146506706231298) - - [GitLab fixed a critical Remote Code Execution (RCE) bug in CE and EE releases](https://twitter.com/Dinosn/status/1562145776679149568) - - [Smartphone gyroscopes threaten air-gapped systems, researcher finds](https://twitter.com/Dinosn/status/1562145640636981253) - - [French hospital hit by $10M ransomware attack, sends patients elsewhere](https://twitter.com/Dinosn/status/1562145559699415047) - - [Google Uncovers Tool Used by Iranian Hackers to Steal Data from Email Accounts](https://twitter.com/Dinosn/status/1562145515621556230) - - [Backdoored Counterfeited Android Phones Hacking WhatsApp Accounts](https://twitter.com/Dinosn/status/1562145361472495617) - - [ETHERLED: Air-gapped systems leak data via network card LEDs](https://twitter.com/Dinosn/status/1562064770420903936) - - [Charming Kitten APT Wields New Scraper to Steal Email Inboxes](https://twitter.com/Dinosn/status/1562064315678695424) - - [Over 80,000 exploitable Hikvision cameras exposed online](https://twitter.com/Dinosn/status/1562063917366509568) - - [Hades is an cross-platform HIDS with kernel-space data collection.](https://twitter.com/Dinosn/status/1562032393111961602) - - [Windows dirty pipe CVE-2022-22715,](https://twitter.com/Dinosn/status/1562015664319221761) - - [CVE-2022-22715 PoC: Windows Dirty Pipe](https://twitter.com/Dinosn/status/1562014794902814721) - - [Windows System Calls For Hunters](https://twitter.com/Dinosn/status/1562014523531427840) - - [Novant Health admits leak of 1.3m patients' info to Facebook](https://twitter.com/Dinosn/status/1561951904074186753) - - [Microsoft finds critical hole in operating system that for once isn't Windows](https://twitter.com/Dinosn/status/1561950235898822656) - - [New Air-Gap Attack Uses MEMS Gyroscope Ultrasonic Covert Channel to Leak Data](https://twitter.com/Dinosn/status/1561950150947442688) -- 跳跳糖 - 安全与分享社区 - - [一种新的Tomcat内存马 - Upgrade内存马](https://tttang.com/archive/1709/) -- Tenable Blog - - [New IT/OT Features Help Tenable Customers Increase Visibility, Security and Control](https://www.tenable.com/blog/new-itot-features-help-tenable-customers-increase-visibility-security-and-control) -- SecWiki News - - [SecWiki News 2022-08-23 Review](http://www.sec-wiki.com/?2022-08-23) -- 安全客-有思想的安全新媒体 - - [研究员：美国政府变本加厉地进行全球监听活动](https://www.anquanke.com/post/id/278599) - - [红队实录系列（一）-从 NodeJS 代码审计到内网突破](https://www.anquanke.com/post/id/276582) - - [LockBit勒索软件站点因DDoS攻击掉线](https://www.anquanke.com/post/id/278635) - - [军网：防范重要经济目标网络攻击](https://www.anquanke.com/post/id/278597) - - [CISA漏洞修复目录新增7个主动利用漏洞](https://www.anquanke.com/post/id/278595) - - [新型勒索病毒RoBaj分析](https://www.anquanke.com/post/id/278560) - - [互联网安全报告：游戏行业网络攻击急剧攀升](https://www.anquanke.com/post/id/278592) - - [越南要求大公司将数据存储和办公室本地化](https://www.anquanke.com/post/id/278563) - - [NSO重组专注北约成员国，CEO卸任在即](https://www.anquanke.com/post/id/278561) - - [我用 CF 打穿了他的云上内网](https://www.anquanke.com/post/id/276542) - - [乌克兰黑客入侵克里米亚电视台，播放泽伦斯基演说](https://www.anquanke.com/post/id/278555) -- paper - Last paper - - [Celer Network cBridge 跨链桥事故真相：BGP 劫持](https://paper.seebug.org/1948/) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Mitigating the Risk of Zero-Day Vulnerabilities by using Compensating Controls](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Sucuri Blog - - [Examining Less-Common WordPress Credit Card Skimmers](https://blog.sucuri.net/2022/08/examining-less-common-wordpress-credit-card-skimmers.html) -- 先知安全技术社区 - - [聊一聊基于"ebpf xdp"的rootkit](https://xz.aliyun.com/t/11639) - - [论如何优雅的注入Java Agent内存马](https://xz.aliyun.com/t/11640) - - [Shiro 历史漏洞分析](https://xz.aliyun.com/t/11633) -- Sploitus.com Exploits RSS Feed - - [Teleport 9.3.6 Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168137&utm_source=rss&utm_medium=rss) - - [WordPress Duplicator 1.4.7.2 Backup Disclosure exploit](https://sploitus.com/exploit?id=PACKETSTORM:168134&utm_source=rss&utm_medium=rss) - - [10-Strike Network Inventory Explorer 9.3 Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:168133&utm_source=rss&utm_medium=rss) - - [10-Strike Network Inventory Explorer 9.3 Buffer Overflow Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37922&utm_source=rss&utm_medium=rss) - - [Teleport 9.3.6 Command Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37921&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Check for Unusual or Exceptional Conditions in Polkit Project Polkit exploit](https://sploitus.com/exploit?id=D3DACBE8-D7F0-53E7-BBA2-40B044FDB5CE&utm_source=rss&utm_medium=rss) -- Recent Commits to cve:main - - [Update Tue Aug 23 05:23:29 UTC 2022](https://github.com/trickest/cve/commit/ba4e564e1f14b91d4c2c70887cf1ec7ab965c75f) -- WHEREISK0SHL - - [Break me out of sandbox in old pipe - CVE-2022-22715 Windows Dirty Pipe](http://whereisk0shl.top/post/break-me-out-of-sandbox-in-old-pipe-cve-2022-22715-windows-dirty-pipe) -- Trustwave Blog - - [Trustwave Government Solutions’ Cybersecurity Glossary](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-government-solutions-cybersecurity-glossary/) -- 先知安全技术社区 - - [聊一聊基于"ebpf xdp"的rootkit](https://xz.aliyun.com/t/11639) - - [论如何优雅的注入Java Agent内存马](https://xz.aliyun.com/t/11640) - - [Shiro 历史漏洞分析](https://xz.aliyun.com/t/11633) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [什么是IP欺骗以及如何防范？](https://www.4hou.com/posts/nJJR) - - [赛迪顾问发布中国服务器安全报告 | 奇安信稳居市场第一](https://www.4hou.com/posts/AOOO) - - [XCon2022虽迟但到||开幕日官宣定档，创始人呆神向你发出参会邀请！](https://www.4hou.com/posts/xjj9) - - [希腊天然气运营商遭到勒索软件攻击，数据泄露](https://www.4hou.com/posts/q882) - - [恶意软件可绕过安卓13安全新特征](https://www.4hou.com/posts/mXNr) -- Forcepoint - - [Resetting Expectations Around Data Security Programs](https://www.forcepoint.com/blog/insights/customer-conversations-resetting-data-security-expectations) -- Twitter @bytehx - - [RT Paul Seekamp: Did you know you can feed sqlmap swagger files?! python](https://twitter.com/nullenc0de/status/1561890469541564416) -- SAP Blogs - - [Bank Account Management – Two Step Verification Approval](https://blogs.sap.com/2022/08/23/bank-account-management-two-step-verification-approval/) - - [How to Mapping and get multiple dependent information on behalf person id](https://blogs.sap.com/2022/08/23/how-to-mapping-and-get-multiple-dependent-information-on-behalf-person-id/) - - [New Book on SAP S/4HANA Cloud for Advanced Financial Closing](https://blogs.sap.com/2022/08/23/new-book-on-sap-s-4hana-cloud-for-advanced-financial-closing/) - - [A Summer Break Well Spent at the High School Orientation hosted by Premium Hub CoE!](https://blogs.sap.com/2022/08/23/summer-break-well-spent-at-the-high-school-orientation-hosted-by-premium-hub-coe/) - - [xP&A: Why Streamlining Financial Processes is Essential for Business Optimization](https://blogs.sap.com/2022/08/23/xpa-why-streamlining-financial-processes-is-essential-for-business-optimization/) - - [Create Customer Project in SAP S/4HANA Cloud using SAP Process Automation Recorder](https://blogs.sap.com/2022/08/23/create-customer-project-in-sap-s-4hana-cloud-using-sap-process-automation-recorder/) - - [Recap of the SAP Community Call for ALM on August 17, 2022](https://blogs.sap.com/2022/08/23/recap-of-the-sap-community-call-for-alm-on-august-17-2022/) - - [SAP BTP ABAP Environment – Release 2208](https://blogs.sap.com/2022/08/23/sap-btp-abap-environment-release-2208/) - - [Unable to connect ECC application to HANA/ hdbuserstore error](https://blogs.sap.com/2022/08/23/unable-to-connect-ecc-application-to-hana-hdbuserstore-error/) -- SpiderLabs Blog from Trustwave - - [Oracle SBC: Multiple Security Vulnerabilities Leading to Unauthorized Access and Denial of Service](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/oracle-sbc-multiple-security-vulnerabilities-leading-to-unauthorized-access-and-denial-of-service/) -- blog.avast.com EN - - [Scamdemic: We’re in the midst of one — here’s what to do about it](https://blog.avast.com/scamdemic-research) -- Malwarebytes Labs - - [Thousands of Hikvision video cameras remain unpatched and vulnerable to takeover](https://www.malwarebytes.com/blog/news/2022/08/thousands-of-hikvision-video-cameras-remain-unpatched-and-vulnerable-to-takeover) - - [Google flags man as sex abuser after he sends photos of child to doctor](https://www.malwarebytes.com/blog/news/2022/08/google-flags-man-as-sex-abuser-after-he-sends-photos-of-child-to-doctor) -- Marco Ramilli Web Corner - - [Windows System Calls For Hunters](https://marcoramilli.com/2022/08/23/windows-system-calls-for-hunters/) -- Sucuri Blog - - [Examining Less-Common WordPress Credit Card Skimmers](https://blog.sucuri.net/2022/08/examining-less-common-wordpress-credit-card-skimmers.html) -- Reverse Engineering - - [But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer, Part 2](https://www.reddit.com/r/ReverseEngineering/comments/wvtg51/but_you_told_me_you_were_safe_attacking_the/) -- CCC Event Blog - - [Das aller letzte Hacks on the Beach #hotb22](https://events.ccc.de/2022/08/23/hotb22/) -- 安全脉搏 - - [实战 | 记一次从Flarum开始的RCE之旅](https://www.secpulse.com/archives/185921.html) - - [实战 | 我是如何从Cloudflare获得6000美元的漏洞赏金](https://www.secpulse.com/archives/185893.html) - - [实战 | 记一次不太成功的反诈骗渗透测试](https://www.secpulse.com/archives/185861.html) - - [实战 | 记一次3000美金的Instagram绕过电子邮件确认漏洞挖掘经历](https://www.secpulse.com/archives/185856.html) - - [【云攻防系列】从攻击者视角聊聊K8S集群安全（上）](https://www.secpulse.com/archives/185847.html) -- Application Security Blog - - [AppSec Decoded: The NIST guidance on supply chain risk management](https://www.synopsys.com/blogs/software-security/appsec-decoded-nist-supply-chain-risk-management/) -- Intigriti - - [Meet two hackers heading to Yahoo’s live hacking event, 1337UP0822](https://blog.intigriti.com/2022/08/23/meet-two-hackers-heading-to-yahoos-live-hacking-event-1337up0822/) -- The Daily Swig | Cybersecurity news and views - - [Security researchers blast ‘ridiculous’ CrowdStrike bug disclosure practices](https://portswigger.net/daily-swig/security-researchers-blast-ridiculous-crowdstrike-bug-disclosure-practices) - - [GitLab patches critical remote code execution bug](https://portswigger.net/daily-swig/gitlab-patches-critical-remote-code-execution-bug) -- Twitter @Keiran Smith (Affix) - - [Checkout Doopla](https://twitter.com/cli/status/1562215677427126272) -- 雷神众测 - - [Apache-Shiro可用key检测](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652499362&idx=1&sn=e923d3fcb249fdaaa5a86f2dc77c7bb3&chksm=f2584e11c52fc707cf35acf968a85b0074746cdd3969defc013c2f09226450ab2284df218bbb&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [System Informer - A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware](http://www.kitploit.com/2022/08/system-informer-free-powerful-multi.html) -- Seebug漏洞平台 - - [星际奇兵第1期：404星链计划开源工具演示—KunLun-M](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650964035&idx=1&sn=1d99bcd9b54c9aa66e51adcd1d0faf76&chksm=8079c271b70e4b67981432ce3ac5f9d2d2fb122d80434e6d4a32909b83c7ab8b20a6d7e4d22a&scene=58&subscene=0#rd) -- 威努特工控安全 - - [科技巨头英伟达、思科相继“中招”！企业防勒索攻击需要“特效药”](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651088362&idx=1&sn=0350854ad6993e5e3b651abc824a8085&chksm=80e67f5ab791f64c2bda11a102e714b783edeed46c0097ebc819c3f0fd418481cc5eeee7eb20&scene=58&subscene=0#rd) -- Blog - Praetorian - - [NIST CSF 2.0 Workshop Themes: Praetorian’s View](https://www.praetorian.com/blog/nist-csf-2-0/) -- 代码卫士 - - [微软详述严重的 ChromeOS 漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513642&idx=1&sn=c27beda5a40b560ba74580a1caf6d022&chksm=ea948740dde30e56257ab398f0d4f9790aad2d2f22465534355d2e72193d043fece45a36d8f6&scene=58&subscene=0#rd) - - [Java库中充斥着大量反序列化安全弱点](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513642&idx=2&sn=578939f666058f85fd2e4c44e8cb8d46&chksm=ea948740dde30e56322ed889bb709c1b98880d5e843fafb19e3fb1ce4772647aeab3a8e1eae2&scene=58&subscene=0#rd) -- 天御攻防实验室 - - [中国网络安全行业的变化与趋势（2021～2025）](https://mp.weixin.qq.com/s?__biz=MzU0MzgyMzM2Nw==&mid=2247484818&idx=1&sn=ca6c11fbddb8a8ffad846f4a0dc3f2a4&chksm=fb04c6facc734fece8dce9935a2cfb323ef741d37f1d5b1d7e23cbfd9b68af9f8e7fe0ec78a7&scene=58&subscene=0#rd) -- 中国信息安全 - - [从网络大国向网络强国阔步迈进](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164369&idx=1&sn=d10ac78c2f443e81620370de8538e7f2&chksm=8b5eeee8bc2967fe73d68e0e7fe36d909315a3c488bcd3fd862eb988c9d1a2d30199fece80d8&scene=58&subscene=0#rd) - - [工信部：扎实推进信息通信行业电信网络诈骗防范治理工作](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164369&idx=2&sn=438b4a06fe02dd9c349bbdd7c7c08640&chksm=8b5eeee8bc2967fea2150ad05621c1ea4ddb014f3b35a325939db87ca83d02da9da64378f330&scene=58&subscene=0#rd) - - [CNNVD | 关于苹果多个安全漏洞情况的通报](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164369&idx=3&sn=99f895e3826dd8c833d98c4d16083c3b&chksm=8b5eeee8bc2967fe5dd87157286c49ff676d07721322815c31afef0d89160fb92658ecce56d9&scene=58&subscene=0#rd) - - [关注 | 海南省网信办等有关部门查处曝光10起网上违法违规行为典型案例](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164369&idx=4&sn=0f58d5b4ac437483d9e49df4369f2bb1&chksm=8b5eeee8bc2967fe222b799bd714872d88dbd1e00234690113f5f179a0e4186323ba9516f6f6&scene=58&subscene=0#rd) - - [注意 | 恢复出厂设置都不保险！旧手机这样处理更安全](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164369&idx=5&sn=70f99da28b19cf3ed32ab8bbcdfcd8af&chksm=8b5eeee8bc2967fefbc6ca702b85931a0bd6eaa516b13a96f8c62149994a96e5853480a285ac&scene=58&subscene=0#rd) -- 安全牛 - - [改变从“心”开始！企业网络安全文化养成记](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117868&idx=1&sn=038208081fdce53f55ddecd4ed7e7bd8&chksm=bd1469ff8a63e0e94989eb57d48d39376180e1121c251a9e25f0f6bb404ef62148e371b6b689&scene=58&subscene=0#rd) - - [专家观点 | 央企安全专家谈实战中关基保护顶层设计的思路与方法](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117868&idx=2&sn=35e687028c83450562f8b758559a1c12&chksm=bd1469ff8a63e0e95325faa6099dc1336b2475657f3a2de17eda9217e0173b89e3ab6cf80123&scene=58&subscene=0#rd) - - [直播预告 | —数据出境安全评估要点解读](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117868&idx=3&sn=b95cd9c4a5ba8df2f1562970d6351b84&chksm=bd1469ff8a63e0e9cd3160655433dfe9ee80162da7fb2c09b048a6cac48965447ff560a90aca&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [利用中国剩余定理加速 RSA](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495881&idx=1&sn=8e7bbba75df709dd152835aa9ceab0f2&chksm=fa522577cd25ac61c40a870e547adede260abb9241a47b4a2a40385be1f17d0301ec18953a5b&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [TechWorld 2022技术嘉年华｜“实战派”金融数字化转型论坛在北京举行](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247492098&idx=1&sn=8a67d9486bb3ac21dc97fdf88264c183&chksm=eaac7145dddbf8537d8047328640375f9c1ff30df1875775389f0fa15598563f6a6b9db45b1c&scene=58&subscene=0#rd) -- CNCERT风险评估 - - [从网络大国向网络强国阔步迈进](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497274&idx=1&sn=0275bd74845518301b010ab815c22399&chksm=973ac558a04d4c4e1a799be9281f8e36128c8ade337221949aa5a5baa3761b80cf3f272d5213&scene=58&subscene=0#rd) - - [新时代网络强国建设取得历史性成就](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497274&idx=2&sn=207e464c1330a2974793ac9a854b24d4&chksm=973ac558a04d4c4e019921ac973fc5704c293c217ae6693e9890fad6bf1fae7d41a5b83acdfe&scene=58&subscene=0#rd) - - [每周移动恶意程序传播渠道安全监测报告（2022年08月15日—2022年08月21日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497274&idx=3&sn=37049b906ca25331dc22e4c64cba788b&chksm=973ac558a04d4c4e54010bf3a2e7a249c2735d50313c4b5c6e66a852a9a070036905d2540c46&scene=58&subscene=0#rd) -- 极客公园 - - [对话 AfterShip 陈龙生：很少公司因为一件事做十年而死](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965736&idx=1&sn=635d5ab9bea2620f85e2dea41ebd0489&chksm=7e5476de4923ffc8bc86e225e070e36de4d90338d6c983cd4f35a43c7a56e29e465b020f6685&scene=58&subscene=0#rd) - - [怎么让虚拟人的心智更像人？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965736&idx=2&sn=37cb342897d8f3fb36759d82aa1c26b0&chksm=7e5476de4923ffc8e4f026fe41e01a36a6faf0d07f6b502ff1670dcb9dfdd9b570d58453834c&scene=58&subscene=0#rd) - - [11 家网约车平台被约谈；微博个人主页将展示历史评论；华为 Mate5 将于 9 月 6 日发布 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965725&idx=1&sn=a59b3b552462391e6f788c93f22b3945&chksm=7e5476eb4923fffdb609f439cfb9f9fc5cab3c17b6fa54f414889b29d16ea06543e230c59f49&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [XCon2022虽迟但到||开幕日官宣定档，创始人呆神向你发出参会邀请！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548837&idx=1&sn=6602362ee81d44499a12cf7169d2e9fa&chksm=e915ef9fde62668937bccf05d1d76784ea7b1d9ab7547e5219aa565de7ab4f9dd5e429e7a643&scene=58&subscene=0#rd) - - [恶意软件可绕过安卓13安全新特征](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548837&idx=2&sn=f3ed4cb459a296b4c604223be3ce2350&chksm=e915ef9fde6266890799e4a4d670466459e554a5695a8c1d3d47dadeb3649c3eff595b526869&scene=58&subscene=0#rd) - - [希腊天然气运营商遭到勒索软件攻击，数据泄露](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247548837&idx=3&sn=7a80c78e534592487217bd45bc986cbe&chksm=e915ef9fde626689e90db7d82215fc5254227e9e9a25ff9d64a11dd484eff5ce50cf35f2cc7c&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【漏洞通告】GitLab远程代码执行漏洞CVE-2022-2884](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650263607&idx=1&sn=b82d7eb365156809e6bf7f00d5327359&chksm=f3e26a43c495e35571e86d7f9701ae08323a35e7dbdce7d574d5fd7b0909c26c037d4ee68dff&scene=58&subscene=0#rd) - - [“您的主机已被接管！”新型 JavaScript 远控木马花样来袭](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650263607&idx=2&sn=32bc2de76a029f6f3571bfe4786035df&chksm=f3e26a43c495e3553b68f7b49fbf81baeb6a78b8fe34a516d2f7b94da789983f2bd08c334a05&scene=58&subscene=0#rd) -- KCon黑客大会 - - [KCon 倒计时4天｜“827”见证未来](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135704&idx=1&sn=a3f1d13b277cb8e63da5b781707e7f55&chksm=f2c11fb8c5b696aee23742c2dcbc1469787173b0bdc5d5123019c33d374e8d26273392560299&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-25.md b/archive/2022/2022-08-25.md deleted file mode 100644 index 166667990d..0000000000 --- a/archive/2022/2022-08-25.md +++ /dev/null @@ -1,216 +0,0 @@ -# 每日安全资讯（2022-08-25） - -- Files ≈ Packet Storm - - [Zimbra Zip Path Traversal](https://packetstormsecurity.com/files/168146/zimbra_mboximport_cve_2022_27925.rb.txt) - - [MIMEDefang Email Scanner 3.1](https://packetstormsecurity.com/files/168145/mimedefang-3.1.tar.gz) - - [Ubuntu Security Notice USN-5578-1](https://packetstormsecurity.com/files/168144/USN-5578-1.txt) - - [Ubuntu Security Notice USN-5576-1](https://packetstormsecurity.com/files/168143/USN-5576-1.txt) - - [Ubuntu Security Notice USN-5577-1](https://packetstormsecurity.com/files/168142/USN-5577-1.txt) - - [Red Hat Security Advisory 2022-6094-01](https://packetstormsecurity.com/files/168141/RHSA-2022-6094-01.txt) - - [Red Hat Security Advisory 2022-6102-01](https://packetstormsecurity.com/files/168140/RHSA-2022-6102-01.txt) - - [Red Hat Security Advisory 2022-6103-01](https://packetstormsecurity.com/files/168139/RHSA-2022-6103-01.txt) -- Microsoft Security Blog - - [MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone](https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/) - - [Data governance: 5 tips for holistic data protection](https://www.microsoft.com/security/blog/2022/08/24/data-governance-5-tips-for-holistic-data-protection/) - - [Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks](https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Yashwant solutions - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022080071) - - [Zimbra Zip Path Traversal](https://cxsecurity.com/issue/WLB-2022080070) -- unSafe.sh - 不安全 - - [CVE-2022-34265 Django SQL 注入漏洞调试分析](https://buaq.net/go-123646.html) - - [一文入门 soot](https://buaq.net/go-123647.html) - - [渗透测试之数据库安全：redis安全](https://buaq.net/go-123624.html) - - [Vishing 101: What's vishing and how can I protect myself?](https://buaq.net/go-123627.html) - - [Microsoft Active Directory as a Prime Target for Ransomware Operators](https://buaq.net/go-123629.html) -- Trustwave Blog - - [Overview of the Cyber Weapons Used in the Ukraine - Russia War](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/) -- 安全客-有思想的安全新媒体 - - [速来领取！《软件供应链安全治理与运营白皮书（2022）》正式发布](https://www.anquanke.com/post/id/278771) - - [微信三端登录功能被黑灰产利用趋势预警](https://www.anquanke.com/post/id/276038) - - [2022年上半年《全国移动互联网应用安全报告》](https://www.anquanke.com/post/id/278736) - - [CVE-2022-32893：Apple WebKit 代码执行漏洞](https://www.anquanke.com/post/id/278688) - - [利用裸聊敲诈勒索，池州警方抓获5名犯罪嫌疑人](https://www.anquanke.com/post/id/278703) - - [前安全主管举报推特存“严重缺陷”，马斯克、特朗普曾遭黑客攻击](https://www.anquanke.com/post/id/278694) - - [论文分享解读：Android第三方库的版本识别和漏洞检测](https://www.anquanke.com/post/id/278472) - - [上线一周多，黑客组织已找到Android 13安全漏洞](https://www.anquanke.com/post/id/278696) - - [谷歌发现伊朗黑客电子邮件账户数据窃取工具](https://www.anquanke.com/post/id/278713) - - [报告：滥用 SaaS 平台的网络钓鱼攻击飙升1100%](https://www.anquanke.com/post/id/278715) - - [法国公立医院遭黑客攻击 勒索千万美元赎金](https://www.anquanke.com/post/id/278691) - - [基础研究 | Go语言：goroutine 的副作用](https://www.anquanke.com/post/id/276698) - - [中央网信办：集中整治网络暴力、网络水军、网络黑公关方面问题](https://www.anquanke.com/post/id/278699) - - [NSO重组专注北约成员国，CEO卸任在即](https://www.anquanke.com/post/id/278630) -- Twitter @Nicolas Krassas - - [MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone](https://twitter.com/Dinosn/status/1562497447330738176) - - [VMware LPE Bug Allows Cyberattackers to Feast on Virtual Machine Data](https://twitter.com/Dinosn/status/1562497274206633984) - - [Multiple vulnerabilities in Dell OpenManage Enterprise](https://twitter.com/Dinosn/status/1562483078899335169) - - [Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks](https://twitter.com/Dinosn/status/1562477259910713344) - - [CVE-2022-34265 Django SQL Injection Vulnerability Analysis](https://twitter.com/Dinosn/status/1562474453832908801) - - [RT Pierre (피에르): 2-byte DoS in freebsd-telnetd / netbsd-telnetd / netkit-telnetd / inetutils-telnetd / telnetd in Kerberos Version 5 Applications](https://twitter.com/PierreKimSec/status/1562457719478845440) - - [Source Code Management Attack Toolkit](https://twitter.com/Dinosn/status/1562452823086108675) - - [Ox4Shell - Deobfuscate Log4Shell Payloads With Ease](https://twitter.com/Dinosn/status/1562451985169006594) - - [RT Charles Fol: My research on @watchguard Firebox/XTM firewalls, that yielded pre-auth Remote Code Execution as root, will be available on @ambionics...](https://twitter.com/cfreal_/status/1562445561135243267) - - [Pirated 3DMark benchmark tool delivering info-stealer malware](https://twitter.com/Dinosn/status/1562401032394661888) - - [Massive Facebook glitch floods users’ feeds with celebrity posts](https://twitter.com/Dinosn/status/1562365703616974848) - - [Lloyd's to exclude certain nation-state attacks from cyber insurance policies](https://twitter.com/Dinosn/status/1562365445373575168) - - [Octopii: AI-powered Personal Identifiable Information scanner](https://twitter.com/Dinosn/status/1562365342537682944) - - [RT Dr. Nestori Syynimaa: Finally, a new version of #AADInternals is almost ready to be published! I demoed this already at @WEareTROOPERS / #TROOPERS2...](https://twitter.com/DrAzureAD/status/1562364918485209088) - - [Plex tells users to reset their passwords after potential data breach](https://twitter.com/Dinosn/status/1562364788054818816) - - [Cache poisoning denial-of-service attack techniques](https://twitter.com/Dinosn/status/1562314104563552256) - - [VMware Carbon Black causing BSOD crashes on Windows](https://twitter.com/Dinosn/status/1562313970542845952) - - [Blockchain Forensics R&D with Python - Tracking Attackers, Etherscan API Usage, Python Coding, Signature Lookups and Decompiling bytecode](https://twitter.com/Dinosn/status/1562313844889997312) -- 跳跳糖 - 安全与分享社区 - - [利用 PHP-FPM 做内存马的方法](https://tttang.com/archive/1720/) -- 先知安全技术社区 - - [Flask Pin码构造详解](https://xz.aliyun.com/t/11647) - - [CVE-2022-34265 Django SQL 注入漏洞调试分析](https://xz.aliyun.com/t/11628) - - [一文入门 soot](https://xz.aliyun.com/t/11643) -- Recent Commits to cve:main - - [Update Wed Aug 24 05:27:20 UTC 2022](https://github.com/trickest/cve/commit/ec2031fe70f7ca398d183bf767582ed188bf01b6) -- Google Online Security Blog - - [Announcing the Open Sourcing of Paranoid's Library](http://security.googleblog.com/2022/08/announcing-open-sourcing-of-paranoids.html) -- Security Boulevard - - [Security Awareness Games in Slack](https://securityboulevard.com/2022/08/security-awareness-games-in-slack/) - - [Elastic Security Advances SOAR Integration](https://securityboulevard.com/2022/08/elastic-security-advances-soar-integration/) - - [BSidesTLV 2022 – Ayelet HaShachar Penrod’s ‘Hack LinkedIn Networking (The People Skill, Not The Tech Skill)’](https://securityboulevard.com/2022/08/bsidestlv-2022-ayelet-hashachar-penrods-hack-linkedin-networking-the-people-skill-not-the-tech-skill/) - - [Case Study: DTEX InTERCEPT Helps Multinational Retailer Gain Visibility into Risk in Retail Stores](https://securityboulevard.com/2022/08/case-study-dtex-intercept-helps-multinational-retailer-gain-visibility-into-risk-in-retail-stores/) - - [2022 Cequence Roadshow — Learn the ABCs of API Protection](https://securityboulevard.com/2022/08/2022-cequence-roadshow-learn-the-abcs-of-api-protection/) - - [FinOps “Crawl, Walk, Run” Maturity Model Applied to Kubernetes](https://securityboulevard.com/2022/08/finops-crawl-walk-run-maturity-model-applied-to-kubernetes/) - - [Defending in a hostile environment: Key findings from the BlackHat NOC](https://securityboulevard.com/2022/08/defending-in-a-hostile-environment-key-findings-from-the-blackhat-noc/) -- bunnie's blog - - [Name that Ware, August 2022](https://www.bunniestudios.com/blog/?p=6466) - - [Winner, Name that Ware, July 2022](https://www.bunniestudios.com/blog/?p=6471) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [牵手杭电 | 研学创能·产业释能](https://www.4hou.com/posts/PJJw) - - [优秀奖肯定要优先发布！](https://www.4hou.com/posts/O99p) - - [在登录 OAuth 流程中使用”OAuth-dance”方法进行帐户劫持（下）](https://www.4hou.com/posts/03EK) - - [超过8万台海康威视摄像头受漏洞影响](https://www.4hou.com/posts/KEER) - - [《软件供应链安全治理与运营白皮书（2022）》正式发布](https://www.4hou.com/posts/MBBA) -- ongoing by Tim Bray - - [On Faith](https://www.tbray.org/ongoing/When/202x/2022/08/24/On-Faith) -- Sploitus.com Exploits RSS Feed - - [Zimbra Zip Path Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:168146&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=0324AD5C-F2E9-597E-A085-6035280E8508&utm_source=rss&utm_medium=rss) -- Envato Tuts+ Code - Mobile Development - - [What Is the Android Activity Lifecycle?](https://code.tutsplus.com/tutorials/what-are-android-activities--cms-29518) -- 安全脉搏 - - [【匠歆出品】The 3rd AutoCS 2022智能汽车信息安全大会圆满落幕](https://www.secpulse.com/archives/186076.html) - - [远控免杀专题(74)-基于Go的条件触发式免杀](https://www.secpulse.com/archives/186054.html) - - [揭开新型窃密软件的面纱：伪装成CDR画图应用安装包](https://www.secpulse.com/archives/186021.html) - - [“黑猫”又伸出恶魔之手？揭秘BlackCat病毒的三重勒索](https://www.secpulse.com/archives/185962.html) -- SecWiki News - - [SecWiki News 2022-08-24 Review](http://www.sec-wiki.com/?2022-08-24) -- NowSecure - - [4 Things You Can Do with a Mobile SBOM](https://www.nowsecure.com/blog/2022/08/24/4-things-you-can-do-with-a-mobile-sbom/) -- 先知安全技术社区 - - [Flask Pin码构造详解](https://xz.aliyun.com/t/11647) - - [CVE-2022-34265 Django SQL 注入漏洞调试分析](https://xz.aliyun.com/t/11628) - - [一文入门 soot](https://xz.aliyun.com/t/11643) -- Forcepoint - - [Eliminating Zero Trust Complexity](https://www.forcepoint.com/blog/insights/eliminating-zero-trust-complexity-g2-forcepoint-one) -- Twitter @bytehx - - [RT bugcrowd: If you’re thinking about getting into #BugBounty, go for it! 🐛 Need some inspo to get going? ⭐ Check out @sw33tLie's expereince!](https://twitter.com/Bugcrowd/status/1562520369059500032) -- SAP Blogs - - [Groovy: convert number to words (useful for CPI)](https://blogs.sap.com/2022/08/24/groovy-convert-number-to-words-useful-for-cpi/) - - [SAP Document and Reporting Compliance: Manifesto Eletrônico de Documentos Fiscais (MDF-e)](https://blogs.sap.com/2022/08/24/sap-document-and-reporting-compliance-manifesto-eletronico-de-documentos-fiscais-mdf-e/) - - [CIAP no TDF: Suporte a múltiplos CT-es](https://blogs.sap.com/2022/08/24/ciap-no-tdf-suporte-a-multiplos-ct-es/) - - [Partially compounded display keys in SAP Analytics Cloud](https://blogs.sap.com/2022/08/24/partially-compounded-display-keys-in-sap-analytics-cloud/) - - [FP&A Trends Survey 2022 – The latest results](https://blogs.sap.com/2022/08/24/fpa-trends-survey-2022-the-latest-results/) - - [SAP PaPM Cloud: What’s New as of 2022-08-22?](https://blogs.sap.com/2022/08/24/sap-papm-cloud-whats-new-as-of-2022-08-22/) - - [Datahub Upgrade & Migration](https://blogs.sap.com/2022/08/24/datahub-upgrade-migration/) - - [Partner Innovation: Prosumer Onboarding with SAP Workflow Management for Utility Industry](https://blogs.sap.com/2022/08/24/partner-innovation-green-energy-prosumer-onboarding-with-sap-workflow-management-for-utility-industry/) - - [Is the WRICEF term still appropriate in the days of SAP RISE?](https://blogs.sap.com/2022/08/24/is-the-wricef-term-still-appropriate-in-the-days-of-sap-rise/) -- Securelist - - [Ransomware updates & 1-day exploits](https://securelist.com/ransomware-updates-1-day-exploits/107291/) -- blog.avast.com EN - - [Vishing 101: What's vishing and how can I protect myself?](https://blog.avast.com/stay-protected-vishing-scams) - - [Businesses get a new layer of protection with Avast Ransomware Shield](https://blog.avast.com/business-ransomware-shield) -- Toooold - - [Guess the size of an atomic bomb and an iOS supply chain attack](https://toooold.com/2022/08/24/guess_size.html) -- SentinelOne - - [Microsoft Active Directory as a Prime Target for Ransomware Operators](https://www.sentinelone.com/blog/microsoft-active-directory-as-a-prime-target-for-ransomware-operators/) -- Application Security Blog - - [API authentication and authorization best practices](https://www.synopsys.com/blogs/software-security/api-authentication-authorization-best-practices/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Break the Logic: Insecure Parameters (€300)](https://infosecwriteups.com/break-the-logic-insecure-parameters-300-e655cc4fcc42?source=rss----7b722bfd1b8d--bug_bounty) -- Malwarebytes Labs - - [ChromeOS vulnerability found by Microsoft](https://www.malwarebytes.com/blog/news/2022/08/chromeos-vulnerability-found-by-microsoft) - - [Reset your password now! Plex suffers data breach](https://www.malwarebytes.com/blog/news/2022/08/reset-your-password-now-plex-suffers-data-breach) - - [How to secure a Mac for your kids](https://www.malwarebytes.com/blog/personal/2022/08/how-to-secure-your-mac-for-your-kids) -- Webroot Blog - - [How to stop social engineering tactics](https://www.webroot.com/blog/2022/08/24/how-to-stop-social-engineering-tactics/) -- The Daily Swig | Cybersecurity news and views - - [Stop, press: Fragmented vendor ecosystem leaves media industry increasingly vulnerable to software supply chain threats](https://portswigger.net/daily-swig/stop-press-fragmented-vendor-ecosystem-leaves-media-industry-increasingly-vulnerable-to-software-supply-chain-threats) -- Reverse Engineering - - [Detect It Easy 3.06 Program for determining types of files for Windows, Linux and MacOS.](https://www.reddit.com/r/ReverseEngineering/comments/wwxygr/detect_it_easy_306_program_for_determining_types/) - - [Story of ARM TrustZone reverse engineering](https://www.reddit.com/r/ReverseEngineering/comments/wwoks0/story_of_arm_trustzone_reverse_engineering/) - - [Exploitation in the era of formal verification - a peek at a new frontier](https://www.reddit.com/r/ReverseEngineering/comments/wwtzs9/exploitation_in_the_era_of_formal_verification_a/) -- daniel.haxx.se - - [What if I vanished?](https://daniel.haxx.se/blog/2022/08/24/what-if-i-vanished/) -- Intigriti - - [Visma’s Bug Bounty Program Manager speaks to Intigriti about the practice of running a successful program](https://blog.intigriti.com/2022/08/24/vismas-bug-bounty-program-manager-speaks-to-intigriti-about-the-practice-of-running-a-successful-program/) -- 吾爱破解论坛 - - [【杂谈】关于吾爱破解精华集那些事（欢迎留言提意见建议）](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651138274&idx=1&sn=43b4793002a9408118462d773bede327&chksm=bd50b8b68a2731a030de0e9046eb51d03b2c8622aada326e98cb9b549a11537af7c846716d9e&scene=58&subscene=0#rd) -- bishopfox.com - - [You're (Still) Doing IoT RNG](https://bishopfox.com/blog/iot-rng-csprng) -- 酒仙桥六号部队 - - [Java反序列化之CC1链分析 | 技术精选0142](https://mp.weixin.qq.com/s?__biz=MzAwMzYxNzc1OA==&mid=2247501368&idx=1&sn=a8d6791c7f61b3a5c50b259e1ac13c8f&chksm=9b3ae089ac4d699f108fbfb83398cd203df3bccfbcdcc22fa95dd35e9e741d53de4c41e1e25e&scene=58&subscene=0#rd) -- 互联网安全内参 - - [法国首都一医院遭勒索软件攻击：急诊被迫停业 赎金1000万美元](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505448&idx=1&sn=2e5926b5554e58217acb41e2395fbc30&chksm=ebfa9108dc8d181ed817fc3f6759eb5d0a0a878db29740f1bbc1c42406962df03f241a3da0b9&scene=58&subscene=0#rd) - - [Gartner：中国云安全资源池创新洞察](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505448&idx=2&sn=9d0139cfffaf3c7645da2b1caa06c83f&chksm=ebfa9108dc8d181e98e9be6cb2e7f30188e65b5b1904b4ea8ef8e08b2087656d9278c29b6861&scene=58&subscene=0#rd) - - [GitLab远程代码执行漏洞 (CVE-2022-2884) 安全风险通告](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505448&idx=3&sn=ff7442735de8b8e1161a62e741782f21&chksm=ebfa9108dc8d181e0553fec08ad322ee646a8950defb82fd0fa1239a1ea2ed78e0a6fddb8f88&scene=58&subscene=0#rd) - - [乌克兰网络防御高官：数据擦除恶意软件仍是最大网络安全挑战](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505448&idx=4&sn=fbfd3a26e6f6b76376f8e9b69fe6d5d9&chksm=ebfa9108dc8d181eb8f49c4bc33335ddeb8eecfd1953d382354614d872f93cfdce787153bd80&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [Ox4Shell - Deobfuscate Log4Shell Payloads With Ease](http://www.kitploit.com/2022/08/ox4shell-deobfuscate-log4shell-payloads.html) -- 看雪学院 - - [formbook脱壳记](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465332&idx=1&sn=5dd03de23f59a2e8d697215a44a45365&chksm=b18e04be86f98da8afa5194ebb59f0a96cbdbe1bba01a9c9875d4533de36886d964d2a51fe08&scene=58&subscene=0#rd) - - [淘宝上线订单号码保护功能，全链路加强用户隐私保护](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465332&idx=2&sn=72b622d96c0db2f88cd10f2999d6b719&chksm=b18e04be86f98da858ca5db922371a1a9890aaf1eef024a4a980fc70cf17248fc09d75dae896&scene=58&subscene=0#rd) - - [勒索1000万美元，疑似LockBit勒索软件团伙违规攻击法国医疗机构](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465332&idx=3&sn=7ceb203f59a55df7ec6b584f134df7df&chksm=b18e04be86f98da8a42105299778f7e5c068a1a6ccfb4310f0a7bcdd399bf0f7dbaa33ae769a&scene=58&subscene=0#rd) - - [《IDA插件开发入门》为你的逆向工作添砖加瓦](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465332&idx=4&sn=9a53c127f046285f9b07eaf51bf338c9&chksm=b18e04be86f98da8a4e534f08d1f41ddd6c1dddd88362654f2ebfeae365c4d9a4c41e17a4720&scene=58&subscene=0#rd) -- M01NTeam - - [DEFCON议题解读｜Dll劫持新思路——修改环境变量](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489442&idx=1&sn=5a9e38dbe1287e01cc417a812e41f742&chksm=c187d7b3f6f05ea51e6dd6cf7712f014cb3a8aad48e172b68e16233e874b1bb4ec598d3e2035&scene=58&subscene=0#rd) -- 白帽100安全攻防实验室 - - [转发抽奖|WMCTF2022圆满落幕](https://mp.weixin.qq.com/s?__biz=MzIxMDYyNTk3Nw==&mid=2247490282&idx=1&sn=56862c1d1e0acadc0357bd5ad88aec3c&chksm=9760ee3ca017672a1e07acda071665c5a379c3d2ba9fa1b24dad0213afd742c941cf42789b0f&scene=58&subscene=0#rd) -- 极客公园 - - [半年被盗 20 亿美金，黑客与监管都盯上了 Web3](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966055&idx=1&sn=4295b9266deb5053a3071e7beb526914&chksm=7e5471114923f807bec6e90bea8df55b183d8ad5dfbce3d90fae31971edb4335cead11988742&scene=58&subscene=0#rd) - - [快手治好了「烧钱病」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966052&idx=1&sn=786e58b5c631511b592eded90c423cbc&chksm=7e5471124923f804fab4ed29e2d8ad74d3d828d334e9ae0ada311597926d4df3b3fed83e7666&scene=58&subscene=0#rd) - - [自动驾驶商业化时代已经到来](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966052&idx=2&sn=b18ef2aefc2905d3babeee55aba04bdb&chksm=7e5471124923f804d2a210b0a54e1dbcf62438b05931f9da6b4cbd7292a1a04ef4e0ec4d5587&scene=58&subscene=0#rd) - - [任正非：华为要把活下来作为主要纲领；宁德时代上半年净利润增长82%；传每日优鲜3000万出售便利购业务 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652965792&idx=1&sn=33484ae2bdfa030f4a6d4fce86cc4357&chksm=7e5476164923ff00288b7566d6de0441b5ebd5ca39c9f47b597cac34aa0c582ecc6854228e7c&scene=58&subscene=0#rd) -- KCon黑客大会 - - [KCon 倒计时3天｜聚焦前沿，关注实践](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135710&idx=1&sn=4e1d8b5fb0fbda70eb1565b0bd3489f1&chksm=f2c11fbec5b696a8f3a56ea6e2ba06b0c3905ae1a74de0c7ef2229897f5c5a2a2bf77243cc71&scene=58&subscene=0#rd) -- Checkmarx.com - - [API Security Is the New Endpoint Security](https://checkmarx.com/blog/api-security-is-the-new-endpoint-security/) -- 网络安全应急技术国家工程实验室 - - [国内外最新网络安全发展动态](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530790&idx=1&sn=8d365dd09e784315553de0fceb84dd18&chksm=fa93cfe7cde446f1175782948a7e6cc067e48b27db95db069e34117e00bca13a5b82607c0699&scene=58&subscene=0#rd) - - [恶意软件可绕过安卓13安全新特征](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530790&idx=2&sn=e269a2329fb831da493cfc24a5faf32c&chksm=fa93cfe7cde446f1c506eacf73bff20107ae716e44631a8bf3191c74203c48107c545363a6e3&scene=58&subscene=0#rd) - - [改变从“心”开始！企业网络安全文化养成记](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530790&idx=3&sn=cd8ec2d04388d0e26018c7358bc46e82&chksm=fa93cfe7cde446f11d90aab3d50a6f164893f536f400e8199d85ec2392ca755922fdf20dfc88&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [工业互联网设备的网络安全管理与防护研究](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530494&idx=1&sn=456bcacc1bbc438f8894ae11c505ad41&chksm=c1e9fbaff69e72b9454a42d10a9ce1316196f3eb2f177dcddf44415d9be98c9fc03377a654f9&scene=58&subscene=0#rd) - - [2022最危险的五个API安全漏洞](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530494&idx=2&sn=e2f2ba8bbe39e4272567fe9e0a5d26eb&chksm=c1e9fbaff69e72b9063eb9d42c39d816addf4169a2e37ba91fecf915364d0400201628e1a30c&scene=58&subscene=0#rd) - - [黑客利用零日漏洞窃取General Bytes ATM 机上的加密货币](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530494&idx=3&sn=2330973ada932f8ce314690abe87d965&chksm=c1e9fbaff69e72b9417b4a83478ef497db3fd1ec7a59f603aad2f3f4afbb30ced3a7a91a77f8&scene=58&subscene=0#rd) -- webs3c - Latest posts - - [How can I replace Nuclei output urls in bash using sed command and regex?](https://webs3c.com/t/how-can-i-replace-nuclei-output-urls-in-bash-using-sed-command-and-regex/202#post_1) -- 网安寻路人 - - [俄罗斯修改个人数据跨境传输程序](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495718&idx=1&sn=6950424bd58a2768e0781af62c32565f&chksm=97e94dcca09ec4dafd30a5f3fe0dd42ab7ba2ed52f57b81091a7e4cb3b4896e6bfeb07768561&scene=58&subscene=0#rd) -- 情报分析师 - - [杜金娜之死|俄乌间的“超限战”](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514342&idx=1&sn=bac03eaedd4da172bcdaa61a73c9f1a7&chksm=87168dedb06104fb227afacd05f4b9123fe8b8d6443424787bcdf83de1c4c29eb7a1546c0c9b&scene=58&subscene=0#rd) - - [【专业报告】收集有关国家安全的社交媒体分析数据方法和影响（46页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514342&idx=2&sn=eeb4a698851de9c2d705b713ea00c96e&chksm=87168dedb06104fb40b155eb240c16f8360458c85e19f8e853b82d5deee99238d11fa1e53333&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [SourceGuardian代码混淆的还原分析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495906&idx=1&sn=0ea6a9ce027d4a062f36ea81cf5026bc&chksm=fa52255ccd25ac4a995aba34668d33e20df4494de6c2f15c8c7f50b8ba8002608d9657518b92&scene=58&subscene=0#rd) -- 中国信息安全 - - [专题·医疗数据安全 | 面向医疗信息系统的安全管理实践](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164406&idx=1&sn=c88e1ce1b50c62fe188e1df1d081c774&chksm=8b5eeecfbc2967d9bdc3fd3e818cb05cdcff3ee7089391f2881a062cfc1e8c121f5f6b544dd4&scene=58&subscene=0#rd) - - [中央网信办：累计清理违法和不良信息200多亿条、账号近14亿个](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164406&idx=2&sn=407581780170b7893b5196c025300ec0&chksm=8b5eeecfbc2967d90eb9e8f6a23e4e33e095fd1111436ff11f2bcedfe6b37b63fdfb05a4323c&scene=58&subscene=0#rd) - - [专家解读 | 加强数字素养与技能教育 培养合格数字公民](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164406&idx=3&sn=7121649cd80497cb42e0cc21dc829f91&chksm=8b5eeecfbc2967d9b78e36d9334495d65dc4360966822e093b36b540d5c5ecc283715f59d480&scene=58&subscene=0#rd) - - [关注 | 上海市通信管理局通报31款APP侵害用户权益未整改](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164406&idx=4&sn=4d9329b948bbfcaf0808cb58bd405084&chksm=8b5eeecfbc2967d9f7740d06f471cee626cd824f1146019effc7d383314be9e1aa7d12814396&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [38家银行API存在安全缺陷，“开放银行”信息安全建设任重道远](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247494213&idx=1&sn=236211af133ef487918457cab7396a48&chksm=eb12cc7edc6545682376e2b50f1e9fd59a1908c766ad65a3775f9da779435bfdbc2fc36ec893&scene=58&subscene=0#rd) - - [预告 | 永安在线在2022CCS成都网络安全大会等你](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247494213&idx=2&sn=9e0e40e58e359d86f3d1a16e522bd4ba&chksm=eb12cc7edc654568530b2df8da730fe908a2aba7aa8b1668dd41dda5235151a031461de338cf&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [超过8万台海康威视摄像头受漏洞影响](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549005&idx=1&sn=0ab806381d2637fc37e19c5d58384fcd&chksm=e915d077de6259610a5afc0d25043a2779a91b634922b0569b4eafee4e11ff0ea5573da2e148&scene=58&subscene=0#rd) - - [在登录 OAuth 流程中使用”OAuth-dance”方法进行帐户劫持（下）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549005&idx=2&sn=b6c9351505fc5e0b8b1a3bd89d8638cd&chksm=e915d077de6259610d5f0700ae08272bc633b4728ee59e38d73977ad1cf14cf2f463182033cc&scene=58&subscene=0#rd) - - [《软件供应链安全治理与运营白皮书（2022）》正式发布](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549005&idx=3&sn=85337517b4f78c5b788f330ddf799b4b&chksm=e915d077de6259616a4298b8a69e525724f9c1e5655edca755839642cfabf10a9addd3df0be4&scene=58&subscene=0#rd) -- 星阑科技 - - [参编《数据传输安全白皮书》，工信部寄来了感谢信！](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495223&idx=1&sn=6236c50fb2d8dfaf89ce413bcd2e57b3&chksm=c00743abf770cabdb309a379ca458daa81b8c2c8a659c79401c985ef08385827c18d89ae8141&scene=58&subscene=0#rd) -- SecIN技术平台 - - [原创 | 内网渗透一周目小结](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247494945&idx=1&sn=7138e27f42bf161c3694c81a0dfea9e8&chksm=eb84b075dcf3396381021f919bfd6e68ee22ebc6394243dc810f5b9c87a751ed0fd6a1292197&scene=58&subscene=0#rd) -- 青藤云安全 - - [Q3，我一个菜鸟活下来了](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650837792&idx=1&sn=d49d94f0b79591cc5993a17906febb76&chksm=80dbf085b7ac7993c5a8ee89d5aeeb74b8503918a955743933a5295a670150367646a22a4299&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-26.md b/archive/2022/2022-08-26.md deleted file mode 100644 index 87108104e5..0000000000 --- a/archive/2022/2022-08-26.md +++ /dev/null @@ -1,225 +0,0 @@ -# 每日安全资讯（2022-08-26） - -- Sploitus.com Exploits RSS Feed - - [Centreon 22.04.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37923&utm_source=rss&utm_medium=rss) - - [PrestaShop Ap Pagebuilder 2.4.4 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37924&utm_source=rss&utm_medium=rss) - - [Centreon 22.04.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168149&utm_source=rss&utm_medium=rss) - - [Zimbra Zip Path Traversal Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37925&utm_source=rss&utm_medium=rss) - - [PrestaShop Ap Pagebuilder 2.4.4 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168148&utm_source=rss&utm_medium=rss) - - [Exploit for Expression Language Injection in Apache Log4J exploit](https://sploitus.com/exploit?id=423CC97A-8BDD-56B9-9449-FC05A902AEC1&utm_source=rss&utm_medium=rss) -- Blog & What's New | Offensive Security - - [Bypassing Intel CET with Counterfeit Objects](https://www.offensive-security.com/offsec/bypassing-intel-cet-with-counterfeit-objects/) -- SecWiki News - - [SecWiki News 2022-08-25 Review](http://www.sec-wiki.com/?2022-08-25) -- Microsoft Security Blog - - [MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations](https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/) - - [Microsoft Security highlights from Black Hat USA 2022](https://www.microsoft.com/security/blog/2022/08/25/microsoft-security-highlights-from-black-hat-usa-2022/) -- Recent Commits to cve:main - - [Update Thu Aug 25 05:22:02 UTC 2022](https://github.com/trickest/cve/commit/e73f21b4bb261f5f3d299f39e880a7a2bc88638c) -- Files ≈ Packet Storm - - [GNU Privacy Guard 2.2.37](https://packetstormsecurity.com/files/168185/gnupg-2.2.37.tar.bz2) - - [Ubuntu Security Notice USN-5474-2](https://packetstormsecurity.com/files/168184/USN-5474-2.txt) - - [Red Hat Security Advisory 2022-6187-01](https://packetstormsecurity.com/files/168183/RHSA-2022-6187-01.txt) - - [Red Hat Security Advisory 2022-6184-01](https://packetstormsecurity.com/files/168182/RHSA-2022-6184-01.txt) - - [Ubuntu Security Notice USN-5582-1](https://packetstormsecurity.com/files/168181/USN-5582-1.txt) - - [Ubuntu Security Notice USN-5581-1](https://packetstormsecurity.com/files/168180/USN-5581-1.txt) - - [Ubuntu Security Notice USN-5579-1](https://packetstormsecurity.com/files/168179/USN-5579-1.txt) - - [Ubuntu Security Notice USN-5578-2](https://packetstormsecurity.com/files/168178/USN-5578-2.txt) - - [Ubuntu Security Notice USN-5580-1](https://packetstormsecurity.com/files/168177/USN-5580-1.txt) - - [Red Hat Security Advisory 2022-6155-01](https://packetstormsecurity.com/files/168176/RHSA-2022-6155-01.txt) - - [Red Hat Security Advisory 2022-6163-01](https://packetstormsecurity.com/files/168175/RHSA-2022-6163-01.txt) - - [Red Hat Security Advisory 2022-6157-01](https://packetstormsecurity.com/files/168174/RHSA-2022-6157-01.txt) - - [Red Hat Security Advisory 2022-6170-01](https://packetstormsecurity.com/files/168173/RHSA-2022-6170-01.txt) - - [Red Hat Security Advisory 2022-6178-01](https://packetstormsecurity.com/files/168172/RHSA-2022-6178-01.txt) - - [Red Hat Security Advisory 2022-6165-01](https://packetstormsecurity.com/files/168171/RHSA-2022-6165-01.txt) - - [Red Hat Security Advisory 2022-6158-01](https://packetstormsecurity.com/files/168170/RHSA-2022-6158-01.txt) - - [Red Hat Security Advisory 2022-6160-01](https://packetstormsecurity.com/files/168169/RHSA-2022-6160-01.txt) - - [Red Hat Security Advisory 2022-6180-01](https://packetstormsecurity.com/files/168168/RHSA-2022-6180-01.txt) - - [Red Hat Security Advisory 2022-6175-01](https://packetstormsecurity.com/files/168167/RHSA-2022-6175-01.txt) - - [Red Hat Security Advisory 2022-6169-01](https://packetstormsecurity.com/files/168166/RHSA-2022-6169-01.txt) - - [Red Hat Security Advisory 2022-6168-01](https://packetstormsecurity.com/files/168165/RHSA-2022-6168-01.txt) - - [Red Hat Security Advisory 2022-6161-01](https://packetstormsecurity.com/files/168164/RHSA-2022-6161-01.txt) - - [Red Hat Security Advisory 2022-6179-01](https://packetstormsecurity.com/files/168163/RHSA-2022-6179-01.txt) - - [Red Hat Security Advisory 2022-6166-01](https://packetstormsecurity.com/files/168162/RHSA-2022-6166-01.txt) - - [Red Hat Security Advisory 2022-6171-01](https://packetstormsecurity.com/files/168161/RHSA-2022-6171-01.txt) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [XCon2022全日程曝光，售票通道同步开启||9月19日·望京昆泰，不负相见！](https://www.4hou.com/posts/033v) - - [某知名OA命令执行方法探索（续）](https://www.4hou.com/posts/N116) - - [专访酷德啄木鸟：筑建中国网络安全“防火墙”](https://www.4hou.com/posts/7JJj) - - [专访统信刘闻欢：国产基础软件发展正当时](https://www.4hou.com/posts/6VVn) - - [使用25美元的Modchip成功攻击了"星链"](https://www.4hou.com/posts/gX83) - - [RASP持续升温 ADR应运而生 云原生安全公司边界无限完成数千万元人民币天使+、Pre-A融资](https://www.4hou.com/posts/3JJM) - - [新的缓解措施：模块篡改保护](https://www.4hou.com/posts/ykk7) -- unSafe.sh - 不安全 - - [打造全自动漏洞赏金扫描工具 - 渗透测试中心](https://buaq.net/go-123829.html) - - [官方通报：湘雅刘翔峰涉嫌严重违法，已接受调查](https://buaq.net/go-123826.html) - - [Exploits and TrickBot disrupt manufacturing operations](https://buaq.net/go-123840.html) - - [Magnifier: An Experiment with Interactive Decompilation](https://buaq.net/go-123787.html) - - [Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus](https://buaq.net/go-123806.html) - - [Exploring the Heightened Importance of Cybersecurity in Mobile App Development by Jeff Kalwerisky](https://buaq.net/go-123808.html) - - [亚马逊：西部数据 SN850 2TB SSD 内置硬盘到手价 ¥1365.4，带有散热器，兼容 PS5](https://buaq.net/go-123807.html) - - [Application governance in the cloud with Microsoft’s native CASB solution](https://buaq.net/go-123789.html) -- Sucuri Blog - - [Post-Hack Instructions: SEO Spam & 404 Errors in Search Console](https://blog.sucuri.net/2022/08/post-hack-instructions-seo-spam-404-errors-in-search-console.html) -- Security Boulevard - - [Passwordless Is the Future … but What About the Present?](https://securityboulevard.com/2022/08/passwordless-is-the-future-but-what-about-the-present/) - - [Avoiding the Cyber Tools Integration Headache](https://securityboulevard.com/2022/08/avoiding-the-cyber-tools-integration-headache/) - - [Security Industry Rallies Behind Twitter Whistleblower](https://securityboulevard.com/2022/08/security-industry-rallies-behind-twitter-whistleblower/) - - [How unauthorized access to Git became a big headache for Twitter](https://securityboulevard.com/2022/08/how-unauthorized-access-to-git-became-a-big-headache-for-twitter/) - - [RiskLens Fast Facts on Cyber Risk for Retailing – Wawa Data Breach](https://securityboulevard.com/2022/08/risklens-fast-facts-on-cyber-risk-for-retailing-wawa-data-breach/) - - [BSidesTLV 2022 – Tal Melamed’s Meir Benayoun’s ‘Serverless Security Testing, Forget Everything You Knew!’](https://securityboulevard.com/2022/08/bsidestlv-2022-tal-melameds-meir-benayouns-serverless-security-testing-forget-everything-you-knew/) - - [Identity Governance and Administration (IGA): Is it enough?](https://securityboulevard.com/2022/08/identity-governance-and-administration-iga-is-it-enough/) - - [Google Brings Curated Detections to Cloud Security Service](https://securityboulevard.com/2022/08/google-brings-curated-detections-to-cloud-security-service/) - - [Good-bye, insurance coverage for nation-state cyber attacks](https://securityboulevard.com/2022/08/good-bye-insurance-coverage-for-nation-state-cyber-attacks/) -- 安全客-有思想的安全新媒体 - - [活动 | 360SRC活动-论中秋佳节“正确”打开方式](https://www.anquanke.com/post/id/278891) - - [WMCTF 2022 挑战赛 chess writeup](https://www.anquanke.com/post/id/278828) - - [Internet下载管理器？假Chrome插件被安装200000次](https://www.anquanke.com/post/id/278815) - - [黑客借虚假 DDoS 保护页面分发恶意软件](https://www.anquanke.com/post/id/278819) - - [黑客窃超千万用户数据，Plex无奈强行重置密码](https://www.anquanke.com/post/id/278817) - - [从0开始ByPass之Mysql注入篇](https://www.anquanke.com/post/id/277844) - - [前苹果工程师承认窃取苹果汽车机密材料](https://www.anquanke.com/post/id/278812) - - [CVE-2022-2884：GitLab远程代码执行漏洞通告](https://www.anquanke.com/post/id/278684) - - [Facebook出事？大量用户页面现奇怪內容](https://www.anquanke.com/post/id/278769) - - [未更新固件，超八万台海康威视摄像机可能被利用](https://www.anquanke.com/post/id/278801) - - [Java安全攻防之从wsProxy到AbstractTranslet](https://www.anquanke.com/post/id/278639) - - [前主管举报隐私安全问题，Twitter陷危机](https://www.anquanke.com/post/id/278738) -- WHEREISK0SHL - - [Break me out of sandbox in old pipe - CVE-2022-22715 Windows Dirty Pipe](http://whereisk0shl.top/post/break-me-out-of-sandbox-in-old-pipe-cve-2022-22715-windows-dirty-pipe) -- ElcomSoft blog - - [Low-Level Extraction of iOS 15.2-15.3.1](https://blog.elcomsoft.com/2022/08/low-level-extraction-of-ios-15-2-15-3-1/) -- Twitter @Nicolas Krassas - - [RT Felix Wilhelm: If you perform SAML auth in Java you should make sure you patched](https://twitter.com/_fel1x/status/1562857983864107009) - - [Microsoft: Russian malware hijacks ADFS to log in as anyone in Windows](https://twitter.com/Dinosn/status/1562854286358630400) - - [More hackers adopt Sliver toolkit as a Cobalt Strike alternative](https://twitter.com/Dinosn/status/1562783768334979072) - - [dBmonster - Track WiFi Devices With Their Recieved Signal Strength](https://twitter.com/Dinosn/status/1562783713318293509) - - [RT 0xdf: New video solving the forensics challenge I created for the @hackthebox_eu Business CTF this summer, mbcoin. Challenge is available on HTB ri...](https://twitter.com/0xdf_/status/1562783285473726468) - - [Researchers Uncover Kimusky Infra Targeting South Korean Politicians and Diplomats](https://twitter.com/Dinosn/status/1562779033485856771) - - [Man-in-the-Middle Phishing Attack](https://twitter.com/Dinosn/status/1562778931031224320) - - [RT hackaday: Everything You Didn’t Know You Need to Know About Glitching Attacks](https://twitter.com/hackaday/status/1562757001041436673) - - [Ransomware Gang Demands $10M in Attack on French Hospital](https://twitter.com/Dinosn/status/1562748351619117056) - - [CISA: Just-Disclosed Palo Alto Networks Firewall Bug Under Active Exploit](https://twitter.com/Dinosn/status/1562748162854764545) - - [Major Database Mess Up Leaves Indian Federal Police and Banking Records Exposed](https://twitter.com/Dinosn/status/1562748082873597952) - - [Bug Bounty Tips, Desync Attacks, SSRF, SQL Injection, Vulnerabilities in CPU, RCE, and much more…](https://twitter.com/Dinosn/status/1562747936370753541) - - [Detect It Easy 3.06 Program for determining types of files for Windows, Linux and MacOS.](https://twitter.com/Dinosn/status/1562747892606967808) - - [whids - Open Source EDR for Windows](https://twitter.com/Dinosn/status/1562747796142555136) - - [CVE-2022-2959: Linux Kernel privilege escalation vulnerability](https://twitter.com/Dinosn/status/1562747692685570048) - - [Reversing the Pokit Meter's Bluetooth Protocol](https://twitter.com/Dinosn/status/1562747629662253057) - - [Block sued after ex-staffer siphons customer data](https://twitter.com/Dinosn/status/1562747366830051329) - - [Threat actors are using the Tox P2P messenger as C2 server](https://twitter.com/Dinosn/status/1562747298303864833) - - [PyPI Repository Warns Python Project Maintainers About Ongoing Phishing Attacks](https://twitter.com/Dinosn/status/1562747270117801984) -- 安全脉搏 - - [【漏洞预警】GitLab远程代码执行漏洞](https://www.secpulse.com/archives/186301.html) - - [Moriarty Corp靶场攻略](https://www.secpulse.com/archives/186249.html) - - [反弹shell | 反弹shell总结](https://www.secpulse.com/archives/186155.html) -- Envato Tuts+ Code - Mobile Development - - [9 Best Weather App Templates](https://code.tutsplus.com/articles/best-weather-app-templates--cms-28480) -- Bug Bounty in InfoSec Write-ups on Medium - - [This SIMPLE trick will exploit image uploads - $2500 TikTok bug bounty.](https://infosecwriteups.com/this-simple-trick-will-exploit-image-uploads-2500-tiktok-bug-bounty-41fc01128ee?source=rss----7b722bfd1b8d--bug_bounty) - - [Server Side Template Injections Portswiggers Labs Walkthrough.](https://infosecwriteups.com/server-side-template-injections-portswiggers-labs-walkthrough-5a1a06f057d2?source=rss----7b722bfd1b8d--bug_bounty) - - [Cool Recon techniques every hacker misses!](https://infosecwriteups.com/cool-recon-techniques-every-hacker-misses-1c5e0e294e89?source=rss----7b722bfd1b8d--bug_bounty) -- SpiderLabs Blog from Trustwave - - [2022 Trustwave SpiderLabs Telemetry Report](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/2022-trustwave-spiderlabs-telemetry-report/) -- Twitter @bytehx - - [RT Nicolas Krassas: Bug Bounty Tips, Desync Attacks, SSRF, SQL Injection, Vulnerabilities in CPU, RCE, and much more…](https://twitter.com/Dinosn/status/1562747936370753541) -- Securelist - - [Kimsuky’s GoldDragon cluster and its C2 operations](https://securelist.com/kimsukys-golddragon-cluster-and-its-c2-operations/107258/) -- SAP Blogs - - [IT Cost Management with Green IT Scenario](https://blogs.sap.com/2022/08/25/it-cost-management-with-green-it-scenario/) - - [Upcoming Webinar on SAP Application Extension Methodology](https://blogs.sap.com/2022/08/25/upcoming-webinar-on-sap-application-extension-methodology/) - - [Load Data from A Local File into HANA Cloud, Data Lake](https://blogs.sap.com/2022/08/25/load-data-from-a-local-file-into-hana-cloud-data-lake/) - - [SAP Security Role Redesigning](https://blogs.sap.com/2022/08/25/sap-security-role-redesigning/) - - [Serialize Files Transfer with SFTP Adapter in CPI using General splitter & Poll Enrich](https://blogs.sap.com/2022/08/25/serialize-files-transfer-with-sftp-adapter-in-cpi-using-general-splitter-poll-enrich/) - - [Are You a Business Expert and not a Pro-Developer? Let’s talk …](https://blogs.sap.com/2022/08/25/are-you-a-business-expert-and-not-a-pro-developer-lets-talk-.../) - - [Part 5: Using ABAPGit to Transfer On-Premise ABAP Source Code to SAP BW bridge](https://blogs.sap.com/2022/08/25/part-5-using-abapgit-to-transfer-on-premise-abap-source-code-to-sap-bw-bridge/) - - [Coach’s Corner – Self-Help That Prevents Self-Limiting Beliefs from Becoming Self-Fulfilling](https://blogs.sap.com/2022/08/25/coachs-corner-self-help-that-prevents-self-limiting-beliefs-from-becoming-self-fulfilling/) - - [Predicting bad SAP performance (Part 3)](https://blogs.sap.com/2022/08/25/predicting-bad-sap-performance-part-3/) - - [Learn SAP Business One? Try it while learning it with our new simulations👈](https://blogs.sap.com/2022/08/25/learn-sap-business-one-try-it-while-learning-it-with-our-new-simulations%f0%9f%91%88/) -- Malwarebytes Labs - - [Exploits and TrickBot disrupt manufacturing operations](https://www.malwarebytes.com/blog/threat-intelligence/2022/08/exploits-and-trickbot-disrupt-manufacturing-operations) - - [Introducing Patch Management for OneView](https://www.malwarebytes.com/blog/business/2022/08/introducing-patch-management-for-oneview) - - [Update now! GitLab issues critical security release for RCE vulnerability](https://www.malwarebytes.com/blog/news/2022/08/update-now-gitlab-issues-critical-security-release-for-rce-vulnerability) -- Reverse Engineering - - [Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus](https://www.reddit.com/r/ReverseEngineering/comments/wxfy3i/ransomware_actor_abuses_genshin_impact_anticheat/) - - [Magnifier: An Experiment with Interactive Decompilation](https://www.reddit.com/r/ReverseEngineering/comments/wxg8ao/magnifier_an_experiment_with_interactive/) - - [MATE: Interactive Program Analysis with Code Property Graphs](https://www.reddit.com/r/ReverseEngineering/comments/wxd7oc/mate_interactive_program_analysis_with_code/) -- SentinelOne - - [BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar](https://www.sentinelone.com/blog/bluesky-ransomware-ad-lateral-movement-evasion-and-fast-encryption-puts-threat-on-the-radar/) -- Trail of Bits Blog - - [Magnifier: An Experiment with Interactive Decompilation](https://blog.trailofbits.com/2022/08/25/magnifier-an-experiment-with-interactive-decompilation/) -- The Daily Swig | Cybersecurity news and views - - [Ethereum Foundation offers $1m bug bounty payouts with proof-of-stake migration multiplier](https://portswigger.net/daily-swig/ethereum-foundation-offers-1m-bug-bounty-payouts-with-proof-of-stake-migration-multiplier) -- Sucuri Blog - - [Post-Hack Instructions: SEO Spam & 404 Errors in Search Console](https://blog.sucuri.net/2022/08/post-hack-instructions-seo-spam-404-errors-in-search-console.html) -- webs3c - Latest posts - - [How can I replace Nuclei output urls in bash using sed command and regex?](https://webs3c.com/t/how-can-i-replace-nuclei-output-urls-in-bash-using-sed-command-and-regex/202#post_2) -- 信安之路 - - [一句话木马的精简史](https://mp.weixin.qq.com/s?__biz=MzI5MDQ2NjExOQ==&mid=2247497836&idx=1&sn=41bf3c8d72ba71d8bb33106295596482&chksm=ec1dc844db6a4152e13d0a3a5e21856deac54a88975e2c2009b26bcfd599bad7b2b598e80268&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [dBmonster - Track WiFi Devices With Their Recieved Signal Strength](http://www.kitploit.com/2022/08/dbmonster-track-wifi-devices-with-their.html) -- 三六零CERT - - [安全日报（2022.08.25）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491348&idx=1&sn=f0cd86a298742ae648570806f2514658&chksm=fe251a15c95293034ff22e13a9a5c769e22e782ab8c708217f199bd1e6e4e8f7b284a7ca98ab&scene=58&subscene=0#rd) -- Blog - Praetorian - - [Securing the Family](https://www.praetorian.com/blog/securing-the-family/) -- 看雪学院 - - [实现一个压缩壳，并给它加点“料”](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465700&idx=1&sn=88c0571f7a9bd353015fb15b395c8099&chksm=b18e052e86f98c382c9d5ae0de7b9a6650d19c61b78f9c33e06db03a4434bd51fe5238d46ca6&scene=58&subscene=0#rd) - - [【极客市集】展商招募，峰会现场（2022 SDC）分享你的黑科技！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465700&idx=2&sn=f74f7b6887564fc668b7433596e44cbc&chksm=b18e052e86f98c382642c728795509dad1bd651f21b96a2c0eb9a9ff9b3fc6a31816bf4a1631&scene=58&subscene=0#rd) - - [GitLab存在严重漏洞，允许通过Github导入实现远程命令执行](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465700&idx=3&sn=8b93b0d13f775d53299314d9fd9011fa&chksm=b18e052e86f98c3827c75517863bd2cc1f973468ee593c9988fa189438462f99d8f00b660560&scene=58&subscene=0#rd) - - [看雪讲师招募中！助你成为知识传播者](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465700&idx=4&sn=6cf32bda8f9cf9d854d1be880a039e31&chksm=b18e052e86f98c38b136fe08769d9f97211ad37cccfa609e50e3645b78a7410ac931c7d2e05a&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-08-25 Detecting logical bugs in DBMS](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492485&idx=1&sn=149c8016b42fa9313e18095a813b337b&chksm=c063cd5cf714444aad729b02ea93cdc6942f172a9d3be1bab44dc325f1b022e0d2947592683f&scene=58&subscene=0#rd) -- 暗影安全 - - [挖洞老当大冤种？逐鹿特训营教你告别“小趴菜”](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163143&idx=1&sn=41e1351a87fa8373009f5e606a9fd742&chksm=f1d4e562c6a36c74039de91f90e845b8b4aef45efb1780429be093f38774206f8f45bb0f1e85&scene=58&subscene=0#rd) -- GuidePoint Security - - [Application governance in the cloud with Microsoft’s native CASB solution](https://www.guidepointsecurity.com/blog/application-governance-in-the-cloud-with-microsofts-native-casb-solution/) -- 互联网安全内参 - - [《公路水路关键信息基础设施安全保护管理办法》公开征求意见](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505465&idx=1&sn=c8d3e026287dc8edbebab8e1ac494d2b&chksm=ebfa9119dc8d180f6de5fe004c5dae0bfb5c18c871ce1aa646f0eda215e97ca2a763e5d5bb02&scene=58&subscene=0#rd) - - [国际航空重要供应商遭勒索软件攻击，航空业已成为勒索主要目标](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505465&idx=2&sn=7371a6315a00019dad9681be09f0a456&chksm=ebfa9119dc8d180f38108076278a7724b1b1bb5d68ccf64b2a4323a4c5ca3259ab73fc87bc80&scene=58&subscene=0#rd) - - [上半年DDoS攻击暴增203%，“爱国黑客”激增](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505465&idx=3&sn=b507d70b98bf7a10b0e7b54894d7d4e3&chksm=ebfa9119dc8d180f1c166e214423361e0855c1a333083e8270b34d418d4c3460bef6fe0f2ec1&scene=58&subscene=0#rd) - - [淘宝上线订单虚拟号码保护功能，加强用户隐私保护](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505465&idx=4&sn=9a4bcb8018f7b21dd11b894230aa129e&chksm=ebfa9119dc8d180f83295da95eab6f684953e1065243e1308f791a111a9f208ab11f70f69fc7&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [密码学系列 | 3.9 二次残差与二次互易](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495937&idx=1&sn=96a3b25bc2fa195496c91656658ee5d1&chksm=fa5224bfcd25ada974cb81ef4ab05a99ec0c3026f2242bffbf244d778e97fb43211ca75fe7f9&scene=58&subscene=0#rd) -- ChaMd5安全团队 - - [Maui 恶意软件分析](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247506729&idx=1&sn=bd4eff945349311b60ae71f617506966&chksm=e89df3f1dfea7ae72cfafa42217e1dc10edb60ed54b04aa29e2fa211fb789dde96cdea5ca508&scene=58&subscene=0#rd) -- 云鼎实验室 - - [腾讯云数据安全中台保护方案获“首届全国商用密码应用优秀案例”](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494641&idx=1&sn=12fd8cb78c438dbf9e43b9e88cecff95&chksm=fd791777ca0e9e6153838f55325c2cc4e761013a659b479c6043940d901b267198e53fa55c25&scene=58&subscene=0#rd) -- 安全牛 - - [警惕！别让数字化发展落入“工具蔓延”的陷阱中](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117918&idx=1&sn=ca3f497c6febd4df8915191505ed8212&chksm=bd14698d8a63e09b9d8489eb5670557034e7b3a8c3206821a7b241e67e733d5d42aed0d6fd42&scene=58&subscene=0#rd) - - [边界无限宣布连续完成天使+和Pre-A两轮融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117918&idx=2&sn=7e12a74b518522698c76c2a76b619a18&chksm=bd14698d8a63e09b820d37f94b966e8963b2015ba45deb1509be95dd2f61a33e2c7521046c4b&scene=58&subscene=0#rd) - - [转载 丨 工业数据安全能力建设路径与思考](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117918&idx=3&sn=c82814482d37bacf2eefffff1e338857&chksm=bd14698d8a63e09bd4f5d43702c4b39bb38b0125b21f0955ac5cc94d335066d70cede5328398&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [2022上半年XIoT安全态势-XIoT环境下信息物理系统的漏洞披露和补救措施](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530546&idx=1&sn=441d3c4a1f7444bbb0d41fd620ecee12&chksm=c1e9f463f69e7d751e99cbebc3f215e1176755225a2e6c0f3fe2e9cb6d5a4bccf2ecfb94428f&scene=58&subscene=0#rd) - - [物理隔离系统的网卡指示灯会泄露数据](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530546&idx=2&sn=58210c9f466272721db28715b93efd04&chksm=c1e9f463f69e7d7594646ee18e4f4687b5f3f28e9d3235d33489efc54905d7c617f1137814d9&scene=58&subscene=0#rd) - - [推特前安全主管控诉存在“令人震惊”的安全漏洞](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530546&idx=3&sn=9f9780e145a4a4b627d2f08ecf308a0b&chksm=c1e9f463f69e7d75fe2c56b1c8388fc608aa3eb0cd26dc738a9867011bef8fd689d85529c6a7&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [金融业如何在对抗网络攻击方面保持领先](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491897&idx=1&sn=a1b8c9aaa2d96759a1016f686e16a405&chksm=feb6602ac9c1e93c510623b03cd596897119916b812656df2aab33d754028abdad6aa45e4f97&scene=58&subscene=0#rd) - - [深入实施创新驱动发展战略 努力实现高水平科技自立自强](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247491897&idx=2&sn=a87513228b1ce4ec6d5ef71de640ccf2&chksm=feb6602ac9c1e93c6afa2235f8c2a973aa3192f3a9f9db7091d1b1e0e59a6eaff6f1e85fcc39&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [XCon2022全日程曝光，售票通道同步开启||9月19日·望京昆泰，不负相见！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549086&idx=1&sn=508839d7f0d58587ccc0cbf93fd9bec2&chksm=e915d0a4de6259b24521cd3cd23ff311dc2f9a594c6e36478c926d843abf954b96588dc8577a&scene=58&subscene=0#rd) - - [使用25美元的Modchip成功攻击了"星链"](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549086&idx=2&sn=3bad83b21a49c58b72027e26843fdf84&chksm=e915d0a4de6259b2cc136372adc7f1e2899ac1635ba7f70e2cd7e309e5118686ccfbc97b2142&scene=58&subscene=0#rd) - - [新的缓解措施：模块篡改保护](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549086&idx=3&sn=b24f86ad1bec9db9db629da5b73b690a&chksm=e915d0a4de6259b20872880ffa651ff5c6a61cf257fae700b0786655be8543df5aea27771059&scene=58&subscene=0#rd) - - [边界无限完成数千万元人民币天使+、Pre-A融资](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549086&idx=4&sn=a98f660ed39069c1765f223caba541c7&chksm=e915d0a4de6259b24924be9b81402272aa64b3c3508b504c043379cc14f1927f8f59c3dca077&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [两个密码对应同一个加密ZIP包](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486131&idx=1&sn=488d6607422e11874f967ee488bea617&chksm=fab2c98ccdc5409a8d775a76e3e351d589e230221f4cda2b744ad5a5bb0dac86e13bf56bb103&scene=58&subscene=0#rd) -- 情报分析师 - - [《人工智能的军事应用》不确定世界中的伦理问题](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514539&idx=1&sn=b15e055f556f2e0aaf005dacfec2d612&chksm=87168a20b0610336892ec8042490374e397253058c40ceef410e794d5325d9ff5e02ed20b712&scene=58&subscene=0#rd) - - [开源情报工具在调查中的独特价值](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514539&idx=2&sn=c12a0083ae67a91ecfe8bec72757306c&chksm=87168a20b0610336d8a1be4c9a48708570355ce4fc8be9fec24e3099f959de394e28ac8dae01&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [主题分享 | .NET cshtml视图全局文件Tricks](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486084&idx=1&sn=f5ec3495c4fecf6cdc37bd552df53291&chksm=fa5aa469cd2d2d7fb5ec8706541e053638aed5d51332f7af64b35c280c93c194df5764fbddde&scene=58&subscene=0#rd) - - [庆祝粉丝突破5K，星球限时特价!](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486084&idx=2&sn=bafcd972a165210b968c4cc413401296&chksm=fa5aa469cd2d2d7fffba6ef9e7c764f2c520b8c92bee20cb9f6dfb4b7a70a6c962ca9388bd5a&scene=58&subscene=0#rd) -- 极客公园 - - [小众民乐，直播间赚到第一桶金](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966160&idx=1&sn=5c4fff379f45b26ec3e7859f1076923c&chksm=7e5470a64923f9b01cc8899bd3e5e3ca6ecc7ba5d64c655a1eaa0117b63e7768b4e0022e0b2f&scene=58&subscene=0#rd) - - [残障人士，到底需要怎样的「机器手」？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966125&idx=1&sn=7d2d5bc0ea5276203e5f3f52ef2eddcb&chksm=7e54715b4923f84decdfe52ac1a69275495b421e9f45958a772a4c02ebcdf400ce5f4ed57343&scene=58&subscene=0#rd) - - [苹果秋季发布会 9 月 8 日凌晨举行；英伟达二季度游戏收入暴跌 30%；老虎基金创始人去世 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966079&idx=1&sn=f09e943fb5278cbebed1f024438d561c&chksm=7e5471094923f81fd7303757aa493da12ec9d56177aec22cde8239dc9e91af8a65a37d886c19&scene=58&subscene=0#rd) -- 星阑科技 - - [【技术干货】CVE-2022-0540 Jira身份验证绕过漏洞分析](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495290&idx=1&sn=a6fb2282c9208d2eb9b68a120aaac1be&chksm=c00743e6f770caf0cc12fb695389d94dc4c5016e5964e57849cdca213ab99f7bd99adf870e8e&scene=58&subscene=0#rd) -- KCon黑客大会 - - [KCon 倒计时2天｜不忘初心，让技术更有温度](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135718&idx=1&sn=bf9e359682b3e715845ed198a7fbe962&chksm=f2c11f86c5b69690026c8c499e9856aeac231d12750efa234291fbfcc49eaa89707ad1815e9b&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [激战正酣，AI与人类的对抗邀你参加](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489541&idx=1&sn=b94394998dfe58aa55377b7cf2ad96fc&chksm=fa9ee353cde96a45320e0d444a83e2321f5a71dcba5f0666d02e0a276bf228667fa437d0e605&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [微软公开披露关键 ChromeOS 漏洞的细节](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530818&idx=1&sn=7186baa61312bf8dd44abdbc526d6302&chksm=fa93cf83cde446957058e12471d6f7e4138ed08a0901f3fd56f5178f273ce05d5290e83e6b35&scene=58&subscene=0#rd) - - [专题·医疗数据安全 | 面向医疗信息系统的安全管理实践](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530818&idx=2&sn=50750f5698a2246d63c1d64cd72574e8&chksm=fa93cf83cde44695fd475d49d248460998295c0d6b199ef3fe3051b9bc02d2b87561d73c6cfe&scene=58&subscene=0#rd) - - [超过8万台海康威视摄像头受漏洞影响](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530818&idx=3&sn=82b5fbaa8965465c27b7c7c0d695f886&chksm=fa93cf83cde44695c5865d4239b2ef9384ae1aaedfb2c256ed2204ad93be57a2ad7c3ebc4c2a&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [下周一！白帽众测挑战赛正式开启！](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537429&idx=1&sn=1e666949de7bc4478aa0c306fac8535f&chksm=8bcba669bcbc2f7f63cc697696c84f223f96cd81b758da713e939d8c02fd004faed3c3e552dd&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-27.md b/archive/2022/2022-08-27.md deleted file mode 100644 index 29c9acb395..0000000000 --- a/archive/2022/2022-08-27.md +++ /dev/null @@ -1,209 +0,0 @@ -# 每日安全资讯（2022-08-27） - -- Twitter @Nicolas Krassas - - [Critical Vulnerability Discovered in Atlassian Bitbucket Server and Data Center](https://twitter.com/Dinosn/status/1563279026562940931) - - [DoorDash customer info caught up in Oktapus arms](https://twitter.com/Dinosn/status/1563214137056182272) - - [Bypassing Intel CET with Counterfeit Objects](https://twitter.com/Dinosn/status/1563194468341231617) - - [Unstripping Stripped Binaries](https://twitter.com/Dinosn/status/1563156628639125505) - - [rekono: Execute complete pentesting processes](https://twitter.com/Dinosn/status/1563156522926219264) - - [CVE-2021-25642: Apache Hadoop Command Execution Vulnerability](https://twitter.com/Dinosn/status/1563156377341534208) - - [IAM Whoever I Say IAM :: Infiltrating VMWare Workspace ONE Access Using a 0-Click Exploit](https://twitter.com/Dinosn/status/1563078676496822275) - - [CVE-2022-36804: Bitbucket Server and Data Center command injection vulnerability](https://twitter.com/Dinosn/status/1563078611556782081) - - [Tool Release – JWT-Reauth](https://twitter.com/Dinosn/status/1563078429301698564) - - [SharpSCCM: post-exploitation tool designed to leverage SCCM for lateral movement](https://twitter.com/Dinosn/status/1563078312263839746) - - [Sometimes times the best hack is no hack at all — $2900 Shopify Bug Bounty](https://twitter.com/Dinosn/status/1563078178180337666) - - [Twilio hackers hit over 130 orgs in massive Okta phishing attack](https://twitter.com/Dinosn/status/1563059324108189697) - - [Twilio Hackers Scarf 10K Okta Credentials in Sprawling Supply Chain Attack](https://twitter.com/Dinosn/status/1563059258534506496) - - [](https://twitter.com/Dinosn/status/1563059000249184256) - - [Hackers abuse Genshin Impact anti-cheat system to disable antivirus](https://twitter.com/Dinosn/status/1563058806854393858) - - [Stored XSS using SVG file](https://twitter.com/Dinosn/status/1563058731893415937) - - [SolarWinds Hackers Using New Post-Exploitation Backdoor ‘MagicWeb’](https://twitter.com/Dinosn/status/1563058455107121154) - - [Binance chief says a “sophisticated hacking team” turned him into a deepfake hologram](https://twitter.com/Dinosn/status/1563058332642197504) - - [Hackers attacks LastPass and steals source code](https://twitter.com/Dinosn/status/1563050882891010048) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-6188-01](https://packetstormsecurity.com/files/168187/RHSA-2022-6188-01.txt) - - [Xalan-J XSLTC Integer Truncation](https://packetstormsecurity.com/files/168186/GS20220826142700.tgz) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-aug-26) -- paper - Last paper - - [项目推荐：XPEViewer](https://paper.seebug.org/1950/) -- Recent Commits to cve:main - - [Update Fri Aug 26 05:23:48 UTC 2022](https://github.com/trickest/cve/commit/0eced06195b25fb98471d4519bd653ba3dab6a4e) -- SecWiki News - - [SecWiki News 2022-08-26 Review](http://www.sec-wiki.com/?2022-08-26) -- 跳跳糖 - 安全与分享社区 - - [若依(RuoYi)管理系统后台sql注入漏洞分析](https://tttang.com/archive/1712/) -- unSafe.sh - 不安全 - - [The Good, the Bad and the Ugly in Cybersecurity – Week 35](https://buaq.net/go-123972.html) - - [派周报 | 本周会员内容提要；跑题：啁啾哨音](https://buaq.net/go-123970.html) - - [What I wish I knew about security when I started programming](https://buaq.net/go-123963.html) - - [ReconPal - Leveraging NLP For Infosec](https://buaq.net/go-123964.html) - - [zentao15.0.3](https://buaq.net/go-123958.html) - - [concurrent-map/README-zh.md at v2.0.0 · orcaman/concurrent-map](https://buaq.net/go-123943.html) - - [Source code of password manager LastPass stolen by attacker](https://buaq.net/go-123993.html) - - [《安卓高级研修班》推出【看雪安卓应用安全能力认证】证书](https://buaq.net/go-123971.html) - - [本周看什么 | 最近值得一看的 7 部作品](https://buaq.net/go-123960.html) - - [zentaopms](https://buaq.net/go-123959.html) - - [goahead环境变量注入漏洞](https://buaq.net/go-123991.html) - - [【免费领】国外专家12年经验总结：渗透红队实战技术宝典](https://buaq.net/go-123990.html) - - [选择MSS服务的10个理由](https://buaq.net/go-123950.html) - - [金融安全指数报告（国别版）发布](https://buaq.net/go-123952.html) - - [交通运输部就《公路水路关键信息基础设施安全保护管理办法（征求意见稿）》公开征求意见](https://buaq.net/go-123953.html) - - [以数据安全赋能信创未来丨慧盾安全加入麒麟软件生态圈](https://buaq.net/go-123954.html) - - [又一国家级规划鼓励智慧社区建设丨智慧社区数据安全亟需重视](https://buaq.net/go-123955.html) -- 安全客-有思想的安全新媒体 - - [密码管理软件 LastPass遭黑客入侵](https://www.anquanke.com/post/id/278912) - - [黑客使用 AiTM 监控 Microsoft 365 帐户实施 BEC 诈骗](https://www.anquanke.com/post/id/278822) - - [俄媒：俄央行将于近期组织各银行举行网络安全演习](https://www.anquanke.com/post/id/278864) - - [美国政府：要警惕量子计算机带来的安全问题 不要等到对手攻击才采取行动](https://www.anquanke.com/post/id/278859) - - [中国移动旗下支付APP被通报，8月29日前未完成整改将被下架](https://www.anquanke.com/post/id/278867) - - [CobaltStrike特征修改](https://www.anquanke.com/post/id/278690) - - [勒索软件Quantum 染指多米尼加共和国政府机构](https://www.anquanke.com/post/id/278824) - - [Facebook出事？大量用户页面现奇怪內容](https://www.anquanke.com/post/id/278852) -- Security Boulevard - - [The inevitable pivot to BYOA (Bring Your Own Application): Mitigating risk to enable innovation](https://securityboulevard.com/2022/08/the-inevitable-pivot-to-byoa-bring-your-own-application-mitigating-risk-to-enable-innovation/) - - [LastPass Breach Raises Disclosure Transparency Concerns](https://securityboulevard.com/2022/08/lastpass-breach-raises-disclosure-transparency-concerns/) - - [IAM budget in a recession](https://securityboulevard.com/2022/08/iam-budget-in-a-recession/) - - [BSidesTLV 2022 – Shira Stepansky’s ‘Diamond Model Analysis Of Whatsapp Security Breach’](https://securityboulevard.com/2022/08/bsidestlv-2022-shira-stepanskys-diamond-model-analysis-of-whatsapp-security-breach/) - - [Unified API Protection for Telcos and Mobile Carriers – Time to Value](https://securityboulevard.com/2022/08/unified-api-protection-for-telcos-and-mobile-carriers-time-to-value/) - - [XKCD ‘Tetherball Configurations’](https://securityboulevard.com/2022/08/xkcd-tetherball-configurations/) - - [When to Use Penetration Testing Software, Services, or Both](https://securityboulevard.com/2022/08/when-to-use-penetration-testing-software-services-or-both/) - - [This Week in Malware – 450 Packages and a Phishing Campaign Against PyPI Maintainers](https://securityboulevard.com/2022/08/this-week-in-malware-450-packages-and-a-phishing-campaign-against-pypi-maintainers/) - - [Apple flaws put company networks at risk](https://securityboulevard.com/2022/08/apple-flaws-put-company-networks-at-risk/) - - [What Is a TLS/SSL Port?](https://securityboulevard.com/2022/08/what-is-a-tls-ssl-port/) -- 安全脉搏 - - [最终议程！AFSS-亚太金融安全峰会（北京2022年09月02日周五）](https://www.secpulse.com/archives/186304.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [奇安信集团总裁吴云坤获CSO名人堂中国安全十大人物](https://www.4hou.com/posts/pVo2) - - [技术引领未来, IDC TechScape中国数据安全发展路线图首发](https://www.4hou.com/posts/nJmR) - - [早鸟票限时开售||两大会场全天联动，20+议题干货满级！](https://www.4hou.com/posts/l6k5) - - [黑客控制一颗退役卫星来播放影片](https://www.4hou.com/posts/YXXK) - - [攻击者渗透云通讯平台公司 Twilio 并利用其短信服务攻击 Signal 用户](https://www.4hou.com/posts/9XYZ) - - [最终议程！AFSS-亚太金融安全峰会（北京2022年09月02日周五）](https://www.4hou.com/posts/kMj5) -- SAP Blogs - - [Basic scripting differences in SAC Analytical application designer Vs Lumira](https://blogs.sap.com/2022/08/26/basic-scripting-differences-in-sac-analytical-application-designer-vs-lumira/) - - [HCM Processes & Forms: FPM forms? Let there be light…er uhm….PRINT!!!!](https://blogs.sap.com/2022/08/26/hcm-processes-forms-fpm-forms-let-there-be-light...er-uhm....print/) - - [Jan Musil’s take on Experience Management and SAP Activate](https://blogs.sap.com/2022/08/26/experience-management-sap-activate-call-recap/) - - [S4 EWM – Basic concepts.](https://blogs.sap.com/2022/08/26/s4-ewm-basic-concepts./) - - [SAP Data Migration Process – Simplified Version](https://blogs.sap.com/2022/08/26/sap-data-migration-process-simplified-version/) - - [SAP BTP Security: How to handle Authorization and Attributes [2] with XSUAA and IAS](https://blogs.sap.com/2022/08/26/sap-btp-security-how-to-handle-authorization-and-attributes-2-with-xsuaa-and-ias/) - - [Migration Steps for SAP Commerce 2205](https://blogs.sap.com/2022/08/26/migration-steps-for-sap-commerce-2205/) - - [Streams in RAP : Uploading PDF , Excel and Other Files in RAP Application](https://blogs.sap.com/2022/08/26/streams-in-rap-uploading-pdf-excel-and-other-files-in-rap-application/) - - [Three Reasons Why You Need to Move to an ERP System in the Cloud](https://blogs.sap.com/2022/08/26/three-reasons-why-you-need-to-move-to-an-erp-system-in-the-cloud/) - - [How to update the NodeJS version in application level on SAP Business Application Studio](https://blogs.sap.com/2022/08/26/how-to-update-the-nodejs-version-in-application-level-on-sap-business-application-studio/) -- Hex Rays - - [Igor’s tip of the week #104: Immediate search](https://hex-rays.com/blog/igors-tip-of-the-week-104-immediate-search/) -- Pulse Security - - [ASP.NET Boilerplate Multiple Vulnerabilities](https://pulsesecurity.co.nz/advisories/aspnetboilerplate-jwt) -- Bug Bounty in InfoSec Write-ups on Medium - - [Sometimes times the best hack is no hack at all — $2900 Shopify Bug Bounty](https://infosecwriteups.com/sometimes-times-the-best-hack-is-no-hack-at-all-2900-shopify-bug-bounty-38531b279c67?source=rss----7b722bfd1b8d--bug_bounty) - - [Bypassing unexpected IDOR](https://infosecwriteups.com/bypassing-unexpected-idor-e6a9da2e0498?source=rss----7b722bfd1b8d--bug_bounty) - - [Stored XSS using SVG file](https://infosecwriteups.com/stored-xss-using-svg-file-2e3608248fae?source=rss----7b722bfd1b8d--bug_bounty) - - [Break the Logic: 5 Different Perspectives in Single Page (€1500)](https://infosecwriteups.com/break-the-logic-5-different-perspectives-in-single-page-1500-5aa09da0fe7a?source=rss----7b722bfd1b8d--bug_bounty) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 35](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-35-4/) -- Reverse Engineering - - [2bit PXLR Studio Next -- homebrew project enhancing capabilities of Game Boy Camera](https://www.reddit.com/r/ReverseEngineering/comments/wym1n2/2bit_pxlr_studio_next_homebrew_project_enhancing/) - - [Ghidrathon: Snaking Ghidra with Python 3 Scripting | Mandiant](https://www.reddit.com/r/ReverseEngineering/comments/wy3rup/ghidrathon_snaking_ghidra_with_python_3_scripting/) - - [Unstripping Stripped Binaries](https://www.reddit.com/r/ReverseEngineering/comments/wy1efz/unstripping_stripped_binaries/) -- Malwarebytes Labs - - [Adware found on Google Play — PDF Reader servicing up full screen ads](https://www.malwarebytes.com/blog/news/2022/08/adware-found-on-google-play-pdf-reader-servicing-up-full-screen-ads) - - [Source code of password manager LastPass stolen by attacker](https://www.malwarebytes.com/blog/news/2022/08/source-code-of-password-manager-lastpass-stolen-by-attacker) -- blog.avast.com EN - - [Apple flaws put company networks at risk](https://blog.avast.com/apple-flaws-corporate-entry) -- Application Security Blog - - [What I wish I knew about security when I started programming](https://www.synopsys.com/blogs/software-security/security-basics-for-developers/) -- The Daily Swig | Cybersecurity news and views - - [Critical command injection vulnerability discovered in Bitbucket Server and Data Center](https://portswigger.net/daily-swig/critical-command-injection-vulnerability-discovered-in-bitbucket-server-and-data-center) - - [LastPass flags security incident after attackers stole source code, technical information](https://portswigger.net/daily-swig/lastpass-flags-security-incident-after-attackers-stole-source-code-technical-information) -- daniel.haxx.se - - [curl up 2022 take 2](https://daniel.haxx.se/blog/2022/08/26/curl-up-2022-take-2/) -- KitPloit - PenTest & Hacking Tools - - [ReconPal - Leveraging NLP For Infosec](http://www.kitploit.com/2022/08/reconpal-leveraging-nlp-for-infosec.html) -- 博客园 - 飘渺红尘✨ - - [过滤器和拦截器执行流程 - 飘渺红尘✨](https://www.cnblogs.com/piaomiaohongchen/p/16626818.html) -- 看雪学院 - - [House of cat新型glibc中IO利用手法解析 & 第六届强网杯House of cat详解](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465726&idx=1&sn=1825492dd76fb697decccef216c5c37a&chksm=b18e053486f98c223c6d4061df0f12da6599ff43e1836d453579c910bcc59c7b547c703bf7f1&scene=58&subscene=0#rd) - - [最大密码管理软件LastPass遭攻击，源代码和专有技术数据失窃](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465726&idx=2&sn=e9b7fc283632f402c5c67397a24624cf&chksm=b18e053486f98c229bae2c05cde72bde679544e4762e48b042541b299ad174d11128ee7881a1&scene=58&subscene=0#rd) - - [《安卓高级研修班》推出【看雪安卓应用安全能力认证】证书](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465726&idx=3&sn=687f9aaaaa7f5af6fec827c2c33e694f&chksm=b18e053486f98c22349b1b3d7c53f01917d00271c02cd2e17db5a88e7dd21368614f69fe3a05&scene=58&subscene=0#rd) -- 虎符智库 - - [方滨兴：破解隐私保护与数据要素流动相悖之局](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247488100&idx=1&sn=86b1661ab4c351e6b6b8d3c4c04aba05&chksm=971e7f66a069f670bc9186588e6b152d8e75d8ace879f3d186f73d4a52544710fd942ef7484e&scene=58&subscene=0#rd) -- 白帽100安全攻防实验室 - - [WMCTF 2022|iOS一解题chess官方writeup](https://mp.weixin.qq.com/s?__biz=MzIxMDYyNTk3Nw==&mid=2247490289&idx=1&sn=474848dd7a50d7759298d7d1532cac93&chksm=9760ee27a0176731eff4db9fa5355a83ad5396a50f0a25e2941cdc4a1af2da66fcc74bd03a33&scene=58&subscene=0#rd) -- Black Hills Information Security - - [Talkin’ About Infosec News – 8/26/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-8-26-2022/) -- 代码卫士 - - [以太坊基金会设立最高100万美元的短期漏洞奖励计划](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513692&idx=1&sn=0f726f793b5bfac0b6d002b8506c64d9&chksm=ea948736dde30e204ff4f91d0084bee437def61910139696409b7b268f10c0ae0f63b07a54da&scene=58&subscene=0#rd) - - [黑客攻陷Okta发动供应链攻击，影响130多家组织机构](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513692&idx=2&sn=9edbf81f8e756e90d33627cdfe3796f3&chksm=ea948736dde30e20a3b8750b3189dd23d0baf268f08e98448ec6421a9d7649d3cfc08f11f960&scene=58&subscene=0#rd) - - [密码管理软件公司LastPass源代码被盗](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513692&idx=3&sn=dbd6673b2a5de3cb84448df24e561ab4&chksm=ea948736dde30e20dcad8bfaeb5f354ef9e5afea1a2cd8dbce6e535287362ea2f69ff0d52234&scene=58&subscene=0#rd) -- Checkmarx.com - - [Automatic Execution of Code Upon Package Download on Python Package Manager](https://checkmarx.com/blog/automatic-execution-of-code-upon-package-download-on-python-package-manager/) -- 奇安信病毒响应中心 - - [每周勒索威胁摘要](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247491216&idx=1&sn=ec4026793f89877a9a106a3d6d885242&chksm=ec6a6eb8db1de7ae53473958c965a18b362a609ff30f036e09dbda3532300fab225a93cf4fc2&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [主题分享 | .NET MVC 利用AuthenticationFilter过滤器实现虚拟 WebShell](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486091&idx=1&sn=e4468f0a34977a6f7094251f60fa861e&chksm=fa5aa466cd2d2d70571fa73a8189f3d3f88c2e0b872e2f6081a29af3fed078d69e56f438abea&scene=58&subscene=0#rd) - - [庆祝粉丝突破5K，星球限时特价!](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486091&idx=2&sn=e81b828ae53b3295cc04a560403553d7&chksm=fa5aa466cd2d2d708c5e57592e3e55a120b4fae33bdc139f0059e2c8a7bc9d1fa843193f6348&scene=58&subscene=0#rd) -- Wallarm - - [What are JWT Injections, and Why do You Need to Know About Them](https://lab.wallarm.com/what-are-jwt-injections-and-why-do-you-need-to-know-about-them/) -- 丁爸情报分析师的工具箱 - - [【情报系统】美国空军分布式通用地面系统（AF DCGS）](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131669&idx=1&sn=ad61f93b235d9dca0499e0d639590a25&chksm=f1af782fc6d8f139eb3791bee91e6862d6254ab745e9a842103ba0893064ea4205c0ec153a77&scene=58&subscene=0#rd) -- 暗影安全 - - [XCon2022全日程曝光，售票通道同步开启||9月19日·望京昆泰，不负相见！](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163151&idx=1&sn=747e74e4615b83540b4132f3d1058ba7&chksm=f1d4e56ac6a36c7c0631ef2738add15a5d10d1a1ec883d7c334ca62094e1c245a5f19acd4412&scene=58&subscene=0#rd) -- 极客公园 - - [游戏收入暴跌 40%，但英伟达其实没那么糟糕](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966232&idx=1&sn=7c15f6ff5fe3d228e30a8f69300454aa&chksm=7e5470ee4923f9f8a280d13be9f54bb1992b123f79598d76d3a0e95b511b7a4a6f704091c2de&scene=58&subscene=0#rd) - - [外卷出圈？无人机也要出潮玩！](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966219&idx=2&sn=e8dad423f63b8af8758e3ff8c7a1c283&chksm=7e5470fd4923f9eb6a7f4cf992f1c2c0e70f00791e48d78a80260a617887ac622985a47071f6&scene=58&subscene=0#rd) - - [推特：马斯克弃购后大量员工离职；比亚迪计划年底推出百万元高端车型；梅根成为 Spotify 头号网红播客 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966219&idx=1&sn=0aeb5771cd5032eb1cfa61cfe33187da&chksm=7e5470fd4923f9eb6f38f7101fedec8d39887ac74b361b893ad7ae3682ee89994e6e7dfde0ce&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [区块链安全题目分析 之 chainflag（一）](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247495990&idx=1&sn=7850425c2a1ac91475c143f6a24c7725&chksm=fa522488cd25ad9ee86eef11a6f6428fcf486e2bc57f7f3d0e101c2c523c5e9e37f5e5b7c63f&scene=58&subscene=0#rd) -- 中国信息安全 - - [通知 | 交通运输部就《公路水路关键信息基础设施安全保护管理办法（征求意见稿）》公开征求意见](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164510&idx=1&sn=0207d79f8d5e9134ca7bf7b1bc738656&chksm=8b5eee67bc296771d670bd473d088885846b661185e5fa954e152fa607cf68815877ecaeea42&scene=58&subscene=0#rd) - - [关注 | 工信部通报47款侵害用户权益APP和SDK](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164510&idx=2&sn=a51db889b87a999fe01072773293c2a3&chksm=8b5eee67bc2967712267d35238fa94211b7aa15ff7383594a036881a2bee3cc5e9c64853dce5&scene=58&subscene=0#rd) - - [关注 | 从事电信网络诈骗犯罪及关联犯罪或将记入信用记录](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164510&idx=3&sn=a009135d99d632c281ab6e6aef3be1f5&chksm=8b5eee67bc29677172501e6bedf5139162213e2fd8b32e7282e99a2c451bb6e91882d272ba9d&scene=58&subscene=0#rd) - - [通知 | 信安标委征求《工业互联网企业网络安全 第1部分：应用工业互联网的工业企业防护要求（征求意见稿）》等3项国家标准意见](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164510&idx=4&sn=0d358dc68b72af9d819094128e2c0366&chksm=8b5eee67bc296771463c835929b76d70b0fcf1018097a7ea33865bcdf7296054848b4c36306c&scene=58&subscene=0#rd) - - [行业 | IDC TechScape发布中国数据安全发展路线图](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164510&idx=5&sn=9431466dfce28eb3ffe5b410ee1cb112&chksm=8b5eee67bc2967717e7f2edc399e0be5284fdc581ac2f46e69c4ff26e11538127d4f452a51da&scene=58&subscene=0#rd) -- 梦之光芒的电子梦 - - [如何开展蓝军工作与量化评估](https://mp.weixin.qq.com/s?__biz=MzUyODQ0MTE2MQ==&mid=2247483708&idx=1&sn=5cb76a4382101079110ef39e6eebbb5b&chksm=fa710b1acd06820c9a0109b8b6b430a0fefc9531de0f06ced62db96d4858bac7d33bd0fa05e6&scene=58&subscene=0#rd) -- 皮相 - - [选择困难的痛苦来自贪念](https://mp.weixin.qq.com/s?__biz=MzI0NDA5MDYyNA==&mid=2648256957&idx=1&sn=3567bb9daa3734cfb6692304705bd61a&chksm=f14e83d2c6390ac4e079c19788e18eb061f4fce82c3343f3a827a67d631e0680fa6c5c7b7a45&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [黑客控制一颗退役卫星来播放影片](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549179&idx=1&sn=bd3a83db83d7ebd2e32d20ffe7677da0&chksm=e915d0c1de6259d72334f88a242e65dd026b7882cfcec9b8e3bbac6b898ba1f2ef875251ef5b&scene=58&subscene=0#rd) - - [早鸟票限时开售||两大会场全天联动，20+议题干货满级！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549179&idx=2&sn=7fbadb715b8f03f3430f9a51409a3835&chksm=e915d0c1de6259d7d47147281bab78b84a1a4933c7993d4a01ec30870dc1e1e83daecf2fa2cd&scene=58&subscene=0#rd) - - [攻击者渗透云通讯平台公司 Twilio 并利用其短信服务攻击 Signal 用户](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549179&idx=3&sn=cca1a8635334da59a26cfca4374edac8&chksm=e915d0c1de6259d735e3d006f7bd9b96afc0089fe981826629a35f3c428e7de9f4e3817edbdf&scene=58&subscene=0#rd) -- 情报分析师 - - [分析经典：《如何分析人》之心理操纵的13个法则](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514680&idx=1&sn=01a22cd724ec4c2369bcfaceb4f851bd&chksm=87168ab3b06103a52b5d34647e2cdbaf57ed91a8701a114efe03e74f5337392897582c40ee38&scene=58&subscene=0#rd) - - [如何利用人工智能防止孤狼（个人极端暴力）攻击](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514680&idx=2&sn=ffc8831314a69e8d600461a51819c30e&chksm=87168ab3b06103a5b1903fdf782e0d5803f08a77d88aa42d37887e3a48c738a98ca3bbfb8e52&scene=58&subscene=0#rd) - - [【他山之石】如何获得警方报告](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514680&idx=3&sn=82b69ccc5312f24dd568115e572712fb&chksm=87168ab3b06103a5dc7895de25a6627d1d3120a6dda9723d2125772f9568afd0ea3ed6d25ba7&scene=58&subscene=0#rd) -- Seebug漏洞平台 - - [看这篇，不迷路！KCon 2022 参会攻略来咯，404助力福利持续加码中...](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650964176&idx=1&sn=c8c0545345896279ea9d69abe17f84b9&chksm=8079c2e2b70e4bf4a2dc4862c7d7ce4def9a7ff2b1cca68104a5fb0224520eba266174e7caa0&scene=58&subscene=0#rd) -- 数世咨询 - - [发布预告 | 中国数字安全产业统计与分析报告（2022）](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494894&idx=1&sn=fcb7d0998dda43ddff7dcbd9ce20b22d&chksm=c1449e53f63317456a934c1f0ba53563698ef80ce0c00c2992e9779b2e43e3fd9abff87cf33b&scene=58&subscene=0#rd) - - [最新议程 | 第二届数字安全大会明日正式开启！](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494894&idx=2&sn=71f0ce30e669d3d25c90c3383fe0177d&chksm=c1449e53f6331745b5659a90cc499001039dc1ed9371eb5c0f6318e8ada3aebea34258bdfd22&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Aug.26th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495775&idx=1&sn=f07926bc74ec894182b1b8832a2b546a&chksm=ce96bd61f9e1347701b4f2a9ef2bfcf1b9d9cc9dbb895b44faa24e2bdf1e8b09c37a39d3d0d9&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [卡巴斯基发现了针对韩国政客和外交官的朝鲜黑客组织Kimusky](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530874&idx=1&sn=fe0549f39a7db9312e29140cc912eb55&chksm=fa93cfbbcde446ad545330e6617325a4d7d99f2f826c22fa6564acdca20042087fd333581a3c&scene=58&subscene=0#rd) - - [GitLab修复了CE、EE版本中一个远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530874&idx=2&sn=33bcba2e1a1127ce540ee20e737a72ca&chksm=fa93cfbbcde446adcd73f5632c2387e8c38030d6bc81ab8bd6cec68143e0bc6d0ea5a1e70cd2&scene=58&subscene=0#rd) - - [新的缓解措施：模块篡改保护](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530874&idx=3&sn=8d906c6b09073104f9676d58280831bc&chksm=fa93cfbbcde446ad9340200803ba3d4e329bb155c070412c3c1e50201bc8cc9e1f077c19ecae&scene=58&subscene=0#rd) -- KCon黑客大会 - - [KCon 倒计时1天｜10年风雨，更进1步](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135723&idx=1&sn=9b76d0d7ce6e13cb9bb38baf3e6f6d56&chksm=f2c11f8bc5b6969de9f9576ce910c10382353913aa15917e771294c2d6e1506cd6db5f5a5c62&scene=58&subscene=0#rd) -- 安全牛 - - [交通运输部就《公路水路关键信息基础设施安全保护管理办法（征求意见稿）》公开征求意见](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117968&idx=1&sn=d4c841b6f80cb1b63e5e2efebc09638b&chksm=bd1469438a63e055f2b622e681d1f35769203bb3f6761c7129d63e2724284632bf3a1506573b&scene=58&subscene=0#rd) - - [金融安全指数报告（国别版）发布](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117968&idx=2&sn=f5685350f97520ecea0a33b44bb89326&chksm=bd1469438a63e055f373470bbbdb09c80bc241f003f9f49dd6333b8eef3779caaf833acb1c4b&scene=58&subscene=0#rd) - - [选择MSS服务的10个理由](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117968&idx=3&sn=0c3f44b352414d158d1f33404d0d8e84&chksm=bd1469438a63e055893582a45eee0979fc94e7c35946ab8e0a12d2131d8916a184de2b0343cc&scene=58&subscene=0#rd) -- 星阑科技 - - [国外篇｜网安相关政策法规及相关报告汇总（附下载）](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495306&idx=1&sn=93d5101910372c7101252f3cd21699c1&chksm=c0074316f770ca006822651f036be94a1e1e8551c6bc36e8735f846b3a0bb0c2aab0b1954170&scene=58&subscene=0#rd) -- 安恒威胁情报中心 - - [安恒高级安全威胁情报周报（2022.8.20~8.26）](https://mp.weixin.qq.com/s?__biz=MzI1MDU5NjYwNg==&mid=2247496568&idx=1&sn=8925ce0e671ab85dff8b726313f0d5af&chksm=e9fd6ee9de8ae7ffdc73f5f40f9a6d90a74faabc862dafca40a66aa6ed4a76907c6e811a1775&scene=58&subscene=0#rd) -- 安全学术圈 - - [ClusterCommit：一种基于项目集群的实时缺陷预测方法](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247488129&idx=1&sn=ad213594dcdf6c0dc2b60fc480d3e3e3&chksm=fe2eed0ac959641c08b7c481b6452a03d71ba854bd3c9a44dce59001f8a6102d9c638341cb8a&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [CISA警示关键基础设施应为大规模后量子密码系统迁移做准备](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530571&idx=1&sn=0d7b870ad107b9acb248ba9e9f3b6845&chksm=c1e9f41af69e7d0c27c0d5a121681a1d4d3c95c0e33e42115428272aed29ea44bd48b6c6ca4b&scene=58&subscene=0#rd) - - [医疗行业数据安全风险分析及思考](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530571&idx=2&sn=2cccbbffbf78181a31fa10bb39281fbc&chksm=c1e9f41af69e7d0cade42c0d189009b773c0da95bcd6104a68ca5e8a750dc22fc92d10951bc9&scene=58&subscene=0#rd) - - [国际航空重要供应商遭勒索软件攻击，航空业已成为勒索主要目标](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530571&idx=3&sn=64012061db1afd6b3a6b789b168c4a87&chksm=c1e9f41af69e7d0c5420a546876c07e5176477c4959233023804f24d06722402b2b628cb5ced&scene=58&subscene=0#rd) -- 长亭科技 - - [长亭科技杨坤：以原子能力打造体系化安全](https://mp.weixin.qq.com/s?__biz=MzIwNDA2NDk5OQ==&mid=2651382324&idx=1&sn=34807011833ee43f4bb58e51d0f3fdce&chksm=8d3993bcba4e1aaa628779a9d1578d677a18afe33b9ecc0d616e0abe409ecde7e4d2ffa8718b&scene=58&subscene=0#rd) - - [长亭推出“安全服务联合运营中心”，与合作伙伴共创共赢](https://mp.weixin.qq.com/s?__biz=MzIwNDA2NDk5OQ==&mid=2651382324&idx=2&sn=45941cca7d041ce4717fafa35134c050&chksm=8d3993bcba4e1aaa33fbedd216a8ba8c1e39a4404fc0aa388c623d296219f479e12e42d8eb94&scene=58&subscene=0#rd) - - [网安周，约~秋天的第一场线下展会！](https://mp.weixin.qq.com/s?__biz=MzIwNDA2NDk5OQ==&mid=2651382324&idx=3&sn=5ca8e3e02811f532fbae4578bd778d4b&chksm=8d3993bcba4e1aaa60d3c8c2d256f52e049dde4812d3ae9cf399ab786ba34126c1c1c91aba6e&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [抖音平台多产物代码隔离技术的实践与探索](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247498242&idx=1&sn=939412ce672d2bfcf053b56f50f14818&chksm=e9d331e0dea4b8f65913b589e98dbacb8edba92ff623bef0d57413dd55695a9e661cc0e55adf&scene=58&subscene=0#rd) - - [稀土开发者大会讲师 PPT 精华送上，通关全靠你自己了！](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247498242&idx=2&sn=8f505b65619f09360de0175362b34652&chksm=e9d331e0dea4b8f6217b9cbc826591f64773a972eea083adcafff8d4bae380a2ff702d82acee&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-28.md b/archive/2022/2022-08-28.md deleted file mode 100644 index 82e29c3a38..0000000000 --- a/archive/2022/2022-08-28.md +++ /dev/null @@ -1,83 +0,0 @@ -# 每日安全资讯（2022-08-28） - -- Security Boulevard - - [Exposing a Compilation of Known Ransomware Group’s Dark Web Onion Web Sites – An OSINT Analysis](https://securityboulevard.com/2022/08/exposing-a-compilation-of-known-ransomware-groups-dark-web-onion-web-sites-an-osint-analysis/) - - [LastPass Admits Hackers Stole Source Code, Proprietary Tech Info](https://securityboulevard.com/2022/08/lastpass-admits-hackers-stole-source-code-proprietary-tech-info/) - - [BSidesTLV 2022 – Rani Hod’s ‘How Not To Encrypt Your Files’](https://securityboulevard.com/2022/08/bsidestlv-2022-rani-hods-how-not-to-encrypt-your-files/) -- unSafe.sh - 不安全 - - [新浪微博批量移除关注脚本](https://buaq.net/go-124067.html) - - [The Travis separation a year later](https://buaq.net/go-124048.html) - - [Rekono - Execute Full Pentesting Processes Combining Multiple Hacking Tools Automatically](https://buaq.net/go-124051.html) - - [SSRF leads to access AWS metadata.](https://buaq.net/go-124049.html) - - [Update: 1768.py Version 0.0.16](https://buaq.net/go-124045.html) - - [忏悔 24 小时——关于微信被封禁，我想告诉你这些](https://buaq.net/go-124043.html) - - [今日直播预告 | 敏捷渗透技能学习总结](https://buaq.net/go-124050.html) - - [网鼎杯2022 BadBean Hessian2反序列化](https://buaq.net/go-124038.html) - - [亚信安全发布2022年半年度报告 营业收入同比增长22%](https://buaq.net/go-124036.html) - - [$7000 Bounty, Web3 Bug Hunting, API Hacking, IDOR, Triggering XSS with emojis, XSS Flyer, and much…](https://buaq.net/go-124035.html) - - [摸鱼的最高境界，我连自己都信了](https://buaq.net/go-124034.html) - - [我是如何在 Notion 中运用 PARA 模型来整理第二大脑](https://buaq.net/go-124029.html) - - [谷歌为Chrome浏览器今年的第五个 "0 day漏洞" 打补丁](https://buaq.net/go-124024.html) - - [DirtyCred：存在8年的Linux kernel漏洞](https://buaq.net/go-124025.html) - - [2bit PXLR Studio Next -- homebrew project enhancing capabilities of Game Boy Camera](https://buaq.net/go-123994.html) - - [Adware found on Google Play — PDF Reader servicing up full screen ads](https://buaq.net/go-123992.html) -- Twitter @Nicolas Krassas - - [Unprecedented cyber attack hit State Infrastructure of Montenegro](https://twitter.com/Dinosn/status/1563617725951483904) - - [Rekono - Execute Full Pentesting Processes Combining Multiple Hacking Tools Automatically](https://twitter.com/Dinosn/status/1563595465085657088) - - [HTB: Talkative](https://twitter.com/Dinosn/status/1563595367186178050) - - [Zimbra Open Bucket Data Leak – Responsible Disclosure](https://twitter.com/Dinosn/status/1563413016070144001) - - [Scammers Made Deepfake AI Hologram of Binance Executive](https://twitter.com/Dinosn/status/1563400536736829441) -- SecWiki News - - [SecWiki News 2022-08-27 Review](http://www.sec-wiki.com/?2022-08-27) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [亚信安全发布2022年半年度报告 营业收入同比增长22%](https://www.4hou.com/posts/ykA7) - - [谷歌为Chrome浏览器今年的第五个 "0 day漏洞" 打补丁](https://www.4hou.com/posts/vJLX) - - [DirtyCred：存在8年的Linux kernel漏洞](https://www.4hou.com/posts/JXX2) -- Sploitus.com Exploits RSS Feed - - [AeroCMS v0.0.1 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37928&utm_source=rss&utm_medium=rss) - - [WordPress Robo Gallery 3.2.1 plugin - Bypass POST comment approvement Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37926&utm_source=rss&utm_medium=rss) - - [WordPress Robo Gallery 3.2.1 plugin - XSS Stored Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37927&utm_source=rss&utm_medium=rss) -- Recent Commits to cve:main - - [Update Sat Aug 27 05:31:15 UTC 2022](https://github.com/trickest/cve/commit/6fce5d899095c681501e6afb88dd2355596c93fd) -- Bug Bounty in InfoSec Write-ups on Medium - - [SSRF — The Server’s Loophole 01](https://infosecwriteups.com/ssrf-the-servers-loophole-01-6e7e33fb1d57?source=rss----7b722bfd1b8d--bug_bounty) - - [Server Side Template Injections Portswiggers Labs Walkthrough Part III](https://infosecwriteups.com/server-side-template-injections-portswiggers-labs-walkthrough-part-iii-bc6983412a3d?source=rss----7b722bfd1b8d--bug_bounty) - - [SSRF leads to access AWS metadata.](https://infosecwriteups.com/ssrf-leads-to-access-aws-metadata-21952c220aeb?source=rss----7b722bfd1b8d--bug_bounty) - - [$7000 Bounty, Web3 Bug Hunting, API Hacking, IDOR, Triggering XSS with emojis, XSS Flyer, and much…](https://infosecwriteups.com/7000-bounty-web3-bug-hunting-api-hacking-idor-triggering-xss-with-emojis-xss-flyer-and-much-fb4c51fb26ef?source=rss----7b722bfd1b8d--bug_bounty) -- Didier Stevens - - [Update: 1768.py Version 0.0.16](https://blog.didierstevens.com/2022/08/27/update-1768-py-version-0-0-16/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Exposing a Compilation of Known Ransomware Group's Dark Web Onion Web Sites - An OSINT Analysis](https://ddanchev.blogspot.com/2022/08/exposing-compilation-of-known.html) - - [A Compilation of Dancho Danchev's Personal Photos - An OSINT Analysis](https://ddanchev.blogspot.com/2022/08/a-compilation-of-dancho-danchevs.html) -- HAHWUL - - [Param Digger! Easy param mining via ZAP](https://www.hahwul.com/2022/08/27/zap-param-digger/) - - [Jekyll Collection 다루기](https://www.hahwul.com/2022/08/27/jekyll-collection/) -- SAP Blogs - - [RISE with SAP: Business Value of Cybersecurity](https://blogs.sap.com/2022/08/27/rise-with-sap-business-value-of-cybersecurity/) - - [why SAP BTP? — Motivation of SAP BTP](https://blogs.sap.com/2022/08/27/why-sap-btp-motivation-of-sap-btp/) - - [SAP HANA Cloud Database Upgrades and Patches – Part 2](https://blogs.sap.com/2022/08/27/sap-hana-cloud-database-upgrades-and-patches-part-2/) - - [Fundamentals of Multitenancy in SAP BTP](https://blogs.sap.com/2022/08/27/fundamentals-of-multitenancy-in-sap-btp/) - - [SAP HANA Cloud Database Upgrades and Patches – Part 1](https://blogs.sap.com/2022/08/27/sap-hana-cloud-database-upgrades-and-patches-part-1/) - - [Conversion of Engineering BOM to Manufacturing BOM (VEMP)](https://blogs.sap.com/2022/08/27/conversion-of-engineering-bom-to-manufacturing-bom-vemp/) -- Reverse Engineering - - [Full Disclosure: I found an API broken function level authorization vulnerability on the FACEIT Ltd platform](https://www.reddit.com/r/ReverseEngineering/comments/wzh38t/full_disclosure_i_found_an_api_broken_function/) -- daniel.haxx.se - - [The Travis separation a year later](https://daniel.haxx.se/blog/2022/08/27/the-travis-separation-a-year-later/) -- KitPloit - PenTest & Hacking Tools - - [Rekono - Execute Full Pentesting Processes Combining Multiple Hacking Tools Automatically](http://www.kitploit.com/2022/08/rekono-execute-full-pentesting.html) -- Twitter @hakivvi - - [Re @Doyensec Only US/EU residents ?](https://twitter.com/hakivvi/status/1563330751520616448) -- 黑哥说安全 - - [KCon 2022开场致辞](https://mp.weixin.qq.com/s?__biz=Mzg5OTU1NTEwMg==&mid=2247483851&idx=1&sn=32e0d57bbf83e0b9895e509eeb690652&chksm=c050cbbaf72742ac218ff4c0f05f92da85226a10f22f409ea1617420c5d11dc34b3527221b44&scene=58&subscene=0#rd) -- KCon黑客大会 - - [+1 进阶，护航未来｜2022 KCon黑客大会云端火热开场](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135810&idx=1&sn=0c8cbc1c6801eb435e43e11c9925871d&chksm=f2c11e22c5b697341cab912b2d26c343fa6ec5720a08231e50d8fc3d2ad095c5ba563c7c7512&scene=58&subscene=0#rd) -- NOVASEC - - [Java安全学习04-反序列化漏洞-动态代理-CC1链-入门](https://mp.weixin.qq.com/s?__biz=MzUzODU3ODA0MA==&mid=2247487993&idx=1&sn=9c6d388e20779e343c6885fd5bc257fc&chksm=fad4cceecda345f84249d2130ce7fffc7e8b7fa3e1b7dd28135b1d9d96af003d8466e7464c63&scene=58&subscene=0#rd) -- 数世咨询 - - [中国数字安全产业统计与分析报告（2022）](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494948&idx=1&sn=5e93426f57a340f9fe4ac327273dd086&chksm=c1449f99f633168fbfb8d0e80d87329dca6f810120d19820824f108569943ea177462752ee6a&scene=58&subscene=0#rd) - - [听一首流行歌可导致笔记本电脑崩溃](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247494948&idx=2&sn=c783af06669d07912caca04fbf1f6fd4&chksm=c1449f99f633168f45251e6a1b9366f7eeb9f4f6959c79a9b9b2a1323746c617b0be8885ab86&scene=58&subscene=0#rd) -- 情报分析师 - - [智库报告《危险的海峡!对未来台hai冲突的兵棋推演》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514711&idx=1&sn=8b9bd369e4020e96f6f8539695da5d77&chksm=87168b5cb061024a23b210ea1b929632fffe39e2309fbeb7a14ab57ca2506243cec28967ef50&scene=58&subscene=0#rd) - - [加拿大建立国外人力情报局](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514711&idx=2&sn=5fd81f53b0536dad0cb41b64f02114fd&chksm=87168b5cb061024aa31d41a02c11fb6ba235ed60ae70409e700f0b1db891ca77b29aabd42cd3&scene=58&subscene=0#rd) -- 极客公园 - - [中美签署审计监管合作协议；美团二季度收入同比增长16.4%；Quest Pro将于10月推出 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966274&idx=1&sn=27b1ff5024da738b17189aa273eb8b2e&chksm=7e5470344923f9221b76c3e0e347c38582bfcd33f8e6cbd519309fa6882a2cc7758fc7af35b7&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-29.md b/archive/2022/2022-08-29.md deleted file mode 100644 index de0b98fcde..0000000000 --- a/archive/2022/2022-08-29.md +++ /dev/null @@ -1,47 +0,0 @@ -# 每日安全资讯（2022-08-29） - -- Twitter @Nicolas Krassas - - [Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator](https://twitter.com/Dinosn/status/1563934905792356357) - - [SATisfying our way into remote code execution in the OPC UA industrial stack](https://twitter.com/Dinosn/status/1563895599849783297) - - [Dealing With False Positives when Scanning Memory Dumps for Cobalt Strike Beacons, (Sun, Aug 28th)](https://twitter.com/Dinosn/status/1563895455364382720) - - [Tetsuji: Remote Code Execution on a GameBoy Colour 22 Years Later](https://twitter.com/Dinosn/status/1563781179773489152) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [daihocpccc - Cross Site Scripting Vulnerability (XSS)](https://cxsecurity.com/issue/WLB-2022080072) -- Security Boulevard - - [Key Points from the IBM Cost of a Data Breach Report 2022](https://securityboulevard.com/2022/08/key-points-from-the-ibm-cost-of-a-data-breach-report-2022/) - - [BSidesTLV 2022 – Philip Tsukerman’s And Amir Kutcher’s ‘Unmasked! – Fighting Stealthy Execution Methods Using Process Creation Properties’](https://securityboulevard.com/2022/08/bsidestlv-2022-philip-tsukermans-and-amir-kutchers-unmasked-fighting-stealthy-execution-methods-using-process-creation-properties/) - - [How to Prevent High Risk Authentication Coercion Vulnerabilities](https://securityboulevard.com/2022/08/how-to-prevent-high-risk-authentication-coercion-vulnerabilities/) - - [Will Voluntary CISA Cyber Goals Be Enough to Protect Critical Infrastructure?](https://securityboulevard.com/2022/08/will-voluntary-cisa-cyber-goals-be-enough-to-protect-critical-infrastructure/) -- unSafe.sh - 不安全 - - [cby的日常(before 2022.7.21)](https://buaq.net/go-124167.html) - - [Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator](https://buaq.net/go-124124.html) - - [[送码] 更完善的中文拼音搜索体验：效率启动器 HapiGO 带来多项更新](https://buaq.net/go-124115.html) -- SecWiki News - - [SecWiki News 2022-08-28 Review](http://www.sec-wiki.com/?2022-08-28) -- ArthurChiao's Blog - - [TCP Socket Listen: A Tale of Two Queues](https://arthurchiao.github.io/blog/tcp-listen-a-tale-of-two-queues/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [PostgreSQL漏洞泄露企业数据库，多家云巨头受到影响](https://www.4hou.com/posts/pVV2) - - [苹果敦促iPhone用户尽快更新到零风险版本](https://www.4hou.com/posts/wg7M) -- Twitter @bytehx - - [RT Ryan M. Montgomery: Toxssin - (Incredible XSS Hook) - This is the best I've seen in quite a long time, check out the video linked below for a demon...](https://twitter.com/0dayCTF/status/1564016278301548544) -- Reverse Engineering - - [FISSURE - The RF Framework](https://www.reddit.com/r/ReverseEngineering/comments/x06eco/fissure_the_rf_framework/) - - [My thinking process for reverse engineering ANYTHING :)](https://www.reddit.com/r/ReverseEngineering/comments/wzz42l/my_thinking_process_for_reverse_engineering/) -- SAP Blogs - - [SAP BTP Cloud Foundry Architecture for Developer](https://blogs.sap.com/2022/08/28/sap-btp-cloud-foundry-architecture-for-developer/) - - [SOMIX Suite for Software Visualization](https://blogs.sap.com/2022/08/28/somix-suite-for-software-visualization/) - - [Customer Service : Cost + Uplift Billing (RR Billing)](https://blogs.sap.com/2022/08/28/customer-service-cost-uplift-billing-rr-billing/) - - [Share it from the Web Client](https://blogs.sap.com/2022/08/28/share-it-from-the-web-client/) - - [Handle Divide By 0 Error in Hana Sql or Hana View](https://blogs.sap.com/2022/08/28/handle-divide-by-0-error-in-hana-sql-or-hana-view/) - - [Query folders base on created secondary type on folders of BTP document management service](https://blogs.sap.com/2022/08/28/query-folders-base-on-created-secondary-type-on-folders-of-btp-document-management-service/) -- 看雪学院 - - [某车联网APP加固分析](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465858&idx=1&sn=1dc3e63174341873bf5cbec39426874c&chksm=b18e06c886f98fde03eaee13675e184b870a438c7c760ae859fe94547ad354796fc50b0bc35d&scene=58&subscene=0#rd) - - [《VMProtect分析与还原》—— 附赠价值5000元xx_vm工具](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458465858&idx=2&sn=e049b2252ce742244ccdd622ce633fe9&chksm=b18e06c886f98fde6345e6c249039b1cfa96488dbc8657d811620933d91a4dc5b3b79c6fcacd&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator](http://www.kitploit.com/2022/08/toxssin-xss-exploitation-command-line.html) -- 云鼎实验室 - - [每周云安全资讯-2022年第35周](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494643&idx=1&sn=6c63fa196789329145096a8d2b614ee8&chksm=fd791775ca0e9e6343f299cf96c3d173d8b69e71f66962d6692a1663bd532a1cfc9b83a82e78&scene=58&subscene=0#rd) -- 极客公园 - - [卫星，未来太空数据的「智能平台」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966298&idx=1&sn=2fe06b4665c037a754196c4ba176015e&chksm=7e54702c4923f93a665a95d1b273c1da59ace7f9b65d8b77e46eb25d9228f1617ed47e6f6759&scene=58&subscene=0#rd) - - [比特币跌破 2 万美元；100多名员工请愿罢免法拉第未来董事长；HBO 确认续订《龙之家族》第二季 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966297&idx=1&sn=028ac882bf8c8d4194ee624cc1a56384&chksm=7e54702f4923f939a4d23df1c632c9e2c0938c57591e6d9cb0439b775c92fcb30b33847b44cc&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-30.md b/archive/2022/2022-08-30.md deleted file mode 100644 index 6264604495..0000000000 --- a/archive/2022/2022-08-30.md +++ /dev/null @@ -1,238 +0,0 @@ -# 每日安全资讯（2022-08-30） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [AeroCMS 0.0.1 SQL Injection](https://cxsecurity.com/issue/WLB-2022080073) -- Security Boulevard - - [Millennials and Online Scams | Avast](https://securityboulevard.com/2022/08/millennials-and-online-scams-avast/) - - [Synopsys and the new Automated Source Code Data Protection Measure have you covered](https://securityboulevard.com/2022/08/synopsys-and-the-new-automated-source-code-data-protection-measure-have-you-covered/) - - [How To Protect Your Businesses During the Threat of Cyberattacks](https://securityboulevard.com/2022/08/how-to-protect-your-businesses-during-the-threat-of-cyberattacks/) - - [Cyber Security Solutions](https://securityboulevard.com/2022/08/cyber-security-solutions/) - - [BSidesTLV 2022 – Chris Kubecka’s ‘Inside The OSINT Operation Getting Foreign Students Out Of Ukraine’](https://securityboulevard.com/2022/08/bsidestlv-2022-chris-kubeckas-inside-the-osint-operation-getting-foreign-students-out-of-ukraine/) - - [Black Hat Fireside Chat: Taking the fight to the adversaries — with continuous, proactive ‘pen tests’](https://securityboulevard.com/2022/08/black-hat-fireside-chat-taking-the-fight-to-the-adversaries-with-continuous-proactive-pen-tests/) - - [Nobelium Hackers Exploit Admin Credentials](https://securityboulevard.com/2022/08/nobelium-hackers-exploit-admin-credentials/) - - [Threat Intelligence](https://securityboulevard.com/2022/08/threat-intelligence/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – “WEEK 396”](https://securityboulevard.com/2022/08/robert-m-lees-jeff-haas-little-bobby-comic-week-396/) - - [What is in Your SOC?](https://securityboulevard.com/2022/08/what-is-in-your-soc/) -- SecWiki News - - [SecWiki News 2022-08-29 Review](http://www.sec-wiki.com/?2022-08-29) -- Recent Commits to cve:main - - [Update Mon Aug 29 05:28:41 UTC 2022](https://github.com/trickest/cve/commit/76fa646fdb1ad79fa6326281a3b72aeca28ac94f) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5584-1](https://packetstormsecurity.com/files/168190/USN-5584-1.txt) - - [AeroCMS 0.0.1 SQL Injection](https://packetstormsecurity.com/files/168189/aerocms0001-sql.txt) -- 先知安全技术社区 - - [ADCS攻击笔记](https://xz.aliyun.com/t/11627) - - [ThinkPHP 5.0.X代码审计](https://xz.aliyun.com/t/11658) - - [【云攻防系列】从攻击者视角聊聊K8S集群安全（上）](https://xz.aliyun.com/t/11652) - - [给木马带双眼睛](https://xz.aliyun.com/t/11655) - - [利用 PHP-FPM 做内存马的方法](https://xz.aliyun.com/t/11651) -- 先知安全技术社区 - - [ADCS攻击笔记](https://xz.aliyun.com/t/11627) - - [ThinkPHP 5.0.X代码审计](https://xz.aliyun.com/t/11658) - - [【云攻防系列】从攻击者视角聊聊K8S集群安全（上）](https://xz.aliyun.com/t/11652) - - [给木马带双眼睛](https://xz.aliyun.com/t/11655) - - [利用 PHP-FPM 做内存马的方法](https://xz.aliyun.com/t/11651) -- Sploitus.com Exploits RSS Feed - - [AeroCMS 0.0.1 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168189&utm_source=rss&utm_medium=rss) - - [Exploit for OS Command Injection in Hikvision Ds-2Cd2026G2-Iu\/Sl Firmware exploit](https://sploitus.com/exploit?id=CDD887D3-0536-588B-9CFC-6EF1E7FB9329&utm_source=rss&utm_medium=rss) -- unSafe.sh - 不安全 - - [Pwn2Own Toronto 2022 Announced: More than $1,000,000 available in cash and prizes](https://buaq.net/go-124324.html) - - [Announcing Pwn2Own Toronto 2022 and Introducing the SOHO Smashup!](https://buaq.net/go-124326.html) - - [Autonomous Detection & Response | How MDR Disrupts the Cyber Kill Chain](https://buaq.net/go-124325.html) - - [ADCS攻击笔记](https://buaq.net/go-124318.html) - - [ThinkPHP 5.0.X代码审计](https://buaq.net/go-124319.html) - - [【云攻防系列】从攻击者视角聊聊K8S集群安全（上）](https://buaq.net/go-124321.html) - - [给木马带双眼睛](https://buaq.net/go-124322.html) - - [利用 PHP-FPM 做内存马的方法](https://buaq.net/go-124323.html) - - [Draw.io - 吊打付费！开源免费的跨平台流程图绘图制图工具 (替代 Visio / ProcessOn)](https://buaq.net/go-124350.html) - - [A technical analysis of Pegasus for Android – Part 1](https://buaq.net/go-124306.html) - - [Tor 101: How Tor Works and its Risks to the Enterprise](https://buaq.net/go-124312.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [安全玻璃盒：与CSO大会双向奔赴，DevSecOps赋能掷地有声！](https://www.4hou.com/posts/MBKA) - - [AI算法赋能数字安全 第二届数字安全公开赛正式开赛](https://www.4hou.com/posts/LB1w) - - [谈谈工控系统网络安全的四大误区](https://www.4hou.com/posts/GWGQ) - - [XCon2022议题：隐藏在工业控制系统中的间谍](https://www.4hou.com/posts/DEZx) - - [【技术原创】Sophos UTM利用分析——清除Last WebAdmin Sessions记录](https://www.4hou.com/posts/PJM4) - - [Jackware：控制机器的恶意软件](https://www.4hou.com/posts/3JEx) - - [反诈态势情报 | 移动端预警，同源色情直播类APP特征分析](https://www.4hou.com/posts/BEXX) -- 安全脉搏 - - [【漏洞预警】Apache Hadoop YARN远程代码执行漏洞](https://www.secpulse.com/archives/186403.html) - - [远控免杀专题(76)-基于Go的各种API免杀测试](https://www.secpulse.com/archives/186378.html) - - [远控免杀专题(75)-基于Go的沙箱检测](https://www.secpulse.com/archives/186371.html) - - [获取IP地址的途径有哪些？要如何保护IP地址不被窃取？](https://www.secpulse.com/archives/186244.html) - - [goahead环境变量注入漏洞](https://www.secpulse.com/archives/186339.html) -- 跳跳糖 - 安全与分享社区 - - [ATT&CK中的攻与防——T1059](https://tttang.com/archive/1718/) -- 安全客-有思想的安全新媒体 - - [数字安全观察-每周简报(2022.08.17-2022.08.23)](https://www.anquanke.com/post/id/279043) - - [反诈态势情报 | 移动端预警，同源色情直播类APP特征分析](https://www.anquanke.com/post/id/278957) - - [某流行企业财务软件0day漏洞大规模勒索利用通告](https://www.anquanke.com/post/id/279012) - - [三倍勒索策略！LockBit或开启勒索攻击乱斗时代？](https://www.anquanke.com/post/id/278960) - - [游戏赚钱社区？黑客分发恶意软件套路多](https://www.anquanke.com/post/id/278963) - - [VMware 系列产品之身份验证绕过和JDBC注入漏洞分析](https://www.anquanke.com/post/id/278903) - - [Twilio漏洞致Okta一次性MFA密码泄露](https://www.anquanke.com/post/id/278958) - - [上半年DDoS攻击暴增203%，“爱国黑客”激增](https://www.anquanke.com/post/id/278944) - - [美国国防工业网络保护框架和启示](https://www.anquanke.com/post/id/278954) - - [黑山指责俄罗斯对政府服务器进行网络攻击](https://www.anquanke.com/post/id/278940) - - [DuckDuckGo 开放提供反跟踪电邮服务](https://www.anquanke.com/post/id/278967) - - [一例简单的frida反调试绕过](https://www.anquanke.com/post/id/278827) - - [勒索软件Quantum 染指多米尼加共和国政府机构](https://www.anquanke.com/post/id/278917) -- Twitter @Nicolas Krassas - - [NATO Investigates Dark Web Leak of Data Stolen from Missile Vendor](https://twitter.com/Dinosn/status/1564326376563433478) - - [Nelnet Servicing breach exposes data of 2.5M student loan accounts](https://twitter.com/Dinosn/status/1564326236746293251) - - [US govt sues Kochava for selling sensitive geolocation data](https://twitter.com/Dinosn/status/1564324165699751938) - - [Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms](https://twitter.com/Dinosn/status/1564319249702723590) - - [Cloudflare CDN clients caught in Austrian fight against pirate sites](https://twitter.com/Dinosn/status/1564316394052804610) - - [Blind exploits to rule WatchGuard firewalls: pre-auth RCE as root on WG appliances](https://twitter.com/Dinosn/status/1564315169769115648) - - [A technical analysis of Pegasus for Android – Part 1](https://twitter.com/Dinosn/status/1564257594356686851) - - [Check Point Research detects Crypto Miner malware disguised as Google translate desktop and other legitimate applications](https://twitter.com/Dinosn/status/1564243680445321218) - - [iOS Obfuscation and RASP Analysis](https://twitter.com/Dinosn/status/1564243583040888833) - - [Bypassing Amazon WAF to pop an alert()](https://twitter.com/Dinosn/status/1564243465730416640) - - [Nitrokod Crypto Miner Infected Over 111,000 Users with Copies of Popular Software](https://twitter.com/Dinosn/status/1564241207026384898) - - [GO Simple Tunnel - a simple tunnel written in golang](https://twitter.com/Dinosn/status/1564220424275329025) - - [Proxy is a high performance HTTP(S) proxies, SOCKS5 proxies,WEBSOCKET, TCP, UDP proxy server implemented by golang. Now, it supports chain-style proxi...](https://twitter.com/Dinosn/status/1564220141981818880) - - [A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.](https://twitter.com/Dinosn/status/1564220035962490881) - - [Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python](https://twitter.com/Dinosn/status/1564218829596774400) - - [SubSeven Legacy Official Source Code Repository](https://twitter.com/Dinosn/status/1564213311004180480) - - [Ultimate DevSecOps library](https://twitter.com/Dinosn/status/1564201664940331008) - - [RT Vulns Security: We are very interested in buying 0-day exploits for Microsoft Windows LPE/MS Word Bounty starts from $100K+/$300K+ PM over Wire: vu...](https://twitter.com/vulns_sec/status/1564195831292592128) - - [RT Jean-Pierre LESUEUR: SubSeven Legacy is now open source 😎](https://twitter.com/DarkCoderSc/status/1564185343624093699) -- Twitter @bytehx - - [RT Matheus Vrech: I made multiple changes in Richsploit adding support to send arbitrary expressions, change the exploited path, sending cookies, etc.](https://twitter.com/vrechson/status/1564074400521019393) -- Bug Bounty in InfoSec Write-ups on Medium - - [Bypassing Amazon WAF to pop an alert()](https://infosecwriteups.com/bypassing-amazon-waf-to-pop-an-alert-4646ce35554e?source=rss----7b722bfd1b8d--bug_bounty) -- paper - Last paper - - [通过动态链接库绕过反病毒软件 Hook - Break JVM](https://paper.seebug.org/1953/) - - [CVE-2021-22600 通过 Modprobe_path 及 USMA 进行漏洞利用与分析](https://paper.seebug.org/1952/) - - [Ruby 安全漫谈](https://paper.seebug.org/1951/) - - [Cisco RV340 wfapp 命令注入漏洞（CVE-2022-20827）分析](https://paper.seebug.org/1949/) -- Horizon3.ai - - [An International Look at Cybercrime](https://www.horizon3.ai/an-international-look-at-cybercrime/) -- SAP Blogs - - [How a focus on employee experience improves your HR Service Delivery](https://blogs.sap.com/2022/08/29/how-a-focus-on-employee-experience-improves-your-hr-service-delivery/) - - [How to create table and export the data to spreadsheet dynamically](https://blogs.sap.com/2022/08/29/how-to-create-table-and-export-the-data-to-spreadsheet-dynamically/) - - [How to edit the MTA yaml in low code environment in SAP Business Application Studio](https://blogs.sap.com/2022/08/29/how-to-edit-the-mta-yaml-in-low-code-environment-in-sap-business-application-studio/) - - [What’s New in SAP Analytics Cloud Release 2022.18](https://blogs.sap.com/2022/08/29/whats-new-in-sap-analytics-cloud-release-2022.18/) - - [XSD Validation for Map Format Data](https://blogs.sap.com/2022/08/29/xsd-validation-for-map-format-data/) - - [Apple M1 and real SAP Basis Support](https://blogs.sap.com/2022/08/29/apple-m1-and-real-sap-basis-support/) - - [The Business Value of Predictive Planning – Episode 1: Speeding Up & Automating Planning](https://blogs.sap.com/2022/08/29/the-business-value-of-predictive-planning-episode-1-speeding-up-automating-planning/) -- Application Security Blog - - [Synopsys and the new Automated Source Code Data Protection Measure have you covered](https://www.synopsys.com/blogs/software-security/ascdpm-standard-data-protection/) -- blog.avast.com EN - - [Millennials and Online Scams | Avast](https://blog.avast.com/millennials-online-scams) -- Hex Rays - - [IDA 8.0 Service Pack 1 released](https://hex-rays.com/blog/ida-8-0-service-pack-1-released/) -- SentinelOne - - [Autonomous Detection & Response | How MDR Disrupts the Cyber Kill Chain](https://www.sentinelone.com/blog/autonomous-detection-response-how-mdr-disrupts-the-cyber-kill-chain/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/x0i2cf/rreverseengineerings_weekly_questions_thread/) - - [Pwn2Own Toronto 2022 Announced: More than $1,000,000 available in cash and prizes](https://www.reddit.com/r/ReverseEngineering/comments/x0rhgs/pwn2own_toronto_2022_announced_more_than_1000000/) - - [IDA Pro 8.0 SP1 Released](https://www.reddit.com/r/ReverseEngineering/comments/x0ny2t/ida_pro_80_sp1_released/) - - [A technical analysis of Pegasus for Android – Part 1](https://www.reddit.com/r/ReverseEngineering/comments/x0o8ut/a_technical_analysis_of_pegasus_for_android_part_1/) - - [How CastGuard Works [BHUSA 2022]](https://www.reddit.com/r/ReverseEngineering/comments/x0yr3p/how_castguard_works_bhusa_2022/) - - [iOS Obfuscation and RASP Analysis](https://www.reddit.com/r/ReverseEngineering/comments/x0k7g3/ios_obfuscation_and_rasp_analysis/) -- 博客园 - sevck - - [1password6 在chromeV99复活 - sevck](https://www.cnblogs.com/sevck/p/16635963.html) -- Yang Hao's blog - - [利用Azure Attest Service持久化](https://yanghaoi.github.io/2022/08/29/li-yong-azureattestservice-chi-jiu-hua/) -- Malwarebytes Labs - - [Playing Doom on a John Deere tractor with Sick Codes: Lock and Code S03E18](https://www.malwarebytes.com/blog/podcast/2022/08/playing-doom-on-a-john-deere-tractor-lock-and-code-s03e18) - - [Twilio data breach turns out to be more elaborate than suspected](https://www.malwarebytes.com/blog/news/2022/08/twilio-data-breach-turns-out-to-be-more-elaborate-than-suspected) - - [A week in security (August 22 - August 28)](https://www.malwarebytes.com/blog/news/2022/08/a-week-in-security-august-22-august-28) -- KitPloit - PenTest & Hacking Tools - - [Erlik - Vulnerable Soap Service](http://www.kitploit.com/2022/08/erlik-vulnerable-soap-service.html) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（2022.08.22-2022.08.28）](http://blog.nsfocus.net/weeklyreport35/) -- HackerNews - - [密码管理巨头 LastPass 遭遇网络攻击，源代码已泄露](https://hackernews.cc/archives/41193) - - [监控公司 Intellexa 购买价值 800 万美元的 iOS RCE 零日漏洞](https://hackernews.cc/archives/41185) - - [借助 DDoS，LockBit 勒索软件正变得更加凶险](https://hackernews.cc/archives/41182) - - [Atlassian Bitbucket 服务器和数据中心出现漏洞](https://hackernews.cc/archives/41179) - - [安全研究人员发现一场巨大的网络钓鱼活动，针对超过 130 家公司](https://hackernews.cc/archives/41176) - - [FCC : 美国大多数顶级移动运营商对客户地理位置数据保留两年](https://hackernews.cc/archives/41173) -- 安全牛 - - [安全玻璃盒：与CSO大会双向奔赴，DevSecOps赋能掷地有声！](https://www.aqniu.com/vendor/88422.html) - - [安全头条 |2022年中国网络文明大会主论坛在天津举行；CNNVD通报关于苹果的多个安全漏洞情况](https://www.aqniu.com/homenews/88405.html) - - [金融机构第三方风险管理（TPRM）的目标与实施](https://www.aqniu.com/hometop/88407.html) - - [数字安全大会：数字安全产业将是万亿市场](https://www.aqniu.com/vendor/88393.html) - - [+1 进阶，护航未来｜2022 KCon黑客大会云端火热开场](https://www.aqniu.com/industry/88362.html) - - [亚信安全发布2022年半年度报告 营业收入同比增长22%](https://www.aqniu.com/vendor/88360.html) -- Twitter @Keiran Smith (Affix) - - [Re @Akamai are literally blocking me from accessing my @Tesla because I took part in the @Tesla Bug Bounty program #awesome #mycarwontupdate #1stwordl...](https://twitter.com/cli/status/1564161066338340866) -- 360 Netlab Blog - Network Security Research Lab at 360 - - [PureCrypter is busy pumping out various malicious malware families](https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/) - - [PureCrypter Loader持续活跃，已经传播了10多个其它家族](https://blog.netlab.360.com/purecrypter/) -- 安全客 - - [【技术分享】对抗重编程攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649776466&idx=1&sn=d15bdf6d81a0fc051f63bd866a39fa92&chksm=8893513dbfe4d82b2f3a5f89be5e7d4c075f9c0784e5bae752c2999093628dcc1fa1b94bef2b&scene=58&subscene=0#rd) - - [【安全头条】Quantum染指多米尼加共和国政府机构](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649776466&idx=2&sn=58822dd3b24bf10250ba7b3ed34c3238&chksm=8893513dbfe4d82b3f601bb1b644d9e8ccd1e52b3d3049375c85b3c0309cdee4f6b01850e530&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [物种灭绝和范围缩小导致全球食物网的崩溃](https://www.solidot.org/story?sid=72609) - - [植物也许有智能](https://www.solidot.org/story?sid=72608) - - [聆听有 3400 年历史的音乐](https://www.solidot.org/story?sid=72607) - - [Google 在实施强制性重返办公室政策后记录到数百例新冠确诊](https://www.solidot.org/story?sid=72606) - - [天文学家首次在系外行星大气中发现二氧化碳](https://www.solidot.org/story?sid=72605) - - [NASA 准备发射阿尔忒弥斯1号月球任务](https://www.solidot.org/story?sid=72604) - - [西方国家纷纷重启旧核电站](https://www.solidot.org/story?sid=72603) - - [为改进可及性 Debian 考虑默认加载非自由固件](https://www.solidot.org/story?sid=72602) - - [苹果面临反垄断诉讼](https://www.solidot.org/story?sid=72601) - - [至少 136 家公司遭到相同黑客的钓鱼攻击](https://www.solidot.org/story?sid=72600) - - [儒艮在中国沿海功能性灭绝](https://www.solidot.org/story?sid=72599) -- Seebug漏洞平台 - - [原创Paper | Cisco RV340 wfapp 命令注入漏洞（CVE-2022-20827）分析](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650964259&idx=1&sn=70e0aea69c8255ba44f1b9738085b4f0&chksm=8079c311b70e4a075046e8e6bf55e21d786b99cc24bdf82deecaa8774ab152f770a55ab3b645&scene=58&subscene=0#rd) -- 博客园 - 渗透测试中心 - - [2022第三届“网鼎杯”网络安全大赛-青龙组 部分WriteUp - 渗透测试中心](https://www.cnblogs.com/backlion/p/16635279.html) -- FreeBuf网络安全行业门户 - - [Sliver取代Cobalt Strike成黑客渗透工具“新宠”](https://www.freebuf.com/sectool/343235.html) - - [如何使用jwtXploiter测试JSON Web令牌的安全性](https://www.freebuf.com/articles/web/288278.html) - - [密码管理巨头LastPass遭遇网络攻击，源代码已泄露](https://www.freebuf.com/news/343183.html) - - [FreeBuf早报 | 美国外卖巨头DoorDash发生数据泄露事件；黑客窃取LastPass源代码](https://www.freebuf.com/news/343158.html) - - [Atlassian Bitbucket 服务器和数据中心出现漏洞](https://www.freebuf.com/news/343151.html) - - [借助DDoS，LockBit勒索软件正变得更加凶险](https://www.freebuf.com/news/343132.html) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220829期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530607&idx=1&sn=ff94ed0ca892b848c431567e8969c27d&chksm=c1e9f43ef69e7d28d10083bd2372a1c459a79b5ad60a84d42ec7fd42e1439c3bf20b62a8fe5a&scene=58&subscene=0#rd) - - [北美国家政务机构遭勒索软件攻击，内部数据全部泄露](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530607&idx=2&sn=3ce2100a9106e4582561fb0408250fc0&chksm=c1e9f43ef69e7d28ba638e091041fdb1df67386e3920bba2d34145b4e46cbe4bc52139c55ec6&scene=58&subscene=0#rd) - - [DirtyCred：存在8年的Linux kernel漏洞](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530607&idx=3&sn=2bdefffa908eb5a777e46085c0c1ac39&chksm=c1e9f43ef69e7d28c65ad982ec538509d2d338f97c198379c9fad411170a5095cfc74ea91a3d&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【情报分析案例】炭疽菌杀手](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131704&idx=1&sn=3c62533cbffa8f00fcb1f25524ea992f&chksm=f1af7802c6d8f114886eef4e42bcee5490b5b64cd8ae93fa89127b6f0dc964d35813ca2eb799&scene=58&subscene=0#rd) -- 安全牛 - - [金融机构第三方风险管理（TPRM）的目标与实施](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117994&idx=1&sn=8eb0783f09a8efa292da8d1ac214a8a7&chksm=bd1469798a63e06f6d91b32db1a2fdf92a7d8f26debe0e6fa21a450bce8baa6c8ddcbe82e44b&scene=58&subscene=0#rd) - - [安全头条 |2022年中国网络文明大会主论坛在天津举行；CNNVD通报关于苹果的多个安全漏洞情况](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651117994&idx=2&sn=6668cac77efe9ff8f69b98c0129c0403&chksm=bd1469798a63e06f3e7c8e124a257c34f9b8b8cad79bc73c12c9757ad90771fc6eb4b023733b&scene=58&subscene=0#rd) -- 中国信息安全 - - [依法治网 习近平这样筑牢法治根基](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164686&idx=1&sn=7f9d5f800f70f4116fb43f5d94714fb1&chksm=8b5eefb7bc2966a1e83ee9329af6e85eab6702a3ce1aa30bdbdce0ab3b56b46e4bbc2a720c2f&scene=58&subscene=0#rd) - - [聚焦 | 2022年中国网络文明大会主论坛在天津举行](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164686&idx=2&sn=93b8f2b9cf7b55093f34bcc453ce693b&chksm=8b5eefb7bc2966a16a05233bbabd17fa9c85cff8f81733ee964c6265e359278ff4394323d37a&scene=58&subscene=0#rd) - - [发布 | 《中国网络诚信发展报告2022》发布 提出四条思考建议](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164686&idx=3&sn=d50ec1d0f58fe7740c96ebdfb54a48a3&chksm=8b5eefb7bc2966a19b871666ba1170c669f0f7edb78226891e09cee3d59ec69d3646207b31e3&scene=58&subscene=0#rd) - - [发布 | 《共建网络文明天津宣言》](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164686&idx=4&sn=e577d4045e7f48b694489cb31d5d5822&chksm=8b5eefb7bc2966a1130e9ec3af53a17391ab2cc823e4fbd55a36222292a29acf391c78caa9f7&scene=58&subscene=0#rd) - - [以“法”打造安全清朗的“第五空间”](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164686&idx=5&sn=6daed186c53f102b0a81acc35802b817&chksm=8b5eefb7bc2966a1445670d522eafe366f1d1cb3ae07429d9348d1ece939f415cb80b59327d3&scene=58&subscene=0#rd) - - [专家观点 | 筑牢铁路关键信息基础设施安全保障体系](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164686&idx=6&sn=3cc845c1f9668a735df6c262a470009b&chksm=8b5eefb7bc2966a1f3edd88868dc58322738adbc23f87ccbc64877287ca0af2681bf4c83d5f3&scene=58&subscene=0#rd) -- 情报分析师 - - [如何写情报分析报告及情报结构化分析技巧](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514821&idx=1&sn=65b7d925f70b4c7901bad86fd34617e8&chksm=87168bceb06102d89e1d363745ecfd53f63ccda1a79163c940dc6caaddb0735bcadaf166bf5f&scene=58&subscene=0#rd) - - [【情报课堂】OSINT开源情报工具大揭秘](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650514821&idx=2&sn=184361128a3e30ddc123e24d42ee5f39&chksm=87168bceb06102d84a5b25d373dd55dd0303e3ff7cc5d683a353302e1241b2d1e794169b3f42&scene=58&subscene=0#rd) -- 极客公园 - - [2050 年，我们需要 500 万「机器人」摘水果](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966399&idx=1&sn=9abb672c45bd5c2fe1b9634d51af95f7&chksm=7e5470494923f95f6ab5a17df563076faed86301a815f6c636c5a2a256eac3f2a55c267ac205&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Aug.29th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495777&idx=1&sn=3042c52c544b69935d0d96c75a126269&chksm=ce96bd5ff9e13449eb0a081cb6745ae22937728fe68f90cdb5bdad85d0f27452bbc2c268178a&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (08.22-08.28)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491360&idx=1&sn=cf10a82aae68c27807ec8cfbd774da26&chksm=fe251a21c9529337d13a38246f4813986016582b573140bed321b280b0061f0a6eac050e27a2&scene=58&subscene=0#rd) - - [安全日报（2022.08.29）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491360&idx=2&sn=e957e9d12c51da9b37b8f1712300beb8&chksm=fe251a21c9529337d37c9f0057734628804980ef4c87f352c9548d86bbaa86d5906ba36b1e82&scene=58&subscene=0#rd) -- 且听安全 - - [CVE-2022-26911 Skype for Business 任意文件读取漏洞分析与复现](https://mp.weixin.qq.com/s?__biz=Mzg3MTU0MjkwNw==&mid=2247491457&idx=1&sn=5a4a4db750ae92082cd7d86bf8a67e1a&chksm=cefda695f98a2f83301bf03758c51b7d2e5d0c0fc76fbabbba31348d6b98df10d7784c4ee9b9&scene=58&subscene=0#rd) -- KCon黑客大会 - - [KCon 2022 圆满落幕，直播间邀请榜获奖名单公布！](https://mp.weixin.qq.com/s?__biz=MzIzOTAwNzc1OQ==&mid=2651135837&idx=1&sn=462c8a250b2bb5f4ad46d2d86b5ad1c4&chksm=f2c11e3dc5b6972b0715de986eabe548cdc1b52df9309fd2054e0a2abea7169224e48528a435&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [国家工程研究中心安全资讯周报20220829期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530917&idx=1&sn=0fc2e8685b06178ebc650ff3e56cd4c1&chksm=fa93cf64cde44672066390310cee4f2d73fd212d33e868be412b64ee225a0ea6d57410cced27&scene=58&subscene=0#rd) - - [北约成员国黑山关键基础设施遭遇“前所未有”的网络攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530917&idx=2&sn=4fcef9c4f901e2402bf5d0238cf9bef6&chksm=fa93cf64cde4467243a23d6a53840e86a6cd57fc37a069c5060cb9918eb96beb95a994aa8113&scene=58&subscene=0#rd) - - [警惕！O.MG黑客数据线升级版提供更加邪恶的新功能](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530917&idx=3&sn=08a35fee87e2d357332c3f79091ed9d8&chksm=fa93cf64cde446722b42346ade0d76cc4b2c7f6be92db609f84cc3e4aba81c011b4a0f08f1cf&scene=58&subscene=0#rd) -- 百度安全应急响应中心 - - [分享图片](https://mp.weixin.qq.com/s?__biz=MzA4ODc0MTIwMw==&mid=2652537432&idx=1&sn=db4f01588e4288d7d20792675934c1b6&chksm=8bcba664bcbc2f726f893e291ad03b257946251173007bde6f8a519753c9ef77aaff76d8b0f9&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-08-29](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492568&idx=1&sn=d4b1663c38d4103f50ee34e0a37bc145&chksm=c063cd01f71444171ce01629371959b9ba212c8a982843af022ae8fa3ca616b6354c0ff2905e&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [【技术原创】Sophos UTM利用分析——清除Last WebAdmin Sessions记录](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549293&idx=1&sn=24ee9c71563ef5ae1469bb5987df29e6&chksm=e915d157de6258413e914b40511063992c68298a94facb3dc0e15cd60962aedf322752f38a4f&scene=58&subscene=0#rd) - - [XCon2022议题：隐藏在工业控制系统中的间谍](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549293&idx=2&sn=30ae5a96d211a3caaa2633d3cc182098&chksm=e915d157de6258418c08b34a12847d881c506306f4bcde9d8cfcffe26c7eb59098b248204de6&scene=58&subscene=0#rd) - - [Jackware：控制机器的恶意软件](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549293&idx=3&sn=f61f46dd865e7cf0651d064984caa774&chksm=e915d157de62584158c4b251ef298611061691da3e1c521a3a9161e1fab7631937f6d70091be&scene=58&subscene=0#rd) -- 甲方安全建设 - - [方法论 | 我与入侵检测的二三事儿](https://mp.weixin.qq.com/s?__biz=MzU0MDcyMTMxOQ==&mid=2247487300&idx=1&sn=d2bb372406293f3dc888dba831925c65&chksm=fb35a68ccc422f9a495013d8d61bfceddd9603962f214f62e9f6839c07ca465e491a89c7d83e&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [2022黑帽亚洲议题分享——Use Zero to Attack ZKP](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496004&idx=1&sn=4fa3469e8a3bff4e263b63e663f35ac0&chksm=fa5224facd25adec6ec4801a4dc5eeccfdc31da8936f820d34d6481a28f03dccea8077e038a3&scene=58&subscene=0#rd) -- 星阑科技 - - [【技术干货】VMware 系列产品之身份验证绕过和JDBC注入漏洞分析](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495396&idx=1&sn=71230f1c8ce8f5c8ecac51978dd8077f&chksm=c0074378f770ca6e92e338bd326eb30092102659ea54d54c417192d351e972cc491c0a9ab47f&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-08-31.md b/archive/2022/2022-08-31.md deleted file mode 100644 index 88cb5df573..0000000000 --- a/archive/2022/2022-08-31.md +++ /dev/null @@ -1,189 +0,0 @@ -# 每日安全资讯（2022-08-31） - -- Microsoft Security Blog - - [Cyber Signals: 3 strategies for protection against ransomware](https://www.microsoft.com/security/blog/2022/08/30/cyber-signals-3-strategies-for-protection-against-ransomware/) -- SecWiki News - - [SecWiki News 2022-08-30 Review](http://www.sec-wiki.com/?2022-08-30) -- Security Boulevard - - [Tech knowledge: Parents believe their children have overtaken them](https://securityboulevard.com/2022/08/tech-knowledge-parents-believe-their-children-have-overtaken-them/) - - [Lloyd’s Backs Off Insurance for State-Sponsored Cyberattacks](https://securityboulevard.com/2022/08/lloyds-backs-off-insurance-for-state-sponsored-cyberattacks/) - - [GigaOm Recognizes DTEX as the Only Outperforming Leader in 2022 Data Loss Prevention Radar Report](https://securityboulevard.com/2022/08/gigaom-recognizes-dtex-as-the-only-outperforming-leader-in-2022-data-loss-prevention-radar-report/) - - [Do companies have a false sense of database security?](https://securityboulevard.com/2022/08/do-companies-have-a-false-sense-of-database-security/) - - [Insecure Deserialization in AWS Lambda | What is the Vulnerability and How to Avoid It? | Contrast Security](https://securityboulevard.com/2022/08/insecure-deserialization-in-aws-lambda-what-is-the-vulnerability-and-how-to-avoid-it-contrast-security/) - - [Salesforce Backup Best Practices](https://securityboulevard.com/2022/08/salesforce-backup-best-practices/) - - [Transport Layer Security](https://securityboulevard.com/2022/08/transport-layer-security/) - - [BSides Vancouver 2022 – Rob “mubix” Fuller’s ‘Keynote: Beautiful Basics’](https://securityboulevard.com/2022/08/bsides-vancouver-2022-rob-mubix-fullers-keynote-beautiful-basics/) - - [The How and Why of Networking Device Remote Control](https://securityboulevard.com/2022/08/the-how-and-why-of-networking-device-remote-control/) - - [Qualys Discovers Two Major Vulnerabilities – Techstrong TV](https://securityboulevard.com/2022/08/qualys-discovers-two-major-vulnerabilities-techstrong-tv/) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5588-1](https://packetstormsecurity.com/files/168200/USN-5588-1.txt) - - [Ubuntu Security Notice USN-5572-2](https://packetstormsecurity.com/files/168199/USN-5572-2.txt) - - [Zeek 5.0.1](https://packetstormsecurity.com/files/168198/zeek-5.0.1.tar.gz) - - [Ubuntu Security Notice USN-5585-1](https://packetstormsecurity.com/files/168197/USN-5585-1.txt) - - [Red Hat Security Advisory 2022-6206-01](https://packetstormsecurity.com/files/168196/RHSA-2022-6206-01.txt) - - [Linux unmap_mapping_range() Race Condition](https://packetstormsecurity.com/files/168195/GS20220830150653.txt) - - [Ubuntu Security Notice USN-5583-1](https://packetstormsecurity.com/files/168194/USN-5583-1.txt) - - [Ubuntu Security Notice USN-5586-1](https://packetstormsecurity.com/files/168193/USN-5586-1.txt) - - [Linux KVM Instruction Emulation Issue](https://packetstormsecurity.com/files/168192/GS20220830150314.tgz) - - [Kernel Live Patch Security Notice LSN-0089-1](https://packetstormsecurity.com/files/168191/LSN-0089-1.txt) -- unSafe.sh - 不安全 - - [CVE-2022-31197 PostgreSQL JDBC SQL注入分析](https://buaq.net/go-124495.html) - - [Establishing trust in your software supply chain with an SBOM](https://buaq.net/go-124498.html) - - [British Airways customers targeted in lost luggage Twitter scam](https://buaq.net/go-124518.html) - - [Enabling Global-Scale Digital Trust | Avast](https://buaq.net/go-124481.html) - - [Masky - Python Library With CLI Allowing To Remotely Dump Domain User Credentials Via An ADCS Without Dumping The LSASS Process Memory](https://buaq.net/go-124485.html) - - [5 ½ Questions to Ask When Selecting a CDR Vendor](https://buaq.net/go-124482.html) - - [Chromium browsers can write to the system clipboard without your permission](https://buaq.net/go-124519.html) - - [Hack With SQL Injection Attacks! DVWA medium security — StackZero](https://buaq.net/go-124483.html) - - [SSRF — Exploitation 02](https://buaq.net/go-124484.html) -- 先知安全技术社区 - - [CVE-2022-31197 PostgreSQL JDBC SQL注入分析](https://xz.aliyun.com/t/11660) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [IDC安全创新者，以科技改变未来](https://www.4hou.com/posts/VZ2M) - - [XCon2022议题：流量中的威胁 Chrome网络组件漏洞剖析](https://www.4hou.com/posts/PJKw) - - [死而不僵——SmokeLoader 继续使用旧漏洞攻击](https://www.4hou.com/posts/vJD0) - - [MiMi应用被植入后门，攻击安卓、iOS、Windows和macOS平台](https://www.4hou.com/posts/7JYr) - - [聚焦金融客户数据安全 奇安信可信浏览器推出全平台防截屏功能](https://www.4hou.com/posts/O9Xp) -- 安全客-有思想的安全新媒体 - - [国际观察 | 以色列国家网络安全防御体系建设及启示](https://www.anquanke.com/post/id/279094) - - [CVE-2022-36804：Atlassian Bitbucket 命令注入漏洞通告](https://www.anquanke.com/post/id/279120) - - [Antenna开源！挖掘白帽子的最深需求！](https://www.anquanke.com/post/id/279022) - - [APT组织Kimusky盯上韩国政客和外交官](https://www.anquanke.com/post/id/279013) - - [FBI：黑客越来越多地利用 DeFi 漏洞窃取加密货币](https://www.anquanke.com/post/id/279077) - - [Cisco RV340 wfapp 命令注入漏洞（CVE-2022-20827）分析](https://www.anquanke.com/post/id/278956) - - [美国政府起诉Kochava出售敏感的地理位置数据](https://www.anquanke.com/post/id/279074) - - [安全事件周报 (08.22-08.28)](https://www.anquanke.com/post/id/278992) - - [Nelnet服务漏洞暴露250万学生贷款账户数据](https://www.anquanke.com/post/id/279071) - - [印度Akasa航空乘客数据遭黑客攻击](https://www.anquanke.com/post/id/279056) - - [黑客叫卖北约机密资料，80GB数据要价15比特币](https://www.anquanke.com/post/id/279058) - - [Zloader 木马分析](https://www.anquanke.com/post/id/278914) - - [Bitbucket Server曝RCE 漏洞，在野利用可执行任意代码](https://www.anquanke.com/post/id/279018) -- 跳跳糖 - 安全与分享社区 - - [UAC 原理与检测](https://tttang.com/archive/1715/) -- 先知安全技术社区 - - [CVE-2022-31197 PostgreSQL JDBC SQL注入分析](https://xz.aliyun.com/t/11660) -- Sucuri Blog - - [WordPress Vulnerabilities & Patch Roundup — August 2022](https://blog.sucuri.net/2022/08/wordpress-vulnerabilities-patch-roundup-august-2022.html) -- paper - Last paper - - [404星链计划 | 大动作！好多优秀新项目都来加入我们了](https://paper.seebug.org/1956/) - - [Chrome V8 命令执行漏洞（CVE-2022-1310）分析](https://paper.seebug.org/1955/) - - [基于 RDP 协议识别主机操作系统版本与用户名](https://paper.seebug.org/1954/) -- Twitter @Nicolas Krassas - - [A study on malicious plugins in WordPress Marketplaces](https://twitter.com/Dinosn/status/1564693030589943808) - - [Chrome extensions with 1.4 million installs steal browsing data](https://twitter.com/Dinosn/status/1564691635803508738) - - [A simple program to create a Windows account you will only know about :)](https://twitter.com/Dinosn/status/1564652327642058753) - - [threatest: framework for end-to-end testing threat detection rules](https://twitter.com/Dinosn/status/1564584993875165191) - - [India's Newest Airline Akasa Air Found Leaking Passengers' Personal Information](https://twitter.com/Dinosn/status/1564559998641922048) - - [World’s largest distributors of books Baker & Taylor hit by ransomware](https://twitter.com/Dinosn/status/1564559936264306689) - - [Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor](https://twitter.com/Dinosn/status/1564536072520040449) - - [Crooks are increasingly targeting DeFi platforms to steal cryptocurrency](https://twitter.com/Dinosn/status/1564507906577502208) - - [Truth Behind the Celer Network cBridge cross-chain bridge incident: BGP hijacking](https://twitter.com/Dinosn/status/1564507777954889729) - - [FBI Warns Investors to Take Precautions with Decentralized Financial Platforms](https://twitter.com/Dinosn/status/1564507734023733248) - - [RT Csaba Fitzl: I always missed some pieces around CVE-2017-2533, which was an LPE in the Disk Arbitration daemon found by phoenhex team. I finally to...](https://twitter.com/theevilbit/status/1564472021962182658) - - [FBI: Hackers increasingly exploit DeFi bugs to steal cryptocurrency](https://twitter.com/Dinosn/status/1564471167888629762) - - [CVE-2022-38556: TRENDnet TEW733GR Static Default Credential Flaw](https://twitter.com/Dinosn/status/1564471114415357952) - - [What Are the Top 10 Android Educational Apps That Collect Most User Data?](https://twitter.com/Dinosn/status/1564470985553809412) - - [Canaries as Network Motion Sensors](https://twitter.com/Dinosn/status/1564470922941194240) - - [jscythe: Abuse the node.js inspector mechanism to force any node.js/electron/v8 based process to execute arbitrary javascript code.](https://twitter.com/Dinosn/status/1564467692685377536) - - [FTC Sues Data Broker Over Selling Location Data for Hundreds of Millions of Phones](https://twitter.com/Dinosn/status/1564467385624576003) - - [Google Play to ban Android VPN apps from interfering with ads](https://twitter.com/Dinosn/status/1564467301130424321) - - [START - 7,455,386 breached accounts](https://twitter.com/Dinosn/status/1564467216803848192) -- 安全脉搏 - - [远控免杀专题(77)-基于Go的免杀总结](https://www.secpulse.com/archives/186458.html) - - [“您的主机已被接管！”新型 JavaScript 远控木马花样来袭](https://www.secpulse.com/archives/186442.html) - - [【云攻防系列】从攻击者视角聊聊K8S集群安全（下）](https://www.secpulse.com/archives/186424.html) -- Sploitus.com Exploits RSS Feed - - [ICPR Certificate Management exploit](https://sploitus.com/exploit?id=MSF:AUXILIARY-ADMIN-DCERPC-ICPR_CERT-&utm_source=rss&utm_medium=rss) -- Recent Commits to cve:main - - [Update Tue Aug 30 05:31:48 UTC 2022](https://github.com/trickest/cve/commit/f68c7910312570a2e61abf639572649f63c514db) -- Google Online Security Blog - - [Announcing Google’s Open Source Software Vulnerability Rewards Program](http://security.googleblog.com/2023/08/Announcing-Googles-Open-Source-Software-Vulnerability-Rewards-Program .html) -- Bug Bounty in InfoSec Write-ups on Medium - - [Hack With SQL Injection Attacks! DVWA medium security — StackZero](https://infosecwriteups.com/hack-with-sql-injection-attacks-dvwa-medium-security-stackzero-d4af0a9a5f9?source=rss----7b722bfd1b8d--bug_bounty) - - [SSRF — Exploitation 02](https://infosecwriteups.com/ssrf-exploitation-02-b682de16594?source=rss----7b722bfd1b8d--bug_bounty) -- Forcepoint - - [5 ½ Questions to Ask When Selecting a CDR Vendor](https://www.forcepoint.com/blog/insights/5-questions-when-selecting-cdr-vendor) -- SAP Blogs - - [2208: SAP Commissions Release Highlights](https://blogs.sap.com/2022/08/30/2208-sap-commissions-release-highlights/) - - [A Hitchhiker’s Guide to SAP Fiori User Experience and its Technologies 2.0](https://blogs.sap.com/2022/08/30/a-hitchhikers-guide-to-sap-fiori-user-experience-and-its-technologies-2.0/) - - [Testing your CAP HANA Artifacts with jest – including multitenancy, hdbprocedure and hdbview](https://blogs.sap.com/2022/08/30/testing-your-cap-hana-artifacts-with-jest-including-multitenancy-hdbprocedure-and-hdbview/) - - [Latest SAP Product Lifecycle Costing release now available in the SAP Cloud Appliance Library](https://blogs.sap.com/2022/08/30/latest-sap-product-lifecycle-costing-release-now-available-in-the-sap-cloud-appliance-library/) - - [Import OpenAPI-documented APIs remotely with SAP Cloud Application Programming Model](https://blogs.sap.com/2022/08/30/import-openapi-documented-apis-remotely-with-sap-cloud-application-programming-model/) - - [Custom Editability of UI objects dependent on User Status](https://blogs.sap.com/2022/08/30/custom-editability-of-ui-objects-dependent-on-user-status/) - - [Guest Blog Post from IDC: Electronic documents and eSignatures can help companies with their ESG journey](https://blogs.sap.com/2022/08/30/guest-blog-post-from-idc-electronic-documents-and-esignatures-can-help-companies-with-their-esg-journey/) - - [How to Download Excel From Tree Table in SAP UI5](https://blogs.sap.com/2022/08/30/how-to-download-excel-from-tree-table-in-sap-ui5/) - - [2022 Stay Current – SAP Certifications for SAP Customer Experience Solutions](https://blogs.sap.com/2022/08/30/2022-stay-current-sap-certifications-for-sap-customer-experience-solutions/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-08-30 - Follow-up traffic from Bumblebee infection](https://www.malware-traffic-analysis.net/2022/08/30/index.html) -- Application Security Blog - - [Establishing trust in your software supply chain with an SBOM](https://www.synopsys.com/blogs/software-security/establishing-trust-software-supply-chain-sbom/) -- Sucuri Blog - - [WordPress Vulnerabilities & Patch Roundup — August 2022](https://blog.sucuri.net/2022/08/wordpress-vulnerabilities-patch-roundup-august-2022.html) -- blog.avast.com EN - - [Tech knowledge: Parents believe their children have overtaken them](https://blog.avast.com/uk-back-to-school) - - [Enabling Global-Scale Digital Trust | Avast](https://blog.avast.com/global-scale-digital-trust) -- The Daily Swig | Cybersecurity news and views - - [Log4Shell legacy? Patching times plummet for most critical vulnerabilities – report](https://portswigger.net/daily-swig/log4shell-legacy-patching-times-plummet-for-most-critical-vulnerabilities-report) - - [Graph-based JavaScript bug scanner discovers more than 100 zero-day vulnerabilities in Node.js libraries](https://portswigger.net/daily-swig/graph-based-javascript-bug-scanner-discovers-more-than-100-zero-day-vulnerabilities-in-node-js-libraries) -- Reverse Engineering - - [Introduction to Patch Diffing for CTFs with Ghidra](https://www.reddit.com/r/ReverseEngineering/comments/x1nih7/introduction_to_patch_diffing_for_ctfs_with_ghidra/) -- Malwarebytes Labs - - [British Airways customers targeted in lost luggage Twitter scam](https://www.malwarebytes.com/blog/news/2022/08/steer-clear-of-lost-luggage-scams-on-twitter) - - [Chromium browsers can write to the system clipboard without your permission](https://www.malwarebytes.com/blog/news/2022/08/chromium-browsers-can-write-to-the-system-clipboard) -- KitPloit - PenTest & Hacking Tools - - [Masky - Python Library With CLI Allowing To Remotely Dump Domain User Credentials Via An ADCS Without Dumping The LSASS Process Memory](http://www.kitploit.com/2022/08/masky-python-library-with-cli-allowing.html) -- 绿盟科技技术博客 - - [绿盟终端安全系统ESS可防范”用友畅捷通T+勒索攻击“](http://blog.nsfocus.net/ess/) - - [用友畅捷通T+任意文件上传漏洞通告](http://blog.nsfocus.net/t/) -- HackerNews - - [美国联邦贸易委员会起诉数据中间商 Kochava，涉及售卖上亿手机敏感位置数据](https://hackernews.cc/archives/41216) - - [暗网上正在出售 COVID-19 患者数据](https://hackernews.cc/archives/41212) - - [CISA 在其已知漏洞目录中增加了 10 个新漏洞](https://hackernews.cc/archives/41208) - - [网传用友等头部软件厂商遭勒索攻击](https://hackernews.cc/archives/41204) - - [儿童智能手表藏风险，多管齐下护“腕上安全”](https://hackernews.cc/archives/41201) - - [美国陆军宣布招募“国家黑客”](https://hackernews.cc/archives/41198) -- 安全牛 - - [专家观点| 筑牢铁路关键信息基础设施安全保障体系](https://www.aqniu.com/homenews/88437.html) - - [国家卫建委发布《医疗卫生机构网络安全管理办法》，即日起实施](https://www.aqniu.com/homenews/88438.html) - - [简析DNS攻击的常见类型、危害与防护建议](https://www.aqniu.com/hometop/88452.html) - - [DeFi安全之杠杆挖矿](https://www.aqniu.com/vendor/88436.html) - - [案例研究丨神策数据在多项目、多网络场景下使用JumpServer堡垒机](https://www.aqniu.com/vendor/88434.html) - - [诚邀参会｜“引领数据安全创新，加速数字经济发展” 技术研讨会](https://www.aqniu.com/industry/88431.html) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 美国陆军招募“国家黑客”；特斯拉因幽灵刹车被提起集体诉讼](https://www.freebuf.com/news/343320.html) - - [国家卫健委等三部门发布《医疗卫生机构网络安全管理办法》](https://www.freebuf.com/news/343278.html) - - [美国联邦贸易委员会起诉数据中间商Kochava，涉及售卖上亿手机敏感位置数据](https://www.freebuf.com/articles/mobile/343277.html) - - [暗网上正在出售COVID-19患者数据](https://www.freebuf.com/news/343260.html) - - [损失不可估计！网传用友等头部软件厂商遭勒索攻击](https://www.freebuf.com/news/343248.html) -- 博客园 - 渗透测试中心 - - [Windows域横向渗透 - 渗透测试中心](https://www.cnblogs.com/backlion/p/16639848.html) -- Blog - Praetorian - - [NTLMv1 vs NTLMv2: Digging into an NTLM Downgrade Attack](https://www.praetorian.com/blog/ntlmv1-vs-ntlmv2/) -- 奇客Solidot–传递最新科技情报 - - [格陵兰冰盖融化难以逆转](https://www.solidot.org/story?sid=72623) - - [猴痘病毒颠覆科学家认知](https://www.solidot.org/story?sid=72622) - - [Oppo 认为未来有一天智能手机一秒钟就能充满电](https://www.solidot.org/story?sid=72621) - - [影迷和影评人的评分日益两级分化](https://www.solidot.org/story?sid=72620) - - [每天步行10分钟有助延长老年人寿命](https://www.solidot.org/story?sid=72619) - - [法国用 AI 发现未申报的私人水池](https://www.solidot.org/story?sid=72618) - - [清华大学提议用分布式 3D 打印机建造水坝](https://www.solidot.org/story?sid=72617) - - [巴基斯坦遭遇创记录洪水](https://www.solidot.org/story?sid=72616) - - [印度调查 WhatsApp 隐私政策](https://www.solidot.org/story?sid=72615) - - [Google Play 禁止 VPN 应用屏蔽广告](https://www.solidot.org/story?sid=72614) - - [研究显示迷幻药有助于减少酗酒](https://www.solidot.org/story?sid=72613) - - [研究预测八十年后会有逾五十亿人长时间经历热浪](https://www.solidot.org/story?sid=72612) - - [为节省天然气德国命令晚上关闭数字广告牌](https://www.solidot.org/story?sid=72611) - - [AMD 发布 Ryzen 7000 系列处理器](https://www.solidot.org/story?sid=72610) -- rtl-sdr.com - - [Tracking and Decoding Guide for NOAA Weather Satellites](https://www.rtl-sdr.com/tracking-and-decoding-guide-for-noaa-weather-satellites/) -- 长亭安全课堂 - - [漏洞风险提示 | 畅捷通T+远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247490371&idx=1&sn=2d13096f981f40a65e1ad68d0d2b1acb&chksm=96f4042ea1838d38f4df946c1fb0ed0ed0ea0793c2d4ebba3b54f9500de0403dbbd52c252b1d&scene=58&subscene=0#rd) -- 安全威胁情报 - - [弭患无形，重庆万国网络安全建设实践](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650173934&idx=1&sn=972e5fda0d1a17ed6ecb548999abc165&chksm=f4488a52c33f0344bfc36a1783657f410d5612a588bf69881432907680c6dc5421525911b8f9&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [关于畅捷通T+软件存在任意文件上传漏洞的安全公告](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492332&idx=1&sn=59802f822b19f53158177e6b1f68430a&chksm=fd74d225ca035b33062e86bfc04651db0ad187a2ca5fdccbb56571c38e6bae52858f25eac324&scene=58&subscene=0#rd) -- 唯品会安全应急响应中心 - - [共庆中秋，VSRC大礼包等你来拿！](https://mp.weixin.qq.com/s?__biz=MzI5ODE0ODA5MQ==&mid=2652281052&idx=1&sn=0fc2e2a02c64e018fa48120d5afcd31e&chksm=f7487148c03ff85ebdca72f344c72b956a168e252f949bae5729afd53e04253400db33f1dd48&scene=58&subscene=0#rd) -- 黑海洋 - WIKI - - [IntelliJ IDEA_2022.2.1 Ultimate 永久激活版](https://blog.upx8.com/2947) - - [NextSSH (SSH客户端) linux](https://blog.upx8.com/2946) diff --git a/archive/2022/2022-09-01.md b/archive/2022/2022-09-01.md deleted file mode 100644 index 92a3cbd103..0000000000 --- a/archive/2022/2022-09-01.md +++ /dev/null @@ -1,268 +0,0 @@ -# 每日安全资讯（2022-09-01） - -- NOSEC 安全讯息平台 - 漏洞预警 - - [【漏洞通报】GitLab CE/EE 远程命令执行漏洞（CVE-2022-299...](https://nosec.org/home/detail/5034.html) -- Security Boulevard - - [Revisiting Cybersecurity’s 2022 IPO Pipeline](https://securityboulevard.com/2022/08/revisiting-cybersecuritys-2022-ipo-pipeline/) - - [Identity Attack Watch: August 2022](https://securityboulevard.com/2022/08/identity-attack-watch-august-2022/) - - [BSides Vancouver 2022 – Ritu Gill’s ‘Online Privacy & Risk Management’](https://securityboulevard.com/2022/08/bsides-vancouver-2022-ritu-gills-online-privacy-risk-management/) - - [VMware Launches Multiple Projects to Integrate Network and Security Ops](https://securityboulevard.com/2022/08/vmware-launches-multiple-projects-to-integrate-network-and-security-ops/) - - [LogRhythm Announces More Details of Its In-Person Annual Security User Conference](https://securityboulevard.com/2022/08/logrhythm-announces-more-details-of-its-in-person-annual-security-user-conference/) - - [Your Digital User Experience is Great. But Could it Cost You Millions?](https://securityboulevard.com/2022/08/your-digital-user-experience-is-great-but-could-it-cost-you-millions/) - - [Margins Are Slim – Online Retailers Can’t Skimp on Security or Margins Might be Non-Existent](https://securityboulevard.com/2022/08/margins-are-slim-online-retailers-cant-skimp-on-security-or-margins-might-be-non-existent/) - - [Mikkel Noe-Nygaard’s & Luxshan Ratnarav’s ‘#186 – Agile Hardware Development’](https://securityboulevard.com/2022/08/mikkel-noe-nygaards-luxshan-ratnaravs-186-agile-hardware-development/) - - [Palo Alto Networks Simplifies SASE Management](https://securityboulevard.com/2022/08/palo-alto-networks-simplifies-sase-management/) -- 安全通告 - - [安全通告 - 涉及华为路由器产品的流量劫持漏洞](//www.huawei.com/cn/psirt/security-advisories/2022/huawei-sa-20220831-01-5370a6df-cn) -- Twitter @Nicolas Krassas - - [TikTok for Android Bug Allows Single-Click Account Hijack](https://twitter.com/Dinosn/status/1565014597014372352) - - [Automating Azure Abuse Research — Part 2](https://twitter.com/Dinosn/status/1564990823778979842) - - [Write-up of N-day exploit for CVE-2022-2586: Linux kernel nft_object UAF](https://twitter.com/Dinosn/status/1564970287518679040) - - [xnLinkFinder: discover endpoints for a given target](https://twitter.com/Dinosn/status/1564970221923958785) - - [Network Relaying Abuse in a Windows Domain](https://twitter.com/Dinosn/status/1564970130869821440) - - [Sandman: NTP based backdoor for red team engagements](https://twitter.com/Dinosn/status/1564944255612817409) - - [CVE-2022-26113: FortiClient Arbitrary File Write As SYSTEM](https://twitter.com/Dinosn/status/1564937914424987648) - - [Introduction to Patch Diffing for CTFs with Ghidra](https://twitter.com/Dinosn/status/1564937881420013568) - - [Bootkitting Windows Sandbox](https://twitter.com/Dinosn/status/1564937748628348929) - - [hashcathelper: Convenience tool for hashcat - crack NT hashes by taking LM hashes into account; generate analytics for cracked passwords; visualize "S...](https://twitter.com/Dinosn/status/1564937691061428225) - - [Watering Hole Attacks Push ScanBox Keylogger](https://twitter.com/Dinosn/status/1564937638825660419) - - [Hackers Use ModernLoader to Infect Systems with Stealers and Cryptominers](https://twitter.com/Dinosn/status/1564932591374958593) - - [Masky - Python Library With CLI Allowing To Remotely Dump Domain User Credentials Via An ADCS Without Dumping The LSASS Process Memory](https://twitter.com/Dinosn/status/1564915616665976840) - - [Three campaigns delivering multiple malware, including ModernLoader and XMRig miner](https://twitter.com/Dinosn/status/1564915185722310656) - - [Microsoft Azure outage knocks Ubuntu VMs offline after buggy update](https://twitter.com/Dinosn/status/1564915132051980288) - - [Russian streaming platform confirms data breach affecting 7.5M users](https://twitter.com/Dinosn/status/1564915046307840000) - - [Nitrokod Crypto Miner Hiding in Fake Microsoft and Google Translate Apps](https://twitter.com/Dinosn/status/1564914987818254336) - - [That 'clean' Google Translate app is actually Windows crypto-mining malware](https://twitter.com/Dinosn/status/1564914556991950848) - - [Chromium browsers can write to the system clipboard without your permission](https://twitter.com/Dinosn/status/1564914501144788992) - - [reinschauer - A PoC to remotely control Windows machines over Websockets.](https://twitter.com/Dinosn/status/1564914275491188737) -- paper - Last paper - - [基于深度学习的主机操作系统识别](https://paper.seebug.org/1957/) -- Sploitus.com Exploits RSS Feed - - [WordPress Core Cross Site Scripting / SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168201&utm_source=rss&utm_medium=rss) - - [Zyxel Firewall SUID Binary Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:168202&utm_source=rss&utm_medium=rss) -- Microsoft Security Blog - - [Vulnerability in TikTok Android app could lead to one-click account hijacking](https://www.microsoft.com/security/blog/2022/08/31/vulnerability-in-tiktok-android-app-could-lead-to-one-click-account-hijacking/) - - [Stop Ransomware with Microsoft Security digital event presents threat intelligence in action](https://www.microsoft.com/security/blog/2022/08/31/stop-ransomware-with-microsoft-security-digital-event-presents-threat-intelligence-in-action/) -- Files ≈ Packet Storm - - [Packet Storm New Exploits For August, 2022](https://packetstormsecurity.com/files/168209/202208-exploits.tgz) - - [Red Hat Security Advisory 2022-6248-01](https://packetstormsecurity.com/files/168208/RHSA-2022-6248-01.txt) - - [Red Hat Security Advisory 2022-6243-01](https://packetstormsecurity.com/files/168207/RHSA-2022-6243-01.txt) - - [Red Hat Security Advisory 2022-6250-01](https://packetstormsecurity.com/files/168206/RHSA-2022-6250-01.txt) - - [Ubuntu Security Notice USN-5590-1](https://packetstormsecurity.com/files/168205/USN-5590-1.txt) - - [Red Hat Security Advisory 2022-6224-01](https://packetstormsecurity.com/files/168204/RHSA-2022-6224-01.txt) - - [Ubuntu Security Notice USN-5589-1](https://packetstormsecurity.com/files/168203/USN-5589-1.txt) - - [Zyxel Firewall SUID Binary Privilege Escalation](https://packetstormsecurity.com/files/168202/zyxel_suid_cp_lpe.rb.txt) - - [WordPress Core Cross Site Scripting / SQL Injection](https://packetstormsecurity.com/files/168201/wpcore-sqlxss.txt) -- 安全客-有思想的安全新媒体 - - [CVE-2022-2992：GitLab远程代码执行漏洞通告](https://www.anquanke.com/post/id/279226) - - [院士观点| 冯登国：关键信息基础设施安全保护三大关键能力](https://www.anquanke.com/post/id/279098) - - [用友旗下畅捷通“中招”勒索病毒 企业用户被迫支付比特币“赎金”](https://www.anquanke.com/post/id/279219) - - [黑客借NASA星云图像“钓鱼”，分发恶意软件](https://www.anquanke.com/post/id/279184) - - [乌克兰打击加密货币欺诈网络犯罪集团](https://www.anquanke.com/post/id/279187) - - [可视化全链路日志追踪](https://www.anquanke.com/post/id/279016) - - [俄罗斯流媒体平台START数据泄露，波及750万用户](https://www.anquanke.com/post/id/279181) - - [印度调查 WhatsApp 隐私政策](https://www.anquanke.com/post/id/279171) - - [“两高一部”联合发布信息网络犯罪案件适用刑事诉讼程序意见](https://www.anquanke.com/post/id/279152) - - [对全网上一些JSONP蜜罐探索与识别](https://www.anquanke.com/post/id/279007) - - [关于畅捷通T+软件严重安全漏洞造成勒索攻击隐患的网络安全风险提示](https://www.anquanke.com/post/id/279174) - - [黑客叫卖北约机密资料，80GB数据要价15比特币](https://www.anquanke.com/post/id/279114) -- 先知安全技术社区 - - [利用Nginx、Tyk Gateway API和CloudFlare防火墙隐藏C2设施](https://xz.aliyun.com/t/11662) - - [域内批量获取敏感文件](https://xz.aliyun.com/t/11667) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [安全玻璃盒|浙江省公共和工业互联网攻防演练比赛荣获第一!](https://www.4hou.com/posts/gXyY) - - [设立80万元奖金池！第四届“第五空间”网络安全大赛启动报名](https://www.4hou.com/posts/03ov) - - [2022互联网岳麓峰会：长沙城市安全运营中心是全国城市的标杆](https://www.4hou.com/posts/6Vxn) - - [XCon2022议题 | All in one：基于运行时单探针插桩的代码疫苗技术](https://www.4hou.com/posts/3JrM) - - [【技术原创】Lsassy二次开发——添加dump方法](https://www.4hou.com/posts/RBME) - - [越来越多的黑客利用defi漏洞窃取加密货币](https://www.4hou.com/posts/XVXW) - - [漏洞预警|NVFlare 不可信数据的反序列化漏洞](https://www.4hou.com/posts/ZXGJ) - - [海云安个人隐私信息安全影响评估系统入选“2022年中国网络文明大会”个人信息保护创新实践案例](https://www.4hou.com/posts/50wB) - - [BCS2022第九届虎符安全训练营圆满结营 18门干货课程云端开讲](https://www.4hou.com/posts/4Kv1) -- unSafe.sh - 不安全 - - [AppSec Decoded: Addressing NIST guidelines begins with understanding your risk profile](https://buaq.net/go-124648.html) - - [James Webb telescope images used to hide malware](https://buaq.net/go-124694.html) - - [Advancing Security | The Age of AI & Machine Learning in Cybersecurity](https://buaq.net/go-124647.html) - - [利用Nginx、Tyk Gateway API和CloudFlare防火墙隐藏C2设施](https://buaq.net/go-124644.html) - - [域内批量获取敏感文件](https://buaq.net/go-124645.html) - - [Writing FreeBSD Kernel Modules in Rust](https://buaq.net/go-124646.html) - - [Awesome-Password-Cracking - A Curated List Of Awesome Tools, Research, Papers And Other Projects Related To Password Cracking And Password Security](https://buaq.net/go-124641.html) - - [Stopping Pictures from Hiding a Thousand Words—or Worse](https://buaq.net/go-124639.html) - - [How to set up an iPhone for your kids](https://buaq.net/go-124695.html) - - [FreeBuf早报 | 谷歌推出开源软件漏洞赏金计划；美国CISO年薪中位数近100万美元](https://buaq.net/go-124687.html) - - [安全玻璃盒|浙江省公共和工业互联网攻防演练比赛荣获第一!](https://buaq.net/go-124629.html) -- 跳跳糖 - 安全与分享社区 - - [浅析路由器WEB服务架构（一）](https://tttang.com/archive/1719/) -- SecWiki News - - [SecWiki News 2022-08-31 Review](http://www.sec-wiki.com/?2022-08-31) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [cr-led - Cross Site Scripting Vulnerability (XSS)](https://cxsecurity.com/issue/WLB-2022080077) - - [Linux unmap_mapping_range() Race Condition](https://cxsecurity.com/issue/WLB-2022080076) - - [Zyxel Firewall SUID Binary Privilege Escalation](https://cxsecurity.com/issue/WLB-2022080075) - - [WordPress Core Cross Site Scripting / SQL Injection](https://cxsecurity.com/issue/WLB-2022080074) -- obaby@mars - - [全国统计用区划代码和城乡划分代码[爬虫代码]【Json+CSV格式】](http://h4ck.org.cn/2022/08/%e5%85%a8%e5%9b%bd%e7%bb%9f%e8%ae%a1%e7%94%a8%e5%8c%ba%e5%88%92%e4%bb%a3%e7%a0%81%e5%92%8c%e5%9f%8e%e4%b9%a1%e5%88%92%e5%88%86%e4%bb%a3%e7%a0%81%e7%88%ac%e8%99%ab%e4%bb%a3%e7%a0%81%e3%80%90jsoncsv/) -- 先知安全技术社区 - - [利用Nginx、Tyk Gateway API和CloudFlare防火墙隐藏C2设施](https://xz.aliyun.com/t/11662) - - [域内批量获取敏感文件](https://xz.aliyun.com/t/11667) -- Real-time communications security on Communication Breakdown - Real-Time Communications Security - - [SIP ALG exploit hits Realtek SDK, our Attack Platform and holidays](https://www.rtcsec.com/newsletter/2022-08-rtcsec-news/) -- Forcepoint - - [Stopping Pictures from Hiding a Thousand Words—or Worse](https://www.forcepoint.com/blog/insights/stop-pictures-hiding-malicious-content) -- SAP Blogs - - [SAP Conversational AI – Handling Chat Partner Inputs](https://blogs.sap.com/2022/08/31/sap-conversational-ai-handling-chat-partner-inputs/) - - [Efficient Automatic Clearing Techniques of High Volume Open Items in the GR/IR Clearing Account](https://blogs.sap.com/2022/08/31/efficient-automatic-clearing-techniques-of-high-volume-open-items-in-the-gr-ir-clearing-account/) - - [Migrate SAP Fiori Application to Business Application Studio](https://blogs.sap.com/2022/08/31/migrate-sap-fiori-application-to-business-application-studio/) - - [Activate standard ODATA V2 API on S/4HANA – Consume & Test using Gateway Client](https://blogs.sap.com/2022/08/31/activate-standard-odata-v2-api-on-s-4hana-consume-test-using-gateway-client/) - - [The Cloud Mindset](https://blogs.sap.com/2022/08/31/the-cloud-mindset/) - - [SAP Business Network – value analytics](https://blogs.sap.com/2022/08/31/sap-business-network-value-analytics/) - - [SAP HANA Native Storage Extension (NSE) capabilities – Key Findings](https://blogs.sap.com/2022/08/31/sap-hana-native-storage-extension-nse-capabilities-key-findings/) - - [Executing Analysis for Office InA/MDS Request in Active/Active (Read Enabled) Environment](https://blogs.sap.com/2022/08/31/executing-analysis-for-office-ina-mds-request-in-active-active-read-enabled-environment/) - - [How to Find CDS Views Based on source table provided to ABAP Executable Program](https://blogs.sap.com/2022/08/31/how-to-find-cds-views-based-on-source-table-provided-to-abap-executable-program/) -- BREAKDEV - - [Hacked Discord - Bookmarklet Strikes Back](https://breakdev.org/hacked-discord-bookmarklet-attacks/) -- Application Security Blog - - [AppSec Decoded: Addressing NIST guidelines begins with understanding your risk profile](https://www.synopsys.com/blogs/software-security/appsec-decoded-understanding-your-risk-profile-nist-guidelines/) -- 梧桐雨blog - - [macos清理history](http://wutongyu.info/macos_del_history/) -- SpiderLabs Blog from Trustwave - - [Squiz Matrix CMS Authenticated Privilege Escalation through IDOR](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor/) -- Reverse Engineering - - [Tetsuji: Remote Code Execution on a GameBoy Colour 22 Years Later :: TheXcellerator](https://www.reddit.com/r/ReverseEngineering/comments/x2hs01/tetsuji_remote_code_execution_on_a_gameboy_colour/) -- Horizon3.ai - - [Are Your Kubernetes Clusters Configured Properly?](https://www.horizon3.ai/are-your-kubernetes-clusters-configured-properly/) - - [Healthcare Staffing Organization Puts Cybersecurity Best Practices in Place with NodeZero](https://www.horizon3.ai/healthcare-staffing-organization-puts-cybersecurity-best-practices-in-place-with-nodezero/) -- Intigriti - - [Considerations for running an internal bug bounty program](https://blog.intigriti.com/2022/08/31/considerations-for-running-an-internal-bug-bounty-program/) -- SentinelOne - - [Advancing Security | The Age of AI & Machine Learning in Cybersecurity](https://www.sentinelone.com/blog/advancing-security-the-age-of-ai-machine-learning-in-cybersecurity/) -- PortSwigger Blog - - [Burp Suite price increases](https://portswigger.net/blog/burp-suite-price-increases) -- Malwarebytes Labs - - [Malwarebytes receives highest rankings in recent third-party tests](https://www.malwarebytes.com/blog/business/2022/08/malwarebytes-receives-highest-rankings-in-recent-third-party-tests) - - [James Webb telescope images used to hide malware](https://www.malwarebytes.com/blog/news/2022/08/james-webb-telescope-images-used-to-hide-malware) - - [How to set up an iPhone for your kids](https://www.malwarebytes.com/blog/news/2022/08/how-to-set-up-ios-for-your-kids) - - [Final Fantasy 14 players targeted by QR code phishing](https://www.malwarebytes.com/blog/news/2022/08/final-fantasy-14-players-targeted-by-qr-code-phishing) -- The Daily Swig | Cybersecurity news and views - - [Three-day hackathon uncovers hundreds of bugs in Yahoo search engine tool Vespa](https://portswigger.net/daily-swig/three-day-hackathon-uncovers-hundreds-of-bugs-in-yahoo-search-engine-tool-vespa) - - [Command injection vulnerability in GitHub Pages nets bug hunter $4k](https://portswigger.net/daily-swig/command-injection-vulnerability-in-github-pages-nets-bug-hunter-4k) -- daniel.haxx.se - - [curl 7.85.0 for you](https://daniel.haxx.se/blog/2022/08/31/curl-7-85-0-for-you/) -- PortSwigger Blog - - [Burp Suite price increases](https://portswigger.net/blog/burp-suite-price-increases) -- 绿盟科技技术博客 - - [Linux提权手法实战](http://blog.nsfocus.net/linux/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 谷歌推出开源软件漏洞赏金计划；美国CISO年薪中位数近100万美元](https://www.freebuf.com/articles/343434.html) - - [影响750万用户，俄流媒体平台“START”已公开承认](https://www.freebuf.com/news/343388.html) - - [黑客利用天文望远镜拍摄的图像传播恶意软件](https://www.freebuf.com/news/343382.html) - - [FreeBuf甲方社群直播大放送](https://www.freebuf.com/articles/343288.html) -- webs3c - Latest posts - - [FAQ/Guidelines](https://webs3c.com/t/faq-guidelines/5#post_7) -- HackerNews - - [黑客使用各种恶意软件感染系统](https://hackernews.cc/archives/41235) - - [黑客利用天文望远镜拍摄的图像传播恶意软件](https://hackernews.cc/archives/41231) - - [全球著名图书馆服务公司 Baker & Taylor 遭勒索软件攻击](https://hackernews.cc/archives/41228) - - [因未告知消费者出售其个人信息，丝芙兰被罚 120 万美元](https://hackernews.cc/archives/41226) - - [俄罗斯流媒体巨头遭恶意攻击，210 万中国用户数据泄露](https://hackernews.cc/archives/41222) - - [勒索软件疑似借助用友畅捷通 T+ 传播](https://hackernews.cc/archives/41219) -- KitPloit - PenTest & Hacking Tools - - [Awesome-Password-Cracking - A Curated List Of Awesome Tools, Research, Papers And Other Projects Related To Password Cracking And Password Security](http://www.kitploit.com/2022/08/awesome-password-cracking-curated-list.html) -- rtl-sdr.com - - [KrakenSDR now Shipped to the Majority of Crowd Supply Backers](https://www.rtl-sdr.com/krakensdr-now-shipped-to-the-majority-of-crowd-supply-backers/) - - [HDFM Version 2 Released: HD Radio Live Weather and Traffic Data Decoder](https://www.rtl-sdr.com/hdfm-version-2-released-hd-radio-live-weather-and-traffic-data-decoder/) - - [Fissure: An Open Source RF Reverse Engineering Framework](https://www.rtl-sdr.com/fissure-an-open-source-rf-reverse-engineering-framework/) - - [Video on Receiving HF Signals with the RTL-SDR Blog V3](https://www.rtl-sdr.com/video-on-receiving-hf-signals-with-the-rtl-sdr-blog-v3/) -- 安全牛 - - [北信源以“一大核心、四大支撑、六大能力” 落实《关键信息基础设施安全保护条例》](https://www.aqniu.com/vendor/88539.html) - - [六方“漫”谈丨应对勒索病毒，你怕了吗？](https://www.aqniu.com/vendor/88519.html) - - [首家网络与安全厂商！Fortinet在亚马逊云科技Marketplace（中国区）上线按需付费模式（PAYG）](https://www.aqniu.com/vendor/88520.html) - - [MSP精华实录|金融行业之移动设备安全管理方案](https://www.aqniu.com/vendor/88521.html) - - [BCS2022第九届虎符安全训练营圆满结营 18门干货课程云端开讲](https://www.aqniu.com/industry/88503.html) - - [海云安个人隐私信息安全影响评估系统入选“2022年中国网络文明大会”个人信息保护创新实践案例](https://www.aqniu.com/industry/88504.html) - - [大数据技术在金融行业的应用与安全风险管理](https://www.aqniu.com/hometop/88472.html) - - [应用云上数据管理能力框架（CDMC），提升云数据安全管理能力](https://www.aqniu.com/homenews/88473.html) - - [《关于办理信息网络犯罪案件适用刑事诉讼程序若干问题的意见》正式发布](https://www.aqniu.com/homenews/88475.html) -- 黑海洋 - WIKI - - [不翻墙正常打开github网站方法](https://blog.upx8.com/2951) - - [钉钉助手 v1.4.4.3 消息防撤回虚拟定位抢红包（安卓）](https://blog.upx8.com/2949) - - [TVbox（takagen99版） TV盒子点播](https://blog.upx8.com/2948) -- 腾讯玄武实验室 - - [每日安全动态推送(08-31)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958655&idx=1&sn=b948e7fc311c545d1453ec124ded81b1&chksm=8baecde0bcd944f6265afadad4cf1495510f45edde8ea3f219af3b4cce9dc7142b9bcd9feec6&scene=58&subscene=0#rd) -- 看雪学院 - - [太猖獗！近期勒索攻击事件频发，业内人士发表见解](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458466600&idx=1&sn=eb1e689b6d017cb9275effd0bba9214e&chksm=b18e09a286f980b4edb1df59107e39a6d93ffbf6c561de8c3e0725c0ebff0ebb6ed822e14388&scene=58&subscene=0#rd) - - [WhatsApp私信协议实现记录](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458466600&idx=2&sn=686480e121b729cd45ee6d391553472e&chksm=b18e09a286f980b43f67d83fa54f8eb3b37301080d2fa9aa90f271009979cc2585bd642dffb0&scene=58&subscene=0#rd) - - [反勒索软件开发实战篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458466600&idx=3&sn=0dc051761dfcab45d740cb62c5d5aa6d&chksm=b18e09a286f980b4eee40d71f9566c68f61df82fc96ed09b31d4bcdb6947e8c757f340578095&scene=58&subscene=0#rd) -- 威努特工控安全 - - [威努特2023届秋季校园招聘全面启动](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651088795&idx=1&sn=88b9685278006fd8ec1d9571a0359889&chksm=80e67d2bb791f43d2aec0feebec4346bb60fbbdd274c8fe195e296e60e87c3d7c10c43f59962&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【资料】美国最高机密：一个隐秘的世界，正在失控](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131742&idx=1&sn=1f6a5a4a283b800ea25ba66f216b5229&chksm=f1af7864c6d8f172b63b7262a007bc3ff4753088a67966b27202312f0c819ac95ffee6ce8bd4&scene=58&subscene=0#rd) - - [【资料】战略情报从业人员手册](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131742&idx=2&sn=319be8973347f2510f75862baa43a337&chksm=f1af7864c6d8f1727607da13a3d42211be8e3455946c837ae499ba4d4dd0932e78c05e53ee6d&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [预警 | 勒索病毒来势汹汹的卷入.NET技术栈](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486135&idx=1&sn=f5503285db7f7eeda3efdd32784aee41&chksm=fa5aa45acd2d2d4c8e44bbf2429fabe5ecbd134b671a7b49e84ff1042bf3a32bbb1a720447de&scene=58&subscene=0#rd) - - [干货 | .NET 文件上传多个场景绕过预编译限制获取Shell](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486135&idx=2&sn=f1af41d20e0dcda7f516c1fb4e95071e&chksm=fa5aa45acd2d2d4c279d08ab72967105aec25be812b671080d67d2fc9bdee5036d27d484a975&scene=58&subscene=0#rd) - - [庆祝粉丝突破5K，星球最后一周特价!](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486135&idx=3&sn=12588ec0214ca7a941eafa2397ca3ce1&chksm=fa5aa45acd2d2d4cac01855580ada6f66c09ab381cf5748be9991a5770cd05040f23045ae730&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [NASA 修复航海家1号数据损坏问题](https://www.solidot.org/story?sid=72636) - - [2021 年我国研发经费投入 2.8 万亿元](https://www.solidot.org/story?sid=72635) - - [澳门提供自费 mRNA 疫苗接种](https://www.solidot.org/story?sid=72634) - - [热浪和空气污染是致命组合](https://www.solidot.org/story?sid=72633) - - [美国首次记录到与猴痘相关的死亡病例](https://www.solidot.org/story?sid=72632) - - [运行在 Telegram 之上的新闻机构](https://www.solidot.org/story?sid=72631) - - [网易收购 Quantic Dream 腾讯入股 FromSoftware](https://www.solidot.org/story?sid=72630) - - [2021 年结婚人数首次低于 800 万对](https://www.solidot.org/story?sid=72629) - - [特斯拉禁止穿亲工会T恤违法](https://www.solidot.org/story?sid=72628) - - [Google Play 禁止特朗普的 Truth Social](https://www.solidot.org/story?sid=72627) - - [一窥优麒麟操作系统](https://www.solidot.org/story?sid=72626) - - [加州新议案要求社交媒体考虑未成年人健康](https://www.solidot.org/story?sid=72625) - - [戈尔巴乔夫去世](https://www.solidot.org/story?sid=72624) -- SecIN技术平台 - - [原创 | 浅谈Agent内存马](https://mp.weixin.qq.com/s?__biz=MzI4Mzc0MTI0Mw==&mid=2247495035&idx=1&sn=52a01c84dc1608499d4dd2bf31a17103&chksm=eb84b02fdcf33939af61fc366e8b943a04a5d011e7714247c30abbb2a15e6bc39413cd821b0d&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [“深湖暗影”攻击剧本揭密，采用FontOnLake恶意软件作案](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247495957&idx=1&sn=f44bc3b5530f95782fcc5a35ecf20843&chksm=cfca9201f8bd1b17e1bb37ae53fc1f5cdfa56b66d44cc919693548206118f33da781a5ac479d&scene=58&subscene=0#rd) -- 安全威胁情报 - - [勒索软件永不眠](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650174064&idx=1&sn=fd0aa5346c70c330b87e639a951df3ef&chksm=f44889ccc33f00dad390cb85ca31132b09412df4326e969e9543f5004225780cb24d40cbeeb0&scene=58&subscene=0#rd) -- 极客公园 - - [一天卖出 1200 万，AR 眼镜怎么就「火」了？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966539&idx=1&sn=f09bc8cb859e1a849a5c317a3c2e0ebe&chksm=7e54733d4923fa2b072be2078785bac3a881a22fa8c02b9165a4ba7b3c68ee3b94946d5899e3&scene=58&subscene=0#rd) - - [潘塔纳尔，是一件很难的正经事](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966520&idx=1&sn=797a59d3591bf8a466029e0421e30076&chksm=7e5473ce4923fad8fb46521b7540cb825806a063ff24b22358323f1cffd417907ef789df91ea&scene=58&subscene=0#rd) - - [马斯克正式发函，终止收购推特；李彦宏发内部信：困难时期保持信心；日本「经营之圣」稻盛和夫逝世，终年 90 岁 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966502&idx=1&sn=50d8fd3229df9662030f58f9e1819283&chksm=7e5473d04923fac62d359fc7d2bf85cebd663743226e8d23e43942b64de442e4c46a8971a2a9&scene=58&subscene=0#rd) -- Checkmarx.com - - [First Known Phishing Attack Against PyPi Users](https://checkmarx.com/blog/first-known-phishing-attack-against-pypi-users/) -- 青藤云安全 - - [青藤&湖北电力荣获2022“闪电杯”能源行业网络安全实践案例二等奖](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650837922&idx=1&sn=799b897486dc8dc3d565f182ebffe82e&chksm=80dbf007b7ac7911c5428fbed189a98dd87b6433e042dc92570ab30a197fa726d6c07bb22f30&scene=58&subscene=0#rd) -- 中国信息安全 - - [网络强国｜建久安之势、成长治之业 习近平强调共筑网络安全防线](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164893&idx=1&sn=4c600a3ad3b0244d5e240bcd7145fb52&chksm=8b5eece4bc2965f2ffce1f345e6acecde707d46ee480f043c18d6d518883e84f37c0ae1457fe&scene=58&subscene=0#rd) - - [发布 | CNNIC发第50次《中国互联网络发展状况统计报告》](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164893&idx=2&sn=39c7d856ff77076d5a2865e2ad054c05&chksm=8b5eece4bc2965f2c43e7ced2cca81023c0052cae9aab8d32a9180b1fe58b67365f3054a5d92&scene=58&subscene=0#rd) - - [观点 | 构建更安全的医保网络服务体系](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164893&idx=3&sn=72ceda6276bbcd3aae015453649d6022&chksm=8b5eece4bc2965f2683180f55b805aadca4f617a5e8bd88d63ac8f6809f6c747f08f1199481f&scene=58&subscene=0#rd) - - [前沿 | 商业银行安全纵深防御体系探索与实践](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664164893&idx=4&sn=66dbc6aa6f8a21d7cf64f6c72928523f&chksm=8b5eece4bc2965f2c27afa234e4b04f4c7789846a34af2e8a043de92e4f1a9f6a34ba9016b20&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [【技术原创】Lsassy二次开发——添加dump方法](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549437&idx=1&sn=2219658ea9a4fa789256a6a621975540&chksm=e915d1c7de6258d1927635bb3f4708698c3f6437c9bc721dd129451725b61b67b992a01059d0&scene=58&subscene=0#rd) - - [XCon2022议题 | All in one：基于运行时单探针插桩的代码疫苗技术](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549437&idx=2&sn=050fc5a5766da892eea910fb4f0c6638&chksm=e915d1c7de6258d1a446cad3af66dba927390161747d6047f37992844a3d2292f0cec30cb095&scene=58&subscene=0#rd) - - [越来越多的黑客利用defi漏洞窃取加密货币](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549437&idx=3&sn=e22600143bef1de0f958dae29a26d10d&chksm=e915d1c7de6258d1ea00b4e22021adc9b24230d04705a33cb30bcc1955243e8b310d0b5ad67b&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [LLVM Pass PWN（上）](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496124&idx=1&sn=af2d0a9f7d60e6903423a7ca64bd76a5&chksm=fa522402cd25ad14c794209fb19dcbe5184942fb9a9e3bda4066b6ab3ddd6513f65d018473a2&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-08-31 Floo](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492600&idx=1&sn=0dc06baad198d94c66590c73ef49475c&chksm=c063cd21f71444377444bb4130084f428ddb2c6e0ef754cfb55863290fb32dff71457e0153c4&scene=58&subscene=0#rd) -- 安全牛 - - [大数据技术在金融行业的应用与安全风险管理](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118114&idx=1&sn=a9160103872169ff6e8f59eb26f85e02&chksm=bd146af18a63e3e7675278be4e8525a94b4c8638af757654e8203821cfa4f208790741a285fd&scene=58&subscene=0#rd) - - [应用云上数据管理能力框架（CDMC），提升云数据安全管理能力](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118114&idx=2&sn=ccf9cc0351f762e680a9b02291e15b91&chksm=bd146af18a63e3e7c0b356026ed9cb12a1a2de393bc4642d20e5e4008ff828b7dbf8686ad094&scene=58&subscene=0#rd) - - [《关于办理信息网络犯罪案件适用刑事诉讼程序若干问题的意见》正式发布](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118114&idx=3&sn=3f2f7a2edbd33de2cf34413a86f93310&chksm=bd146af18a63e3e76a5da7295a780af0a3b027e0ec3501c8144706e0763dc2520b7be6fb4dd6&scene=58&subscene=0#rd) -- 吴鲁加 - - [懒惰才是生产力](https://mp.weixin.qq.com/s?__biz=Mzg5NDY4ODM1MA==&mid=2247484188&idx=1&sn=2726f2b69c62aedcafe665226bf54df0&chksm=c01a8e2df76d073b0e37a1d99cda1817742c5940ead19c7f27844b169682d23e1cd8c1135d26&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [MiMi应用被植入后门，攻击安卓、iOS、Windows和macOS平台](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530767&idx=1&sn=7fbc9586e84feb20973ad3b8eb3160ce&chksm=c1e9f55ef69e7c48d649610ddc2ad7b70d45c5bb317c497c97f699eb9a49f1a8513f00630bbf&scene=58&subscene=0#rd) - - [发布 | 《中国网络诚信发展报告2022》发布 提出四条思考建议](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530767&idx=2&sn=c013233ffd2350896943a3f05b5ad6df&chksm=c1e9f55ef69e7c489e1e8018b6483d908b7031603ee035f018701389bad3694fd9df94bf2e07&scene=58&subscene=0#rd) - - [俄罗斯流媒体巨头遭恶意攻击，210万中国用户数据泄露｜俄乌冲突](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530767&idx=3&sn=114b24419d52030656cca0e0040544f6&chksm=c1e9f55ef69e7c48fbe2aa512f6f6beb3f86721701f60b66da8680b7debe28f084b073bf2853&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [基于 RTC 的全景 8K@120fps FoV 实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247498400&idx=1&sn=da9c4547cb598118c430614838e1d191&chksm=e9d33142dea4b8547a22f82cb10e760a4c0a000e04d8992f3ef8f3c7a49727e973a0943b01c1&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于GitLab存在CVE-2022-2992 RCE漏洞的风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495793&idx=1&sn=94b38eda28383d4649bc2d265774e2f4&chksm=ce96bd4ff9e13459a7cb521db67c7a142c4810c6080414ae4f360dce9ad824b86f538c0ae589&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Aug.31th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495793&idx=2&sn=99c073bc5d48cabb1a8b00c520089458&chksm=ce96bd4ff9e13459281214d3ff5c3fdc59e181ec39f56de825b1ee2ab5bb88bf3741ec0351b5&scene=58&subscene=0#rd) -- 代码卫士 - - [谷歌推出开源软件漏洞奖励计划，提振软件供应链安全](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513721&idx=1&sn=9ccc0511cb8d6c7134eb54700130f1b7&chksm=ea948713dde30e0503874ed6e5ebcd5a90933ef86048fd21466e73431420b799a861f800164a&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [【漏洞通告】GitLab远程代码执行漏洞CVE-2022-2992](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650263793&idx=1&sn=e394aa7f8ca4ad9d6d5452fe3eb6c822&chksm=f3e26a85c495e39372428fab39325dbcded441ce5dcfa9ae0c4a287d305d7b70f963fb127894&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [简析DNS攻击的常见类型、危害与防护建议](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530965&idx=1&sn=5c35152b5545c2716af43b85144acab4&chksm=fa93cf14cde44602f937581f78af1a3c9b9c08acec40383e9c00722d343a1b67ad388a3986ac&scene=58&subscene=0#rd) - - [借助DDoS，LockBit勒索软件正变得更加凶险](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530965&idx=2&sn=de38f2e67aa5d64fe2b8de4574630d71&chksm=fa93cf14cde446020bc637f2365dfcff5bf49021a104b96bd145c03626ba11e1026e7031d2e5&scene=58&subscene=0#rd) - - [北约调查导弹系统公司的暗网数据泄露](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247530965&idx=3&sn=7b3e9eab5ebfc9d1c9c8b0ef45f5503e&chksm=fa93cf14cde4460211634f9d8037bc7710a2fff4eb3a7c2cff41d9fad5a157468c4174aa2379&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-03.md b/archive/2022/2022-09-03.md deleted file mode 100644 index f7bd8c4b3c..0000000000 --- a/archive/2022/2022-09-03.md +++ /dev/null @@ -1,264 +0,0 @@ -# 每日安全资讯（2022-09-03） - -- SecWiki News - - [SecWiki News 2022-09-02 Review](http://www.sec-wiki.com/?2022-09-02) -- 安全客-有思想的安全新媒体 - - [筑牢数据出境安全防线，《数据出境安全评估办法》正式实施](https://www.anquanke.com/post/id/279455) - - [360发布《2022年上半年度中国手机安全状况报告》（数据篇）](https://www.anquanke.com/post/id/279274) - - [HTTP/3：最新版本的 HTTP](https://www.anquanke.com/post/id/279283) - - [VPN提供商因网络安全新规关闭印度服务器](https://www.anquanke.com/post/id/279393) - - [苹果发布iOS12.5.6更新，针对旧款iPhone和iPad漏洞](https://www.anquanke.com/post/id/279369) - - [Instagram蓝V？诱导数千人中招的网络钓鱼攻击](https://www.anquanke.com/post/id/279367) - - [智利政府Windows、Linux服务器遭新型勒索病毒攻击](https://www.anquanke.com/post/id/279363) - - [黑山重大网络攻击系勒索病毒，黑客要价千万美元赎金](https://www.anquanke.com/post/id/279365) - - [关于Antenna 的隐匿性部署](https://www.anquanke.com/post/id/279228) - - [自然资源部发文规范智能网联汽车测绘地理信息数据采集和管理](https://www.anquanke.com/post/id/279360) - - [又是意大利，石油巨头ENI突遭网络攻击](https://www.anquanke.com/post/id/279335) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [OX App Suite Cross Site Scripting / Command Injection](https://cxsecurity.com/issue/WLB-2022090002) - - [WordPress Netroics Blog Posts Grid 1.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090001) -- Twitter @Nicolas Krassas - - [Hive ransomware hits Damart clothing store with $2 million ransom](https://twitter.com/Dinosn/status/1565743174647160833) - - [GraphQL Batching Attacks: Turbo Intruder](https://twitter.com/Dinosn/status/1565742667346100224) - - [Aced - Tool to parse and resolve a single targeted Active Directory principal's DACL](https://twitter.com/Dinosn/status/1565742378891317254) - - [Attack infrastructure used in Cisco hack linked to Evil Corp affiliate](https://twitter.com/Dinosn/status/1565742284288794626) - - [Prynt Stealer Contains a Backdoor to Steal Victims' Data Stolen by Other Cybercriminals](https://twitter.com/Dinosn/status/1565741954150928384) - - [Warning: PyPI Feature Executes Code Automatically After Python Package Download](https://twitter.com/Dinosn/status/1565741425647575041) - - [Cops Wanted To Keep Mass Surveillance App Secret](https://twitter.com/Dinosn/status/1565741366675742720) - - [Google Chrome Bug Lets Sites Silently Overwrite System Clipboard Content](https://twitter.com/Dinosn/status/1565741149159055361) - - [Another Ransomware For Linux Likely In Development](https://twitter.com/Dinosn/status/1565741064664895489) - - [The Makings of a Successful Threat-Hunting Program](https://twitter.com/Dinosn/status/1565740849396420608) - - [Various ways to execute shellcode](https://twitter.com/Dinosn/status/1565707345581248514) - - [RT paramil: Wow got these in the mail recently & I’m speechless. They are seriously beautiful. Thank you @SynackRedTeam !!](https://twitter.com/m0ram1de/status/1565689820235476992) - - [RT Marcin Kozlowski: If you have used, use or support](https://twitter.com/marcinguy/status/1565659543127949312) - - [RT tlansec: Finished up my material for #cyberthreat22 taking place 12-13 September where I'll be talking about @Volexity's discovery of two ITW 0-day...](https://twitter.com/tlansec/status/1565627534263336960) - - [Source Code Management Attack Toolkit - Supports GitHub Enterprise, GitLab Enterprise, & Bitbucket Server](https://twitter.com/Dinosn/status/1565588217642065920) - - [Researchers analyzed a new JavaScript skimmer used by Magecart threat actors](https://twitter.com/Dinosn/status/1565570294512754689) - - [Governments Embrace Internet Shutdowns As A Form Of Control](https://twitter.com/Dinosn/status/1565570131324858369) -- Recent Commits to cve:main - - [Update Fri Sep 2 05:28:27 UTC 2022](https://github.com/trickest/cve/commit/9d6876ecc734572f0d9772f6fd5494a050d338d6) -- Files ≈ Packet Storm - - [Nmap Port Scanner 7.93](https://packetstormsecurity.com/files/168246/nmap-7.93.tar.bz2) - - [Hashcat Advanced Password Recovery 6.2.6 Source Code](https://packetstormsecurity.com/files/168245/hashcat-6.2.6.tar.gz) - - [Hashcat Advanced Password Recovery 6.2.6 Binary Release](https://packetstormsecurity.com/files/168244/hashcat-6.2.6.7z) - - [GNU Privacy Guard 2.2.39](https://packetstormsecurity.com/files/168243/gnupg-2.2.39.tar.bz2) - - [OX App Suite Cross Site Scripting / Command Injection](https://packetstormsecurity.com/files/168242/oxappsuite-xssexec.txt) - - [Ubuntu Security Notice USN-5593-1](https://packetstormsecurity.com/files/168241/USN-5593-1.txt) - - [Ubuntu Security Notice USN-5594-1](https://packetstormsecurity.com/files/168240/USN-5594-1.txt) - - [Ubuntu Security Notice USN-5587-1](https://packetstormsecurity.com/files/168239/USN-5587-1.txt) - - [Ubuntu Security Notice USN-5592-1](https://packetstormsecurity.com/files/168238/USN-5592-1.txt) - - [Ubuntu Security Notice USN-5591-3](https://packetstormsecurity.com/files/168237/USN-5591-3.txt) - - [Ubuntu Security Notice USN-5591-2](https://packetstormsecurity.com/files/168236/USN-5591-2.txt) - - [WordPress Netroics Blog Posts Grid 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/168235/wpnetroicsblogpostsgrid10-xss.txt) -- Security Boulevard - - [Multi-Factor Authentication (MFA) Is Not Enough](https://securityboulevard.com/2022/09/multi-factor-authentication-mfa-is-not-enough/) - - [Authentication in the Finance Industry: Now and Next](https://securityboulevard.com/2022/09/authentication-in-the-finance-industry-now-and-next/) - - [BSides Vancouver 2022 – Kurt Pomeroy’s ‘The Emotional Rollercoaster That Is Penetration Testing’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-kurt-pomeroys-the-emotional-rollercoaster-that-is-penetration-testing/) - - [SIEM/XDR Solutions Need to Contextualize the Attack to be accurate](https://securityboulevard.com/2022/09/siem-xdr-solutions-need-to-contextualize-the-attack-to-be-accurate/) - - [Daniel Stori’s ‘Profile Pics Vs. Real Life’](https://securityboulevard.com/2022/09/daniel-storis-profile-pics-vs-real-life-2/) - - [Hackers Hail all Taxis in Moscow — HUGE Gridlock for 3 Hours](https://securityboulevard.com/2022/09/hackers-taxi-moscow-oprussia-richixbw/) - - [GitHub Security 101: Best Practices for Securing your Repository](https://securityboulevard.com/2022/09/github-security-101-best-practices-for-securing-your-repository/) - - [Understanding NIST 800-171 & What it Means for Your Organization](https://securityboulevard.com/2022/09/understanding-nist-800-171-what-it-means-for-your-organization/) - - [This Week in Malware – A PyPI Phishing Follow-up Plus 120 Packages](https://securityboulevard.com/2022/09/this-week-in-malware-a-pypi-phishing-follow-up-plus-120-packages/) - - [French tax office uses AI to find swimming pools](https://securityboulevard.com/2022/09/french-tax-office-uses-ai-to-find-swimming-pools/) -- cloud world - - [2022 36 Open source weekly report](https://cloudsjhan.github.io/2022/09/02/2022-36-Open-source-weekly-report/) -- Sploitus.com Exploits RSS Feed - - [Zyxel Firewall SUID Binary Privilege Escalation Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37930&utm_source=rss&utm_medium=rss) - - [Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37931&utm_source=rss&utm_medium=rss) - - [WordPress Testimonial Slider and Showcase 2.2.6 Plugin - Stored XSS Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37933&utm_source=rss&utm_medium=rss) - - [Doctors Appointment System 1.0 Cross Site Scripting / SQL Injection Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-37929&utm_source=rss&utm_medium=rss) - - [WordPress Netroics Blog Posts Grid 1.0 Plugin - Stored XSS Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37932&utm_source=rss&utm_medium=rss) - - [WordPress Netroics Blog Posts Grid 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168235&utm_source=rss&utm_medium=rss) - - [Exploit for Incorrect Authorization in Powertekpdus Basic Pdu Firmware exploit](https://sploitus.com/exploit?id=94326D8A-123F-5122-9C25-03690268EDB2&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Combodo Itop exploit](https://sploitus.com/exploit?id=61E082AB-93AC-5D2B-A722-0BE09A8CFC7A&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Secureauth Impacket exploit](https://sploitus.com/exploit?id=F8FE965E-D2E3-51C2-B02B-0850AE4EB1FA&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=ACB6F5C0-7366-5D78-A7CE-F7ABD8C63974&utm_source=rss&utm_medium=rss) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [反电信网络诈骗法表决通过 奇安盘古：将推动多部门合力共同反诈](https://www.4hou.com/posts/q8or) - - [《数据出境安全评估办法》9月1日实施 企业如何保障出境合规？](https://www.4hou.com/posts/pVn6) - - [XCon2022 | macOS+混合符号执行——移植QSYM到macOS Intel平台，mac+Intel发挥余热](https://www.4hou.com/posts/mXk0) - - [PyPI 中还有两个恶意 Python 包](https://www.4hou.com/posts/MBW5) - - [Nitrokod：加密货币恶意软件分析](https://www.4hou.com/posts/WBKJ) - - [盛邦安全创始人权晓文入选IDC中国CSO名人堂十大人物](https://www.4hou.com/posts/mXkO) - - [黑灰产洗钱链条新兴技术研究与溯源打击新思路](https://www.4hou.com/posts/nJlR) - - [【安全热点】从畅捷通漏洞利用事件看勒索病毒如何防治](https://www.4hou.com/posts/l606) - - [360发布《2022年上半年度中国手机安全状况报告》（数据篇）](https://www.4hou.com/posts/oJmj) - - [2022年“数据安全”知识竞赛暨“数据安全产业发展”故事互动征集有奖活动开启](https://www.4hou.com/posts/kMg5) -- 安全脉搏 - - [【安全热点】从畅捷通漏洞利用事件看勒索病毒如何防治](https://www.secpulse.com/archives/186638.html) - - [某OA 审计小记](https://www.secpulse.com/archives/186652.html) - - [实战 | 记一次渗透拿下某儿童色情网站的经过](https://www.secpulse.com/archives/186619.html) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-sept-2) -- o0xmuhe's blog - - [HW OTA unpack](https://o0xmuhe.github.io/2022/09/02/HW-OTA-unpack/) -- 跳跳糖 - 安全与分享社区 - - [浅析XML外部实体注入](https://tttang.com/archive/1716/) -- Fox-IT International blog - - [Sharkbot is back in Google Play](https://blog.fox-it.com/2022/09/02/sharkbot-is-back-in-google-play/) -- unSafe.sh - 不安全 - - [讨论Python函数默认参数的坑(2)](https://buaq.net/go-125024.html) - - [卫星通讯手机将发布，卫星导航板块掀涨停潮，附个股](https://buaq.net/go-124993.html) - - [普通手机能直连卫星吗？](https://buaq.net/go-124992.html) - - [一年白干](https://buaq.net/go-124991.html) - - [French tax office uses AI to find swimming pools](https://buaq.net/go-125016.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 36](https://buaq.net/go-125019.html) - - [DEFCON 30 CTF Final 參加記](https://buaq.net/go-125018.html) - - [Aced - Tool to parse and resolve a single targeted Active Directory principal's DACL](https://buaq.net/go-124982.html) - - [curl’s TLS fingerprint](https://buaq.net/go-124980.html) - - [想不到居然有人在 P 站花钱？你到底花了多少啊？](https://buaq.net/go-124976.html) - - [Pandora – 管理网络付费订阅，内置 180 + 网络订阅服务[iPhone/iPad]](https://buaq.net/go-124981.html) - - [Sharkbot is back in Google Play](https://buaq.net/go-124978.html) - - [讨论Python函数默认参数的坑2.0](https://buaq.net/go-124972.html) -- SAP Blogs - - [Integration of SAP Ariba Sourcing with Qualtrics XM for Suppliers, part 3: Cloud Integration](https://blogs.sap.com/2022/09/02/integration-of-sap-ariba-sourcing-with-qualtrics-xm-for-suppliers-part-3-cloud-integration/) - - [Get onboarded on SAP Integrated Business Planning!](https://blogs.sap.com/2022/09/02/get-onboarded-on-sap-integrated-business-planning/) - - [ABAP Meshes – when and how to use them](https://blogs.sap.com/2022/09/02/abap-meshes-when-and-how-to-use-them/) - - [SAP S4/Hana ABAP RFC connection via SNC](https://blogs.sap.com/2022/09/02/sap-s4hana-abap-rfc-connection-via-snc/) - - [Guest Blog Post from IDC: Deskless workers should not be treated as less than office workers](https://blogs.sap.com/2022/09/02/guest-blog-post-from-idc-deskless-workers-should-not-be-treated-as-less-than-office-workers/) - - [It’s time to get serious about services](https://blogs.sap.com/2022/09/02/its-time-to-get-serious-about-services/) - - [Uplifting transformation capabilities – reconciling Enterprise Architecture and Business Process Management](https://blogs.sap.com/2022/09/02/uplifting-transformation-capabilities-reconciling-enterprise-architecture-and-business-process-management/) - - [Flexible workflow for Maintenance Order](https://blogs.sap.com/2022/09/02/flexible-workflow-for-maintenance-order/) - - [How To Copy SAP DMC POD Across Tenants, Plants](https://blogs.sap.com/2022/09/02/how-to-copy-sap-dmc-pod-across-tenants-plants/) -- Twitter @bytehx - - [Re @m0ram1de @SynackRedTeam Congrats man!](https://twitter.com/bytehx343/status/1565852012557869058) - - [Re @Dinosn @phyr3wall @synack @SynackRedTeam Congrats man!](https://twitter.com/bytehx343/status/1565605309707689985) -- Didier Stevens - - [Update: jpegdump.py Version 0.0.10](https://blog.didierstevens.com/2022/09/02/update-jpegdump-py-version-0-0-10/) - - [Quickpost: Standby Power Consumption Of My Bosch 18V Chargers](https://blog.didierstevens.com/2022/09/02/quickpost-standby-power-consumption-of-my-bosch-18v-chargers/) -- blog.avast.com EN - - [French tax office uses AI to find swimming pools](https://blog.avast.com/france-ai-pools) -- Hex Rays - - [Igor’s tip of the week: Season 02](https://hex-rays.com/blog/igors-tip-of-the-week-season-02/) -- Hexacorn - - [Adobe: JSX and JSXBIN files](https://www.hexacorn.com/blog/2022/09/02/adobe-jsx-and-jsxbin-files/) -- Forcepoint - - [The Answer to the Zero Trust Challenge](https://www.forcepoint.com/blog/insights/zero-trust-challenge-answer) -- Aris' Blog - - [Running Starnet2/Starnet++ with GPU on Linux](https://blog.0xbadc0de.be/archives/464) -- 梧桐雨blog - - [通过powershell获取本机存在的伪协议](http://wutongyu.info/powershell_get_agreement/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 36](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-36-4/) -- HAHWUL - - [Ruby Concurrency](https://www.hahwul.com/2022/09/02/ruby-concurrency/) -- The Daily Swig | Cybersecurity news and views - - [Bug Bounty Radar // The latest bug bounty programs for September 2022](https://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-september-2022) - - [CSRF flaw in csurf NPM package aimed at protecting against the same flaws](https://portswigger.net/daily-swig/csrf-flaw-in-csurf-npm-package-aimed-at-protecting-against-the-same-flaws) -- daniel.haxx.se - - [curl’s TLS fingerprint](https://daniel.haxx.se/blog/2022/09/02/curls-tls-fingerprint/) -- KitPloit - PenTest & Hacking Tools - - [Aced - Tool to parse and resolve a single targeted Active Directory principal's DACL](http://www.kitploit.com/2022/09/aced-tool-to-parse-and-resolve-single.html) -- Exploit-DB.com RSS Feed - - [[webapps] WordPress Plugin Netroics Blog Posts Grid 1.0 - Stored Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/51008) - - [[webapps] WordPress Plugin Testimonial Slider and Showcase 2.2.6 - Stored Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/51007) - - [[webapps] Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass](https://www.exploit-db.com/exploits/51006) -- Kaibro's blog - - [DEFCON 30 CTF Final 參加記](http://blog.kaibro.tw/2022/09/02/DEFCON-30-CTF-Final-%E5%8F%83%E5%8A%A0%E8%A8%98/) -- 体验盒子 - - [Flutter 中的组件绘制完成监听、组件生命周期和APP生命周期](https://www.uedbox.com/post/68431/) -- HackerNews - - [Ragnar Locker 声称攻击葡萄牙航空公司，并喊话数百 GB 数据将受到影响](https://hackernews.cc/archives/41281) - - [首部！《反电信网络诈骗法》通过，12 月 1 日起施行](https://hackernews.cc/archives/41278) - - [美国警方被曝利用 Fog Reveal 收集的应用数据展开大规模监视](https://hackernews.cc/archives/41272) - - [新版 macOS 悄然启用 XProtect Remediator：增强恶意软件防护](https://hackernews.cc/archives/41268) -- 绿盟科技技术博客 - - [讨论Python函数默认参数的坑2.0](http://blog.nsfocus.net/python2-0/) - - [讨论Python函数默认参数的坑](http://blog.nsfocus.net/python/) -- 奇客Solidot–传递最新科技情报 - - [美国学童语数能力大幅下降](https://www.solidot.org/story?sid=72661) - - [干细胞生成特定人类胚胎细胞](https://www.solidot.org/story?sid=72660) - - [Chrome 扩展秘密跟踪浏览历史和植入跟踪代码](https://www.solidot.org/story?sid=72659) - - [USB4 v2 支持最高 80 Gbps 的数据传输](https://www.solidot.org/story?sid=72658) - - [利用 AI 更新 MS-DOS 游戏图像](https://www.solidot.org/story?sid=72656) - - [PyPI 发现活跃半年以上的供应链攻击](https://www.solidot.org/story?sid=72655) - - [2021 年温室气体浓度和海平面高度创纪录](https://www.solidot.org/story?sid=72654) - - [跑路的加密货币交易所 Thodex CEO 被捕](https://www.solidot.org/story?sid=72653) - - [主要 VPN 服务商关闭印度服务器](https://www.solidot.org/story?sid=72652) - - [Twitter 向付费订阅用户提供编辑功能](https://www.solidot.org/story?sid=72651) - - [在发生车祸导致乘客受伤后 Cruise 召回了无人驾驶出租车](https://www.solidot.org/story?sid=72650) - - [英国挑战微软收购动视暴雪交易](https://www.solidot.org/story?sid=72649) -- FreeBuf网络安全行业门户 - - [FreeBuf周报 | 谷歌发布开源漏洞奖励计划；网传用友等头部软件厂商遭勒索攻击](https://www.freebuf.com/news/343638.html) - - [首部！《反电信网络诈骗法》通过，12月1日起施行](https://www.freebuf.com/news/343637.html) - - [黑山遭遇勒索软件攻击，黑客索要1000万美元](https://www.freebuf.com/news/343620.html) - - [月圆「识」好礼，惊喜词条彩蛋上线！](https://www.freebuf.com/fevents/343604.html) -- 安全牛 - - [网络安全周服务包来了 零门槛部署一键展示](https://www.aqniu.com/vendor/88681.html) - - [火眼金睛，教你如何识别Rug Pull项目](https://www.aqniu.com/vendor/88680.html) - - [献礼《数据安全法》一周年｜“引领数据安全创新，加速数字经济发展”技术研讨会成功举办](https://www.aqniu.com/industry/88671.html) - - [《数据出境安全评估办法》正式实施的价值分析与产业影响思考](https://www.aqniu.com/homenews/88637.html) - - [CVSS评分机制会将企业漏洞管理引入歧途吗？](https://www.aqniu.com/hometop/88638.html) - - [智能安全运营厂商众智维科技宣布完成数千万级PreA+轮融资](https://www.aqniu.com/homenews/88663.html) - - [2022网络安全宣传周即将开启，三大亮点抢先看](https://www.aqniu.com/industry/88636.html) - - [FakeTLS恶意加密流量分析](https://www.aqniu.com/vendor/88634.html) - - [2022年“数据安全”知识竞赛暨“数据安全产业发展”故事互动征集活动开启](https://www.aqniu.com/activity-meeting/88616.html) - - [远离勒索病毒 江南信安为您的财务数据带来安全防范“利器”](https://www.aqniu.com/vendor/88614.html) -- Twitter @hakivvi - - [RT Nmap Project: We're delighted to celebrate Nmap's 25th anniversary with (of course) a new release!](https://twitter.com/nmap/status/1565527702496768003) -- 奇安信病毒响应中心 - - [每周勒索威胁摘要](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247491571&idx=1&sn=87c53604b9ef000c06e4d8db81de2ba5&chksm=ec6a6fdbdb1de6cd0c83af34daa546c79fabd6adc15f23dd1902459c7040838d74286d2a0246&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [每周高级威胁情报解读(2022.08.25~09.01)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247503532&idx=1&sn=a32e5753f5cf0aa10f8f2316ea835dd7&chksm=ea6639dbdd11b0cdccd703cbfde09371409fb5520347531ccd0b05caff0f7e1005a8d8b4ec3d&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [《数据出境安全评估办法》正式实施，将会给数据安全产业带来哪些影响？](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247492191&idx=1&sn=098ad31378b89a5b7120721a90bf58b2&chksm=eaac7118dddbf80e27787bb9fd31aa7cda5677e62d722c4dea1aa17a703389f282ae127c812b&scene=58&subscene=0#rd) -- 长亭安全课堂 - - [智趣长亭 卫你安全|长亭科技2023届校园招聘火热开启](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247490393&idx=1&sn=33d40b08e7405f3b0f5c13631f00d79c&chksm=96f40434a1838d224c2a6843cc7559df9652aa80d42034430e814b507cfa246c6ad904a2dbbe&scene=58&subscene=0#rd) -- Checkmarx.com - - [Seemplicity](https://checkmarx.com/technical-partners/seemplicity/) -- 看雪学院 - - [豹趣科技，助力2022 SDC-第六届安全开发者峰会，共建安全新生态](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458467476&idx=1&sn=1db6552e5300207542ffc2356ecd94ae&chksm=b18e0c1e86f9850824c8a8084ea5e908c6ef53be4e6ef61413e56f016391c4a90311f68eb235&scene=58&subscene=0#rd) - - [四级分页下的页表自映射与基址随机化原理介绍](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458467476&idx=2&sn=aff2cb20d617269e6c936e3d1a0fa20d&chksm=b18e0c1e86f9850844ab9ed32cd6c29f6a98ac2a51479cf6f68a528f8c15f925bc2e7b3651da&scene=58&subscene=0#rd) - - [因遭勒索软件攻击，智利政府机构服务中断](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458467476&idx=3&sn=8ddd9e067f2b19b20d559044faafe213&chksm=b18e0c1e86f98508a82985efdd944c46a0b4df385685d5054e4f2fa2a1563191f95073ad6a6f&scene=58&subscene=0#rd) - - [@你，招人！本周岗位更新](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458467476&idx=4&sn=46cccfe864907ac225402a9e0a02ec79&chksm=b18e0c1e86f9850856f677809d42a7b09a9c33327c303a2bdb75bea92da536d3c0519fb44996&scene=58&subscene=0#rd) -- 电子物证 - - [【应用实例】安卓APP的AES解密](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651043828&idx=1&sn=997c004d7191b4542e4268e7e0522718&chksm=80d0f805b7a77113b2aae59554a5a157cb9dc15d89c4de05103717e3366093001a8d5967b13b&scene=58&subscene=0#rd) - - [【以技术核验为视角】区块链技术下电子证据的推定真实](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651043828&idx=2&sn=ef88f2a9bf7032b49de8c1e632282215&chksm=80d0f805b7a77113c7c3ba80b9b05202f562896d2896badfe0756ca66b2f3c6ed71c2da713f9&scene=58&subscene=0#rd) - - [【技术分享】钓鱼邮件分析溯源](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651043828&idx=3&sn=3593380f057fb7933543174addacf617&chksm=80d0f805b7a771135c652dc99186f79329d398d1d016d6940b4ddf481e2d339be05eb8246103&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [2022第三届网鼎杯 | 玄武组部分WriteUp](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496225&idx=1&sn=b98c906f38e79131864ff798762fb337&chksm=fa52279fcd25ae89871382a2e6f2f47743c2d2147bcb63757eefaba149e65effa4be216c2b78&scene=58&subscene=0#rd) -- 情报分析师 - - [【智库报告】理解美国海外部队的威慑作用243页](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515415&idx=1&sn=6b64584b9d739d46fd0466b720fb8aa0&chksm=8716899cb061008a89b3f536f753c907a9108d3ba33fa500750d88d47e855db943f490273e84&scene=58&subscene=0#rd) - - [【情报简报】FBI在海湖庄园搜索“核文件”可能是什么？](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515415&idx=2&sn=280f86d8c131feca66a8aeb598576454&chksm=8716899cb061008aaee67dc7e260207cf13ad84f7ebda66ef6f1240d0368ee0fa865f3e80f6b&scene=58&subscene=0#rd) - - [【情报课堂】区块链安全分析](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515415&idx=3&sn=f1137a8c7a5e65b69c9fc49243e3a056&chksm=8716899cb061008ab2088fb291d241b457ad3767565ab615f3b23afe7b8349eb89dfbb1a3509&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [讨论Python函数默认参数的坑(2)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486149&idx=1&sn=6d49b929be1cf91d5cf78c5d428a0add&chksm=fab2c9facdc540ec7fecbeefa33fae46ef5630421095c192a84a5323d7f2b9805d5c3e7a26e3&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [最后7天|东南大学、同济大学战队暂列字节安全AI挑战赛初赛榜首](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489653&idx=1&sn=dc998034ce2504ca89fd1286c9bbee78&chksm=fa9ee323cde96a35c1ad8637c9ab983f6d1d5534c77425c6b99928493ce468a28bd2925ee0b0&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(09-02)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958663&idx=1&sn=73dfd34751fefbef2bbdebd7cf7c3edd&chksm=8baecd18bcd9440ed983f7f9ab3857ae038d3593c74dee5f19e43d5a52d60fe35160059d4599&scene=58&subscene=0#rd) -- 安全牛 - - [CVSS评分机制会将企业漏洞管理引入歧途吗？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118294&idx=1&sn=77ed86354261bc5af0e2c80be2c8b557&chksm=bd146a058a63e313b0d99249e6a5e142fc6731dff74b8d839cb7475b42ce1b97d81ac921838c&scene=58&subscene=0#rd) - - [《数据出境安全评估办法》正式实施的价值分析与产业影响思考](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118294&idx=2&sn=998cc0191bc08bfdd38fe6e26ca1366a&chksm=bd146a058a63e3131c968d55bf2538b92755fda7842da45d228c961b744f2a3eef9a6f4195b7&scene=58&subscene=0#rd) - - [智能安全运营厂商众智维科技宣布完成数千万级PreA+轮融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118294&idx=3&sn=751677b882fa983298aa22ea6a82b0e5&chksm=bd146a058a63e313ceff01c8bfe110171242240f7cbcd4c45ac5280a0deacf1c9a59e6828556&scene=58&subscene=0#rd) -- 网安杂谈 - - [反电信网络诈骗法表决通过 12月1日起施行](https://mp.weixin.qq.com/s?__biz=MzAwMTMzMDUwNg==&mid=2650886961&idx=1&sn=a2e950b85d17a7998cf433bdcd1191ad&chksm=812eaf14b6592602c2cf7a644dc0484802614749dbe94901b14aabae74f957d01f839f2334c9&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [工业互联织密数据安全网](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531016&idx=1&sn=77a348af30a3863a7f844e7cc5c3d7f8&chksm=fa93ccc9cde445dff2d6adb070a4aa11b5bbcf99d17e9f8fce4216abbe9b4caeddc3d4f1553a&scene=58&subscene=0#rd) - - [如何做好新员工的网络安全意识培训？](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531016&idx=2&sn=a2220f901214d885d3d56983ddf1a57a&chksm=fa93ccc9cde445df370200f27aba144acd3270dd768b2a47b915af3a66421e1ceea727ec41b9&scene=58&subscene=0#rd) - - [Ragnar Locker 声称攻击葡萄牙航空公司，并喊话数百GB数据将受到影响](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531016&idx=3&sn=189ca1e70190bda3e2be5977e056d45c&chksm=fa93ccc9cde445df4acc55872828bc73d5cc4f72164519b849ebeaa465d4f3447f43402455da&scene=58&subscene=0#rd) -- 极客公园 - - [传腾讯将减持 1000 亿元股票投资；小米推烹饪机器人，能做数百道菜；《武林外传》官宣「恢复营业」| 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966642&idx=1&sn=e96361eeea362faf015a7ec7a1949765&chksm=7e5473444923fa52a1dd73980b6dca01ff42f126297a87bbb24d60cf36e9b7ac06fc0ffc9d74&scene=58&subscene=0#rd) -- 星阑科技 - - [KCon 2022议题分享：自动化API漏洞挖掘](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495520&idx=1&sn=ea128a5304514cddbb0c6d762819554f&chksm=c00742fcf770cbeab05a152a6a855aa5f18bb0a73e7e526dcaf1cad64b184decc63d879400d6&scene=58&subscene=0#rd) -- 网安寻路人 - - [《数据出境安全评估申报指南（第一版）》英文版](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495766&idx=1&sn=ed05ec1441c80bd0e7abe0a2181cded3&chksm=97e94dbca09ec4aad1abab75e0bdff3b0a291866f9865b617549c2ba68fa5f74140fb413bfb7&scene=58&subscene=0#rd) -- 默安科技 - - [默安科技登榜《2022年中胡润中国猎豹企业》](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247493797&idx=1&sn=8be54b8ed23b68de617ed5fec598caba&chksm=e93b1f87de4c96914889206ea7c25f6cfb84d2400cf4a8d73138692afcc1ae0bf1c1cd4be7b5&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【实战技巧】几种水军操控的社交账号对比分析](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131789&idx=1&sn=c35230fbe3a52b389cd175d6940d9d0a&chksm=f1af78b7c6d8f1a1519578b0c15229acb5d50a44638f8c85d2838fb44b03f41cab73c577c04d&scene=58&subscene=0#rd) -- 中国信息安全 - - [重磅 | 反电信网络诈骗法表决通过！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165027&idx=1&sn=5cd4914c5b00dd8ae19a131da5216c49&chksm=8b5eec5abc29654cd32d99cce5a55429063c1c358f7160f01c716056e97369aebe958f123563&scene=58&subscene=0#rd) - - [聚焦2022网安周 | 2022年国家网络安全宣传周将于9月5日至11日举行](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165027&idx=2&sn=6631c20ebd5d2bdb956946bf4e30673d&chksm=8b5eec5abc29654c191a6b0871357d538883476da0754586e22cb97f242ae6a9b0167900f04b&scene=58&subscene=0#rd) - - [关注 | 中央网信办部署开展“清朗·打击网络谣言和虚假信息”专项行动](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165027&idx=3&sn=3610035257442382c1a8ef0df4c7d047&chksm=8b5eec5abc29654c38bd1406fda769baf423ff5214e070d1f7c874e3fcbeff135a40a30ac439&scene=58&subscene=0#rd) - - [通知 | 中央网信办等四部门印发《数字乡村标准体系建设指南》（附全文）](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165027&idx=4&sn=3fc8b8ed587f26044ec5bdb574ae95ec&chksm=8b5eec5abc29654c44a00169cbcdec5d0c25a78d371c1e009e9af59d9333b3d429746ce45fd7&scene=58&subscene=0#rd) - - [发布 | 市场监管总局发布《药品网络销售监督管理办法》 自2022年12月1日起施行](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165027&idx=5&sn=a3c31245c9fe1ba6865ed648165305be&chksm=8b5eec5abc29654c4c7d0a7a9d72899985b604b3527a04fb9412172f04674733d0ea507189f3&scene=58&subscene=0#rd) -- Yak Project - - [值得珍藏！网络安全领域DSL的第一本白皮书](https://mp.weixin.qq.com/s?__biz=Mzk0MTM4NzIxMQ==&mid=2247489847&idx=1&sn=c0d70a4dcc354a8b1fe3af07706b489f&chksm=c2d26593f5a5ec857d3a11adc58c3e6575eef60a1a6b3ce34ffff6994d464d9da7d48ed9ab50&scene=58&subscene=0#rd) - - [找牛人写牛文！—Yakit有奖征文活动正式启动！](https://mp.weixin.qq.com/s?__biz=Mzk0MTM4NzIxMQ==&mid=2247489847&idx=2&sn=43f6f62eb88dae4abfa6363f8d1d06ae&chksm=c2d26593f5a5ec85e26412ddf656a8a90859a060ad23fca81a3fc90eae543f0d768dee8d5b30&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [2022年“数据安全”知识竞赛暨“数据安全产业发展”故事互动征集有奖活动开启](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549697&idx=1&sn=5d07e607f7f2d61d3204d16df5fbbe39&chksm=e915d33bde625a2da13e01adc1f94d8ffd42a0116e256d823b8d42b06bb605792cf21fe07951&scene=58&subscene=0#rd) - - [XCon2022议题 | macOS+混合符号执行——移植QSYM到macOS Intel平台，mac+Intel发挥余热](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549697&idx=2&sn=fbdb378b00cc4638ef1cfc391f4f8843&chksm=e915d33bde625a2d94664f24287f9185bfdd3683a698c617f12af27cb78c23332d2c10b88ed1&scene=58&subscene=0#rd) - - [Nitrokod：加密货币恶意软件分析](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549697&idx=3&sn=e0119ea701ae598584ae50d6b1b3578d&chksm=e915d33bde625a2d8716bf2b75ebc58ebf66f27ed0ed90b613ff037f89e929af11d2b468e4ae&scene=58&subscene=0#rd) - - [PyPI 中还有两个恶意 Python 包](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549697&idx=4&sn=dfab9603fbea164fcf4fed196a3efaef&chksm=e915d33bde625a2d0d29b59ff5be592f48354ecf7e086313394cde519906dd9609fa9839620e&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-04.md b/archive/2022/2022-09-04.md deleted file mode 100644 index c752d1741f..0000000000 --- a/archive/2022/2022-09-04.md +++ /dev/null @@ -1,99 +0,0 @@ -# 每日安全资讯（2022-09-04） - -- Security Boulevard - - [Log4Shell is the worst security issue of the decade: what you should do](https://securityboulevard.com/2022/09/log4shell-is-the-worst-security-issue-of-the-decade-what-you-should-do-2/) - - [BSides Vancouver 2022 – Vivek Ponnada’s ‘OT: Air-Gap Is A Myth And Cloud Is Here To Stay!’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-vivek-ponnadas-ot-air-gap-is-a-myth-and-cloud-is-here-to-stay/) - - [Log4j vulnerabilities still an issue, but CodeSec audit can help | Contrast Security](https://securityboulevard.com/2022/09/log4j-vulnerabilities-still-an-issue-but-codesec-audit-can-help-contrast-security/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Dr. Fone 4.0.8 net_updater32.exe Unquoted Service Path](https://cxsecurity.com/issue/WLB-2022090005) - - [WordPress Plugin Duplicator 1.4.7 Information Disclosure](https://cxsecurity.com/issue/WLB-2022090004) - - [TP-Link Router AX50 firmware 210730 Remote Code Execution (RCE) (Authenticated)](https://cxsecurity.com/issue/WLB-2022090003) -- Sploitus.com Exploits RSS Feed - - [Exploit for Vulnerability in Facade Ignition exploit](https://sploitus.com/exploit?id=3D2EB075-50D1-5A54-ADA0-1A3BF6A0CC42&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-2586 exploit](https://sploitus.com/exploit?id=1EF67F84-0CA0-5928-AE63-14B72E0B13B0&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [US tax agency IRS unintentionally posted private data on ~120,000 taxpayers to its website](https://twitter.com/Dinosn/status/1566156965788762117) - - [iPhone 11 w/ iBoot & iOS16 emulated on QEMU](https://twitter.com/Dinosn/status/1566152404927762432) - - [Revealed: US telcos admit to storing, handing over location data](https://twitter.com/Dinosn/status/1566152341035810816) - - [Convicted felon busted for 3D printing gun parts](https://twitter.com/Dinosn/status/1566147102048239624) - - [HTB: Noter](https://twitter.com/Dinosn/status/1566146797667508231) - - [Browser Exploitation Introduction (Stephen Sims)](https://twitter.com/Dinosn/status/1566146584114593792) - - [Chromeloader browser hijacker](https://twitter.com/Dinosn/status/1566146448848191489) - - [Fun with Windows Containers - Popping Calc](https://twitter.com/Dinosn/status/1566146376987463681) - - [Damart clothing store hit by Hive ransomware, $2 million demanded](https://twitter.com/Dinosn/status/1566069342361600001) - - [Google Chrome emergency update fixes new zero-day used in attacks](https://twitter.com/Dinosn/status/1566069285847539717) - - [Anonymous hacked Russian Yandex taxi app causing a massive traffic jam](https://twitter.com/Dinosn/status/1566069256390942720) - - [Samsung discloses a second data breach this year](https://twitter.com/Dinosn/status/1566066289155645440) -- SecWiki News - - [SecWiki News 2022-09-03 Review](http://www.sec-wiki.com/?2022-09-03) -- unSafe.sh - 不安全 - - [Announcing the Ninth Annual Flare-On Challenge | Mandiant](https://buaq.net/go-125092.html) - - [Browser Exploitation Introduction (Stephen Sims)](https://buaq.net/go-125078.html) - - [ApacheTomcatScanner - A Python Script To Scan For Apache Tomcat Server Vulnerabilities](https://buaq.net/go-125072.html) - - [FakeStandby – 保持 App 运行的同时关闭屏幕[Android]](https://buaq.net/go-125062.html) - - [无缝播放：被数字音乐「弄丢」的专辑之美](https://buaq.net/go-125064.html) - - [思科确认黑客通过员工的谷歌账户进行了网络入侵](https://buaq.net/go-125057.html) - - [寓教于乐：八款在线网络安全游戏 考验你的网络安全技能](https://buaq.net/go-125058.html) - - [皮蛋漫游播客 | Tesla vs 问界，和少数派老麦换车开一周](https://buaq.net/go-125060.html) - - [分享一下最近使用Arch Linux的感受](https://buaq.net/go-125061.html) - - [BPF 进阶笔记（五）：几种 TCP 相关的 BPF（sockops、struct_ops、header options）](https://buaq.net/go-125079.html) - - [Adobe: JSX and JSXBIN files](https://buaq.net/go-125033.html) - - [Update: jpegdump.py Version 0.0.10](https://buaq.net/go-125025.html) - - [There’s Another Hole In Your SoC: Unisoc ROM Vulnerabilities](https://buaq.net/go-125023.html) - - [Running Starnet2/Starnet++ with GPU on Linux](https://buaq.net/go-125017.html) -- ArthurChiao's Blog - - [BPF 进阶笔记（五）：几种 TCP 相关的 BPF（sockops、struct_ops、header options）](https://arthurchiao.github.io/blog/bpf-advanced-notes-5-zh/) -- No Headback - - [平台到底有什么价值](http://xargin.com/value-of-platform/) -- Recent Commits to cve:main - - [Update Sat Sep 3 05:32:18 UTC 2022](https://github.com/trickest/cve/commit/a1d8ca46ff59872445a3c1c9d67125274f8f9dc9) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [思科确认黑客通过员工的谷歌账户进行了网络入侵](https://www.4hou.com/posts/xjLq) - - [寓教于乐：八款在线网络安全游戏 考验你的网络安全技能](https://www.4hou.com/posts/BEEX) -- obaby@mars - - [WordPress 自动发布文章](http://h4ck.org.cn/2022/09/wordpress-%e8%87%aa%e5%8a%a8%e5%8f%91%e5%b8%83%e6%96%87%e7%ab%a0/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Exploiting OAuth authentication vulnerabilities Part II](https://infosecwriteups.com/exploiting-oauth-authentication-vulnerabilities-part-ii-6c150f492e62?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [SAP 分析云 2022.16版新功能抢先看](https://blogs.sap.com/2022/09/03/sap-%e5%88%86%e6%9e%90%e4%ba%91-2022.16%e7%89%88%e6%96%b0%e5%8a%9f%e8%83%bd%e6%8a%a2%e5%85%88%e7%9c%8b/) -- Reverse Engineering - - [Announcing the Ninth Annual Flare-On Challenge | Mandiant](https://www.reddit.com/r/ReverseEngineering/comments/x4xfcq/announcing_the_ninth_annual_flareon_challenge/) - - [Browser Exploitation Introduction (Stephen Sims)](https://www.reddit.com/r/ReverseEngineering/comments/x4v9zn/browser_exploitation_introduction_stephen_sims/) -- 倾旋的博客 - - [分享一下最近使用Arch Linux的感受](https://payloads.online/archivers/2022-09-03/1/) -- KitPloit - PenTest & Hacking Tools - - [ApacheTomcatScanner - A Python Script To Scan For Apache Tomcat Server Vulnerabilities](http://www.kitploit.com/2022/09/apachetomcatscanner-python-script-to.html) -- 黑海洋 - WIKI - - [克苏鲁公社（神话）](https://blog.upx8.com/2956) - - [BgSub（智能抠图）](https://blog.upx8.com/2955) -- 杨龙 - - [nginx 指定下载文件的文件名](https://www.yanglong.pro/nginx-%e6%8c%87%e5%ae%9a%e4%b8%8b%e8%bd%bd%e6%96%87%e4%bb%b6%e7%9a%84%e6%96%87%e4%bb%b6%e5%90%8d/) -- 互联网安全内参 - - [新书推荐：《身份攻击向量》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505787&idx=1&sn=d6883e1196d8bf0c68f918194be4964b&chksm=ebfa905bdc8d194dbaa95effcd34fabada62e631bf317a2178837c70c98c64685d64bc066335&scene=58&subscene=0#rd) - - [《反电信网络诈骗法》将于12月1日起施行 (附全文)](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505787&idx=2&sn=9536e4fa86986d96db65cb5916c93bad&chksm=ebfa905bdc8d194d5ed5e3fd72ff8e1c23b6d7106084f8a6f423d4c13adee277c76dc1580e9e&scene=58&subscene=0#rd) -- - - [Captain’s Log: August 2022](https://cornerpirate.com/2022/09/03/captains-log-august-2022/) -- 看雪学院 - - [基于某钉探索针对CEF框架的一些逆向思路](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458467650&idx=1&sn=480efb5a7ad648fb455d5ea65f327dce&chksm=b18e0dc886f984de654bb6da544fde9c19dca0393fcf76bfcff14c3d3a472930041d032461db&scene=58&subscene=0#rd) - - [前沿技术与干货，第六届安全开发者峰会【议题征集】进行中！早鸟票已开售！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458467650&idx=2&sn=3097b919b0c0f037c2a31719929399b7&chksm=b18e0dc886f984de4952af2b3c3127a347efce4cb4c4638effb0b96618b022aa70d85ddb1978&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [《生化奇兵无限》更新启动器导致众多问题](https://www.solidot.org/story?sid=72668) - - [韦伯望远镜首次直接拍摄到系外行星的图像](https://www.solidot.org/story?sid=72667) - - [美死亡谷记录到 53 摄氏度的九月最高气温](https://www.solidot.org/story?sid=72666) - - [欧盟计划要求智能手机平板能在五年内可维修](https://www.solidot.org/story?sid=72665) - - [三星证实部分美国用户信息被盗](https://www.solidot.org/story?sid=72664) - - [加州通过法律要求企业在招募时公布薪酬范围](https://www.solidot.org/story?sid=72663) - - [SETI 创始人 Frank Drake 去世享年 92 岁](https://www.solidot.org/story?sid=72662) -- 博客园 - 郑瀚Andrew - - [体验经济时代 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16648465.html) - - [以客户为中心的哲学 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16648504.html) -- 极客公园 - - [小米首款汽车定价或超 30 万元；华为 Mate 50 支持卫星通信；微信输入法开启测试 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966680&idx=1&sn=7ba973e9d5323cd60c19d2b7cf95c496&chksm=7e5472ae4923fbb846c156f552c7f8f43e5498f061c6c544b22ba2bee032a2f7ff8037c4620b&scene=58&subscene=0#rd) -- 情报分析师 - - [《2022年人口贩运问题报告》：柬埔寨](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515431&idx=1&sn=59ee9bf9001a600269301328ff5713b5&chksm=871689acb06100ba5a3933f0c532ed9adbf50aeb612fc7ec62fa1416ca3d34a913f6848f1e7d&scene=58&subscene=0#rd) - - [【情报课堂】犯罪分析的分类](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515431&idx=2&sn=75d9bcd17009701189c6d771c532a4e8&chksm=871689acb06100ba6085bf986e719454d59220061fb322b4135778fd4c95f0a717ca8d02f227&scene=58&subscene=0#rd) - - [如何将图像转换为全景图片](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515431&idx=3&sn=b0bf35bad1a6c2ec6a6e4b46ce6d5961&chksm=871689acb06100ba2de603af63574fc93c3ddbf9c2ec84d24ccd8c567ebb62eb1a014346b1b5&scene=58&subscene=0#rd) -- 谛听ditecting - - [谛听 工控安全月报 | 8月](https://mp.weixin.qq.com/s?__biz=MzU3MzQyOTU0Nw==&mid=2247487934&idx=1&sn=b4b569a0c28a77e78ec49405b6820092&chksm=fcc093facbb71aeccb4c0a17b91286b57b461b9669315fc6640c8de10af24a67f34607d22999&scene=58&subscene=0#rd) -- Viola后花园 - - [PANW SASE 业务的护城河](https://mp.weixin.qq.com/s?__biz=MzI2Njg1OTA3OA==&mid=2247483965&idx=1&sn=24aee2e8070fba339a157aa59e0eb875&chksm=ea86e514ddf16c02ce523f2a1cd737cfc03ae7988cc680f368798420c5bbcf34cca63ac6b6a2&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-05.md b/archive/2022/2022-09-05.md deleted file mode 100644 index 67ee53861f..0000000000 --- a/archive/2022/2022-09-05.md +++ /dev/null @@ -1,72 +0,0 @@ -# 每日安全资讯（2022-09-05） - -- SecWiki News - - [SecWiki News 2022-09-04 Review](http://www.sec-wiki.com/?2022-09-04) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [黑客出售导弹公司MBDA的机密数据，北约展开调查](https://www.4hou.com/posts/17pR) - - [暴露的 OPA 服务器可以泄漏应用程序的哪些信息](https://www.4hou.com/posts/gXM3) -- Security Boulevard - - [BSides Vancouver 2022 – Anthony Green’s And Penny Longman’s ‘How To Create A Cyber Security Culture’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-anthony-greens-and-penny-longmans-how-to-create-a-cyber-security-culture/) - - [Violence-as-a-Service: Brickings, Firebombings & Shootings for Hire](https://securityboulevard.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/) - - [NATO Countries Hit With Unprecedented Cyber Attacks](https://securityboulevard.com/2022/09/nato-countries-hit-with-unprecedented-cyber-attacks/) -- unSafe.sh - 不安全 - - [Update: oledump.py Version 0.0.70](https://buaq.net/go-125176.html) - - [CakeCTF 2022 開催記](https://buaq.net/go-125158.html) - - [Polluting Template Engine Cache via Prototype Pollution](https://buaq.net/go-125159.html) - - [青小蛙又拿出祖传种子了。](https://buaq.net/go-125155.html) - - [PicoTorrent – 一个很小的开源 BitTorrent 客户端[Windows]](https://buaq.net/go-125148.html) - - [BeatRev - POC For Frustrating/Defeating Malware Analysts](https://buaq.net/go-125149.html) - - [《安卓高级研修班》推出【看雪安卓应用安全能力认证】证书](https://buaq.net/go-125147.html) - - [App+1 | 此处插入评价：微信输入法测试版上手体验](https://buaq.net/go-125136.html) - - [黑客出售导弹公司MBDA的机密数据，北约展开调查](https://buaq.net/go-125125.html) - - [暴露的 OPA 服务器可以泄漏应用程序的哪些信息](https://buaq.net/go-125126.html) - - [任意键｜最后生还者回归；高达站立于大地；索尼独占喜减一及其他](https://buaq.net/go-125129.html) -- Twitter @Nicolas Krassas - - [Malware dev open-sources CodeRAT after being exposed](https://twitter.com/Dinosn/status/1566272358066913281) -- obaby@mars - - [秀人集爬虫 【22.09.04】【Windows】](http://h4ck.org.cn/2022/09/%e7%a7%80%e4%ba%ba%e9%9b%86%e7%88%ac%e8%99%ab-%e3%80%9022-09-04%e3%80%91%e3%80%90windows%e3%80%91/) - - [微图坊爬虫 [Chrome Support]【22.09.04】【Windows】](http://h4ck.org.cn/2022/09/%e5%be%ae%e5%9b%be%e5%9d%8a%e7%88%ac%e8%99%ab-chrome-support%e3%80%9022-09-04%e3%80%91%e3%80%90windows%e3%80%91/) -- Recent Commits to cve:main - - [Update Sun Sep 4 05:25:51 UTC 2022](https://github.com/trickest/cve/commit/b0bd9f362b4ad0b4e9b0e60f5e6406688e231e9d) -- ふるつき - - [CakeCTF 2022 開催記](https://furutsuki.hatenablog.com/entry/2022/09/05/000733) -- CTFするぞ - - [Polluting Template Engine Cache via Prototype Pollution](https://ptr-yudai.hatenablog.com/entry/2022/09/04/230612) -- Didier Stevens - - [Update: oledump.py Version 0.0.70](https://blog.didierstevens.com/2022/09/04/update-oledump-py-version-0-0-70/) -- SAP Blogs - - [How SAP Analytics Cloud Enables an Agile Delivery Model](https://blogs.sap.com/2022/09/04/how-sap-analytics-cloud-enables-an-agile-delivery-model/) - - [How to achieve fuzzy search and case insensitive search in Fiori Smart Table](https://blogs.sap.com/2022/09/04/how-to-achieve-fuzzy-search-and-case-insensitive-search-in-fiori-smart-table/) - - [Managing Stalled Workflows](https://blogs.sap.com/2022/09/04/managing-stalled-workflows/) - - [Presenting Live Session: Starting with SAP Integration Suite for Customer Experience](https://blogs.sap.com/2022/09/04/presenting-live-session-starting-with-sap-integration-suite-for-customer-experience/) - - [Develop Micronaut based GROOVY CRUDQ web application in BTP cloud foundry : Part 1](https://blogs.sap.com/2022/09/04/develop-micronaut-based-groovy-crudq-web-application-in-btp-cloud-foundry-part-1/) - - [Uncle Editable ALV Grid](https://blogs.sap.com/2022/09/04/uncle-editable-alv-grid/) - - [Extending SAP S/4 HANA On-Premise Situation Handling for Dispute Processing – Alternative to SAP Classical Background jobs](https://blogs.sap.com/2022/09/04/extending-sap-s-4-hana-on-premise-situation-handling-for-dispute-processing-alternative-to-sap-classical-background-jobs/) -- Reverse Engineering - - [Reviving the coolest scanner you’ve never heard of](https://www.reddit.com/r/ReverseEngineering/comments/x601i2/reviving_the_coolest_scanner_youve_never_heard_of/) -- Twitter @hakivvi - - [RT ptr-yudai: I found a small technique to abuse template engine with prototype pollution and made a task in CakeCTF 2022. (Since I'm not familiar wit...](https://twitter.com/ptrYudai/status/1566428369881042944) - - [RT Stefan Judis: I forgot this tool exists but @pomber's "Git History" is probably still the most convenient way to check a file's history out there. ...](https://twitter.com/stefanjudis/status/1566364745929826305) -- print("") - - [CNVD-2022-60632 畅捷通任意文件上传漏洞复现](https://www.o2oxy.cn/4104.html) -- KitPloit - PenTest & Hacking Tools - - [BeatRev - POC For Frustrating/Defeating Malware Analysts](http://www.kitploit.com/2022/09/beatrev-poc-for-frustratingdefeating.html) -- Twitter @Keiran Smith (Affix) - - [RT Janey Godley: Trolls are really, really obsessed with slagging off my hair - I think it’s great! Apparently I am either now “gay” or a “cat own...](https://twitter.com/JaneyGodley/status/1566347071908610049) -- 奇客Solidot–传递最新科技情报 - - [知乎在移动和桌面嵌入盲水印](https://www.solidot.org/story?sid=72670) - - [阿里巴巴性侵案客户二审维持原判](https://www.solidot.org/story?sid=72669) -- 关注安全技术 - - [云渗透课程试看来啦！](https://mp.weixin.qq.com/s?__biz=MzA4MDMwMjQ3Mg==&mid=2651868360&idx=1&sn=a477c0b06157f8a2c23c9946a089b588&chksm=8442b42fb3353d390af80fd6847d3c102a17d1dc3407028374420af7144de940a5b9bbccade3&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】企业员工贩卖信息三万余条获刑罚金赔款道歉](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652015608&idx=1&sn=4a7728e510617899b11905447e7db417&chksm=f36fa7b8c4182eaefaea36517cdfd6b31fbbc0e3d2ac6ef1af7af29fa7e68d110c4ae37be882&scene=58&subscene=0#rd) - - [【安全圈】思科确认黑客通过员工的谷歌账户进行了网络入侵](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652015608&idx=2&sn=b7f9d7110354e210810ed1f68184ccf0&chksm=f36fa7b8c4182eae3aa03407d516ae6ade73b705b688ccf98ffd4622bf138b142795a8899479&scene=58&subscene=0#rd) - - [【安全圈】Google为包含严重安全问题的Chrome发布紧急更新](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652015608&idx=3&sn=dea21295846081a428744a63483b7aee&chksm=f36fa7b8c4182eae3cad24d47910d834c773323800f6634b596ab284d5a241ab9378777600da&scene=58&subscene=0#rd) - - [【安全圈】意大利石油巨头 ENI 遭受网络攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652015608&idx=4&sn=b456aa9803de34676603b966b412a285&chksm=f36fa7b8c4182eae4023394f6f3885250f96cd9cfc25676b78ae04ca9fc29d9a26d0137c71e8&scene=58&subscene=0#rd) -- 奇安信CERT - - [Google Chrome 沙箱逃逸漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496892&idx=1&sn=bbe9a07e0dc92a4994baeae3e2aa429b&chksm=fe79d024c90e5932efd8d66b9775cd5e419f5e97726e8669bb9fdaf042a7ddc6cbc08aa4553c&scene=58&subscene=0#rd) -- RASP安全技术 - - [RASP漏洞防御之 XXE 漏洞](https://mp.weixin.qq.com/s?__biz=Mzg5MjQ1OTkwMg==&mid=2247484491&idx=1&sn=18f6bda7535df72efd63ae6fd03208fc&chksm=c03c8a5af74b034cacfe362d984518d2400b74ef34dda1a424665d3e9be2f4811f0dab20a265&scene=58&subscene=0#rd) -- 极客公园 - - [我去了中国最大的 Web3 聚会，发现人们想要的不是 Web3](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966747&idx=1&sn=0d93254a7ff6f2150a065a5ca300c976&chksm=7e5472ed4923fbfbe494507f9aed2618338163a53061c0da0ff8f3c6fe68d39b265805b703ea&scene=58&subscene=0#rd) - - [微软 AR 战术眼镜正式交付美军；国产「太阳能飞机」首飞成功；《指环王》美剧被批「审美降级」，口碑下降 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966746&idx=1&sn=0ab2c5bfe480aad766681bac9d1457cb&chksm=7e5472ec4923fbfad64ee2d7c4701a7674fc38e8c52c601af09fb51fbfdf09ed90633780e2df&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-06.md b/archive/2022/2022-09-06.md deleted file mode 100644 index e3ab987e02..0000000000 --- a/archive/2022/2022-09-06.md +++ /dev/null @@ -1,233 +0,0 @@ -# 每日安全资讯（2022-09-06） - -- SecWiki News - - [SecWiki News 2022-09-05 Review](http://www.sec-wiki.com/?2022-09-05) -- Sploitus.com Exploits RSS Feed - - [Apple macOS Remote Events Memory Corruption Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37936&utm_source=rss&utm_medium=rss) - - [Online Market Place Site 1.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37934&utm_source=rss&utm_medium=rss) - - [Mobile Mouse 3.6.0.4 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37937&utm_source=rss&utm_medium=rss) - - [Cisco ASA-X With FirePOWER Services Authenticated Command Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37938&utm_source=rss&utm_medium=rss) - - [Online Market Place Site 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168249&utm_source=rss&utm_medium=rss) - - [Online Market Place Site 1.0 SQL Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37935&utm_source=rss&utm_medium=rss) - - [WordPress All-in-One WP Migration 7.64 plugin - Unauthenticated Backup Download Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37939&utm_source=rss&utm_medium=rss) - - [Mobile Mouse 3.6.0.4 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168248&utm_source=rss&utm_medium=rss) - - [Online Market Place Site 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168250&utm_source=rss&utm_medium=rss) - - [Apple macOS Remote Events Memory Corruption exploit](https://sploitus.com/exploit?id=PACKETSTORM:168247&utm_source=rss&utm_medium=rss) - - [Cisco ASA-X With FirePOWER Services Authenticated Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168256&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-2639 exploit](https://sploitus.com/exploit?id=59D4903F-B387-50CB-AC2C-B34EB1920BF5&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Input Validation in Google Android exploit](https://sploitus.com/exploit?id=CD93AA9A-685C-56D3-A157-7A66942CE6F2&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Privilege Management in Microsoft exploit](https://sploitus.com/exploit?id=436B5B97-EF58-5F05-B611-815DDEF67B8A&utm_source=rss&utm_medium=rss) -- 安全客-有思想的安全新媒体 - - [代码审计之路之白盒挖掘机](https://www.anquanke.com/post/id/279501) - - [SharkBot恶意软件潜入Google Play窃取账户信息](https://www.anquanke.com/post/id/279481) - - [新型网络钓鱼诈骗，盯上美国运通卡用户](https://www.anquanke.com/post/id/279486) - - [今年第二次，三星证实部分美国用户信息被盗](https://www.anquanke.com/post/id/279484) - - [美国国税局数据泄露暴露12万纳税人个人信息](https://www.anquanke.com/post/id/279478) - - [《医疗卫生机构网络安全管理办法》政策解读](https://www.anquanke.com/post/id/279428) - - [关于西北工业大学发现美国NSA网络攻击调查报告（之一）](https://www.anquanke.com/post/id/279496) - - [VPN提供商因网络安全新规关闭印度服务器](https://www.anquanke.com/post/id/279412) - - [攻击打车APP，黑客在莫斯科制造巨大交通堵塞](https://www.anquanke.com/post/id/279475) -- Twitter @Nicolas Krassas - - [One day I'll be famous enough to be invited as well ;)](https://twitter.com/Dinosn/status/1566859622069198853) - - [Hacking my Helium Crypto Miner](https://twitter.com/Dinosn/status/1566825674320580608) - - [Shielder - How to Decrypt Manage Engine PMP Passwords for Fun and Domain Admin - a Red Teaming Tale](https://twitter.com/Dinosn/status/1566821472374558720) - - [QNAP: New DeadBolt ransomware attacks exploit Photo Station bug](https://twitter.com/Dinosn/status/1566821373938384896) - - [NATO investigates after criminals claim to be selling its stolen missile plans](https://twitter.com/Dinosn/status/1566821331643109377) - - [TikTok denies hack following leak of user data, source code](https://twitter.com/Dinosn/status/1566821284964704261) - - [Ransomware Attackers Abuse Genshin Impact Anti-Cheat System to Disable Antivirus](https://twitter.com/Dinosn/status/1566821130937171969) - - [RT raptor: Simple AS/400 Hacking (via @buherator)](https://twitter.com/0xdea/status/1566787142063251456) - - [Aura - Python Source Code Auditing And Static Analysis On A Large Scale](https://twitter.com/Dinosn/status/1566768762937909251) - - [Evading Detection: A Beginner's Guide to Obfuscation](https://twitter.com/Dinosn/status/1566754115937607683) - - [Has TikTok U.S. Been Hacked And 2 Billion Database Records Stolen?](https://twitter.com/Dinosn/status/1566751817521930240) - - [RT Bob Diachenko 🇺🇦: OK, #TikTokBreach is real. Our team analyzed publicly exposed repos to confirm partial users data leak.](https://twitter.com/MayhemDayOne/status/1566748988770066435) - - [CI/CD Goat: deliberately vulnerable CI/CD environment](https://twitter.com/Dinosn/status/1566737315262775296) - - [RT Amit Sahu: Bad binder(CVE-2019-2215) exploit on x86_64 Android](https://twitter.com/ameetsaahu/status/1566734600915013632) - - [RT Swissky @ Home : How did I miss that! This repository is amazing to emulate several attackers🤩 "A PoC that packages payloads into output conta...](https://twitter.com/pentest_swissky/status/1566727337181253633) - - [A new SharkBot variant bypassed Google Play checks again](https://twitter.com/Dinosn/status/1566699673137680384) - - [Microsoft mistakenly rated Chromium, Electron, as malware](https://twitter.com/Dinosn/status/1566688627454840832) - - [Mobile Pentesting 101 – Bypassing Biometric Authentication](https://twitter.com/Dinosn/status/1566679524443561986) - - [](https://twitter.com/Dinosn/status/1566677280851730432) -- Security Boulevard - - [Ransomware’s rise: What can be done about it](https://securityboulevard.com/2022/09/ransomwares-rise-what-can-be-done-about-it/) - - [Email Security News Round-Up [August 2022]](https://securityboulevard.com/2022/09/email-security-news-round-up-august-2022/) - - [Paul’s Security Weekly #753. “Data Integrity Lights the Way: Security With the Decentralized Web”](https://securityboulevard.com/2022/09/pauls-security-weekly-753-data-integrity-lights-the-way-security-with-the-decentralized-web/) - - [What is Flutter? Is Flutter a Good Business Prospective?](https://securityboulevard.com/2022/09/what-is-flutter-is-flutter-a-good-business-prospective/) - - [How to address IoT security challenges?](https://securityboulevard.com/2022/09/how-to-address-iot-security-challenges/) - - [Extra, Extra, VERT Reads All About It: Cybersecurity News for the Week of August 29, 2022](https://securityboulevard.com/2022/09/extra-extra-vert-reads-all-about-it-cybersecurity-news-for-the-week-of-august-29-2022/) - - [Identity Verification for Telehealth: A New Boon To The Medical Industry](https://securityboulevard.com/2022/09/identity-verification-for-telehealth-a-new-boon-to-the-medical-industry/) - - [United States Labor Day 2022](https://securityboulevard.com/2022/09/united-states-labor-day-2022/) - - [How Secure Are We?](https://securityboulevard.com/2022/09/how-secure-are-we/) -- Files ≈ Packet Storm - - [Cisco ASA-X With FirePOWER Services Authenticated Command Injection](https://packetstormsecurity.com/files/168256/cisco_asax_sfr_rce.rb.txt) - - [cryptmount Filesystem Manager 6.0](https://packetstormsecurity.com/files/168255/cryptmount-6.0.tar.gz) - - [GNUnet P2P Framework 0.17.5](https://packetstormsecurity.com/files/168254/gnunet-0.17.5.tar.gz) - - [Ubuntu Security Notice USN-5595-1](https://packetstormsecurity.com/files/168253/USN-5595-1.txt) - - [Ubuntu Security Notice USN-5596-1](https://packetstormsecurity.com/files/168252/USN-5596-1.txt) - - [Ubuntu Security Notice USN-5591-4](https://packetstormsecurity.com/files/168251/USN-5591-4.txt) - - [Online Market Place Site 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/168250/omps10-xss.txt) - - [Online Market Place Site 1.0 SQL Injection](https://packetstormsecurity.com/files/168249/omps10-sql.txt) - - [Mobile Mouse 3.6.0.4 Remote Code Execution](https://packetstormsecurity.com/files/168248/mobilemouse3604-exec.txt) - - [Apple macOS Remote Events Memory Corruption](https://packetstormsecurity.com/files/168247/naval.py.txt) -- 先知安全技术社区 - - [CVE-2020-28413 MantisBT SQL注入漏洞分析](https://xz.aliyun.com/t/11671) - - [一些BAT的XSS实例（二）进阶篇](https://xz.aliyun.com/t/11681) - - [JAVA常用框架SQL注入审计](https://xz.aliyun.com/t/11672) -- 先知安全技术社区 - - [CVE-2020-28413 MantisBT SQL注入漏洞分析](https://xz.aliyun.com/t/11671) - - [一些BAT的XSS实例（二）进阶篇](https://xz.aliyun.com/t/11681) - - [JAVA常用框架SQL注入审计](https://xz.aliyun.com/t/11672) -- Recent Commits to cve:main - - [Update Mon Sep 5 05:27:32 UTC 2022](https://github.com/trickest/cve/commit/fd35bb5f11bada859e9b9258a85e25c06e0d201b) -- unSafe.sh - 不安全 - - [CVE-2020-28413 MantisBT SQL注入漏洞分析](https://buaq.net/go-125341.html) - - [一些BAT的XSS实例（二）进阶篇](https://buaq.net/go-125342.html) - - [JAVA常用框架SQL注入审计](https://buaq.net/go-125343.html) - - [Update: translate.py Version 2.5.12](https://buaq.net/go-125344.html) - - [记一次绕过win下宝塔的disable_functions到cs上线](https://buaq.net/go-125331.html) - - [【全球经济动向】德国被断气了，中国的天然气安全吗？](https://buaq.net/go-125328.html) - - [Ransomware's rise: What can be done about it](https://buaq.net/go-125329.html) - - [Microsoft will disable Basic authentication for Exchange Online in less than a month](https://buaq.net/go-125383.html) - - [WxDatViewer - 微信聊天记录图片批量清理/查看/导出/删除工具 (解密读取电脑版 dat 文件)](https://buaq.net/go-125345.html) - - [Phishers use verified status as bait for Instagram users](https://buaq.net/go-125384.html) - - [Constant-Time Data Processing At a Secret Offset, Privacy and QUIC](https://buaq.net/go-125327.html) - - [PersistAssist: Your Persistence Assistant!](https://buaq.net/go-125314.html) - - [零零信安00SEC-D&D数据泄露报警系统正式发布](https://buaq.net/go-125315.html) - - [FreeBuf早报 | 三星承认泄露美国客户信息；苹果零日漏洞利用市售800万欧元](https://buaq.net/go-125376.html) - - [Aura - Python Source Code Auditing And Static Analysis On A Large Scale](https://buaq.net/go-125316.html) - - [Why broken access control is the most severe vulnerability](https://buaq.net/go-125298.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [零零信安00SEC-D&D数据泄露报警系统正式发布](https://www.4hou.com/posts/YXxp) - - [奋发有为|荣获“2022年网络安全优秀创新成果大赛”浙江十佳！](https://www.4hou.com/posts/XVPm) - - [360揭秘美国网络攻击西工大细节 攻克“看见”高级攻击世界性难题](https://www.4hou.com/posts/WB1g) - - [深信服何朝曦：跨越鸿沟，网络安全也要数字化转型](https://www.4hou.com/posts/O9GN) - - [XCon2022议题 | 蓝军视角剖析BYOVD实战利用](https://www.4hou.com/posts/EQyk) - - [在暗网上检查新的DawDropper银行木马滴管和DaaS](https://www.4hou.com/posts/gXQG) - - [五大看点！看透第三届国际零信任峰会的高光时刻，峰会于9月16日开幕](https://www.4hou.com/posts/JX1o) - - [恶意Chrome扩展影响140万用户](https://www.4hou.com/posts/jJB5) - - [大会抢先看丨第四届国际工业信息安全应急大会即将开启！](https://www.4hou.com/posts/xjyr) -- 安全脉搏 - - [某次红蓝对抗之Solr-RCE实战绕过](https://www.secpulse.com/archives/186737.html) - - [设置密码的10大规律和5个习惯](https://www.secpulse.com/archives/186728.html) - - [edusrc漏洞笔记（逻辑篇）](https://www.secpulse.com/archives/186696.html) -- 跳跳糖 - 安全与分享社区 - - [JAVA常用框架SQL注入审计](https://tttang.com/archive/1726/) -- FortyNorth Security Blog - - [PersistAssist: Your Persistence Assistant!](https://fortynorthsecurity.com/blog/persistassist-your-persistence-assistant/) -- Forcepoint - - [Discovering Data with Forcepoint and Wipro](https://www.forcepoint.com/blog/insights/discovering-data-forcepoint-wipro) -- Twitter @bytehx - - [RT Nicolas Krassas: 16 kinds of API anti-kill tests, 8 kinds of encryption tests, anti-sandbox tests, compilation obfuscation, packing, resource modif...](https://twitter.com/Dinosn/status/1566657116621922304) - - [RT Pethuraj M: Netlas - Discover, Research, and Monitor any Assets Available Online Search passively for open ports and vulnerabilities. » #cybersecu...](https://twitter.com/Pethuraj/status/1566629601916248064) -- SAP Blogs - - [Fieldglass Features: #6 – Review your messaging](https://blogs.sap.com/2022/09/05/fieldglass-features-6-review-your-messaging/) - - [Master Data Migration Relevancy Rules -6- BOM- Bill of Material](https://blogs.sap.com/2022/09/05/master-data-migration-relevancy-rules-6-bom-bill-of-material/) - - [Master Data Migration Relevancy Rules -5- Material master- Purchased Parts](https://blogs.sap.com/2022/09/05/master-data-migration-relevancy-rules-5-material-master-purchased-parts/) - - [Master Data Migration Relevancy Rules -4- Material master- SFG- Semi Finished Goods](https://blogs.sap.com/2022/09/05/master-data-migration-relevancy-rules-4-material-master-sfg-semi-finished-goods/) - - [Master Data Migration Relevancy Rules -3- Material master- FG-Finished Goods](https://blogs.sap.com/2022/09/05/master-data-migration-relevancy-rules-3-material-master-fg-finished-goods/) - - [Master Data Migration Relevancy Rules -2- Suppliers/Vendors](https://blogs.sap.com/2022/09/05/master-data-migration-relevancy-rules-2-active-suppliers/) - - [Master Data Migration Relevancy Rules -1- Customers](https://blogs.sap.com/2022/09/05/master-data-migration-relevancy-rules-1-customers/) - - [SAP Fiori for SAP S/4HANA – Feature Comparison Best Practice](https://blogs.sap.com/2022/09/05/sap-fiori-for-sap-s-4hana-feature-comparison-best-practice/) - - [Import CSV\Flat file to Hana Database](https://blogs.sap.com/2022/09/05/import-csvflat-file-to-hana-database/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Why broken access control is the most severe vulnerability](https://infosecwriteups.com/why-broken-access-control-is-the-most-severe-vulnerability-2223baf9bb48?source=rss----7b722bfd1b8d--bug_bounty) -- blog.avast.com EN - - [Ransomware's rise: What can be done about it](https://blog.avast.com/rise-of-ransomware) -- Securelist - - [The nature of cyber incidents](https://securelist.com/the-nature-of-cyber-incidents/107119/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/x69jye/rreverseengineerings_weekly_questions_thread/) -- Didier Stevens - - [Update: translate.py Version 2.5.12](https://blog.didierstevens.com/2022/09/05/update-translate-py-version-2-5-12/) -- The Daily Swig | Cybersecurity news and views - - [Squiz Matrix CMS squashes admin account takeover bug](https://portswigger.net/daily-swig/squiz-matrix-cms-squashes-admin-account-takeover-bug) -- daniel.haxx.se - - [A bug that was 23 years old or not](https://daniel.haxx.se/blog/2022/09/05/a-bug-that-was-23-years-old-or-not/) -- Malwarebytes Labs - - [Zero-day puts a dent in Chrome's mojo](https://www.malwarebytes.com/blog/news/2022/09/update-chrome-asap-a-new-zero-day-is-already-being-exploited) - - [Microsoft will disable Basic authentication for Exchange Online in less than a month](https://www.malwarebytes.com/blog/news/2022/09/microsoft-to-disable-basic-auth-for-exchange-online-in-less-than-a-month) - - [Phishers use verified status as bait for Instagram users](https://www.malwarebytes.com/blog/news/2022/09/phishers-use-verified-status-as-bait-for-instagram-users) - - [A week in security (August 29 - September 4)](https://www.malwarebytes.com/blog/news/2022/09/a-week-in-security-august-29-september-4) -- 小草窝博客 - - [sliver c2代码的学习.md](https://x.hacking8.com/post-445.html) -- Security Café - - [Mobile Pentesting 101 – Bypassing Biometric Authentication](https://securitycafe.ro/2022/09/05/mobile-pentesting-101-bypassing-biometric-authentication/) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（2022.08.29-2022.09.04）](http://blog.nsfocus.net/weeklyreport36/) -- KitPloit - PenTest & Hacking Tools - - [Aura - Python Source Code Auditing And Static Analysis On A Large Scale](http://www.kitploit.com/2022/09/aura-python-source-code-auditing-and.html) -- 安全牛 - - [奋发有为|荣获“2022年网络安全优秀创新成果大赛”浙江十佳！](https://www.aqniu.com/industry/88783.html) - - [深信服何朝曦：跨越鸿沟，网络安全也要数字化转型](https://www.aqniu.com/industry/88774.html) - - [2022年国家网络安全宣传周盛大开幕](https://www.aqniu.com/hometop/88765.html) - - [CVERC：网络攻击西北工业大学的源头系美国国家安全局](https://www.aqniu.com/homenews/88767.html) - - [安全头条 | 中央网信办部署开展“清朗·打击网络谣言和虚假信息”专项行动；反电信网络诈骗法表决通过](https://www.aqniu.com/homenews/88766.html) - - [五大看点！看透第三届国际零信任峰会的高光时刻，峰会于9月16日开幕](https://www.aqniu.com/industry/88755.html) - - [2022国家网络安全宣传周开幕！联通数科重磅亮相](https://www.aqniu.com/industry/88704.html) - - [安芯有你 共创未来 | 安芯网盾2023秋季校园招聘全面启动](https://www.aqniu.com/%e7%89%9b%e8%81%98/88721.html) - - [2022世界人工智能高端对话，首发网络安全保险科技谱图](https://www.aqniu.com/industry/88703.html) - - [SharkTeam：十大智能合约安全威胁之重入攻击](https://www.aqniu.com/vendor/88702.html) - - [以安全赋能企业数字化发展，星阑科技亮相2022服贸会](https://www.aqniu.com/vendor/88695.html) -- 奇客Solidot–传递最新科技情报 - - [地壳在地球穿越银河悬臂时形成速度更快](https://www.solidot.org/story?sid=72682) - - [腾讯开发 3A 游戏的雄心](https://www.solidot.org/story?sid=72681) - - [海底数据中心准备年内开业](https://www.solidot.org/story?sid=72680) - - [360 报告称 NSA 攻击了西北工业大学](https://www.solidot.org/story?sid=72679) - - [Cloudflare 停止为极右翼网站提供服务](https://www.solidot.org/story?sid=72678) - - [计算机科学家 Peter Eckersley 去世](https://www.solidot.org/story?sid=72677) - - [四川发生 6.8 级地震](https://www.solidot.org/story?sid=72676) - - [Arti 1.0.0 释出](https://www.solidot.org/story?sid=72675) - - [供应链正转移到东南亚和南亚](https://www.solidot.org/story?sid=72674) - - [中国二季度碳排放量下降 8%](https://www.solidot.org/story?sid=72673) - - [《指环王：力量之戒》 首映吸引逾 2500 万人观看](https://www.solidot.org/story?sid=72672) - - [华为新手机将支持北斗短报文通信](https://www.solidot.org/story?sid=72671) -- HackerNews - - [虚假防病毒和清洁应用程序安装 SharkBot Android 银行木马](https://hackernews.cc/archives/41310) - - [攻击源头系美国国家安全局，西北工业大学遭网络攻击事件报告发布](https://hackernews.cc/archives/41307) - - [美国国税局意外泄露了 12 万纳税人机密信息](https://hackernews.cc/archives/41305) - - [谷歌发布紧急 Chrome 更新以修复新的零日漏洞](https://hackernews.cc/archives/41300) - - [出于“对人类生命的直接威胁” Cloudflare 宣布屏蔽 Kiwi Farms](https://hackernews.cc/archives/41297) - - [新发现的浏览器漏洞允许覆盖剪贴板内容，可能严重影响加密货币安全](https://hackernews.cc/archives/41292) - - [俄罗斯叫车服务 Yandex Taxi 遭恶意下单，导致交通严重拥堵](https://hackernews.cc/archives/41290) -- Misaki's Blog - - [HTB Challenges Mobile](https://misakikata.github.io/2022/09/HTB-Challenges-Mobile/) -- 90Sec - 最新话题 - - [记一次绕过win下宝塔的disable_functions到cs上线](https://forum.90sec.com/t/topic/2172) -- 雷神众测 - - [雷神众测漏洞周报2022.08.29-2022.09.04-4](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652499490&idx=1&sn=754ae03073da4e0d54b7817a64381466&chksm=f2584d91c52fc487b14aa8f325e426dc528ccda1546976ad25a7b7109c37ae8ffd9a15d5686b&scene=58&subscene=0#rd) -- 黑海洋 - WIKI - - [Stable Diffusion AI文字生成图片](https://blog.upx8.com/2960) - - [ToonME 在线生成漫画头像（免费卡通动漫头像生成器）](https://blog.upx8.com/2959) - - [亚马逊AWS S3存储文件公网直接访问设置（只需一步）](https://blog.upx8.com/2957) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220905期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530906&idx=1&sn=79cf30c35708e21b8f511d1ed2f65ab9&chksm=c1e9f5cbf69e7cdd00da8daaeecb052c9e2ad70407096d522528b27e7910fad9a494f1f659bf&scene=58&subscene=0#rd) - - [又来编了：中国黑客窃取印度疫苗机密，以挽回“落后印度”的局面？](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530906&idx=2&sn=3ba547c2602b3e95a59ad0a2d538e4a7&chksm=c1e9f5cbf69e7cddb0a8ae3ae28b6b94855f98ead1e99a20bf7b2eec467e52a86549b0678a60&scene=58&subscene=0#rd) - - [西北工业大学遭网络攻击，源头系美国国家安全局](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530906&idx=3&sn=4d11f8b71ccfa4c89e393f56a503d960&chksm=c1e9f5cbf69e7cddd13989b76afd0acef4d8658333d9114e000aa7d2e2ae703032803e43f32b&scene=58&subscene=0#rd) - - [《移动互联网应用程序SDK安全技术要求及测试方法》正式发布](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530906&idx=4&sn=f0b29e30eeb634e06dc94be67648f926&chksm=c1e9f5cbf69e7cdd7b846c684010122a46cea3a4b2da8719c990ce4f34516dbde7fdbbe6fc52&scene=58&subscene=0#rd) - - [黑客利用天文望远镜拍摄的图像传播恶意软件](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530906&idx=5&sn=0ad40a2fcde6c6ce1eec757f2aa6df72&chksm=c1e9f5cbf69e7cddab20a86d3b379f17f57743b3d93f60c27ea190c9d5e36fd64f5c134fd835&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [递归MMIO导致的虚拟机逃逸研究](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496245&idx=1&sn=3e838a9d65799c04d50ff3f4da5a3d8e&chksm=fa52278bcd25ae9dec8a17bdf62ce1ecf73eb6bdf40c823afe06205012d04065f9b23bbaf0a1&scene=58&subscene=0#rd) -- 极客公园 - - [无人机物流发展简史](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966789&idx=1&sn=8b2bf9c91262bb73704f1df76cdc43ce&chksm=7e5472334923fb252778ff86f701e70aa5883057f41fb256cc7cd8e690347eac60d8cc654ef2&scene=58&subscene=0#rd) - - [NASA：下周再决定新一代登月火箭发射时间；抖音上线 Mac 客户端；《艾尔登法环》推出搞笑衍生漫画 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966776&idx=1&sn=9211f1197aaa2f35687bd558339a29db&chksm=7e5472ce4923fbd8e887d7ddd14b895bb5660c429148e9069bdab9b99c8c82621360fd9e54cf&scene=58&subscene=0#rd) -- 安全牛 - - [2022年国家网络安全宣传周盛大开幕](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118346&idx=1&sn=12aed0fb9b51e3f76b846ce55e93e1c8&chksm=bd146bd98a63e2cf33e298562a434f5f96e0a89ca69a5dcac7741b9793901eaac9c45b38c047&scene=58&subscene=0#rd) - - [CVERC：网络攻击西北工业大学的源头系美国国家安全局](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118346&idx=2&sn=5d7dd5acdc22c6c1b9b16bed04610a9b&chksm=bd146bd98a63e2cf19537e0b6153160a6806e1dc80d766766937ac004200ba3b1acae8a53923&scene=58&subscene=0#rd) - - [安全头条 | 中央网信办部署开展“清朗·打击网络谣言和虚假信息”专项行动；反电信网络诈骗法表决通过](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118346&idx=3&sn=5403fe6d0f605eaac7a3c7d5416bcd69&chksm=bd146bd98a63e2cfd60307d19f5909add69849460d9db8029e74a34100fc3211e2f696c168ad&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [西北工业大学遭网络攻击，源头系美国国家安全局](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531084&idx=1&sn=f22c70c4f50ed19a511f390cd81811a5&chksm=fa93cc8dcde4459b9b72a7d7b65b7fb323e0c855dfe33ff5d0d5ba5691f6cd62d61245520869&scene=58&subscene=0#rd) - - [又来编了：中国黑客窃取印度疫苗机密，以挽回“落后印度”的局面？](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531084&idx=2&sn=ce8dfc4aa1f5778f2e658233c835d21d&chksm=fa93cc8dcde4459bab2d37182cd5ab6b9a91a6b162553f586946b542094e8832225f23eef043&scene=58&subscene=0#rd) - - [国家工程研究中心安全资讯周报20220905期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531084&idx=3&sn=bf12081c0fb873ab667b367385253422&chksm=fa93cc8dcde4459b9316277d817041b48a606fc6db441b4d4dcef12d69b45709ffe572d0f4a1&scene=58&subscene=0#rd) - - [意大利石油巨头 ENI 遭受网络攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531084&idx=4&sn=bfd1c2a423b443aca575e95fca42581a&chksm=fa93cc8dcde4459b151d7b649b2b28ccdffb9af2dd878dd3b003f1fac948cd778ea83c045acb&scene=58&subscene=0#rd) - - [黑客出售导弹公司MBDA的机密数据，北约展开调查](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531084&idx=5&sn=13933a3449b10623a8d59de27ceefefa&chksm=fa93cc8dcde4459be3db3a5373bd0bb4cfa6905c532f07e856d2168bbc3e6bf6c401cddaecfa&scene=58&subscene=0#rd) -- 奇安信CERT - - [安全热点周报|第二百六十期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496897&idx=1&sn=6f52f6582e6b449d52b4bcc3c6ff8e10&chksm=fe79d059c90e594f63bb503ff544043d7991204b886736b9acbcaef5072aef8e110ceb71f696&scene=58&subscene=0#rd) -- Tide安全团队 - - [潮影webshell在线免杀功能上线](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247500314&idx=1&sn=b202533429f9b6f0832843752d19376b&chksm=ce5de07bf92a696d5cb742d5baa644dbd5ec0d864cfc13e1528b72ec207a51fbe8f619188d8b&scene=58&subscene=0#rd) -- 朴实无华lake2 - - [十几年如一日地维护一款免费安全软件是什么感受 —— D盾防火墙](https://mp.weixin.qq.com/s?__biz=Mzg4NTc0MjAwMg==&mid=2247484141&idx=1&sn=746cd1c6fe2c07ecd26a9305a4778f88&chksm=cfa50230f8d28b264fa80aef016947558c2a48ff9201ebc31d14aab72f1fddc4e2471a0ff93d&scene=58&subscene=0#rd) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 三星承认泄露美国客户信息；苹果零日漏洞利用市售800万欧元](https://www.freebuf.com/articles/343804.html) - - [WINGFUZZ SaaS：在线智能模糊测试](https://www.freebuf.com/news/343802.html) - - [俄罗斯打车软件 Yandex  被黑，造成莫斯科交通堵塞](https://www.freebuf.com/news/343776.html) - - [攻击源头系美国国家安全局，西北工业大学遭网络攻击事件报告发布](https://www.freebuf.com/news/343770.html) - - [美国国税局意外泄露了 12 万纳税人机密信息](https://www.freebuf.com/news/343749.html) diff --git a/archive/2022/2022-09-07.md b/archive/2022/2022-09-07.md deleted file mode 100644 index f6fea88422..0000000000 --- a/archive/2022/2022-09-07.md +++ /dev/null @@ -1,265 +0,0 @@ -# 每日安全资讯（2022-09-07） - -- Sukka's Blog - - [React 为什么重新渲染](https://blog.skk.moe/post/react-re-renders-101/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Apple macOS Remote Events Memory Corruption](https://cxsecurity.com/issue/WLB-2022090011) - - [Cisco ASA-X With FirePOWER Services Authenticated Command Injection](https://cxsecurity.com/issue/WLB-2022090010) - - [Online Market Place Site 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022090009) - - [123elf Project Buffer Overflow](https://cxsecurity.com/issue/WLB-2022090008) - - [Online Employee Leave Management System 1.0 Cross Site Request Forgery](https://cxsecurity.com/issue/WLB-2022090007) - - [Wifi HD Wireless Disk Drive 11 Local File Inclusion](https://cxsecurity.com/issue/WLB-2022090006) -- 安全客-有思想的安全新媒体 - - [邮件钓鱼背后操控的缅北魔方G组织](https://www.anquanke.com/post/id/279371) - - [黑客滥用Genshin Impact反作弊系统，为勒索软件“开绿灯”](https://www.anquanke.com/post/id/279604) - - [警惕！SharkBot Android银行木马假冒防病毒和清洁应用](https://www.anquanke.com/post/id/279601) - - [CVE-2022-3075：Google Chrome远程代码执行漏洞通告](https://www.anquanke.com/post/id/279568) - - [EvilProxy 高级网络钓鱼策略工具，可让黑客绕过身份验证](https://www.anquanke.com/post/id/279597) - - [安全事件周报 (08.29-09.04)](https://www.anquanke.com/post/id/279546) - - [《2022上半年网络安全漏洞态势观察》发布](https://www.anquanke.com/post/id/279583) - - [新型数据中心网络安全体系研究](https://www.anquanke.com/post/id/279509) - - [勒索团伙LockBit 3.0成员称将招募更多日本人](https://www.anquanke.com/post/id/279576) - - [360公司：关于西北工业大学发现美国NSA网络攻击调查报告（之一）](https://www.anquanke.com/post/id/279556) - - [韩警方调查政府YouTube官方频道遭黑客攻击事件](https://www.anquanke.com/post/id/279571) -- unSafe.sh - 不安全 - - [亏掉几十亿的币印，却焊死了矿工的车门？](https://buaq.net/go-125488.html) - - [红队开发基础-基础免杀(四)](https://buaq.net/go-125497.html) - - [揭开新型窃密软件的面纱：伪装成CDR画图应用安装包](https://buaq.net/go-125498.html) - - [Linux提权基础分享和讨论](https://buaq.net/go-125499.html) -- Twitter @Nicolas Krassas - - [Sharkbot is back in Google Play](https://twitter.com/Dinosn/status/1567240625006813189) - - [Re @TupleType Not from my side yet but I hope there will be plenty soon from the community!](https://twitter.com/Dinosn/status/1567216032900595715) - - [The Lessons to Learn from Nomad Crypto Hack](https://twitter.com/Dinosn/status/1567209413127147520) - - [New Linux malware evades detection using multi-stage deployment](https://twitter.com/Dinosn/status/1567208933881778179) - - [InterContinental Hotels Group cyberattack disrupts booking systems](https://twitter.com/Dinosn/status/1567207912744914967) - - [Zyxel releases new NAS firmware to fix critical RCE vulnerability](https://twitter.com/Dinosn/status/1567207871372197889) - - [Newly discovered cyberspy crew targets Asian governments and corporations](https://twitter.com/Dinosn/status/1567207818771431427) - - [Anatomy of an exploit in Windows win32k - CVE-2022-21882 - Avira Blog](https://twitter.com/Dinosn/status/1567139580616245248) - - [TikTok Denies Data Breach After Hackers Claim Stealing 2 Billion Records](https://twitter.com/Dinosn/status/1567139516913262592) - - [TA505 Hackers Using TeslaGun Panel to Manage ServHelper Backdoor Attacks](https://twitter.com/Dinosn/status/1567139144526069760) - - [New EvilProxy Phishing Service Allowing Cybercriminals to Bypass 2-Factor Security](https://twitter.com/Dinosn/status/1567138963827134464) - - [ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current stat...](https://twitter.com/Dinosn/status/1567109903227011072) - - [Re @clintgibler](https://twitter.com/Dinosn/status/1567100358433951744) - - [RT floyd: I added a feature that prevents same size error responses with a random looking string to clutter the list. The response size is also a new ...](https://twitter.com/floyd_ch/status/1567096519861436418) - - [Re @ant0inet It's a good idea though. Nice way of thinking there.](https://twitter.com/Dinosn/status/1567084593492246529) - - [Analysis of an Encoded Cobalt Strike Beacon, (Tue, Sep 6th)](https://twitter.com/Dinosn/status/1567080538011222017) -- 先知安全技术社区 - - [红队开发基础-基础免杀(四)](https://xz.aliyun.com/t/11659) - - [揭开新型窃密软件的面纱：伪装成CDR画图应用安装包](https://xz.aliyun.com/t/11653) - - [Linux提权基础分享和讨论](https://xz.aliyun.com/t/11664) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5597-1](https://packetstormsecurity.com/files/168264/USN-5597-1.txt) - - [Ubuntu Security Notice USN-5600-1](https://packetstormsecurity.com/files/168263/USN-5600-1.txt) - - [Ubuntu Security Notice USN-5599-1](https://packetstormsecurity.com/files/168262/USN-5599-1.txt) - - [Ubuntu Security Notice USN-5598-1](https://packetstormsecurity.com/files/168261/USN-5598-1.txt) - - [Red Hat Security Advisory 2022-6341-01](https://packetstormsecurity.com/files/168260/RHSA-2022-6341-01.txt) - - [123elf Project Buffer Overflow](https://packetstormsecurity.com/files/168259/123elf-overflow.txt) - - [Wifi HD Wireless Disk Drive 11 Local File Inclusion](https://packetstormsecurity.com/files/168258/wifihdwdd11-lfi.txt) - - [Online Employee Leave Management System 1.0 Cross Site Request Forgery](https://packetstormsecurity.com/files/168257/oelms10-xsrf.txt) -- 跳跳糖 - 安全与分享社区 - - [codeql实践之查找house_of_kiwi利用点](https://tttang.com/archive/1727/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [360杜跃进：汽车网络攻击事件剧增，智能汽车需要同步考虑安全问题](https://www.4hou.com/posts/7JzA) - - [XCon2022议题 | 被动资产识别：从人工到AI](https://www.4hou.com/posts/3JvQ) - - [如何在当今不断变化的威胁环境中，实现漏洞管理的现代化](https://www.4hou.com/posts/PJr1) - - [抖音国际版安卓APP安全漏洞可劫持用户账户](https://www.4hou.com/posts/gXy6) -- Security Boulevard - - [Remote Workforce Analytics WITH Remote Workforce Trust](https://securityboulevard.com/2022/09/remote-workforce-analytics-with-remote-workforce-trust/) - - [Study Reveals CISOs’ Top Cybersecurity Concerns and Purchasing Priorities](https://securityboulevard.com/2022/09/study-reveals-cisos-top-cybersecurity-concerns-and-purchasing-priorities/) - - [OpenSSF Announces Project for Open Source Security- TechStrongTV](https://securityboulevard.com/2022/09/openssf-announces-project-for-open-source-security-techstrongtv/) - - [ESG Technical Validation: Improving Cyber Defenses with SafeBreach](https://securityboulevard.com/2022/09/esg-technical-validation-improving-cyber-defenses-with-safebreach/) - - [Data Privacy and Cybersecurity Trends for 2022 – Techstrong TV](https://securityboulevard.com/2022/09/data-privacy-and-cybersecurity-trends-for-2022-techstrong-tv/) - - [BSides Vancouver 2022 – Geoff McDonald’s ‘Large NLP Machine Learning Models And Their Upcoming Impact On Cyber Security’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-geoff-mcdonalds-large-nlp-machine-learning-models-and-their-upcoming-impact-on-cyber-security/) - - [TikTok Breach Allegations Highlight Cloud Platform Security](https://securityboulevard.com/2022/09/tiktok-breach-allegations-highlight-cloud-platform-security/) - - [GUEST ESSAY: The drivers behind persistent ransomware — and defense tactics to deploy](https://securityboulevard.com/2022/09/guest-essay-the-drivers-behind-persistent-ransomware-and-defense-tactics-to-deploy/) - - [TikTok Hack: 2B Records Leak — but ByteDance Denies](https://securityboulevard.com/2022/09/tiktok-hack-2b-records-leak-but-bytedance-denies/) - - [Welcome Our Newest Axion Matt Bradfield, Senior Director, Solutions Engineering and Technology Partnerships](https://securityboulevard.com/2022/09/welcome-our-newest-axion-matt-bradfield-senior-director-solutions-engineering-and-technology-partnerships/) -- Sploitus.com Exploits RSS Feed - - [Online Employee Leave Management System 1.0 Cross Site Request Forgery exploit](https://sploitus.com/exploit?id=PACKETSTORM:168257&utm_source=rss&utm_medium=rss) - - [Wifi HD Wireless Disk Drive 11 Local File Inclusion exploit](https://sploitus.com/exploit?id=PACKETSTORM:168258&utm_source=rss&utm_medium=rss) - - [Exploit for Insecure Default Initialization of Resource in Apache Couchdb exploit](https://sploitus.com/exploit?id=851C227D-4BCC-5511-9624-17B051DB2A2E&utm_source=rss&utm_medium=rss) -- 先知安全技术社区 - - [红队开发基础-基础免杀(四)](https://xz.aliyun.com/t/11659) - - [揭开新型窃密软件的面纱：伪装成CDR画图应用安装包](https://xz.aliyun.com/t/11653) - - [Linux提权基础分享和讨论](https://xz.aliyun.com/t/11664) -- Sucuri Blog - - [How Are Favicon (.ico) Files Used in Website Malware?](https://blog.sucuri.net/2022/09/how-are-favicon-ico-files-used-in-website-malware.html) -- code white | Blog - - [Attacks on Sysmon Revisited - SysmonEnte](https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html) -- 安全脉搏 - - [【Java安全指北】1、序列化与反序列化杂谈](https://www.secpulse.com/archives/186847.html) - - [WMCTF 2022|iOS一解题chess官方writeup](https://www.secpulse.com/archives/186826.html) - - [某通T+ 漏洞分析](https://www.secpulse.com/archives/186800.html) - - [【漏洞预警】Google Chrome沙箱逃逸漏洞](https://www.secpulse.com/archives/186796.html) - - [测试中遇到的一些js加密和签名问题](https://www.secpulse.com/archives/186770.html) -- paper - Last paper - - [一种快速的无代替模型的黑盒对抗攻击算法 SurFree](https://paper.seebug.org/1958/) -- Forcepoint - - [Understanding the Interconnectedness of Cybersecurity and Privacy](https://www.forcepoint.com/blog/insights/privacy-by-design-imperative) -- Recent Commits to cve:main - - [Update Tue Sep 6 10:02:48 UTC 2022](https://github.com/trickest/cve/commit/817698dfa36c5ecdf04bf9e164cc498c7df5a33a) -- Push the Red Button - - [Someone’s Been Messing With My Subnormals!](http://moyix.blogspot.com/2022/09/someones-been-messing-with-my-subnormals.html) -- SAP Blogs - - [Margin Analysis 4 Sell from stock in S/4HANA](https://blogs.sap.com/2022/09/06/margin-analysis-4-sell-from-stock-in-s-4hana/) - - [What’s Brewing in ABAP, AI and ML? | Lukasz Pegiel’s SAP Champion Spotlight Interview](https://blogs.sap.com/2022/09/06/whats-brewing-in-abap-ai-and-ml-lukasz-pegiels-sap-champion-spotlight-interview/) - - [Diagrams related to OData entities (CAP & ECC)](https://blogs.sap.com/2022/09/06/diagrams-related-to-odata-entities-cap-ecc/) - - [How to Remove Negative Entries from Customer Credit Master and SAP Table – S066 and S067](https://blogs.sap.com/2022/09/06/how-to-remove-negative-entries-from-customer-credit-master-and-sap-table-s066-and-s067/) - - [SAP BusinessObjects – BI Platform – Java SDK – List of Users who are in more than one group](https://blogs.sap.com/2022/09/06/sap-businessobjects-bi-platform-java-sdk-list-of-users-who-are-in-more-than-one-group/) - - [Deploy your own custom image classification model using SAP AI Core](https://blogs.sap.com/2022/09/06/deploy-your-own-custom-image-classification-model-using-sap-ai-core/) -- Securelist - - [Good game, well played: an overview of gaming-related cyberthreats in 2022](https://securelist.com/gaming-related-cyberthreats-2021-2022/107346/) -- Twitter @bytehx - - [RT PortSwigger Research: How to turn security research into profit: a CL.0 case study by @albinowax](https://twitter.com/PortSwiggerRes/status/1567134388835549184) -- Didier Stevens - - [Update: xor-kpa.py Version 0.0.6](https://blog.didierstevens.com/2022/09/06/update-xor-kpa-py-version-0-0-6/) -- Reverse Engineering - - [CVE-2022-34715: More Microsoft Windows NFS v4 Remote Code Execution](https://www.reddit.com/r/ReverseEngineering/comments/x7bsh8/cve202234715_more_microsoft_windows_nfs_v4_remote/) - - [Ghidra Headless Python VScode Skeleton with Devcontainer Super Powers](https://www.reddit.com/r/ReverseEngineering/comments/x70jnl/ghidra_headless_python_vscode_skeleton_with/) -- PortSwigger Research - - [How to turn security research into profit: a CL.0 case study](https://portswigger.net/research/how-to-turn-security-research-into-profit) -- Malwarebytes Labs - - [Instagram receives record fine of $400M for abuse of children's data](https://www.malwarebytes.com/blog/news/2022/09/instagram-receives-record-fine-of-400m-for-abuse-of-childrens-data) - - [YouTuber on the run after allegedly swiping $55m from followers](https://www.malwarebytes.com/blog/news/2022/09/youtuber-on-the-run-after-allegedly-swiping-55m-usd-from-followers) - - [Don't share the WhatsApp 'Martinelli' phone hacking alert: It's a hoax](https://www.malwarebytes.com/blog/news/2022/09/dont-share-the-whatsapp-martinelli-phone-hacking-alert-its-a-hoax) - - [Update now! QNAP warns users DeadBolt is exploiting Photo Station vulnerability](https://www.malwarebytes.com/blog/news/2022/09/update-now-qnap-warns-users-about-deadbolt-leveraging-exploitation-of-photo-station-vulnerability) -- Sucuri Blog - - [How Are Favicon (.ico) Files Used in Website Malware?](https://blog.sucuri.net/2022/09/how-are-favicon-ico-files-used-in-website-malware.html) -- blog.avast.com EN - - [Redline Stealer: Malware spread via hacked Facebook accounts](https://blog.avast.com/redline-stealer-malware) -- print("") - - [teleport 堡垒机任意用户登录漏洞](https://www.o2oxy.cn/4132.html) -- SentinelOne - - [Accelerating Your Cloud Security with Workload Protection](https://www.sentinelone.com/blog/accelerating-your-cloud-security-with-workload-protection/) -- r2c website - - [Announcing Semgrep's experimental support of Swift](https://r2c.dev/blog/2022/announcing-swift-exp-support/) -- 博客园 - nice_0e3 - - [c# 调用Windows API - nice_0e3](https://www.cnblogs.com/nice0e3/p/16661576.html) -- code white | Blog - - [Attacks on Sysmon Revisited - SysmonEnte](https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html) -- Microsoft Security Response Center - - [What’s the smallest variety of CHERI?](https://msrc-blog.microsoft.com/2022/09/06/whats-the-smallest-variety-of-cheri/) -- KitPloit - PenTest & Hacking Tools - - [noPac - Exploiting CVE-2021-42278 And CVE-2021-42287 To Impersonate DA From Standard Domain User](http://www.kitploit.com/2022/09/nopac-exploiting-cve-2021-42278-and-cve.html) -- Happy Hacking! - - [Linux Shared Library Hijacking](https://xavibel.com/2022/09/06/linux-shared-library-hijacking/) -- Blog - Praetorian - - [Safeguarding Memory in Higher-Level Programming Languages](https://www.praetorian.com/blog/safeguarding-memory-in-higher-level-programming-languages/) -- FreeBuf网络安全行业门户 - - [疯狂的SOVA：Android银行木马“新标杆”](https://www.freebuf.com/sectool/343921.html) - - [FreeBuf早报 | TikTok否认用户数据源代码泄露；Ins因侵犯儿童隐私被罚4亿欧元](https://www.freebuf.com/news/343895.html) - - [又见天价罚单，Meta违反GDPR被罚4亿美元](https://www.freebuf.com/articles/neopoints/343874.html) - - [人人皆是黑客？EvilProxy推出一键反向代理服务](https://www.freebuf.com/news/343843.html) - - [CICD管道中的代码注入漏洞影响Google、Apache开源GitHub项目](https://www.freebuf.com/news/343842.html) -- 安全牛 - - [企业如何处置不再需要的数据信息](https://www.aqniu.com/homenews/88816.html) - - [直播预告 | 网安大讲堂（41期）：高级Web安全专家（OSWE）认证介绍](https://www.aqniu.com/homenews/88817.html) - - [无法衡量谈何改进？提升安全运营效率的7个关键指标](https://www.aqniu.com/hometop/88814.html) - - [长扬科技助力关基落地保护工作再启新篇章](https://www.aqniu.com/industry/88798.html) - - [江南信安联合用友打造U8系统财务安全卫士 为中小企业财务数据安全保驾护航](https://www.aqniu.com/industry/88796.html) - - [世平信息亮相第七届国家信息安全与信息技术应用创新论坛](https://www.aqniu.com/industry/88797.html) -- Dhole Moments - - [Hobbies Don’t Need to be Policed](https://soatok.blog/2022/09/06/hobbies-dont-need-to-be-policed/) -- Checkmarx.com - - [Checkmarx Launches Checkmarx One™ Application Security Platform in Singapore](https://checkmarx.com/press-releases/checkmarx-launches-checkmarx-one-ast-in-singapore/) -- HackerNews - - [QNAP 警告新的 DeadBolt 勒索软件攻击利用 Photo Station 漏洞](https://hackernews.cc/archives/41329) - - [EvilProxy 推出一键反向代理服务](https://hackernews.cc/archives/41337) - - [TikTok 否认用户数据遭泄露](https://hackernews.cc/archives/41325) - - [伊朗当局计划使用面部识别技术来打击妇女着装问题](https://hackernews.cc/archives/41322) - - [韩国政府 YouTube 频道遭黑客入侵，借马斯克形象推广加密骗局](https://hackernews.cc/archives/41319) -- 奇客Solidot–传递最新科技情报 - - [Node.js 作者呼吁甲骨文释放 JavaScript 商标](https://www.solidot.org/story?sid=72695) - - [希音如何风靡美国](https://www.solidot.org/story?sid=72694) - - [OpenWrt 22.03.0 发布](https://www.solidot.org/story?sid=72693) - - [CERN 考虑在电力需求高峰关闭部分加速器](https://www.solidot.org/story?sid=72692) - - [我国两种长臂猿野外灭绝](https://www.solidot.org/story?sid=72691) - - [印度因板球运动员条目编辑传唤维基高管](https://www.solidot.org/story?sid=72690) - - [量子计算泡沫](https://www.solidot.org/story?sid=72689) - - [诺贝尔奖得主 Gregg Semenza 的四篇论文被撤回](https://www.solidot.org/story?sid=72688) - - [Instagram 因侵犯儿童隐私罚款 4 亿欧元](https://www.solidot.org/story?sid=72687) - - [美国最近流行安静辞职](https://www.solidot.org/story?sid=72686) - - [Google Play 测试第三方支付方案](https://www.solidot.org/story?sid=72685) - - [TikTok 否认用户数据源代码泄露](https://www.solidot.org/story?sid=72684) -- 吾爱破解论坛 - - [【原创】保卫萝卜PC版内存修改器分析、制作详细过程](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651138340&idx=1&sn=0e95cd165b7cc7005ef8afdf6f627ad6&chksm=bd50b9708a273066f25436adc31241723161fd34bedab83d792d95d84bf29a3eccfb38c2dfad&scene=58&subscene=0#rd) - - [【漏洞分析】CNVD-2022-10270分析](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651138298&idx=1&sn=cb42741ad65c10086e00346981085063&chksm=bd50b8ae8a2731b86d2f5822da1697bea36adba72e0a1fa0ee415718fecbffbcc465e43abdb0&scene=58&subscene=0#rd) -- 黑海洋 - WIKI - - [教你如何把冻结永久的QQ给解冻](https://blog.upx8.com/2962) - - [短信HZ接口抓取教程](https://blog.upx8.com/2961) -- 君哥的体历 - - [重磅！西北工业大学遭境外网络攻击，攻击者竟是美国国安局NSA！](https://mp.weixin.qq.com/s?__biz=MzI2MjQ1NTA4MA==&mid=2247488799&idx=1&sn=2af727df0741f70a820073ddfdc36143&chksm=ea4bbf58dd3c364e9a2673edbce46263270016826ea3fe888208b2d09770537c715097a05592&scene=58&subscene=0#rd) -- 代码卫士 - - [QNAP紧急修复已遭勒索团伙利用的0day](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513786&idx=1&sn=6db5fbb61270cf614d6605adb52ca99c&chksm=ea9487d0dde30ec6b7e1631c93975e24741275c2ba254fe0dac3f5f494c3000a8cedb03ff890&scene=58&subscene=0#rd) - - [CSRF防御机制反被CSRF误，csurf 开源NPM包被弃](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513786&idx=2&sn=74891678697b0e36ed3f5b2dfae35425&chksm=ea9487d0dde30ec613ae86e4fd96e0551be1aad357990007323a016cfa483e3249a5b24f75d1&scene=58&subscene=0#rd) - - [扩展物联网 (XIoT) 漏洞激增，安全压力倍增](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513786&idx=3&sn=07ef04262f4e5c1f68019bd0eafffe20&chksm=ea9487d0dde30ec6ddb7fffd17fcf18c63f5f07f66769788f6748460497129ab130565fc545c&scene=58&subscene=0#rd) -- 看雪学院 - - [百度安全，助力2022 SDC-第六届安全开发者峰会，共建安全新生态](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458468074&idx=1&sn=0f9de385f2ed0b7afa5a5bfadf4f1054&chksm=b18e0e6086f98776577ccb2b6dac1f5aa0964e901e89a13af587b8f96622ae1bba704dcc43d4&scene=58&subscene=0#rd) - - [V8 Array.prototype.concat函数出现过的issues和他们的POC们](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458468074&idx=2&sn=06eb27c1649bd4e3a3e43a46a9500add&chksm=b18e0e6086f9877644ba0de33658232f99213d1b1b074342260031cb529c1b7ad1b89b2e0204&scene=58&subscene=0#rd) - - [西北工业大学遭境外网络攻击，已确认攻击源头系美国国家安全局](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458468074&idx=3&sn=2b4866b069d0cc0ec6e670fa8119b50d&chksm=b18e0e6086f9877699cc25ad8f71c5701400fdd2b2e8eaadae473ba3994405b20b432f0d26af&scene=58&subscene=0#rd) - - [看雪讲师招募中！助你成为知识传播者](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458468074&idx=4&sn=db0a00c5788d5805439312981caa6b3e&chksm=b18e0e6086f9877650efeeb0fe7bd04420224b2f77228b156eb0b85171414f5ce43fdc74fe4f&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [物联网安全威胁情报(2022年08月)](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530985&idx=1&sn=ff0bd7ee19a7a9fc665785129541d1a9&chksm=c1e9f5b8f69e7cae1c5be2c768259ba6d2cae4fb5e3191279ae5bbbea01f020f6b688197bc79&scene=58&subscene=0#rd) - - [俄罗斯打车软件 Yandex 被黑，造成莫斯科交通堵塞](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530985&idx=2&sn=72ccc06f625f1853172c5897f2842ecf&chksm=c1e9f5b8f69e7cae6c441f638153f9bdb395f08af986c9b89c78b4a7e59939960a7e0c8085da&scene=58&subscene=0#rd) - - [三星再次遭遇黑客攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530985&idx=3&sn=db544911e4a1613e92dac7d2da4396ae&chksm=c1e9f5b8f69e7cae4916f1fbf30c6c9af51b8ec703ce6b68b8637a23f0caba6846dc2b1bafe1&scene=58&subscene=0#rd) - - [无法衡量谈何改进？提升安全运营效率的7个关键指标](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247530985&idx=4&sn=a61e642ef74505c40e55f20af1874219&chksm=c1e9f5b8f69e7caecf085823df568d7450d99f8b1abf8765679368de881cf5fa97193ec85bf1&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [安全领域中使用机器学习的注意事项](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247493263&idx=1&sn=29df5ba3b7456acc0cbc8ddf016855e0&chksm=e84c4050df3bc946a322c7c24090d0d634943943815497764a401c0b1fa961bc1da98b20a9a8&scene=58&subscene=0#rd) -- 雷神众测 - - [CS4.4二开记录(一)](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652499572&idx=1&sn=35e14922778d3038e818f0a92399affb&chksm=f2584dc7c52fc4d1d75287d645bc00220151ceb2128daf5959522a8956691001ad7c10b6c65d&scene=58&subscene=0#rd) -- 星阑科技 - - [API漏洞自动化测试、安全工作流编排-星阑科技在Kcon黑客大会进行精彩分享](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495601&idx=1&sn=71c76d41dd00ba2aec9ee1f6344ee12f&chksm=c007422df770cb3bc974d42581d905ffaa99510683fe2a7bdd41a583186f88244bafaf99e774&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [GO语言安全 — 沙箱逃逸题目分析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496259&idx=1&sn=20b93256d8a5acfda5826c5d50096f63&chksm=fa5227fdcd25aeebbf9f9add2a483500a252d5ad058a92dafad394eaa1c57cf2bdb597e51b5c&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [高效能低占用 火绒安全获缝制设备龙头杰克股份认可](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247509454&idx=1&sn=529bb8b182f022871e3824ab053b9366&chksm=eb707bf1dc07f2e77c2dd449d552e92671b38616acc09caf4d56e5ceb0e705e9de4f8e1a47f7&scene=58&subscene=0#rd) -- 安全牛 - - [无法衡量谈何改进？提升安全运营效率的7个关键指标](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118371&idx=1&sn=4ead89b8ece0146b379182784997de44&chksm=bd146bf08a63e2e6f97269175263a794f579948dc126154aa12fa4754e9b444b7e84fd4c0b4c&scene=58&subscene=0#rd) - - [企业如何处置不再需要的数据信息](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118371&idx=2&sn=33e75d37c35e216dcdc58b759d8bf771&chksm=bd146bf08a63e2e6b35f4334c9bc8b51a887ff752f26ce4929223bd698fe0bb27df6441cf320&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（41期）：高级Web安全专家（OSWE）认证介绍](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118371&idx=3&sn=1924ee05bfbad80a1e20d4a91f60d757&chksm=bd146bf08a63e2e6623612e2a81b9cb2ed6c90e5de12e47980f62bebb74694187d4a36e6b31b&scene=58&subscene=0#rd) -- 中国信息安全 - - [重磅发布 | 《2022上半年网络安全漏洞态势观察》（附下载）](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165218&idx=1&sn=2abc5a81d2b47c85e6d021f2c1970df1&chksm=8b5eed9bbc29648df22152a192d14fa30a6a6a2243b963282a3fee91630e6504981266b17b8c&scene=58&subscene=0#rd) - - [聚焦2022网安周 | 技术为民，网络安全博览会实景探展](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165218&idx=2&sn=edeac1f4ccf89a7e7d7cf91f4614ba41&chksm=8b5eed9bbc29648d6868bb240b46667eb3c941e98e80f60bee1781b721972f7a1e8b9387ef32&scene=58&subscene=0#rd) - - [聚焦2022网安周 | 源自实践 聚焦实战 首部《网络安全人才实战能力白皮书》发布](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165218&idx=3&sn=09513721e8126205e1b716dd031ec220&chksm=8b5eed9bbc29648d2aa01d30c4ca1ff2b4addbb6724547d71449f32701d8db530d2bf2e86371&scene=58&subscene=0#rd) - - [发布 | 最高法发布人民法院依法惩治电信网络诈骗犯罪工作情况暨典型案例](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165218&idx=4&sn=03caa67b9d4a8a9459be180bea8927df&chksm=8b5eed9bbc29648d3cea8adad5f0b9c50804c1b364c02267c114fc10381902830f0f2eb67094&scene=58&subscene=0#rd) - - [聚焦2022网安周 | “网络资产测绘及风险分析系统（信创版）”亮相国家网络安全宣传周](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165218&idx=5&sn=230fa1bfccf0fe9a2bc618fba9b52d44&chksm=8b5eed9bbc29648df35c9f97be4b278f2b26b4997f8b7a6bbe01629208f226bd8af60915b85d&scene=58&subscene=0#rd) - - [专家观点 | 政务外网关键信息基础设施安全保护实践与探索](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165218&idx=6&sn=71d25bd579715a3139cce118dd73e2b7&chksm=8b5eed9bbc29648d26bf26b0f2848efcfa85e984f3dcda151cf3c9180faeeff6b9f503eb89d6&scene=58&subscene=0#rd) - - [行业 | 数据是否泄露？零零信安00SEC-D&D数据泄露报警系统来回答](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165218&idx=7&sn=85961676e582cefaf0161e0c74b949a9&chksm=8b5eed9bbc29648d733e0ef1b4053bdba1c8b4bbb58fa728d247ecc2e72831adc4402ce87dfd&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.09.06）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491386&idx=1&sn=fed5cf22695d3a7b64948dcefdeacd68&chksm=fe251a3bc952932d9f8289c12649a0f41c1483b7c221a86ad4d81467467cb50164ee37f30582&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-09-06 FlowMatris](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492654&idx=1&sn=0ce4dc74d3f91ac9807ed8ef1bce9983&chksm=c063caf7f71443e1f5688db236357f6796606fd47c929cff530882e90e271d0d4054a281fdec&scene=58&subscene=0#rd) -- 数世咨询 - - [TikTok否认数据泄露，据报道超过20亿用户信息被暴露](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247495291&idx=1&sn=d9f3ff9cdf154c7581495d5977c4661e&chksm=c1449cc6f63315d0947fba7ff1e5d508902a741462376bb341480f45889b1f937081e43fa6e7&scene=58&subscene=0#rd) - - [2022云盾智慧新产品发布会，三大产品重磅推出](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247495291&idx=2&sn=7945d770e507db2671cbd996f0f1c080&chksm=c1449cc6f63315d064dc3d79c4a33ca529611c78e7d76ed4cd91968743bc6230f6f72fb4cba9&scene=58&subscene=0#rd) - - [五大看点！第三届国际零信任峰会将于9月16日开幕](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247495291&idx=3&sn=308227030f0dc9fc3bdb08e4e0b81e1a&chksm=c1449cc6f63315d038e52d3456a9183e95881e67a1f9cf46cdba4bb1b4dfb76a6813230284cd&scene=58&subscene=0#rd) - - [软件供应链安全治理与运营](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247495291&idx=4&sn=c7d2663fe58c180b55a50be22f19b7cb&chksm=c1449cc6f63315d0b48019f146024fad38ee6951c8f5d0987f15192cb6ef6b019c5728df0a51&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [物联网安全威胁情报(2022年08月)](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531240&idx=1&sn=2139acb2b9b31227ba78c4c2017a8cd9&chksm=fa93cc29cde4453fef552bcd36770143e3ca701bf9c1ac93e4dfde39183b041a114dd8952ebf&scene=58&subscene=0#rd) - - [在暗网上检查新的DawDropper银行木马滴管和DaaS](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531240&idx=2&sn=f841772d66b22ef53474105ecb2cd6c5&chksm=fa93cc29cde4453f34ccf6c247f6c262e1fe1a24bb666db7e6bfccac14f0a3322a6c273f354b&scene=58&subscene=0#rd) - - [国内外最新网络安全发展动态](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531240&idx=3&sn=895c1d7f1766c194266f998035bea343&chksm=fa93cc29cde4453f540585585e4b2bf9cf784eaa9419777013ac91db145ce408e8c48def52df&scene=58&subscene=0#rd) - - [12个顶级托管检测和响应解决方案](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531240&idx=4&sn=f36a72a39539ce819ef389dcce91514d&chksm=fa93cc29cde4453f8d8470ec81b806e5c5b4260ee0975e6d6abb9517c9fb0f231eae7e9ccdfb&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(09-06)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958671&idx=1&sn=2e1e8b80ef1020e1c82880eb287ceca1&chksm=8baecd10bcd94406187833a99d5f41af235ca9a10d2d070886f214df588ee8223d5a26fb59f0&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [「手」护者第六期｜安全“向左” 攻防“无幻”主题沙龙预告！](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727835091&idx=1&sn=8a810aa48d3049ed742f8cb5a2e72971&chksm=8050a25bb7272b4d4605c9c47d52372ea59e13ddd56768082c8a59119440feb623a7f5ba9c32&scene=58&subscene=0#rd) -- 青藤云安全 - - [国家网安周论坛：青藤CEO张福提出针对关基保护的网络安全框架](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650838025&idx=1&sn=3af08c4895ee3d4d17cc4f1b5b8252ae&chksm=80dbf7acb7ac7eba59697d56c064dd796e71d9a5dded80930f2041f2044441289a208bcc622b&scene=58&subscene=0#rd) -- 白帽100安全攻防实验室 - - [来自顶级爱豆们的赛事邀请！](https://mp.weixin.qq.com/s?__biz=MzIxMDYyNTk3Nw==&mid=2247490337&idx=1&sn=dd5cdd98b93dced4ed824b4c7226d752&chksm=9760eff7a01766e179a09f5406e9c19e7a67baf8bc1321f5518d12cf4d07e93a30660f38106a&scene=58&subscene=0#rd) -- 极客公园 - - [美妆巨头暗中押注，合成生物学遇上新风口](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966828&idx=1&sn=6c54972e46f4451b1c17b610813673ee&chksm=7e54721a4923fb0c15c8df299785ed44ba449a524a1eb97edc07753793b4d21c2eebd7d9b4d2&scene=58&subscene=0#rd) - - [主攻高端商务场景，这家清洁机器人公司哪来的底气？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966828&idx=2&sn=85ba6a5aa3033e81256722eb23c128c4&chksm=7e54721a4923fb0c10fef8f1877f9c398cbf566268ca7ee348b4e79548e3d309badd838eab84&scene=58&subscene=0#rd) - - [iPhone 14 备货超 3400 万部；第四范式向港交所提交上市申请；50 年前老红旗车惊现二手网站 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966809&idx=1&sn=d5a11b397548c4daaf70abb0ed01d0ff&chksm=7e54722f4923fb393dbba6db43a71e29ea055a8085dae7dec73e03856c15057547e62f3e7b4b&scene=58&subscene=0#rd) -- 慢雾科技 - - [暗夜小偷：Redline Stealer 木马盗币分析](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247496292&idx=1&sn=ffbcd901857403e0a3b4c384644569e0&chksm=fdde8ce3caa905f5777d57bba9a5b881bfbf20bc93931c9d087238b76ed24a5a603559ea371c&scene=58&subscene=0#rd) -- 情报分析师 - - [【智库报告】朝鲜化学和生物武器、电磁脉冲和网络威胁的风险（135页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515600&idx=1&sn=00df3c4c34ff87968baa90c14f9cc81e&chksm=871686dbb0610fcd1fe1a804102c08735382b888376f089bea1a0174675d6dc8cee58ddb1ec6&scene=58&subscene=0#rd) - - [【情报分析】泽连斯基开除情报高官之观察](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515600&idx=2&sn=fe08218da59b2de895661761d9d5b20c&chksm=871686dbb0610fcd352d62c3f6398edf29c71eaaedf81eef1f74f4ecaeba1df02273990ad469&scene=58&subscene=0#rd) - - [[实战案例】对YouTube视频的深入研究](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515600&idx=3&sn=3c5187abddf221a0a0d5921b80612735&chksm=871686dbb0610fcd83945ec3c6fd83b8a9094d051db39aa3a18f072d9b59c77c210196edced1&scene=58&subscene=0#rd) -- 且听安全 - - [CVE-2022-29845~29847 WhatsUp Gold 多个漏洞组合链分析](https://mp.weixin.qq.com/s?__biz=Mzg3MTU0MjkwNw==&mid=2247491458&idx=1&sn=dcc4c17f94b47e7ea1e95bf39067affd&chksm=cefda696f98a2f8081693f981556354718d73688655217a185e34e3e905b2ffdc0af5b5a8fca&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [XCon2022议题 | 被动资产识别：从人工到AI](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549956&idx=1&sn=740ea6020d0807cfc900b726d8c5536d&chksm=e915d43ede625d282de42a181119f01d8e89c6a6743034856f5498b820892d56daf184f7b7f5&scene=58&subscene=0#rd) - - [抖音国际版安卓APP安全漏洞可劫持用户账户](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549956&idx=2&sn=a47885512dc1c9fdc3e0800df8752de0&chksm=e915d43ede625d28e34e5bbb52cc0f617a1f36fc859e63018a34cec25ef35f0ec262c9f7448c&scene=58&subscene=0#rd) - - [如何在当今不断变化的威胁环境中，实现漏洞管理的现代化](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247549956&idx=3&sn=24d47c77f042ee08d69fa0ca9ccdc786&chksm=e915d43ede625d2893f05e5b057601a9043c723782e749294bf50326605eaa20f0f59d4dcf0d&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-08.md b/archive/2022/2022-09-08.md deleted file mode 100644 index 4373cc1aeb..0000000000 --- a/archive/2022/2022-09-08.md +++ /dev/null @@ -1,206 +0,0 @@ -# 每日安全资讯（2022-09-08） - -- SecWiki News - - [SecWiki News 2022-09-07 Review](http://www.sec-wiki.com/?2022-09-07) -- Recent Commits to cve:main - - [Update Wed Sep 7 10:04:23 UTC 2022](https://github.com/trickest/cve/commit/469b369327ba4fde71883151d5045195cb2119ed) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [WordPress BackupBuddy 8.7.4.1 Arbitrary File Read](https://cxsecurity.com/issue/WLB-2022090019) - - [Backdoor.Win32.Winshell.5_0 / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022090018) - - [Trojan.Win32.Autoit.fhj / Named Pipe Null DACL](https://cxsecurity.com/issue/WLB-2022090017) - - [Trojan.Win32.Autoit.fhj / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022090016) - - [Trojan-Ransom.Win32.Hive.bv / Arbitrary Code Execution](https://cxsecurity.com/issue/WLB-2022090015) - - [Backdoor.Win32.Hupigon.aspg / Insecure Service Path](https://cxsecurity.com/issue/WLB-2022090014) - - [FE File Explorer 11.0.4 Local File Inclusion](https://cxsecurity.com/issue/WLB-2022090013) - - [FTPManager 8.2 Local File Inclusion / Directory Traversal](https://cxsecurity.com/issue/WLB-2022090012) -- Twitter @Nicolas Krassas - - [Tool Release – Monkey365](https://twitter.com/Dinosn/status/1567590959675838465) - - [Cisco won’t fix authentication bypass zero-day in EoL routers](https://twitter.com/Dinosn/status/1567575778698608644) - - [200,000 North Face accounts hacked in credential stuffing attack](https://twitter.com/Dinosn/status/1567550980698390530) - - [CVE-2022-36923 ManageEngine OpManager getUserAPIKey Bypass, PoC should work as, echo "http://ip:8060/RestAPI/getAPIKey" | httpx -body "operation=getUs...](https://twitter.com/Dinosn/status/1567540990138785792) - - [Combination of evilginx2 and GoPhish.](https://twitter.com/Dinosn/status/1567532460396744706) - - [CVE-2022-26447: Mediatek Chipsets code execution vulnerability](https://twitter.com/Dinosn/status/1567532272382795778) - - [RT rantoine:](https://twitter.com/ant0inet/status/1567514222346526721) - - [Authorities Shut Down WT1SHOP Site for Selling Stolen Credentials and Credit Cards](https://twitter.com/Dinosn/status/1567513167307198466) - - [Obfuscate Go builds](https://twitter.com/Dinosn/status/1567507670927609857) - - [A repository of tools for pentesting of restricted and isolated environments.](https://twitter.com/Dinosn/status/1567507141015076866) - - [OSCP 110 - My own cheat sheet](https://twitter.com/Dinosn/status/1567499244147179520) - - [Albania blames Iran for July cyberattack, severs diplomatic ties](https://twitter.com/Dinosn/status/1567495662027022337) - - [Spymax: The android RAT and it works like that….](https://twitter.com/Dinosn/status/1567482874093256705) - - [Groovy Template Engine Exploitation – Notes from a real case scenario](https://twitter.com/Dinosn/status/1567468651875385344) - - [noPac - Exploiting CVE-2021-42278 And CVE-2021-42287 To Impersonate DA From Standard Domain User](https://twitter.com/Dinosn/status/1567455404900106240) - - [Hardware debug probes for JTAG debugging for Intel and AMD - Necrosys/x86-JTAG-Information](https://twitter.com/Dinosn/status/1567455344384778240) - - [RT Y4er: Re My article is here My colleague's article is here 3/end](https://twitter.com/Y4er_ChaBug/status/1567449636209836032) - - [RT nicolas vamous: The exploit strategy of CVE-2022-22706 is exactly same as CVE-2021-1048 and CVE-2022-28350:](https://twitter.com/NVamous/status/1567400449212567552) -- Blog & What's New | Offensive Security - - [Students find cybersecurity career success after completing Offensive Security courses](https://www.offensive-security.com/offsec/case-study-students-find-career-success-with-offsec/) -- Security Boulevard - - [Top Common Targets for Hackers](https://securityboulevard.com/2022/09/top-common-targets-for-hackers/) - - [The Moonbeam Song](https://securityboulevard.com/2022/09/the-moonbeam-song/) - - [WT1SHOP: Authorities Seize Online Marketplace Selling Stolen Login Credentials and Other PII](https://securityboulevard.com/2022/09/wt1shop-authorities-seize-online-marketplace-selling-stolen-login-credentials-and-other-pii/) - - [SafeBreach Coverage for US-CERT Alert (AA22-249A) – Vice Society](https://securityboulevard.com/2022/09/safebreach-coverage-for-us-cert-alert-aa22-249a-vice-society/) - - [GDPR and Website Data Leakage:A Complex Problem With a Simple Solution](https://securityboulevard.com/2022/09/gdpr-and-website-data-leakagea-complex-problem-with-a-simple-solution/) - - [BSides Vancouver 2022 – Mrigakshi Goel’s, Payal Sondhi’s, And Lalithya Malyala’s ‘Hacking Basics With Women Hackers’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-mrigakshi-goels-payal-sondhis-and-lalithya-malyalas-hacking-basics-with-women-hackers/) - - [96% Could Have Prevented Their Identity Breach – IDSA](https://securityboulevard.com/2022/09/96-could-have-prevented-their-identity-breach-idsa/) -- 跳跳糖 - 安全与分享社区 - - [dpt-shell抽取壳项目源码及其逆向分析](https://tttang.com/archive/1728/) -- unSafe.sh - 不安全 - - [Cyber Risks in the Education Sector | Why Cybersecurity Needs to Be Top of the Class](https://buaq.net/go-125652.html) - - [Students find cybersecurity career success after completing Offensive Security courses](https://buaq.net/go-125650.html) - - [How to set up an Android for your kids](https://buaq.net/go-125706.html) - - [Coercer - A Python Script To Automatically Coerce A Windows Server To Authenticate On An Arbitrary Machine Through 9 Methods](https://buaq.net/go-125643.html) - - [Warning issued about Vice Society ransomware targeting the education sector](https://buaq.net/go-125707.html) - - [How to Build a Mobile Application Security Champion Program](https://buaq.net/go-125641.html) - - [Spymax: The android RAT and it works like that….](https://buaq.net/go-125639.html) - - [Sextortionists used mobile malware to steal nude videos, contact lists from victims](https://buaq.net/go-125708.html) - - [Running KrakenSDR on the Steam Deck](https://buaq.net/go-125640.html) - - [FreeBuf早报 | Apache IoTDB 模块存在安全漏洞；洛杉矶联合学区遭勒索软件攻击](https://buaq.net/go-125704.html) -- Sploitus.com Exploits RSS Feed - - [Trojan.Win32.Autoit.fhj MVID-2022-0637 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:168270&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Winshell.5_0 MVID-2022-0633 Hardcoded Credential exploit](https://sploitus.com/exploit?id=PACKETSTORM:168276&utm_source=rss&utm_medium=rss) - - [Trojan.Win32.Autoit.fhj MVID-2022-0638 NULL DACL exploit](https://sploitus.com/exploit?id=PACKETSTORM:168288&utm_source=rss&utm_medium=rss) - - [Online Employee Leave Management System 1.0 Cross Site Request Forgery Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37941&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Hupigon.aspg MVID-2022-0634 Unquoted Service Path exploit](https://sploitus.com/exploit?id=PACKETSTORM:168279&utm_source=rss&utm_medium=rss) - - [FE File Explorer 11.0.4 Local File Inclusion exploit](https://sploitus.com/exploit?id=PACKETSTORM:168285&utm_source=rss&utm_medium=rss) - - [FTPManager 8.2 Local File Inclusion / Directory Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:168274&utm_source=rss&utm_medium=rss) - - [Trojan-Ransom.Win32.Hive.bv MVID-2022-0636 Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168293&utm_source=rss&utm_medium=rss) - - [Wifi HD Wireless Disk Drive 11 Local File Inclusion Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37940&utm_source=rss&utm_medium=rss) - - [Trojan-Spy.Win32.Pophot.bsl MVID-2022-0635 Insecure Permissions exploit](https://sploitus.com/exploit?id=PACKETSTORM:168283&utm_source=rss&utm_medium=rss) -- paper - Last paper - - [Spring Cloud Function SpEL 表达式注入](https://paper.seebug.org/1959/) -- Microsoft Security Blog - - [Profiling DEV-0270: PHOSPHORUS’ ransomware operations](https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/) - - [One Microsoft manager’s entrepreneurial vision for multicloud identity and access](https://www.microsoft.com/security/blog/2022/09/07/one-microsoft-managers-entrepreneurial-vision-for-multicloud-identity-and-access/) -- Files ≈ Packet Storm - - [Gentoo Linux Security Advisory 202209-05](https://packetstormsecurity.com/files/168295/glsa-202209-05.txt) - - [Red Hat Security Advisory 2022-6252-02](https://packetstormsecurity.com/files/168294/RHSA-2022-6252-02.txt) - - [Trojan-Ransom.Win32.Hive.bv MVID-2022-0636 Code Execution](https://packetstormsecurity.com/files/168293/MVID-2022-0636.txt) - - [WordPress BackupBuddy 8.7.4.1 Arbitrary File Read](https://packetstormsecurity.com/files/168292/wpbackupbuddy8741-disclose.txt) - - [Red Hat Security Advisory 2022-6381-01](https://packetstormsecurity.com/files/168291/RHSA-2022-6381-01.txt) - - [Gentoo Linux Security Advisory 202209-04](https://packetstormsecurity.com/files/168290/glsa-202209-04.txt) - - [Red Hat Security Advisory 2022-6182-01](https://packetstormsecurity.com/files/168289/RHSA-2022-6182-01.txt) - - [Trojan.Win32.Autoit.fhj MVID-2022-0638 NULL DACL](https://packetstormsecurity.com/files/168288/MVID-2022-0638.txt) - - [Red Hat Security Advisory 2022-6370-01](https://packetstormsecurity.com/files/168287/RHSA-2022-6370-01.txt) - - [Gentoo Linux Security Advisory 202209-03](https://packetstormsecurity.com/files/168286/glsa-202209-03.txt) - - [FE File Explorer 11.0.4 Local File Inclusion](https://packetstormsecurity.com/files/168285/fefileexplorer1104-lfi.txt) - - [Red Hat Security Advisory 2022-6183-01](https://packetstormsecurity.com/files/168284/RHSA-2022-6183-01.txt) - - [Trojan-Spy.Win32.Pophot.bsl MVID-2022-0635 Insecure Permissions](https://packetstormsecurity.com/files/168283/MVID-2022-0635.txt) - - [Red Hat Security Advisory 2022-6345-01](https://packetstormsecurity.com/files/168282/RHSA-2022-6345-01.txt) - - [Red Hat Security Advisory 2022-6347-01](https://packetstormsecurity.com/files/168281/RHSA-2022-6347-01.txt) - - [Red Hat Security Advisory 2022-6348-01](https://packetstormsecurity.com/files/168280/RHSA-2022-6348-01.txt) - - [Backdoor.Win32.Hupigon.aspg MVID-2022-0634 Unquoted Service Path](https://packetstormsecurity.com/files/168279/MVID-2022-0634.txt) - - [Red Hat Security Advisory 2022-6351-01](https://packetstormsecurity.com/files/168278/RHSA-2022-6351-01.txt) - - [Gentoo Linux Security Advisory 202209-02](https://packetstormsecurity.com/files/168277/glsa-202209-02.txt) - - [Backdoor.Win32.Winshell.5_0 MVID-2022-0633 Hardcoded Credential](https://packetstormsecurity.com/files/168276/MVID-2022-0633.txt) - - [Red Hat Security Advisory 2022-6344-01](https://packetstormsecurity.com/files/168275/RHSA-2022-6344-01.txt) - - [FTPManager 8.2 Local File Inclusion / Directory Traversal](https://packetstormsecurity.com/files/168274/ftpmanager82-lfitraversal.txt) - - [Red Hat Security Advisory 2022-6354-01](https://packetstormsecurity.com/files/168273/RHSA-2022-6354-01.txt) - - [Red Hat Security Advisory 2022-6355-01](https://packetstormsecurity.com/files/168272/RHSA-2022-6355-01.txt) - - [Gentoo Linux Security Advisory 202209-01](https://packetstormsecurity.com/files/168271/glsa-202209-01.txt) -- 安全客-有思想的安全新媒体 - - [数字安全观察每周简报【安全事件篇】 2022.08.24-2022.08.30](https://www.anquanke.com/post/id/279722) - - [CVE-2022-2639：Linux Kernel openvswitch 模块权限提升漏洞通告](https://www.anquanke.com/post/id/279708) - - [国际执法行动查缴PII数据犯罪市场WT1SHOP](https://www.anquanke.com/post/id/279651) - - [洲际酒店集团因网络攻击扰乱预订系统](https://www.anquanke.com/post/id/279691) - - [TA505使用TeslaGun面板管理ServHelper后门](https://www.anquanke.com/post/id/279657) - - [洛杉矶联合学区遭勒索软件攻击](https://www.anquanke.com/post/id/279660) - - [Moobot 僵尸网络盯上D-Link 路由器，速打补丁！](https://www.anquanke.com/post/id/279663) - - [Tornado Cash中merkleTree和zk-snarks](https://www.anquanke.com/post/id/279557) - - [日政府网站遭网络攻击 或为亲俄派黑客组织发动](https://www.anquanke.com/post/id/279647) - - [黑客滥用Genshin Impact反作弊系统，为勒索软件“开绿灯”](https://www.anquanke.com/post/id/279625) - - [360数字安全等安全企业入选北京市委网信办网络安全技术支撑单位](https://www.anquanke.com/post/id/279637) -- Tenable Blog - - [Full IT Visibility Requires Business Risk Context](https://www.tenable.com/blog/full-it-visibility-requires-business-risk-context) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [盘古石手机取证分析系统入选首届法律科技成果案例](https://www.4hou.com/posts/nJXl) - - [漏洞预警|Apache IoTDB grafana-connector 模块存在未授权漏洞](https://www.4hou.com/posts/l6L6) - - [2022数据安全技术大会奏响主旋律](https://www.4hou.com/posts/mX60) - - [XCon2022议题 | 数字水印攻防：利用AI对抗攻击&后门投毒的数据溯源方法](https://www.4hou.com/posts/gXK6) - - [扬言要泄露Entrust数据后，LockBit勒索软件团伙反遭DDoS攻击](https://www.4hou.com/posts/LBBw) - - [Novant健康公司承认向Facebook泄露了130万名患者的信息](https://www.4hou.com/posts/GKK7) - - [探索新思路 共创工信安全新未来 | 工业信息安全产业创新发展论坛即将开幕！报名通道已开启](https://www.4hou.com/posts/vJwr) -- Trustwave Blog - - [Trustwave Named Rising Star in 2022 ISG Provider Lens™ Quadrant Report on Cybersecurity Solutions & Services](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-named-rising-star-in-2022-isg-provider-lens-quadrant-report-on-cybersecurity-solutions-services/) - - [Trustwave Government Solutions President Honored with AFFIRM Leadership Award](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-government-solutions-president-honored-with-affirm-leadership-award/) -- 安全脉搏 - - [基于AD Event日志识别DCSync攻击](https://www.secpulse.com/archives/186924.html) - - [实战 | 记一次攻防演练中的溯源经历](https://www.secpulse.com/archives/186905.html) - - [干货 | 记一次公益SRC上分思路](https://www.secpulse.com/archives/186895.html) -- NowSecure - - [How to Build a Mobile Application Security Champion Program](https://www.nowsecure.com/blog/2022/09/07/how-to-build-a-mobile-application-security-champion-program/) -- 博客园 - zha0gongz1 - - [Bypass Windows Defender Dump Lsass（手法拙劣） - zha0gongz1](https://www.cnblogs.com/H4ck3R-XiX/p/16650231.html) -- hn security - - [Groovy Template Engine Exploitation – Notes from a real case scenario](https://security.humanativaspa.it/groovy-template-engine-exploitation-notes-from-a-real-case-scenario/) -- SAP Blogs - - [Develop a Machine Learning Application on SAP BTP – Data Science part](https://blogs.sap.com/2022/09/07/develop-a-machine-learning-application-on-sap-btp-data-science-part/) - - [Looking to strengthen HR’s connection across your business? Learn more at SuccessConnect On-site & Virtual!](https://blogs.sap.com/2022/09/07/looking-to-strengthen-hrs-connection-across-your-business-learn-more-at-successconnect-on-site-virtual/) - - [A Day in the Life of an Internal Sales Representative – Powered by SAP S/4HANA Cloud 2208](https://blogs.sap.com/2022/09/07/a-day-in-the-life-of-an-internal-sales-representative-powered-by-sap-s-4hana-cloud-2208/) - - [CCv2 Image Processing](https://blogs.sap.com/2022/09/07/ccv2-image-processing/) - - [Bonus Calculation Equations in Variable Pay](https://blogs.sap.com/2022/09/07/bonus-calculation-equations-in-variable-pay/) - - [Inputs for CS_BOM_EXPL_MAT_V2 – BOM explosion report – CS11](https://blogs.sap.com/2022/09/07/inputs-for-cs_bom_expl_mat_v2-bom-explosion-report-cs11/) - - [Liquidity analysis in SAP S/4HANA Cloud](https://blogs.sap.com/2022/09/07/liquidity-analysis-in-sap-s-4hana-cloud/) - - [Know Before You Go: Compensation and Benefits Highlights at SuccessConnect 2022](https://blogs.sap.com/2022/09/07/know-before-you-go-compensation-and-benefits-highlights-at-successconnect-2022/) -- SentinelOne - - [Cyber Risks in the Education Sector | Why Cybersecurity Needs to Be Top of the Class](https://www.sentinelone.com/blog/cyber-risks-in-the-education-sector-why-cybersecurity-needs-to-be-top-of-the-class/) -- Insinuator.net - - [Spymax: The android RAT and it works like that….](https://insinuator.net/2022/09/spymax-the-android-rat-and-it-works-like-that/) -- Didier Stevens - - [Update: hex-to-bin.py Version 0.0.6](https://blog.didierstevens.com/2022/09/07/update-hex-to-bin-py-version-0-0-6/) -- blog.avast.com EN - - [The Most Hated Man on the Internet: Has the world changed?](https://blog.avast.com/most-hated-man-internet-world-changed) -- The Daily Swig | Cybersecurity news and views - - [A rough guide to launching a career in cybersecurity](https://portswigger.net/daily-swig/a-rough-guide-to-launching-a-career-in-cybersecurity) -- Malwarebytes Labs - - [How to set up an Android for your kids](https://www.malwarebytes.com/blog/news/2022/09/how-to-set-up-an-android-for-your-kids) - - [Warning issued about Vice Society ransomware targeting the education sector](https://www.malwarebytes.com/blog/news/2022/09/authorities-issue-warning-about-vice-society-ransomware-targeting-the-education-sector) - - [Sextortionists used mobile malware to steal nude videos, contact lists from victims](https://www.malwarebytes.com/blog/news/2022/09/sextortionists-used-mobile-malware-to-steal-nude-videos-contact-lists-from-victims) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | Apache IoTDB 模块存在安全漏洞；洛杉矶联合学区遭勒索软件攻击](https://www.freebuf.com/news/344014.html) - - [Moobot 僵尸网络“盯上了”D-Link 路由器](https://www.freebuf.com/news/343953.html) - - [250万学生贷款记录因违规泄露](https://www.freebuf.com/news/343949.html) -- 绿盟科技技术博客 - - [设备指纹技术介绍与综述（二）](http://blog.nsfocus.net/fingerprint/) -- Microsoft Security Response Center - - [Curious, Innovative, Creative, Community Driven: Meet Cyb3rWard0g, Roberto Rodriquez](https://msrc-blog.microsoft.com/2022/09/07/curious-innovative-creative-community-driven-meet-cyb3rward0g-roberto-rodriquez/) -- KitPloit - PenTest & Hacking Tools - - [Coercer - A Python Script To Automatically Coerce A Windows Server To Authenticate On An Arbitrary Machine Through 9 Methods](http://www.kitploit.com/2022/09/coercer-python-script-to-automatically.html) -- 安全牛 - - [Web应用安全防护的十大误区](https://www.aqniu.com/hometop/88833.html) - - [专家观点 | 政务外网关键信息基础设施安全保护实践与探索](https://www.aqniu.com/homenews/88832.html) - - [安全牛课堂丨开展安全意识培训的5个技巧](https://www.aqniu.com/homenews/88831.html) - - [云盾智慧新品发布，三大产品重磅推出](https://www.aqniu.com/vendor/88830.html) - - [海云安-国家网络安全宣传周 | 科普：网络安全是什么](https://www.aqniu.com/vendor/88826.html) -- 奇客Solidot–传递最新科技情报 - - [马斯克和 Twitter 在听证会上激烈交锋](https://www.solidot.org/story?sid=72707) - - [Stable Diffusion：你所见到的不再是真的](https://www.solidot.org/story?sid=72706) - - [月壤可作月球基地隔热材料](https://www.solidot.org/story?sid=72705) - - [泰坦尼克沉船 8K 视频发布](https://www.solidot.org/story?sid=72704) - - [巴西停售不提供充电器的苹果手机](https://www.solidot.org/story?sid=72703) - - [NASA 现在能在火星上可靠产生一棵树所释放的氧气](https://www.solidot.org/story?sid=72702) - - [Chrome 年内第六次修复正被利用的 0day](https://www.solidot.org/story?sid=72701) - - [洲际酒店集团遭到网络攻击](https://www.solidot.org/story?sid=72700) - - [NASA 计划在未来太空任务中使用 RISC-V 架构处理器](https://www.solidot.org/story?sid=72699) - - [中国如何塑造 iPhone](https://www.solidot.org/story?sid=72698) - - [腾讯投资育碧控股家族](https://www.solidot.org/story?sid=72697) - - [美国计划转向每年接种新冠加强针](https://www.solidot.org/story?sid=72696) -- HackerNews - - [影响 Zyxel NAS 设备的严重 RCE 漏洞，已发布固件补丁](https://hackernews.cc/archives/41367) - - [250 万学生贷款记录因违规泄露](https://hackernews.cc/archives/41364) - - [Moobot 僵尸网络“盯上了”D-Link 路由器](https://hackernews.cc/archives/41359) - - [国际刑警组织在亚洲捣毁性勒索团伙](https://hackernews.cc/archives/41353) - - [CICD 管道中的代码注入漏洞影响 Google、Apache 开源 GitHub 项目](https://hackernews.cc/archives/41351) - - [开源密码管理器 Bitwarden 融资 1 亿美元](https://hackernews.cc/archives/41348) - - [洛杉矶联合学区遭勒索软件攻击，多项服务出现中断](https://hackernews.cc/archives/41345) -- rtl-sdr.com - - [Running KrakenSDR on the Steam Deck](https://www.rtl-sdr.com/running-krakensdr-on-the-steam-deck/) - - [Frugal Radio KrakenSDR Part 1 – Unboxing, Antennas and Initial Setup](https://www.rtl-sdr.com/frugal-radio-krakensdr-part-1-unboxing-antennas-and-initial-setup/) - - [SATRAN MK3 Antenna Rotator Hardware Kit Released](https://www.rtl-sdr.com/satran-mk3-antenna-rotator-hardware-kit-released/) -- 无害实验室sec - - [360首次公开网安运营工程师内训课程，速领！](https://mp.weixin.qq.com/s?__biz=MzkwMTE4NDM5NA==&mid=2247486034&idx=1&sn=0b85097735e5649981c230dfd26e87bc&chksm=c0b9e4b7f7ce6da1a590f4c2816bbbbe98f8f34260a6e3b2e2f0a705161a2ba216118c3299c1&scene=58&subscene=0#rd) -- 阿里安全响应中心 - - [报名开启｜12家SRC邀您加入双11安全保卫战](https://mp.weixin.qq.com/s?__biz=MzIxMjEwNTc4NA==&mid=2652992790&idx=1&sn=f4baa4e521c79b56956b49a03e8115f3&chksm=8c9efa41bbe97357bdee6049c5a5abe83ecd3aa1eb15e30e1c1ed98f724f3cb3cb53e1cd9a2b&scene=58&subscene=0#rd) -- Reverse Engineering - - [Pixel6: Booting up](https://www.reddit.com/r/ReverseEngineering/comments/x80wjs/pixel6_booting_up/) -- 安全威胁情报 - - [“顺着一个攻击IP，4小时后我们站在了攻击者的工位前”](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650174085&idx=1&sn=d76c2714a09924c9fa613e5a34fd275a&chksm=f4488939c33f002f14485bddd0aae615661318121c1ecffaf33b2e8b893045172f180912ba03&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-09.md b/archive/2022/2022-09-09.md deleted file mode 100644 index f796ce1dc4..0000000000 --- a/archive/2022/2022-09-09.md +++ /dev/null @@ -1,253 +0,0 @@ -# 每日安全资讯（2022-09-09） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Mobile Mouse 3.6.0.4 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090022) - - [Trojan-Spy.Win32.Pophot.bsl / Insecure Permissions](https://cxsecurity.com/issue/WLB-2022090021) - - [Apache Spark Unauthenticated Command Injection](https://cxsecurity.com/issue/WLB-2022090020) -- Microsoft Security Blog - - [The art and science behind Microsoft threat hunting: Part 1](https://www.microsoft.com/security/blog/2022/09/08/part-1-the-art-and-science-of-threat-hunting/) - - [Microsoft investigates Iranian attacks against the Albanian government](https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/) -- Security Boulevard - - [Azure: In the Clouds With VSA](https://securityboulevard.com/2022/09/azure-in-the-clouds-with-vsa/) - - [War-Time vs Peace-Time Vulnerability Management](https://securityboulevard.com/2022/09/war-time-vs-peace-time-vulnerability-management/) - - [What is Vishing and Is It A Threat to Your Business?](https://securityboulevard.com/2022/09/what-is-vishing-and-is-it-a-threat-to-your-business/) - - [“Dude, Where’s My Data?” — How Data Is Lost in the Cloud](https://securityboulevard.com/2022/09/dude-wheres-my-data-how-data-is-lost-in-the-cloud/) - - [What is DevSecOps? How Does It Work & What Are the Benefits?](https://securityboulevard.com/2022/09/what-is-devsecops-how-does-it-work-what-are-the-benefits/) - - [5 Benefits of Hiring a Virtual Chief Information Security Officer (vCISO)](https://securityboulevard.com/2022/09/5-benefits-of-hiring-a-virtual-chief-information-security-officer-vciso/) - - [Living Six Months of Core Values](https://securityboulevard.com/2022/09/living-six-months-of-core-values/) - - [How To Bolster Your Azure Cloud Security](https://securityboulevard.com/2022/09/how-to-bolster-your-azure-cloud-security/) - - [Threat Actors Exploiting Dormant Accounts to Bypass MFA: What You Need to Know](https://securityboulevard.com/2022/09/threat-actors-exploiting-dormant-accounts-to-bypass-mfa-what-you-need-to-know/) - - [Atomized Network is an “And” not an “Or”: Driving to Cloud Transformation](https://securityboulevard.com/2022/09/atomized-network-is-an-and-not-an-or-driving-to-cloud-transformation/) -- Recent Commits to cve:main - - [Update Thu Sep 8 10:03:01 UTC 2022](https://github.com/trickest/cve/commit/4d7ae9176e4f2edade64bb31ae88457effd3c105) -- Google Online Security Blog - - [Fuzzing beyond memory corruption: Finding broader classes of vulnerabilities automatically](http://security.googleblog.com/2022/09/fuzzing-beyond-memory-corruption.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [360首次发布国家级黑客组织能力象限图 为国家打造数字空间“预警机”](https://www.4hou.com/posts/AOoz) - - [2022国家网络安全宣传周网络安全人才市场报告发布：人才供需多集中在一线城市](https://www.4hou.com/posts/yk5W) - - [「手」护者第六期｜安全“向左” 攻防“无幻”主题沙龙预告！](https://www.4hou.com/posts/xj5r) - - [XCon2022议题 | 可信密态计算：密态时代的基础设施技术](https://www.4hou.com/posts/r756) - - [ZecOps 对 AliExpress 平台购买的 Android 手机取证分析，发现该手机将系统 Android 6 伪造欺骗成 Android 10](https://www.4hou.com/posts/QLgL) - - [黑客称窃取TikTok和微信数据，TikTok否认](https://www.4hou.com/posts/2Jrv) -- Trustwave Blog - - [Developing Cyber Talent Using Capture the Flag Exercises](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/developing-cyber-talent-using-capture-the-flag-exercises/) -- 跳跳糖 - 安全与分享社区 - - [原生反序列化链 jdk8u20 的新构造](https://tttang.com/archive/1729/) -- Files ≈ Packet Storm - - [Apache Spark Unauthenticated Command Injection](https://packetstormsecurity.com/files/168309/apache_spark_rce_cve_2022_33891.rb.txt) - - [Wireshark Analyzer 3.6.8](https://packetstormsecurity.com/files/168308/wireshark-3.6.8.tar.xz) - - [Hydra Network Logon Cracker 9.4](https://packetstormsecurity.com/files/168307/thc-hydra-9.4.tar.gz) - - [Red Hat Security Advisory 2022-6392-01](https://packetstormsecurity.com/files/168306/RHSA-2022-6392-01.txt) - - [Red Hat Security Advisory 2022-6389-01](https://packetstormsecurity.com/files/168305/RHSA-2022-6389-01.txt) - - [Red Hat Security Advisory 2022-6393-01](https://packetstormsecurity.com/files/168304/RHSA-2022-6393-01.txt) - - [Red Hat Security Advisory 2022-6258-01](https://packetstormsecurity.com/files/168303/RHSA-2022-6258-01.txt) - - [Red Hat Security Advisory 2022-6382-01](https://packetstormsecurity.com/files/168302/RHSA-2022-6382-01.txt) - - [Red Hat Security Advisory 2022-6287-01](https://packetstormsecurity.com/files/168301/RHSA-2022-6287-01.txt) - - [Red Hat Security Advisory 2022-6384-01](https://packetstormsecurity.com/files/168300/RHSA-2022-6384-01.txt) - - [Red Hat Security Advisory 2022-6385-01](https://packetstormsecurity.com/files/168299/RHSA-2022-6385-01.txt) - - [Red Hat Security Advisory 2022-6383-01](https://packetstormsecurity.com/files/168298/RHSA-2022-6383-01.txt) - - [Red Hat Security Advisory 2022-6386-01](https://packetstormsecurity.com/files/168297/RHSA-2022-6386-01.txt) - - [Ubuntu Security Notice USN-4976-2](https://packetstormsecurity.com/files/168296/USN-4976-2.txt) -- Twitter @Nicolas Krassas - - [Prototype Pollution Primer for Pentesters and Programmers](https://twitter.com/Dinosn/status/1567951421550776321) - - [Fuzzing beyond memory corruption: Finding broader classes of vulnerabilities automatically](https://twitter.com/Dinosn/status/1567948326783356930) - - [Shiba Inu Crypto cloud credentials leaked on a public repository!](https://twitter.com/Dinosn/status/1567948055130902533) - - [Riding the InfoRail to Exploit Ivanti Avalanche – Part 2](https://twitter.com/Dinosn/status/1567947869889372161) - - [US recovers $30 million stolen from Axie Infinity by Lazarus hackers](https://twitter.com/Dinosn/status/1567947813987979264) - - [CVE-2021-42133, CVE-2022-36971, & CVE-2022-36981: Multiple Ivanti Avalanche Code Execution Bugs](https://twitter.com/Dinosn/status/1567927747112218624) - - [Facebook Has No Idea What Data It Has](https://twitter.com/Dinosn/status/1567927686349332482) - - [The art and science behind Microsoft threat hunting: Part 1](https://twitter.com/Dinosn/status/1567910903885987842) - - [Microsoft: Iranian hackers encrypt Windows systems using BitLocker](https://twitter.com/Dinosn/status/1567910279584915457) - - [RT chompie: Curious about exploiting VMs or memory bugs in a safe language? Read my new blog post, where I attack Firecracker, AWS' VMM written in Rus...](https://twitter.com/chompie1337/status/1567909910779957249) - - [North Korean Lazarus Hackers Targeting Energy Providers Around the World](https://twitter.com/Dinosn/status/1567876548400750593) - - [Classified NATO documents stolen from Portugal, now sold on darkweb](https://twitter.com/Dinosn/status/1567876499226726402) - - [ForceAdmin - Create Infinite UAC Prompts Forcing A User To Run As Admin](https://twitter.com/Dinosn/status/1567868086404915202) - - [CVE-2022-20696: Cisco SD-WAN vManage Software Security Bypass Flaw](https://twitter.com/Dinosn/status/1567860932683960328) -- Sucuri Blog - - [What Is Clickjacking and How Do I Prevent It?](https://blog.sucuri.net/2022/09/what-is-clickjacking-and-how-do-i-prevent-it.html) -- Tenable Blog - - [IT/OT Convergence: Now Is the Time to Act](https://www.tenable.com/blog/itot-convergence-now-is-the-time-to-act) -- paper - Last paper - - [VMware 系列产品之身份验证绕过和 JDBC 注入漏洞分析](https://paper.seebug.org/1962/) - - [CVE-2022-0540 Jira 身份验证绕过漏洞分析](https://paper.seebug.org/1961/) - - [PyPI 网络钓鱼活动 | JuiceLedger 黑客从虚假应用转向供应链攻击](https://paper.seebug.org/1960/) -- Sploitus.com Exploits RSS Feed - - [SACCO 2022 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37947&utm_source=rss&utm_medium=rss) - - [WordPress BackupBuddy 8.7.4.1 Arbitrary File Read Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37944&utm_source=rss&utm_medium=rss) - - [Apache Spark Unauthenticated Command Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37945&utm_source=rss&utm_medium=rss) - - [Apache Spark Unauthenticated Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168309&utm_source=rss&utm_medium=rss) - - [WordPress Twenty Seventeen 3.0 Cross-origin resource sharing information Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37946&utm_source=rss&utm_medium=rss) - - [FE File Explorer 11.0.4 Local File Inclusion Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37942&utm_source=rss&utm_medium=rss) - - [FTPManager 8.2 Local File Inclusion / Directory Traversal Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37943&utm_source=rss&utm_medium=rss) - - [Exploit for Expression Language Injection in Apache Log4J exploit](https://sploitus.com/exploit?id=94A8FFF1-6A48-57CB-9340-D6806F47EFA0&utm_source=rss&utm_medium=rss) - - [Exploit for Use After Free in Google Android exploit](https://sploitus.com/exploit?id=FEF93DE9-A774-510E-98DE-5F74D4CA06FE&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2021-38314 exploit](https://sploitus.com/exploit?id=C01987A4-07C6-58DF-AC17-C18A9BB94634&utm_source=rss&utm_medium=rss) - - [Exploit for SQL Injection in Djangoproject Django exploit](https://sploitus.com/exploit?id=64158524-CDDE-564C-A824-46758B22B639&utm_source=rss&utm_medium=rss) -- 先知安全技术社区 - - [关于那WebSocket劫持的二三事](https://xz.aliyun.com/t/11684) -- 机智的程序员小熊 - - [django 字段验证器/DRF](https://coding3min.com/1920.html) -- SecWiki News - - [SecWiki News 2022-09-08 Review](http://www.sec-wiki.com/?2022-09-08) -- 安全脉搏 - - [简单钓鱼文件制作——Word邮件与CSV注入](https://www.secpulse.com/archives/187000.html) - - [验证码识别插件对登录页面进行爆破](https://www.secpulse.com/archives/186973.html) - - [Exchange 暴力破解与防范](https://www.secpulse.com/archives/186966.html) - - [edusrc漏洞笔记（逻辑篇2.0）](https://www.secpulse.com/archives/186945.html) -- obaby@mars - - [中文域名体验记](http://h4ck.org.cn/2022/09/%e4%b8%ad%e6%96%87%e5%9f%9f%e5%90%8d%e4%bd%93%e9%aa%8c%e8%ae%b0/) -- 先知安全技术社区 - - [关于那WebSocket劫持的二三事](https://xz.aliyun.com/t/11684) -- Swing'Blog 浮生若梦 - - [Nccgroup Pwn2Own 中攻破 Netgear R6700路由器的漏洞分析](https://bestwing.me/nccgroup-in-pwn2own-pwned-netgear-r6700-route-vulnerability-analysis.html) -- unSafe.sh - 不安全 - - [关于那WebSocket劫持的二三事](https://buaq.net/go-125841.html) - - [一些BAT的XSS实例（三）中级篇](https://buaq.net/go-125657.html) -- 安全客-有思想的安全新媒体 - - [警惕！“清理、Wifi”类应用不能随意下载](https://www.anquanke.com/post/id/276543) - - [afrog 发布新版 Release 1.3.7](https://www.anquanke.com/post/id/276524) - - [CVE-2022-22978 Spring-security 认证绕过漏洞分析和漏洞挖掘思考](https://www.anquanke.com/post/id/279670) - - [勒索软件团伙Cobalt Strike服务器涌现反俄内容](https://www.anquanke.com/post/id/279760) - - [前Conti勒索软件成员组团攻击乌克兰](https://www.anquanke.com/post/id/279757) - - [伊朗黑客组织APT42部署新型定制间谍软件](https://www.anquanke.com/post/id/279773) - - [信息窃取木马 Predator the Thief v3.3.2 版本分析](https://www.anquanke.com/post/id/279723) - - [因遭伊朗网络攻击，阿尔巴尼亚宣布与伊朗断绝外交关系](https://www.anquanke.com/post/id/279784) - - [乌克兰黑客设局，获俄军阵地位置引导军方轰炸](https://www.anquanke.com/post/id/279780) - - [数字安全观察每周简报-【技术趋势】 （2022.08.24-2022.08.30）](https://www.anquanke.com/post/id/279738) - - [CVE-2022-34747：Zyxel NAS设备远程代码执行漏洞通告](https://www.anquanke.com/post/id/279719) - - [因向黑客提供信息，以色列防长家清洁工获刑3年](https://www.anquanke.com/post/id/279712) - - [国家网安周发布首部《网络安全人才实战能力白皮书》](https://www.anquanke.com/post/id/279714) - - [日政府网站遭网络攻击 或为亲俄派黑客组织发动](https://www.anquanke.com/post/id/279696) -- root@cyberworld:~# Noah Lab - - [Xalan-J XSLT整数截断漏洞利用构造(CVE-2022-34169)](http://noahblog.360.cn/xalan-j-integer-truncation-reproduce-cve-2022-34169/) -- MWR Publications - - [Prototype Pollution Primer for Pentesters and Programmers](https://labs.withsecure.com/blog/prototype-pollution-primer-for-pentesters-and-programmers/) -- CTFするぞ - - [CakeCTF 2022を開催しました](https://ptr-yudai.hatenablog.com/entry/2022/09/09/002058) -- Didier Stevens - - [Quickpost: Sun Drying Biodegradable Waste](https://blog.didierstevens.com/2022/09/08/quickpost-sun-drying-biodegradable-waste/) -- Securelist - - [Threat landscape for industrial automation systems for H1 2022](https://securelist.com/threat-landscape-for-industrial-automation-systems-for-h1-2022/107373/) -- Reverse Engineering - - [Fork Bomb for Flutter](https://www.reddit.com/r/ReverseEngineering/comments/x93qog/fork_bomb_for_flutter/) - - [CVE-2021-42133, CVE-2022-36971, & CVE-2022-36981: Multiple Ivanti Avalanche Code Execution Bugs](https://www.reddit.com/r/ReverseEngineering/comments/x94j3r/cve202142133_cve202236971_cve202236981_multiple/) -- Forcepoint - - [Forcepoint at the Gartner Security & Risk Management Summit Next Week](https://www.forcepoint.com/blog/insights/forcepoint-gartner-security-risk-management-summit) -- SAP Blogs - - [NFe Cloud Outbound – Outbound Invoicing Option for Brazil – How does it work?](https://blogs.sap.com/2022/09/08/nfe-cloud-outbound-outbound-invoicing-option-for-brazil-how-does-it-work/) - - [NFe Cloud Outbound – Outbound Invoicing Option for Brazil – Como funciona?](https://blogs.sap.com/2022/09/08/nfe-cloud-outbound-outbound-invoicing-option-for-brazil-como-funciona/) - - [HCM Brasil: Atualizações e novidades de agosto/2022](https://blogs.sap.com/2022/09/08/hcm-brasil-atualizacoes-e-novidades-de-agosto-2022/) - - [HCM Nómina España: Nueva actualización en la funcionalidad de Contratos](https://blogs.sap.com/2022/09/08/hcm-nomina-espana-nueva-actualizacion-en-la-funcionalidad-de-contratos/) - - [HANA Data Lake Materialized Views](https://blogs.sap.com/2022/09/08/hana-data-lake-materialized-views/) - - [Reconciliation report on ODQMON T-Code](https://blogs.sap.com/2022/09/08/reconciliation-report-on-odqmon-t-code/) - - [Stefan’s Not-to-Miss Agenda Highlights for the Upcoming International SAP Conferences for Metals, Mining, Building Materials and Forest Products – September 27-29, 2022, Madrid](https://blogs.sap.com/2022/09/08/stefans-not-to-miss-agenda-highlights-at-the-upcoming-international-sap-conferences-for-metals-mining-building-materials-and-forest-products-september-27-29-2022-madrid/) -- The Daily Swig | Cybersecurity news and views - - [Vendor disputes seriousness of firewall plugin RCE flaw](https://portswigger.net/daily-swig/vendor-disputes-seriousness-of-firewall-plugin-rce-flaw) - - [WordPress warning: 140k BackupBuddy installations on alert over file-read exploitation](https://portswigger.net/daily-swig/wordpress-warning-140k-backupbuddy-installations-on-alert-over-file-read-exploitation) -- Application Security Blog - - [Smart home under fuzzing](https://www.synopsys.com/blogs/software-security/smart-home-fuzzing-defensics/) -- daniel.haxx.se - - [http://http://http://@http://http://?http://#http://](https://daniel.haxx.se/blog/2022/09/08/http-http-http-http-http-http-http/) -- Malwarebytes Labs - - [InterContinental Hotels' booking systems disrupted by cyberattack](https://www.malwarebytes.com/blog/news/2022/09/intercontinental-hotels-booking-systems-disrupted-by-cyberattack) - - [Ransomware review: August 2022](https://www.malwarebytes.com/blog/threat-intelligence/2022/09/ransomware-review-august-2022) - - [Vulnerability response for SMBs: The Malwarebytes approach](https://www.malwarebytes.com/blog/business/2022/09/vulnerability-response-for-smbs-the-malwarebytes-approach) -- Sucuri Blog - - [What Is Clickjacking and How Do I Prevent It?](https://blog.sucuri.net/2022/09/what-is-clickjacking-and-how-do-i-prevent-it.html) -- Wallarm - - [Integrating API Security and WAF into K8s Kong API Gateway](https://lab.wallarm.com/integrating-apisecurity-and-waf-into-kong-api-gateway/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 数万人被虚假的苹果发布会直播欺骗；TikTok否认黑客窃取其数据](https://www.freebuf.com/news/344108.html) - - [正式开源！无恒实验室推出appshark自动化漏洞及隐私合规检测工具](https://www.freebuf.com/vuls/344074.html) - - [网信办发布《网信部门行政执法程序规定（征求意见稿）》](https://www.freebuf.com/news/344065.html) - - [Gartner发布2022云Web应用程序和API保护魔力象限](https://www.freebuf.com/articles/network/344060.html) - - [新型隐形恶意软件Shikitega正针对Linux系统](https://www.freebuf.com/news/344056.html) -- bishopfox.com - - [Solving the Unredacter Challenge](https://bishopfox.com/blog/unredacter-winner) -- rtl-sdr.com - - [KrakenSDR Locates a TETRA Transmitter](https://www.rtl-sdr.com/krakensdr-locates-a-tetra-transmitter/) - - [IEEE Spectrum: Chasing Weather Balloons with Software Defined Radio](https://www.rtl-sdr.com/ieee-spectrum-chasing-weather-balloons-with-software-defined-radio/) - - [Software Defined Radio Academy 2022 Conference Talks](https://www.rtl-sdr.com/software-defined-radio-academy-2022-conference-talks/) -- blog.avast.com EN - - [Is your phone Safe For Scrollers (SFS)?](https://blog.avast.com/phone-safe-for-scrollers) - - [Back to school: Top tips and tricks](https://blog.avast.com/back-to-school-tips-tricks) -- 绿盟科技技术博客 - - [全球IPv4 AS拓扑测绘初探](http://blog.nsfocus.net/ipv4-as/) -- 奇客Solidot–传递最新科技情报 - - [《小猪佩奇》首次出现同性伴侣](https://www.solidot.org/story?sid=72719) - - [库克回应苹果不支持 RCS：给妈妈买一部 iPhone](https://www.solidot.org/story?sid=72718) - - [天文学家发现一颗可能适宜生命的超级地球](https://www.solidot.org/story?sid=72717) - - [Conti 勒索软件黑帮前成员参与对乌克兰的网络战](https://www.solidot.org/story?sid=72716) - - [3 万年前的截肢手术](https://www.solidot.org/story?sid=72715) - - [勒索软件 DeadBolt 以 QNAP NAS 设备为攻击目标](https://www.solidot.org/story?sid=72714) - - [印度考虑对网游赢家征税](https://www.solidot.org/story?sid=72713) - - [阿尔巴尼亚因网络攻击切断与伊朗的外交关系](https://www.solidot.org/story?sid=72712) - - [Twitter 允许用户编辑推文最多五次](https://www.solidot.org/story?sid=72711) - - [韩国超导托卡马克聚变装置实现 1 亿摄氏度运行 30 秒](https://www.solidot.org/story?sid=72710) - - [马斯克因担心三战而建议推迟 Twitter 交易](https://www.solidot.org/story?sid=72709) - - [苹果发布 iPhone 14，支持卫星 SOS 紧急联络](https://www.solidot.org/story?sid=72708) -- 黑海洋 - WIKI - - [SSH客户端WinSCP v5.21.3便携版](https://blog.upx8.com/2965) - - [Self-hosted HTTPS with a custom certificate authority](https://blog.upx8.com/2963) -- KitPloit - PenTest & Hacking Tools - - [ForceAdmin - Create Infinite UAC Prompts Forcing A User To Run As Admin](http://www.kitploit.com/2022/09/forceadmin-create-infinite-uac-prompts.html) -- HackerNews - - [新兴的跨平台 BianLian 勒索软件攻击正在提速](https://hackernews.cc/archives/41396) - - [新型隐形恶意软件 Shikitega 正针对 Linux 系统](https://hackernews.cc/archives/41393) - - [当局关闭出售被盗凭证和信用卡的 WT1SHOP 网站](https://hackernews.cc/archives/41387) - - [《Minecraft》 是黑客用于诱饵最多的一款游戏](https://hackernews.cc/archives/41381) - - [IHG 酒店集团承认遭网络攻击，预订等系统出现中断](https://hackernews.cc/archives/41378) - - [Ring 终于为其视频门铃带来端对端加密功能](https://hackernews.cc/archives/41375) - - [黑客组织 KillNet 攻击日政府网站第二天，东京和大阪地铁网站也瘫了](https://hackernews.cc/archives/41372) -- Twitter @Keiran Smith (Affix) - - [Hey @Uber is this allowed?](https://twitter.com/cli/status/1568003548041863169) -- Checkmarx.com - - [A Developer’s View of Modern Application Development and Cloud-Native Approaches](https://checkmarx.com/blog/a-developers-view-of-modern-application-development-and-cloud-native-approaches/) -- 绿盟科技金融事业部 - - [暗网？隐私？您要的敏感信息监测方案在这！](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247492218&idx=1&sn=7a57a5fb227748e78cc8ba368b3c3134&chksm=eaac713ddddbf82b6913cdfb52e9e2589083446362121a658b46560e0621bde804a570e51948&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【工具】社会网络分析工具：D3、sigma、pajek、snap](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651131885&idx=1&sn=4ab48c7802de338f9905c5888328819e&chksm=f1af78d7c6d8f1c16dd1dcdd177e971e2b8c64f1eed149bc783f29a2eaecd2e106c51e1025b5&scene=58&subscene=0#rd) -- 信息安全国家工程研究中心 - - [工程中心获冬奥网络安全工作优秀技术支持单位荣誉称号！](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247492069&idx=1&sn=0c1e519b385aa240f544596d9733f2b5&chksm=feb660f6c9c1e9e0177df0a7032e554ff122778bbe2cad61cc23f3d0f15989c91cc695c460c0&scene=58&subscene=0#rd) - - [网络安全宣传周|这些网络安全知识，你知道吗？](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247492069&idx=2&sn=df8003db11b2b9363c678ba7ba99fae2&chksm=feb660f6c9c1e9e0455cc61b3ee63099dd0c3cd0ef667c24914e9cc664bc32f1d4c0f70c248b&scene=58&subscene=0#rd) -- 默安科技 - - [某股份制商业银行超大规模DevSecOps分布式部署实践](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247493945&idx=1&sn=aab8f66dfa1554e9554b64f36fb01d58&chksm=e93b1e1bde4c970dadb23b05fd1a28ce1db2a4059065a264e8d571dc614484161326c9f43059&scene=58&subscene=0#rd) -- 三六零CERT - - [2022年8月勒索病毒态势分析](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491398&idx=1&sn=38b5d0185ca0f0be7dc1b5d1ab1623ad&chksm=fe251a47c95293518eb17053875e60521ab065dd8a92445a45cc781a1609c98b126faa48423e&scene=58&subscene=0#rd) - - [安全日报（2022.09.08）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491398&idx=2&sn=c1f33b9e2d0ab6573c7c3d955eb042ac&chksm=fe251a47c952935196f70081bb6523bc67fc831b91b8451648b0bd57ffa1d9fa3fc0745eb50a&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [XCon2022议题 | 可信密态计算：密态时代的基础设施技术](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550051&idx=1&sn=98d22ed1cedc00b00e10d199a73cf07f&chksm=e915d459de625d4f36d5e91be6c30347a64008e7c137d196ba4b87888e889ecec5957bdc9929&scene=58&subscene=0#rd) - - [黑客称窃取TikTok和微信数据，TikTok否认](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550051&idx=2&sn=921db52402a804fe395c084ff8dee2d2&chksm=e915d459de625d4f93f0c638d85d1225b9ddf68fc2081257f0711180bd819eb56e27cdc3cd0f&scene=58&subscene=0#rd) - - [ZecOps 对 AliExpress 平台购买的 Android 手机取证分析](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550051&idx=3&sn=88924f43f8f8ed59b1575c7dbf08fbc5&chksm=e915d459de625d4f3d39375cf8c801cc6a44db4fa1ab98f3eb26be8726277af57a09b5781c20&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】800万美元可购买破解任何智能手机的0day漏洞](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016310&idx=1&sn=0f4193a2321197b6b8a7bfcf7ecff27f&chksm=f36fa2f6c4182be0b48ec33d6c5aa8aef24ea8d329b38067874ef21294bc1ff9b6b21399047c&scene=58&subscene=0#rd) - - [【安全圈】沙盒游戏《我的世界》是黑客用于诱饵最多的一款游戏](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016310&idx=2&sn=6eb634eabd39a32b8a0272c23fc2bf30&chksm=f36fa2f6c4182be0a548e17ac4afb034f27ef920e00d3c5da660b69afbc2e70d001bd750671f&scene=58&subscene=0#rd) - - [【安全圈】美国一市政府遭遇钓鱼邮件诈骗攻击，损失400万美元](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016310&idx=3&sn=dd60fc0bbce51c031501c521d26e1ba2&chksm=f36fa2f6c4182be0b4ceae92c3c83afcdf42b0a71b1731088f97111d729295ad89593b6339c0&scene=58&subscene=0#rd) - - [【安全圈】CICD管道中的代码注入漏洞影响Google、Apache开源GitHub项目](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016310&idx=4&sn=93905da2423a0214694ecd87a795e2f3&chksm=f36fa2f6c4182be0dbba265194064143a597d4e7d89ea97688dd69275296465350af5184e00f&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [IOT设备常见配置文件加解密分析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496354&idx=1&sn=79f02dbebafeb18dfc3e962c489a560f&chksm=fa52271ccd25ae0aed841fe7812172f3b161725199f2e891363008757d13c8fe3a23058a6a65&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | Bitbucket 服务器中的命令注入漏洞](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495609&idx=1&sn=8db06764b675fd1a703a84b753dc5837&chksm=c0074225f770cb330379ff622acc3d75b3991f3a53fcf7958931a65c12f7cec4a6c8f84cff07&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [2022年国家网络安全宣传周“电信日”主题论坛在安徽合肥召开](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531347&idx=1&sn=dbc9d4db7d8ee0415fbb150f9c327f72&chksm=fa93cd92cde4448444e6b8a0195ec1a091c39a64b83cbc37fadd06a88e766fd20155be5074b7&scene=58&subscene=0#rd) - - [Web应用安全防护的十大误区](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531347&idx=2&sn=ffbbb1c4e73a3203eaf0d5175c4533e1&chksm=fa93cd92cde4448445bbd84c467c39508142227f9ed74c69614210347b0c5a49e29e1f05a709&scene=58&subscene=0#rd) - - [洲际酒店集团遭网络攻击预订系统瘫痪](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531347&idx=3&sn=abb8013e711487914857b7e6f578fe0c&chksm=fa93cd92cde444846be221f74740d4c8974dd8d1bef29582f9fb9d02ae46efec1a32fd05464f&scene=58&subscene=0#rd) -- 安全牛 - - [托管防火墙服务（MFW）应用的利与弊](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118471&idx=1&sn=bb9ebe3e06af2d164d18473336694a14&chksm=bd146b548a63e242b10c436d79a87dc0d020ab4af757f2e99a05929e6c1173a8393a048b77f2&scene=58&subscene=0#rd) - - [美国商务部出台芯片法案实施细则，“安全合规”成为优先考虑因素！](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118471&idx=2&sn=760522ea5ff551c12f5bd380f8496783&chksm=bd146b548a63e24251a3768ffcd88bf857a2c648b257de5134db59aab0fb4db7f07c042b7208&scene=58&subscene=0#rd) - - [安全牛课堂 | OSEP高级渗透测试首期班即将开课](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118471&idx=3&sn=7c07e66b58e4bff04b46c975630696ee&chksm=bd146b548a63e24259544d6f9e752a475a797c4976f3cb66c13eb5adb77915a255d7c810d6fc&scene=58&subscene=0#rd) -- 补天平台 - - [补天开学季，玩法大揭秘！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247495078&idx=1&sn=dc0b992d19e908806539e69e747bf9e8&chksm=eaf9a5eadd8e2cfc6174e433db022f21578e8169a55a23636f331ce89aaded1cab32927aec60&scene=58&subscene=0#rd) -- 情报分析师 - - [【经典教程】《情报分析师应用指南》实战和训练秘笈](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515888&idx=1&sn=fab2561ed07dab3f6be704fb05c42d2a&chksm=871687fbb0610eed8e1991ed794bf79cf24775c6b90f78c33a8b845ff5a394fb3e9f3e1f531f&scene=58&subscene=0#rd) - - [【情报简报】虚假信息生态系统矩阵和未来](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515888&idx=2&sn=0d3677c42e6871313858b232c637888f&chksm=871687fbb0610eedfd999d152104ff2607977a75e1072b72d8dc1a931f09b63c52f547fec81b&scene=58&subscene=0#rd) - - [【情报课堂】开源情报工具在调查中的独特价值](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515888&idx=3&sn=3cef03eb159599115f21bbe1efdeeee9&chksm=871687fbb0610eede9a7c0f43bc25e7512cc1820c3ad03c956f8c167158aa0eb02cf393abca9&scene=58&subscene=0#rd) -- 安全威胁情报 - - [微步在线亮相2022国家网络安全宣传周](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650174111&idx=1&sn=6aca5322cf2453ec63a49fa7a1fa6fde&chksm=f4488923c33f00352bb5162c018ae9bcb448fcef39f11008abb55c99f97658b7cca3a9dfd14f&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [报名开启｜美团SRC邀您加入双11安全保卫战](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247490388&idx=1&sn=461e1baa671e8cb7159c343dcf884d68&chksm=ec1bfa87db6c7391e4d6c81768a99a5efa13ce85ba75ee3203732b62b7f8a4f3e2c43680db48&scene=58&subscene=0#rd) -- 极客公园 - - [滑板底盘，新造车最大的「变量」？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966983&idx=1&sn=71381e1c3a3ce1caed74a92ce2aeae10&chksm=7e546df14923e4e7e48f484de4240e3d0f3f7e2270ff1aff805ea94d674e636412b097a254a4&scene=58&subscene=0#rd) - - [苹果正式宣布：手机厂下一个内卷方向是「上天」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966940&idx=1&sn=aec19f20909bf046a676a11f2186858d&chksm=7e546daa4923e4bc918409ec2166a9c74bfc6d91cc37cabe03defaf7aa86cdb04c401c25041c&scene=58&subscene=0#rd) - - [不能交易的数字藏品赛道，创业公司怎么玩？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966940&idx=2&sn=6e9d6771d2720c73c68d37b09a34720a&chksm=7e546daa4923e4bc4a47d60e4427b496b6f81717b28ddfa85152141377f7145537a7d1d056b4&scene=58&subscene=0#rd) - - [苹果发布会药丸屏登场，iPhone 14 Pro不涨价；比亚迪成全球第二大动力电池厂；新首相上任，英国御猫送箴言 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652966920&idx=1&sn=5ab259f0b2ef0789d700c722d6ed0f64&chksm=7e546dbe4923e4a8afcd774c504b1ebc48a02c856ffcf0ef49efc3584152219556b6f1a6591b&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-10.md b/archive/2022/2022-09-10.md deleted file mode 100644 index 0db3a37dce..0000000000 --- a/archive/2022/2022-09-10.md +++ /dev/null @@ -1,241 +0,0 @@ -# 每日安全资讯（2022-09-10） - -- Der Flounder - - [Microsoft Defender and tamper protection](https://derflounder.wordpress.com/2022/09/09/microsoft-defender-and-tamper-protection/) -- Sploitus.com Exploits RSS Feed - - [AirDisk 7.5.5 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168320&utm_source=rss&utm_medium=rss) - - [SACCO-2022 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168310&utm_source=rss&utm_medium=rss) - - [Sagemath 9.0 Overflow / Denial Of Service Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37949&utm_source=rss&utm_medium=rss) - - [mbDrive Lite WiFi Flash Disk 1.4.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168321&utm_source=rss&utm_medium=rss) - - [Online Notice Board 2022 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168323&utm_source=rss&utm_medium=rss) - - [Online Notice Board 2022 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37948&utm_source=rss&utm_medium=rss) - - [mbDrive Lite WiFi Flash Disk 1.4.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37951&utm_source=rss&utm_medium=rss) - - [@Drive 2.8 Local File Inclusion exploit](https://sploitus.com/exploit?id=PACKETSTORM:168316&utm_source=rss&utm_medium=rss) - - [Sagemath 9.0 Overflow / Denial Of Service exploit](https://sploitus.com/exploit?id=PACKETSTORM:168334&utm_source=rss&utm_medium=rss) - - [InTouch Access Anywhere Secure Gateway 2020 R2 Path Traversal Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37950&utm_source=rss&utm_medium=rss) - - [AirDisk 7.5.5 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37952&utm_source=rss&utm_medium=rss) - - [InTouch Access Anywhere Secure Gateway 2020 R2 Path Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:168328&utm_source=rss&utm_medium=rss) - - [@Drive 2.8 Local File Inclusion Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37953&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=C38E0645-3DE1-5134-94E3-00DFE9B99A88&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-3168 exploit](https://sploitus.com/exploit?id=195A678A-E958-5D72-842A-ABE99D4F4375&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-20128 exploit](https://sploitus.com/exploit?id=6D12C361-1BB8-5B38-BC9B-BD5107CC8B8F&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-22629 exploit](https://sploitus.com/exploit?id=480511F0-20B1-50CD-88F2-41A9E04C69A0&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [National Critical Infrastructure Under Attack: Clop Ransomware](https://securityboulevard.com/2022/09/national-critical-infrastructure-under-attack-clop-ransomware/) - - [Albania Breaks Ties With Iran After 2022 Microsoft Investigation of CVE-2019-0604](https://securityboulevard.com/2022/09/albania-breaks-ties-with-iran-after-2022-microsoft-investigation-of-cve-2019-0604/) - - [BSides Vancouver 2022 – Shelly Giesbrecht’s ‘Tailoring Evidence Preservation For Incident Objectives’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-shelly-giesbrechts-tailoring-evidence-preservation-for-incident-objectives/) - - [IronNet’s September Threat Intelligence Brief 2022](https://securityboulevard.com/2022/09/ironnets-september-threat-intelligence-brief-2022/) - - [Use Terraform and Delphix together to automate your data for DevOps](https://securityboulevard.com/2022/09/use-terraform-and-delphix-together-to-automate-your-data-for-devops/) - - [How Do You Help Your IT Team Stay Ahead of Threats?](https://securityboulevard.com/2022/09/how-do-you-help-your-it-team-stay-ahead-of-threats/) - - [Announcing CodeSonar 7.1 with Support for Hybrid Cloud Deployments and Seamless Integration into DevSecOps Pipelines](https://securityboulevard.com/2022/09/announcing-codesonar-7-1-with-support-for-hybrid-cloud-deployments-and-seamless-integration-into-devsecops-pipelines/) - - [How API Security Can Help You Prepare For FedRAMP](https://securityboulevard.com/2022/09/how-api-security-can-help-you-prepare-for-fedramp/) - - [XKCD ‘First Internet Interaction’](https://securityboulevard.com/2022/09/xkcd-first-internet-interaction/) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-sept-9) -- Mohuishou - - [k8s job 为何迟迟不能结束？](https://lailin.xyz/post/kubernetes-job-running-not-end.html) -- Twitter @Nicolas Krassas - - [Gohide - Tunnel Port To Port Traffic Over An Obfuscated Channel With AES-GCM Encryption](https://twitter.com/Dinosn/status/1568339277062316033) - - [Attackers Exploit Zero-Day WordPress Plug-in Vulnerability in BackupBuddy](https://twitter.com/Dinosn/status/1568339060736794628) - - [Coinbase funds lawsuit against Tornado Cash cryptomixer sanctions](https://twitter.com/Dinosn/status/1568339015572623363) - - [Meta disbands Responsible Innovation team, spreads it out over Facebook and co](https://twitter.com/Dinosn/status/1568338937545998337) - - [Sensitive NATO Data Stolen in Cyberattack on Portugal’s Armed Forces](https://twitter.com/Dinosn/status/1568338831283294208) - - [Responsible Disclosure for Cryptocurrency Security](https://twitter.com/Dinosn/status/1568338789625466881) - - [A multi threaded fast tool to preform active subdomain enumeration](https://twitter.com/Dinosn/status/1568219626588327938) - - [Elkeid is a Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern...](https://twitter.com/Dinosn/status/1568208021070782465) - - [Extracting Firmware from Embedded Devices (SPI NOR Flash)](https://twitter.com/Dinosn/status/1568200626860953613) - - [Malware Analysis — FFDroider](https://twitter.com/Dinosn/status/1568194510336704514) - - [Anti-Reversing Techniques (Part 1)](https://twitter.com/Dinosn/status/1568190787044757505) - - [Iran-linked DEV-0270 group abuses BitLocker to encrypt victims’ devices](https://twitter.com/Dinosn/status/1568190677875310594) - - [Hackers Exploit Zero-Day in WordPress BackupBuddy Plugin in ~5 Million Attempts](https://twitter.com/Dinosn/status/1568189852109225986) - - [wtfis: Passive host and domain name lookup tool for non-robots](https://twitter.com/Dinosn/status/1568123422256893952) - - [CVE-2022-30078: Command injection flaw affects NETGEAR routers](https://twitter.com/Dinosn/status/1568122664216043521) - - [Hackers Gained Access To Samsung Customer Data](https://twitter.com/Dinosn/status/1568122560465731586) - - [Hackers Honeytrap Russian Troops Into Sharing Location, Base Bombed](https://twitter.com/Dinosn/status/1568121801774874626) - - [Social Security Numbers Stolen In 49ers Data Breach](https://twitter.com/Dinosn/status/1568121768212062208) - - [Games Popular With Kids Used To Distribute Malware](https://twitter.com/Dinosn/status/1568121593838059521) -- SecWiki News - - [SecWiki News 2022-09-09 Review](http://www.sec-wiki.com/?2022-09-09) -- 跳跳糖 - 安全与分享社区 - - [Dubbo反序列化漏洞分析集合1](https://tttang.com/archive/1730/) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5605-1](https://packetstormsecurity.com/files/168335/USN-5605-1.txt) - - [Sagemath 9.0 Overflow / Denial Of Service](https://packetstormsecurity.com/files/168334/sagemath90-dosoverflow.txt) - - [Red Hat Security Advisory 2022-6407-01](https://packetstormsecurity.com/files/168333/RHSA-2022-6407-01.txt) - - [.NET XML Signature Verification External Entity Injection](https://packetstormsecurity.com/files/168332/GS20220909160817.tgz) - - [Windows Credential Guard TGT Renewal Information Disclosure](https://packetstormsecurity.com/files/168331/GS20220909160551.tgz) - - [Ubuntu Security Notice USN-5604-1](https://packetstormsecurity.com/files/168330/USN-5604-1.txt) - - [Windows Credential Guard Non-Constant Time Comparison Information Disclosure](https://packetstormsecurity.com/files/168329/GS20220909160406.txt) - - [InTouch Access Anywhere Secure Gateway 2020 R2 Path Traversal](https://packetstormsecurity.com/files/168328/avevaitaasg-traversal.txt) - - [Red Hat Security Advisory 2022-6263-01](https://packetstormsecurity.com/files/168327/RHSA-2022-6263-01.txt) - - [Windows Credential Guard KerbIumGetNtlmSupplementalCredential Information Disclosure](https://packetstormsecurity.com/files/168326/GS20220909155928.tgz) - - [Windows Credential Guard KerbIumCreateApReqAuthenticator Key Information Disclosure](https://packetstormsecurity.com/files/168325/GS20220909155726.tgz) - - [Ubuntu Security Notice USN-5603-1](https://packetstormsecurity.com/files/168324/USN-5603-1.txt) - - [Online Notice Board 2022 SQL Injection](https://packetstormsecurity.com/files/168323/onb2022-sql.txt) - - [Red Hat Security Advisory 2022-6262-01](https://packetstormsecurity.com/files/168322/RHSA-2022-6262-01.txt) - - [mbDrive Lite WiFi Flash Disk 1.4.0 Cross Site Scripting](https://packetstormsecurity.com/files/168321/mbdrivelitewfd140-xss.txt) - - [AirDisk 7.5.5 Cross Site Scripting](https://packetstormsecurity.com/files/168320/airdisk755-xss.txt) - - [Windows Credential Guard Kerberos Change Password Privilege Escalation](https://packetstormsecurity.com/files/168319/GS20220909155201.tgz) - - [Windows Credential Guard Insufficient Checks On Kerberos Encryption Type Use](https://packetstormsecurity.com/files/168318/GS20220909154932.tgz) - - [Ubuntu Security Notice USN-5602-1](https://packetstormsecurity.com/files/168317/USN-5602-1.txt) - - [@Drive 2.8 Local File Inclusion](https://packetstormsecurity.com/files/168316/atdrive28-lfi.txt) - - [Windows Credential Guard BCrypt Context Use-After-Free Privilege Escalation](https://packetstormsecurity.com/files/168315/GS20220909154511.tgz) - - [Windows Credential Guard ASN1 Decoder Type Confusion Privilege Escalation](https://packetstormsecurity.com/files/168314/GS20220909154254.tgz) - - [Windows Kernel Registry Hive Memory Problems](https://packetstormsecurity.com/files/168313/GS20220909154008.tgz) - - [Windows Kernel Unchecked Blink Cell Index Invalid Read/Write](https://packetstormsecurity.com/files/168312/GS20220909153743.tgz) - - [Windows Kernel Refcount Overflow Use-After-Free](https://packetstormsecurity.com/files/168311/GS20220909153445.tgz) -- unSafe.sh - 不安全 - - [某后台管理系统的审计](https://buaq.net/go-125840.html) - - [Microsoft Defender and tamper protection](https://buaq.net/go-126013.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 37](https://buaq.net/go-125990.html) - - [Scanning, Testing and Simulating – Where does PTaaS Fit?](https://buaq.net/go-125989.html) - - [Understanding the hows and whys of open source audits](https://buaq.net/go-125991.html) - - [SocialPwned OSINT tool](https://buaq.net/go-125994.html) - - [New Research Exposes Hidden Threats on Illegal Streaming Sites](https://buaq.net/go-126002.html) - - [Gohide - Tunnel Port To Port Traffic Over An Obfuscated Channel With AES-GCM Encryption](https://buaq.net/go-125993.html) - - [浅谈云原生BAS](https://buaq.net/go-125982.html) - - [What’s most important for a CISO in API security?](https://buaq.net/go-125988.html) - - [Extracting Firmware from Embedded Devices (SPI NOR Flash)](https://buaq.net/go-125987.html) - - [《安卓高级研修班》推出【看雪安卓应用安全能力认证】证书](https://buaq.net/go-125984.html) - - [@你，招人！本周岗位更新](https://buaq.net/go-125985.html) - - [本周看什么 | 最近值得一看的 6 部作品](https://buaq.net/go-125983.html) - - [Reverse shell over UDP using PowerShell](https://buaq.net/go-125975.html) - - [App+1 | 人人可用、不取分文，Android 平台习惯养成应用首选：Loop](https://buaq.net/go-125966.html) - - [《互联网弹窗信息推送服务管理规定》发布，弹窗一键搞定](https://buaq.net/go-126050.html) - - [11种常见的蓝牙攻击方法简析](https://buaq.net/go-125946.html) - - [零信任应用的新进化 —— 统一微隔离](https://buaq.net/go-125947.html) -- paper - Last paper - - [Xalan-J XSLT 整数截断漏洞利用构造(CVE-2022-34169)](https://paper.seebug.org/1963/) -- 机智的程序员小熊 - - [mysql字符集修改 Incorrect string value 1366 13919](https://coding3min.com/1926.html) -- Recent Commits to cve:main - - [Update Fri Sep 9 10:03:14 UTC 2022](https://github.com/trickest/cve/commit/67822406c2b26674888801edc9fc17d06905cac2) -- 先知安全技术社区 - - [某后台管理系统的审计](https://xz.aliyun.com/t/11669) -- 安全客-有思想的安全新媒体 - - [专访易安联合伙人兼COO王峰：从VPN到零信任](https://www.anquanke.com/post/id/278841) - - [专访华热科技：智慧供热引领绿色生活](https://www.anquanke.com/post/id/278848) - - [2022年8月勒索病毒态势分析](https://www.anquanke.com/post/id/279837) - - [数万人“误入”油管直播间 库克采访视频被编造用于加密货币欺诈](https://www.anquanke.com/post/id/279906) - - [B站流式传输架构的前世今生](https://www.anquanke.com/post/id/279830) - - [Lazarus APT组织盯上全球能源供应商](https://www.anquanke.com/post/id/279863) - - [北约机密文件从葡萄牙被盗后流入暗网](https://www.anquanke.com/post/id/279861) - - [数字安全观察每周简报【行业动态篇】 2022.08.24-2022.08.30](https://www.anquanke.com/post/id/279748) - - [勒索软件DeadBolt以QNAP NAS设备为攻击目标](https://www.anquanke.com/post/id/279856) - - [CF 云环境利用框架，一键化利用云上内网](https://www.anquanke.com/post/id/276249) - - [黑客攻击后，荷兰当局调查光伏逆变器网络安全问题](https://www.anquanke.com/post/id/279847) - - [美国追回逾3000万美元被朝鲜黑客窃取的加密货币](https://www.anquanke.com/post/id/279776) - - [前Conti勒索软件成员组团攻击乌克兰](https://www.anquanke.com/post/id/279793) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [XCon2022议题 | 元宇宙的焦虑 : 安全先行](https://www.4hou.com/posts/GKx0) - - [补天平台活动中心全新上线 打造白帽安全圈一站式活动平台](https://www.4hou.com/posts/LBD4) - - [学生贷款机构泄露了 250 万条贷款记录](https://www.4hou.com/posts/pVK6) - - [逻辑炸弹攻击（Logic Bomb Attack）全解析：概念、危害、迹象、案例、防御](https://www.4hou.com/posts/DEEx) - - [AI＋SOAR安全解决方案，助力国家网络安全宣传周](https://www.4hou.com/posts/BEpJ) -- MaskRay - - [zstd compressed debug sections](https://maskray.me/blog/2022-09-09-zstd-compressed-debug-sections) -- Twitter @bytehx - - [Re @OriginalSicksec @Hacker0x01 Congrats man!](https://twitter.com/bytehx343/status/1568088178816335873) -- 先知安全技术社区 - - [某后台管理系统的审计](https://xz.aliyun.com/t/11669) -- Didier Stevens - - [Quickpost: Dolmen du roc de l’Arca](https://blog.didierstevens.com/2022/09/09/quickpost-dolmen-du-roc-de-larca/) -- GuidePoint Security - - [Scanning, Testing and Simulating – Where does PTaaS Fit?](https://www.guidepointsecurity.com/blog/scanning-testing-and-simulating-where-does-ptaas-fit/) -- Hex Rays - - [Igor’s tip of the week #105: Offsets with custom base](https://hex-rays.com/blog/igors-tip-of-the-week-105-offsets-with-custom-base/) -- SAP Blogs - - [Diagrams related to OData entities (CAP & ECC)](https://blogs.sap.com/2022/09/09/diagrams-related-to-odata-entities-cap-ecc-2/) - - [SAP Fiori Peak Performance – Introduction & Top 10 Ways to Prevent Performance Issues](https://blogs.sap.com/2022/09/09/sap-fiori-peak-performance-introduction-top-10-ways-to-prevent-performance-issues/) - - [Setting up Integration with SAP Concur](https://blogs.sap.com/2022/09/09/setting-up-integration-with-sap-concur/) - - [SAP Fieldglass at SIA CWS Summit 2022](https://blogs.sap.com/2022/09/09/sap-fieldglass-at-sia-cws-summit-2022/) -- ly0n.me - - [Everything you need to know about DNS services](https://ly0n.me/everything-you-need-to-know-about-dns-services/) -- Application Security Blog - - [Understanding the hows and whys of open source audits](https://www.synopsys.com/blogs/software-security/understanding-how-why-open-source-audits/) -- Webroot Blog - - [New Research Exposes Hidden Threats on Illegal Streaming Sites](https://www.webroot.com/blog/2022/09/09/new-research-exposes-hidden-threats-on-illegal-streaming-sites/) -- The Daily Swig | Cybersecurity news and views - - [Six-year-old blind SSRF vulnerability in WordPress Core feature could enable DDoS attacks](https://portswigger.net/daily-swig/six-year-old-blind-ssrf-vulnerability-in-wordpress-core-feature-could-enable-ddos-attacks) - - [ManageEngine vulnerability posed code injection risk for password management software](https://portswigger.net/daily-swig/manageengine-vulnerability-posed-code-injection-risk-for-password-management-software) -- - - [Reverse shell over UDP using PowerShell](https://cornerpirate.com/2022/09/09/reverse-shell-over-udp-using-powershell/) -- Reverse Engineering - - [Extracting Firmware from Embedded Devices (SPI NOR Flash)](https://www.reddit.com/r/ReverseEngineering/comments/x9shyd/extracting_firmware_from_embedded_devices_spi_nor/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 37](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-37-3/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 9/9/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-9-9-2022/) -- KitPloit - PenTest & Hacking Tools - - [Gohide - Tunnel Port To Port Traffic Over An Obfuscated Channel With AES-GCM Encryption](http://www.kitploit.com/2022/09/gohide-tunnel-port-to-port-traffic-over.html) -- Dhole Moments - - [Should You Delete Your Patreon Account After They Laid Off Their Entire Security Team?](https://soatok.blog/2022/09/09/should-you-delete-your-patreon-account-after-they-laid-off-their-entire-security-team/) -- Twitter @hakivvi - - [RT Alexander Popov: The slides for my talk at @nullcon Goa 2022 A Kernel Hacker Meets Fuchsia OS](https://twitter.com/a13xp0p0v/status/1568156707913613312) -- FreeBuf网络安全行业门户 - - [《互联网弹窗信息推送服务管理规定》发布，弹窗一键搞定](https://www.freebuf.com/news/344218.html) - - [原来用户隐私是这样被泄露：超八成搜索网站将信息出售](https://www.freebuf.com/news/344198.html) - - [葡萄牙武装总参谋部遭网络攻击，数百份北约机密文件泄露](https://www.freebuf.com/news/344183.html) - - [如何应对堡垒机安全风险？| FreeBuf甲方群话题讨论](https://www.freebuf.com/articles/neopoints/344172.html) -- 绿盟科技技术博客 - - [浅谈云原生BAS](http://blog.nsfocus.net/bas/) -- 安全牛 - - [11种常见的蓝牙攻击方法简析](https://www.aqniu.com/hometop/88938.html) - - [零信任应用的新进化 —— 统一微隔离](https://www.aqniu.com/homenews/88894.html) - - [公安部等九部门联合部署开展打击惩治涉网黑恶犯罪专项行动](https://www.aqniu.com/homenews/88893.html) - - [亚信安全勒索治理「方舟」正式上线！ 勒索体检中心全面开放](https://www.aqniu.com/vendor/88892.html) - - [思科荣获“2022开放数据中心精诚之助”奖](https://www.aqniu.com/vendor/88891.html) - - [操作指南｜JumpServer用户权限体系的使用实践](https://www.aqniu.com/vendor/88890.html) - - [完美收官！Fortinet Accelerate 2022中国站在北京落幕](https://www.aqniu.com/vendor/88889.html) - - [清华大学：应对二十大保障，邮件系统安全先行](https://www.aqniu.com/vendor/88859.html) - - [ChainAegis链上分析：以太坊合并后的中心化风险](https://www.aqniu.com/vendor/88858.html) - - [奇安信天擎独家入选第二批Windows 7操作系统安全防护产品目录](https://www.aqniu.com/industry/88857.html) - - [天翼云打造国云安全品牌 铸牢企业云上安全防线](https://www.aqniu.com/vendor/88856.html) - - [SharkTeam：十大智能合约安全威胁之操纵预言机](https://www.aqniu.com/vendor/88853.html) -- 奇客Solidot–传递最新科技情报 - - [女王去世国王继位英国的改变](https://www.solidot.org/story?sid=72730) - - [哔哩哔哩二季度亏损扩大](https://www.solidot.org/story?sid=72729) - - [水熊虫脱水复活关键蛋白能在人类细胞中表达](https://www.solidot.org/story?sid=72728) - - [全球供应紧张局势缓解](https://www.solidot.org/story?sid=72727) - - [50 岁以下人群癌症发病率上升](https://www.solidot.org/story?sid=72726) - - [嫦娥五号发现月球新矿物“嫦娥石”](https://www.solidot.org/story?sid=72725) - - [Facebook 登陆按钮逐渐从网站上消失](https://www.solidot.org/story?sid=72724) - - [全球燃煤发电量下降](https://www.solidot.org/story?sid=72723) - - [美国弗吉尼亚州的数据中心数量远超其它地方](https://www.solidot.org/story?sid=72722) - - [美国政府追回朝鲜黑客窃取的三千万美元加密货币](https://www.solidot.org/story?sid=72721) - - [伊丽莎白女王去世，享年96岁](https://www.solidot.org/story?sid=72720) -- HackerNews - - [数万人“误入”油管直播间 库克采访视频被编造用于加密货币欺诈](https://hackernews.cc/archives/41422) - - [美国防部将发布新版零信任战略，定义百余项具体落地能力](https://hackernews.cc/archives/41417) - - [葡萄牙武装总参谋部遭网络攻击，数百份北约机密文件泄露](https://hackernews.cc/archives/41412) - - [谷歌 TAG 安全团队发现 UAC-0098 黑客组织吸纳了 Conti 勒索软件团伙前成员](https://hackernews.cc/archives/41405) - - [Talos 警告 Lazarus 黑客正利用 Log4j 漏洞入侵美国能源公司](https://hackernews.cc/archives/41398) -- Wallarm - - [What’s most important for a CISO in API security?](https://lab.wallarm.com/whats-most-important-for-a-ciso-in-api-security/) -- 三六零CERT - - [安全日报（2022.09.09）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491401&idx=1&sn=2fcc822cbc4f82df327fd53b74acb942&chksm=fe251a48c952935e1495f474cc08438574b326011656deeb84a761728beaff594414aa0fd817&scene=58&subscene=0#rd) -- 小米安全中心 - - [MiSRC 6月榜单来啦！](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247514178&idx=1&sn=f942a932bb00cc9ac0352bcfd2387682&chksm=ea839ed7ddf417c107c98acb0b6c8cd130abb0bd7e7b8c8aba2735befcc9ca82e00e58f39b29&scene=58&subscene=0#rd) -- 青藤云安全 - - [你有没有看过别人的日记？](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650838166&idx=1&sn=3d6c6525feaf8ee073e9648339470831&chksm=80dbf733b7ac7e2523201cd7d493fb2ebf2fbd5dd58ec4fb9c1676849ced0ddffdca4152d7e6&scene=58&subscene=0#rd) -- 博客园 - 郑瀚Andrew - - [酒店运营管理 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16659887.html) - - [室内设计与施工 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16655560.html) -- 火绒安全实验室 - - [【火绒安全周报】韩国YouTube频道遭黑客入侵/Instagram被处以4.05亿欧元罚款](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247509613&idx=1&sn=10e5f2dfd72e335a4351e977cdb7c06e&chksm=eb707852dc07f144c6c912b689ea18429754d6b94ac9d4dbf6a1a9d1fff8623ee9e137f1c7d0&scene=58&subscene=0#rd) - - [中秋节期间火绒将持续为您护航](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247509613&idx=2&sn=bc3f1d69b2597bd1b791d281785bc2ce&chksm=eb707852dc07f14464f4e6c78c54e75374c9e6819f5b7c362d2e6024844de12edcfc40a2eefc&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Sep.9th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495839&idx=1&sn=0fb4095c5c99b090d48d7f18d103acc3&chksm=ce96bda1f9e134b75b2ca20afab5a3e23c355ded154bf098a5bef74964456ad05e92631d7e34&scene=58&subscene=0#rd) -- 情报分析师 - - [【电子书】《情报主导警务工作手册》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515972&idx=1&sn=4298eeaf0e23db81b9a40a3ba1d4b5a9&chksm=8716844fb0610d59af665d8653c605b78919d5227e25962e18df98035abfcc40f24e453bd84e&scene=58&subscene=0#rd) - - [地图和地理研究工具大起底](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650515972&idx=2&sn=8d447f5b7345eb0b73a890a48761fbbe&chksm=8716844fb0610d59e448e2433831ef3ebf7e4322eb925f1c2d0ef06c6fc5b291731cf5dc327f&scene=58&subscene=0#rd) -- 深信服千里目安全实验室 - - [福利贴|深信服携“饼”来报，邀您快乐开箱](https://mp.weixin.qq.com/s?__biz=MzI4NjE2NjgxMQ==&mid=2650264143&idx=1&sn=1d4296cdfb8a8be09d5eb79d0a3d4d38&chksm=f3e2683bc495e12dd9882fa21bbb8b62d166d76cc793d4a5ef44ae8d565ee26ace5d0fb5e9c4&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(09-09)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958683&idx=1&sn=d0a83448d624089a8856ac85debe549a&chksm=8baecd04bcd9441289edecf48d6047937f4957e0bab67b25590ce72156232146e1972abde86f&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [XCon2022议题 | 元宇宙的焦虑 : 安全先行](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550086&idx=1&sn=a747f99b9fc286738c0f6607bb1da1d0&chksm=e915d4bcde625daa4035f6a13463a7bf404d91adf9308608a2ca1e7bf70f01b4d08d0df4ab55&scene=58&subscene=0#rd) - - [学生贷款机构泄露了 250 万条贷款记录](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550086&idx=2&sn=e7c61af670630eea1cb0c9a5040028c9&chksm=e915d4bcde625daa1dcc0923281f482afa88deff07430164595527e5fc9fc0da29dab738adf3&scene=58&subscene=0#rd) - - [逻辑炸弹攻击全解析：概念、危害、迹象、案例、防御](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550086&idx=3&sn=2c95893e8c5d4dce91573e49e05a206e&chksm=e915d4bcde625daaf50c04976437feb7ee3c8b3d2a7d75b8d2feafbb4eac198a1e1e176fa2a3&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [探索Atomic Red Team测试框架](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496382&idx=1&sn=a3cf83d194caf129a916524aeed2de65&chksm=fa522700cd25ae160ea8ef6d96b1396182ae74dccf2e62d913e5e75c497828f131ace6908497&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-11.md b/archive/2022/2022-09-11.md deleted file mode 100644 index 7148b9599f..0000000000 --- a/archive/2022/2022-09-11.md +++ /dev/null @@ -1,72 +0,0 @@ -# 每日安全资讯（2022-09-11） - -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [黑客通过詹姆斯•韦伯太空望远镜拍摄的图像传播恶意软件](https://www.4hou.com/posts/DExn) - - [微软Defender将Chrome、Edge等错误标记](https://www.4hou.com/posts/ZXy6) -- Security Boulevard - - [Discrete Mathematics & Graph Theory Lecture Notes PDF – JNTUA](https://securityboulevard.com/2022/09/discrete-mathematics-graph-theory-lecture-notes-pdf-jntua/) - - [BSides Vancouver 2022 – Chris Timmons’ ‘Cracking Passwords For Fun And Profit’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-chris-timmons-cracking-passwords-for-fun-and-profit/) - - [Fall Foliage: JavaScript/OJS Edition](https://securityboulevard.com/2022/09/fall-foliage-javascript-ojs-edition/) -- SecWiki News - - [SecWiki News 2022-09-10 Review](http://www.sec-wiki.com/?2022-09-10) -- Recent Commits to cve:main - - [Update Sat Sep 10 10:01:47 UTC 2022](https://github.com/trickest/cve/commit/62f99f235cba1471b8213f23c2ee8249805a33b0) -- unSafe.sh - 不安全 - - [NuttX Binary to Test Particle Photon board](https://buaq.net/go-126079.html) - - [万字长文告诉你Go 1.19中值得关注的几个变化](https://buaq.net/go-126076.html) - - [GraphCrawler - GraphQL Automated Security Testing Toolkit](https://buaq.net/go-126073.html) - - [有人评价这款应用「感觉很正点」？](https://buaq.net/go-126103.html) - - [vshell](https://buaq.net/go-126065.html) - - [RPCMon](https://buaq.net/go-126066.html) - - [Seal – 内嵌 yt-dlp 与 aria2c 的开源 Android 在线视频下载器（音频提取）](https://buaq.net/go-126064.html) - - [从选购到使用，让 3D 打印机打开新世界的大门](https://buaq.net/go-126067.html) - - [How I found 3 RXSS on the Lululemon bug bounty program](https://buaq.net/go-126063.html) - - [黑客通过詹姆斯•韦伯太空望远镜拍摄的图像传播恶意软件](https://buaq.net/go-126056.html) - - [微软Defender将Chrome、Edge等错误标记](https://buaq.net/go-126057.html) - - [大厂出品不等于又大又慢，这 6 个小应用值得一试](https://buaq.net/go-126060.html) - - [免费送月饼？高校发4万多封钓鱼邮件，结果……](https://buaq.net/go-126051.html) -- Twitter @Nicolas Krassas - - [GraphCrawler - GraphQL Automated Security Testing Toolkit](https://twitter.com/Dinosn/status/1568694091218825218) - - [HTB: Scanned](https://twitter.com/Dinosn/status/1568693254279036929) - - [x86matthew - WriteProcessMemoryAPC - Write memory to a remote process using APC calls](https://twitter.com/Dinosn/status/1568690146366881794) - - [Deka - an OpenCL A5/1 cracker](https://twitter.com/Dinosn/status/1568680501283815424) - - [PoC for the WebGL bug that was patched in Safari 15.4 security updates. CVE-2022-22629 Proof of concept](https://twitter.com/Dinosn/status/1568680335260487689) - - [vMass Bot Vulnerability Scanner & Auto Exploiter Tool Written in Perl.](https://twitter.com/Dinosn/status/1568679839300829184) - - [RT 0xdf: Scanned from @hackthebox_eu was really hard. It's a clinic in Linux system exploitation where details matter, and once I learned how all of i...](https://twitter.com/0xdf_/status/1568615325880426497) - - [RT Antonio Cocomazzi: We are releasing an alternative way for elevating to SYSTEM when you have SeTcbPrivilege How? Leveraging AcquireCredentialsHandl...](https://twitter.com/splinter_code/status/1568548572861267968) - - [RT Jonas L: Presenting D-Generate , syscall tracing as its supposed to be! usage: dg cmd.exe - displays all syscalls done by process with cmd.exe as i...](https://twitter.com/jonasLyk/status/1568450498579111936) - - [RT blueblue: GitHub - parsdefense/CVE-2022-22629: CVE-2022-22629 Proof of Concept -](https://twitter.com/piedpiper1616/status/1568442920671543296) - - [SiliFuzz - Fuzzing CPUs by proxy](https://twitter.com/Dinosn/status/1568437465773649922) -- Sploitus.com Exploits RSS Feed - - [Exploit for OS Command Injection in Sap Netweaver exploit](https://sploitus.com/exploit?id=6A1A1A08-4091-5FBF-84C9-2780EA645DF9&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Atlassian Bitbucket exploit](https://sploitus.com/exploit?id=4B077A8D-B9A8-51EC-A30C-160FCB41F9CD&utm_source=rss&utm_medium=rss) -- Bug Bounty in InfoSec Write-ups on Medium - - [How I found 3 RXSS on the Lululemon bug bounty program](https://infosecwriteups.com/how-i-found-3-rxss-on-the-lululemon-bug-bounty-program-fa357a0154c2?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [Bring your data from HANA Cloud to HANA On-prem via DP Agent](https://blogs.sap.com/2022/09/10/bring-your-data-from-hana-cloud-to-hana-on-prem-via-dp-agent/) - - [JavaScript Book Review – Part 01](https://blogs.sap.com/2022/09/10/javascript-book-review-part-01/) - - [EWM Technical Made Easy – Part 4 – Changing / Cleaning Fields on EWM DAS / Shipping Cockpit etc.](https://blogs.sap.com/2022/09/10/ewm-technical-made-easy-part-4-changing-cleaning-fields-on-ewm-das-shipping-cockpit-etc./) - - [SAP Fiori Application To Display SAP Ariba Requisition Data – Part 6](https://blogs.sap.com/2022/09/10/sap-fiori-application-to-display-sap-ariba-requisition-data-part-6/) - - [SAP Fiori Application To Display SAP Ariba Requisition Data – Part 5](https://blogs.sap.com/2022/09/10/sap-fiori-application-to-display-sap-ariba-requisition-data-part-5/) - - [SAP Fiori Application To Display SAP Ariba Requisition Data – Part 4](https://blogs.sap.com/2022/09/10/sap-fiori-application-to-display-sap-ariba-requisition-data-part-4/) - - [SAP Fiori Application To Display SAP Ariba Requisition Data – Part 3](https://blogs.sap.com/2022/09/10/sap-fiori-application-to-display-sap-ariba-requisition-data-part-3/) - - [SAP Fiori Application To Display SAP Ariba Requisition Data – Part 2](https://blogs.sap.com/2022/09/10/sap-fiori-application-to-display-sap-ariba-requisition-data-part-2/) - - [SAP Fiori Application To Display SAP Ariba Requisition Data – Part 1](https://blogs.sap.com/2022/09/10/sap-fiori-application-to-display-sap-ariba-requisition-data-part-1/) -- Didier Stevens - - [Maldoc Analysis Video – Rehearsed & Unrehearsed](https://blog.didierstevens.com/2022/09/10/maldoc-analysis-video-rehearsed-unrehearsed/) -- KitPloit - PenTest & Hacking Tools - - [GraphCrawler - GraphQL Automated Security Testing Toolkit](http://www.kitploit.com/2022/09/graphcrawler-graphql-automated-security.html) -- 体验盒子 - - [2022~中秋节](https://www.uedbox.com/post/68504/) -- Twitter @Keiran Smith (Affix) - - [Re @evil_del @ArgosHelpers It’s a weird place 😂😂](https://twitter.com/cli/status/1568691698087108610) - - [😂😂](https://twitter.com/cli/status/1568556299356454912) - - [Wonder why @Argos_Online in Airdrie doesn’t work like ever other Argos in the uk](https://twitter.com/cli/status/1568546177901010946) -- 黑海洋 - WIKI - - [如何安装宝塔国际版 aapanel(宝塔海外版)](https://blog.upx8.com/2966) -- 雷神众测 - - [望明月 寄相思｜雷神众测祝你中秋节快乐](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652499618&idx=1&sn=e750b22c63aaf6af550eea6bd9d53c1b&chksm=f2584d11c52fc407a4fa8ce11a725bc11cb26c4627f2a52bae71281f74e22cf367e44403f59e&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [Android 13 最低硬件需求为 2GB 内存和 16 GB 存储空间](https://www.solidot.org/story?sid=72734) - - [英伟达称其 H100 数据中心 GPU 性能比上一代高 4.5 倍](https://www.solidot.org/story?sid=72733) - - [旧金山除罪化迷幻药](https://www.solidot.org/story?sid=72732) diff --git a/archive/2022/2022-09-12.md b/archive/2022/2022-09-12.md deleted file mode 100644 index 2dbc34e64b..0000000000 --- a/archive/2022/2022-09-12.md +++ /dev/null @@ -1,65 +0,0 @@ -# 每日安全资讯（2022-09-12） - -- Recent Commits to cve:main - - [Update Sun Sep 11 10:02:05 UTC 2022](https://github.com/trickest/cve/commit/4c6153c3a8e2d217ae863f30bb01dc0038e64841) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Sagemath 9.0 Overflow / Denial Of Service](https://cxsecurity.com/issue/WLB-2022090026) - - [Windows Credential Guard Non-Constant Time Comparison Information Disclosure](https://cxsecurity.com/issue/WLB-2022090025) - - [mbDrive Lite WiFi Flash Disk 1.4.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090024) - - [Infix LMS - Learning Management System Shell Upload](https://cxsecurity.com/issue/WLB-2022090023) -- Security Boulevard - - [Share the My Cyber Risk Benchmark Tool, Earn a Free Subscription](https://securityboulevard.com/2022/09/share-the-my-cyber-risk-benchmark-tool-earn-a-free-subscription/) - - [BSides Vancouver 2022 – Gabriel Agboruche’s ‘Printers: The Neglected High Value Asset In ICS And OT Pentests’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-gabriel-agboruches-printers-the-neglected-high-value-asset-in-ics-and-ot-pentests/) - - [Quiet Quitting or Improved Employee Engagement — Pick One](https://securityboulevard.com/2022/09/quiet-quitting-or-improved-employee-engagement-pick-one/) -- Sploitus.com Exploits RSS Feed - - [ETAP Safety Manager 1.0.0.32 Remote Unauthenticated Reflected XSS exploit](https://sploitus.com/exploit?id=ZSL-2022-5711&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=4608D630-EBBB-5D8B-BDC8-39BE4409DA69&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-09-11 Review](http://www.sec-wiki.com/?2022-09-11) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [勒索软件攻击呈上升趋势](https://www.4hou.com/posts/zl4Y) - - [通过自治系统号（ASN）预判攻击发生的可能性](https://www.4hou.com/posts/AOWP) -- unSafe.sh - 不安全 - - [Nim-RunPE - A Nim Implementation Of Reflective PE-Loading From Memory](https://buaq.net/go-126142.html) - - [现在还有人用这种东西？还要卖1块钱？？](https://buaq.net/go-126140.html) - - [[油猴脚本]让链接变得更好系列](https://buaq.net/go-126138.html) - - [更易检索的「中高风险地区查询」工具，支持 API](https://buaq.net/go-126133.html) - - [Apple 新品发布会上没告诉你的那些事](https://buaq.net/go-126129.html) - - [通过自治系统号（ASN）预判攻击发生的可能性](https://buaq.net/go-126128.html) - - [勒索软件攻击呈上升趋势](https://buaq.net/go-126127.html) - - [任意键｜乌贼娘大战章鱼哥；守望先锋闪电般归来；大名鼎鼎的 V 及其他](https://buaq.net/go-126126.html) - - [System programming in Rust - part 2](https://buaq.net/go-126167.html) - - [简单有效的场景化思维，是如何解决用户痛点的？](https://buaq.net/go-126159.html) - - [铜九铁十，互联网人没有“跳槽季”？](https://buaq.net/go-126153.html) - - [You Can't Do That: Abstracting over Ownership in Rust with Higher-Rank Type Bounds. Or Can You?](https://buaq.net/go-126137.html) - - [Maldoc Analysis Video – Rehearsed & Unrehearsed](https://buaq.net/go-126095.html) - - [Testing SX127x on NuttX](https://buaq.net/go-126090.html) - - [中亚这几个国家，对中国究竟有多重要？](https://buaq.net/go-126088.html) - - [红米 AX6000 最强 CPU 的硬路由｜解锁 SSH 安装 ShellClash 教程](https://buaq.net/go-126089.html) -- Armin Ronacher's Thoughts and Writings - - [You Can't Do That: Abstracting over Ownership in Rust with Higher-Rank Type Bounds. Or Can You?](http://lucumr.pocoo.org/2022/9/11/abstracting-over-ownership) -- Twitter @Nicolas Krassas - - [Nim-RunPE - A Nim Implementation Of Reflective PE-Loading From Memory](https://twitter.com/Dinosn/status/1568945190898999297) - - [RT daem0nc0re: Added my implementation of Ghostly Hollowing and WMI execution. The PoC for WMI process execution supports not only local machine proce...](https://twitter.com/daem0nc0re/status/1568914890697617421) - - [Iranian APT42 Launched Over 30 Espionage Attacks Against Activists and Dissidents](https://twitter.com/Dinosn/status/1568842278608961536) -- 128 nops and counting - - [System programming in Rust - part 2](https://carstein.github.io/2022/09/11/rust-system-programming-3.html) -- Cerbero Blog - - [Cerbero Suite 6 and Cerbero Engine 3 are out!](https://blog.cerbero.io/?p=2467) -- SAP Blogs - - [Build Application using Python – SAP UI5 & Deploy to SAP BTP](https://blogs.sap.com/2022/09/11/build-application-using-python-sap-ui5-deploy-to-sap-btp/) - - [Q&A – Understanding the SAP Returnship experience and it’s impact](https://blogs.sap.com/2022/09/11/qa-understanding-the-sap-returnship-experience-and-its-impact/) - - [Automate Mass Compensation related changes with Integration Center](https://blogs.sap.com/2022/09/11/automate-mass-compensation-related-changes-with-integration-center/) -- KitPloit - PenTest & Hacking Tools - - [Nim-RunPE - A Nim Implementation Of Reflective PE-Loading From Memory](http://www.kitploit.com/2022/09/nim-runpe-nim-implementation-of.html) -- 博客园 - nice_0e3 - - [SolarWinds PM反序列化漏洞分析 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16683888.html) -- 奇客Solidot–传递最新科技情报 - - [研究发现部分遭受勒索软件攻击的医院病人死亡率上升](https://www.solidot.org/story?sid=72737) - - [Chess.com 封杀被控作弊的 19 岁棋手](https://www.solidot.org/story?sid=72736) -- K8哥哥’s Blog - - [〖工具〗Ladon大型内网渗透扫描器&Cobalt Strike](http://k8gege.org/p/Ladon.html) -- 补天平台 - - [这是补天为你独家定制的通用活动，还不快进来康康？!](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247495147&idx=1&sn=f6e3e12663915c7d371ae1569bbaa8ed&chksm=eaf9a5a7dd8e2cb1f8af54dcb5c9e59f843cea582481546b4d74a7a0efcfc6e26470f2336cd2&scene=58&subscene=0#rd) -- 极客公园 - - [探月工程四期任务已获国家批复；iPhone 14 预售火爆，Pro 发货推迟；迪士尼《小美人鱼》首支预告发布 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967111&idx=1&sn=09ef62a9c7846d678eb95adbb31bfa2f&chksm=7e546d714923e4677f74913b26f748df03ff2bf021c3fdcd27a7b11a8553f14cb2c468a96b3d&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-13.md b/archive/2022/2022-09-13.md deleted file mode 100644 index cb5b891115..0000000000 --- a/archive/2022/2022-09-13.md +++ /dev/null @@ -1,128 +0,0 @@ -# 每日安全资讯（2022-09-13） - -- Security Boulevard - - [Trustero Launches New SOC 2 Compliance Help for Startups](https://securityboulevard.com/2022/09/trustero-launches-new-soc-2-compliance-help-for-startups/) - - [Trustero Compliance as a Service Gains New Features](https://securityboulevard.com/2022/09/trustero-compliance-as-a-service-gains-new-features/) - - [BSides Vancouver 2022 – Jason Rivera’s ‘Understanding The Modern Attack: A Review Of The Adversary’s Operational Lifecycle’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-jason-riveras-understanding-the-modern-attack-a-review-of-the-adversarys-operational-lifecycle/) - - [Major Momentum: Apple Supports BIMI in iOS 16](https://securityboulevard.com/2022/09/major-momentum-apple-supports-bimi-in-ios-16/) - - [Your VPN Has Already Been Hacked](https://securityboulevard.com/2022/09/your-vpn-has-already-been-hacked/) - - [XKCD ‘Artemis Quote’](https://securityboulevard.com/2022/09/xkcd-artemis-quote/) - - [Get audit-ready, conduct your exam and get a report from Trustero](https://securityboulevard.com/2022/09/get-audit-ready-conduct-your-exam-and-get-a-report-from-trustero/) - - [Can you afford to cut back on web application security?](https://securityboulevard.com/2022/09/can-you-afford-to-cut-back-on-web-application-security/) - - [Earn CPE Credits with Noname’s API Security Workshop](https://securityboulevard.com/2022/09/earn-cpe-credits-with-nonames-api-security-workshop/) - - [Trustero Adds AI-Powered Recommendations, API Beta Program, and Other Enhancements to its Compliance as a Service Solution](https://securityboulevard.com/2022/09/trustero-adds-ai-powered-recommendations-api-beta-program-and-other-enhancements-to-its-compliance-as-a-service-solution/) -- Der Flounder - - [Jamf Pro 10.41.0 and SSL verification alerts](https://derflounder.wordpress.com/2022/09/12/jamf-pro-10-41-0-and-ssl-verification-alerts/) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5523-2](https://packetstormsecurity.com/files/168340/USN-5523-2.txt) - - [ETAP Safety Manager 1.0.0.32 Cross Site Scripting](https://packetstormsecurity.com/files/168339/ZSL-2022-5711.txt) - - [Infix LMS 4.3.0 Shell Upload](https://packetstormsecurity.com/files/168338/infixlms430-shell.txt) - - [Infix LMS 4.3.0 IFRAME Injection](https://packetstormsecurity.com/files/168337/infixlms430-inject.txt) - - [SmartRG Router 2.6.13 Remote Code Execution](https://packetstormsecurity.com/files/168336/smartrg2613-exec.txt) -- Filippo Valsorda - - [Planning Go 1.20 Cryptography Work](https://words.filippo.io/dispatches/go1-20/) -- Recent Commits to cve:main - - [Update Mon Sep 12 10:04:30 UTC 2022](https://github.com/trickest/cve/commit/0c49acafc042f36798334ba3b708abf8f0c34d50) -- Twitter @Nicolas Krassas - - [How a Script Kiddie and 25 Lines of Python Could Theoretically Devastate America’s Gas Stations](https://twitter.com/Dinosn/status/1569394468767371264) - - [Re @Barbarossa0x @Bonniewahome Not really, show me a screenshot of a cain and abel that will work on any modern system and that has a 'gold function' ...](https://twitter.com/Dinosn/status/1569391537695383554) - - [Re @frycos Much appreciated !](https://twitter.com/Dinosn/status/1569390999272656896) - - [PersistenceSniper - Powershell Script That Can Be Used By Blue Teams, Incident Responders And System Administrators To Hunt Persistences Implanted In ...](https://twitter.com/Dinosn/status/1569390005042429952) - - [Google announced the completion of the acquisition of Mandiant for $5.4 billion](https://twitter.com/Dinosn/status/1569389566615867394) - - [Redeye is a platform to cover all aspects of red team engagement (data management, red team operation management, etc.)](https://twitter.com/Dinosn/status/1569389532461547522) - - [Security pros get ability to manually add incidents to Microsoft Sentinel](https://twitter.com/Dinosn/status/1569389437896867841) - - [China Accuses NSA's TAO Unit of Hacking its Military Research University](https://twitter.com/Dinosn/status/1569388860534099968) - - [New Linux Cryptomining Malware](https://twitter.com/Dinosn/status/1569388748894347267) - - [Lorenz ransomware breaches corporate network via phone systems](https://twitter.com/Dinosn/status/1569388705755930626) - - [Hacktivist Group GhostSec Compromises 55 Berghof PLCs Across Israel](https://twitter.com/Dinosn/status/1569388651041153024) - - [HP will pay customers for blocking non-HP ink cartridges in EU](https://twitter.com/Dinosn/status/1569388521642672130) - - [Scammers Leveraging Microsoft Team GIFs in Phishing Attacks](https://twitter.com/Dinosn/status/1569388160085368833) - - [VMware: 70% drop in Linux ESXi VM performance with Retbleed fixes](https://twitter.com/Dinosn/status/1569387290308345857) - - [Re @Active666 @tresselapp A mute you get](https://twitter.com/Dinosn/status/1569316509364948993) - - [Re @Bonniewahome @Barbarossa0x Wondering many times on these posts if actually the authors have every tried the tools Brutus is ~ 6 years old. ophcrac...](https://twitter.com/Dinosn/status/1569316380477988869) - - [Wazuh - The Open Source Security Platform](https://twitter.com/Dinosn/status/1569313686036140032) - - [Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)](https://twitter.com/Dinosn/status/1569286785565605888) - - [Re @CGolang https:// canarytokens .com](https://twitter.com/Dinosn/status/1569285998466535428) - - [Exploitation paths allowing you to (mis)use the Windows Privileges to elevate your rights within the OS.](https://twitter.com/Dinosn/status/1569282462433398786) -- Sploitus.com Exploits RSS Feed - - [SmartRG Router 2.6.13 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168336&utm_source=rss&utm_medium=rss) - - [ETAP Safety Manager 1.0.0.32 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168339&utm_source=rss&utm_medium=rss) - - [Infix LMS 4.3.0 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168338&utm_source=rss&utm_medium=rss) - - [Infix LMS 4.3.0 IFRAME Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168337&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=AAC5556D-970F-5760-BD5A-7E26CE1A651F&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Google Android exploit](https://sploitus.com/exploit?id=E0070E6C-D156-5108-A620-28903EB02590&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-37706 exploit](https://sploitus.com/exploit?id=AF539206-B179-5EC0-99B5-00FBFA753261&utm_source=rss&utm_medium=rss) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [2022 年与游戏相关的网络威胁](https://www.4hou.com/posts/03pX) - - [微软声称：伊朗黑客使用BitLocker加密Windows系统](https://www.4hou.com/posts/EQvk) -- Planet Classpath - - [Mark Wielaard: Sourceware as Conservancy member project](https://gnu.wildebeest.org/blog/mjw/2022/09/12/sourceware-as-conservancy-member-project/) -- Blog & What's New | Offensive Security - - [The Importance of Skilled Security Practitioners: How Security Skillfulness Reflects on Your Security Posture](https://www.offensive-security.com/offsec/improve-skillfullness-of-cybersecurity-practitioners/) -- The DFIR Report - - [Dead or Alive? An Emotet Story](https://thedfirreport.com/2022/09/12/dead-or-alive-an-emotet-story/) -- 不忘初心 方得始终 - - [CVE-2021-3493 Ubuntu overlayfs privilege escalation vulnerability analysis](http://terenceli.github.io/%E6%8A%80%E6%9C%AF/2022/09/12/CVE-2021-3493-ubuntu-overlayfs-escalation) -- o0xmuhe's blog - - [Paper read <>](https://o0xmuhe.github.io/2022/09/12/Paper-read-The-Convergence-of-Source-Code-and-Binary-Vulnerability-Discovery-%E2%80%93-A-Case-Study/) -- SAP Blogs - - [Repositories and packages required for SAP B1 on SUSE SLES 15 SP3](https://blogs.sap.com/2022/09/12/repositories-and-packages-required-for-sap-b1-on-suse-sles-15-sp3/) - - [S/4HANA Integration with MS Teams via BTP : A Siemens Experience Story](https://blogs.sap.com/2022/09/12/s-4hana-integration-with-ms-teams-via-btp-a-siemens-experience-story/) - - [How to Achieve a Sustainable Future for Your Organization](https://blogs.sap.com/2022/09/12/how-to-achieve-a-sustainable-future-for-your-organization/) - - [10 Strategic Actions for Creating Your Successful Data Governance Strategy](https://blogs.sap.com/2022/09/12/10-strategic-actions-for-creating-your-successful-data-governance-strategy/) - - [Optimizing Your Data Management Strategy for a Maximum ROI From Your Cloud Investment](https://blogs.sap.com/2022/09/12/optimizing-your-data-management-strategy-for-a-maximum-roi-from-your-cloud-investment/) - - [SAP Business Network 2208 Release – What’s new?](https://blogs.sap.com/2022/09/12/sap-business-network-2208-release-whats-new/) - - [Additional Parameters usage in Optimizer](https://blogs.sap.com/2022/09/12/additional-parameters-usage-in-optimizer/) - - [Get onboarded on SAP S/4HANA Cloud for Extended Warehouse Management Private Edition, Extra-stack](https://blogs.sap.com/2022/09/12/get-onboarded-on-sap-s-4hana-cloud-for-extended-warehouse-management-private-edition-extra-stack/) - - [Get onboarded on SAP S/4HANA Cloud for Transportation Management, Private Edition Extra-stack](https://blogs.sap.com/2022/09/12/get-onboarded-on-sap-s-4hana-cloud-for-transportation-management-private-edition-extra-stack/) - - [Flexible Workflows in Condition Contract Management](https://blogs.sap.com/2022/09/12/flexible-workflows-in-condition-contract-management/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Detecting Log4j & its Remediation](https://infosecwriteups.com/detecting-log4j-its-remediation-58ab3a59c865?source=rss----7b722bfd1b8d--bug_bounty) - - [How I found 3 rare security bugs in a day](https://infosecwriteups.com/how-i-found-3-bug-bounties-in-a-day-c82fe023716e?source=rss----7b722bfd1b8d--bug_bounty) - - [New technique 403 bypass lyncdiscover.microsoft.com](https://infosecwriteups.com/403-bypass-lyncdiscover-microsoft-com-db2778458c33?source=rss----7b722bfd1b8d--bug_bounty) - - [How to prevent more than 200 million users from using Google services](https://infosecwriteups.com/how-to-prevent-more-than-200-million-users-from-using-google-services-136b3b8e221f?source=rss----7b722bfd1b8d--bug_bounty) -- Hex Rays - - [Hex-Rays launches a Beta Program!](https://hex-rays.com/blog/hex-rays-launches-a-beta-program/) -- SentinelOne - - [Fortune Names SentinelOne a Top Workplace in Tech](https://www.sentinelone.com/blog/fortune-names-sentinelone-a-top-workplace-in-tech/) -- Malwarebytes Labs - - [The MSP playbook on deciphering tech promises and shaping security culture](https://www.malwarebytes.com/blog/podcast/2022/09/the-msp-playbook-on-deciphering-tech-promises-and-shaping-security-culture-lock-and-code-s03e19) - - [6 patch management best practices for businesses](https://www.malwarebytes.com/blog/business/2022/09/6-patch-management-best-practices-for-businesses) - - [Facebook engineers aren't sure where all user data is kept](https://www.malwarebytes.com/blog/news/2022/09/facebook-engineers-arent-sure-where-all-user-data-is-kept) - - [The North Face hit by credential stuffing attack](https://www.malwarebytes.com/blog/news/2022/09/the-north-face-hit-by-credential-stuffing-attack) - - [A week in security (September 5 – 11)](https://www.malwarebytes.com/blog/news/2022/09/a-week-in-security-september-5--september-11) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/xc5v9m/rreverseengineerings_weekly_questions_thread/) - - [The Touhou PC-98 Restoration Project](https://www.reddit.com/r/ReverseEngineering/comments/xcgemc/the_touhou_pc98_restoration_project/) - - [A new C++ debugger challenge is live!](https://www.reddit.com/r/ReverseEngineering/comments/xc84c5/a_new_c_debugger_challenge_is_live/) -- Intigriti - - [Keep up with Intigriti’s events in September and October](https://blog.intigriti.com/2022/09/12/keep-up-with-intigritis-events-in-september-and-october/) - - [How CM.com improved its security posture with a bug bounty program](https://blog.intigriti.com/2022/09/12/how-cm-com-improved-its-security-posture-with-a-bug-bounty-program/) -- KitPloit - PenTest & Hacking Tools - - [PersistenceSniper - Powershell Script That Can Be Used By Blue Teams, Incident Responders And System Administrators To Hunt Persistences Implanted In Windows Machines](http://www.kitploit.com/2022/09/persistencesniper-powershell-script.html) -- The Daily Swig | Cybersecurity news and views - - [Vulnerability in Xalan-J could allow arbitrary code execution](https://portswigger.net/daily-swig/vulnerability-in-xalan-j-could-allow-arbitrary-code-execution) - - [WordPress project WPHash harvests 75 million hashes for detecting vulnerable plugins](https://portswigger.net/daily-swig/wordpress-project-wphash-harvests-75-million-hashes-for-detecting-vulnerable-plugins) -- HAHWUL - - [Rake(Ruby Make)](https://www.hahwul.com/2022/09/12/ruby-rake/) -- PortSwigger Research - - [The seventh way to call a JavaScript function without parentheses](https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses) -- daniel.haxx.se - - [convert a curl cmdline to libcurl source code](https://daniel.haxx.se/blog/2022/09/12/convert-a-curl-cmdline-to-libcurl-source-code/) -- Horizon3.ai - - [Patched ≠ Remediated: Healthcare Faces an Aggressive Threat Landscape](https://www.horizon3.ai/healthcare-faces-an-aggressive-threat-landscape/) -- blog.avast.com EN - - [Avast and NortonLifeLock merge to tackle new challenges in Cyber Safety](https://blog.avast.com/avast-nortonlifelock-merge) -- text/plain - - [Edge’s Super-Res Image Enhancement](https://textslashplain.com/2022/09/12/edges-super-res-image-enhancement/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 三星因数据泄露面临集体诉讼；中科大超3000名师生中招钓鱼邮件](https://www.freebuf.com/news/344330.html) -- 体验盒子 - - [IOS/Android检测虚拟机模拟器的方法](https://www.uedbox.com/post/68507/) -- 奇客Solidot–传递最新科技情报 - - [思科证实阎罗王勒索软件组织窃取了企业数据](https://www.solidot.org/story?sid=72740) - - [苹果将使用 Globalstar 85% 的卫星网络容量](https://www.solidot.org/story?sid=72739) -- 黑海洋 - WIKI - - [Windows11时间显秒数小工具](https://blog.upx8.com/2969) - - [SuperStart开始菜单工具v2.1.7（win11设置优化）](https://blog.upx8.com/2968) - - [Win11右键恢复经典菜单小工具](https://blog.upx8.com/2967) diff --git a/archive/2022/2022-09-14.md b/archive/2022/2022-09-14.md deleted file mode 100644 index 4f57ad02d9..0000000000 --- a/archive/2022/2022-09-14.md +++ /dev/null @@ -1,275 +0,0 @@ -# 每日安全资讯（2022-09-14） - -- Microsoft Security Blog - - [Secure your endpoints with Transparity and Microsoft](https://www.microsoft.com/security/blog/2022/09/13/secure-your-endpoints-with-transparity-and-microsoft/) -- Der Flounder - - [Microsoft Defender tamper protection status detection for Jamf Pro](https://derflounder.wordpress.com/2022/09/13/microsoft-defender-tamper-protection-status-detection-for-jamf-pro/) -- Security Boulevard - - [VERT Threat Alert: September 2022 Patch Tuesday Analysis](https://securityboulevard.com/2022/09/vert-threat-alert-september-2022-patch-tuesday-analysis/) - - [With Rapid Rise in Funds Stolen from DeFi Protocols, Private Keys in Play](https://securityboulevard.com/2022/09/with-rapid-rise-in-funds-stolen-from-defi-protocols-private-keys-in-play/) - - [Frontline Web Application Scanning WAS™ Datasheet](https://securityboulevard.com/2022/09/frontline-web-application-scanning-was-datasheet/) - - [Frontline Web Application Penetration Testing (WAPT) Datasheet](https://securityboulevard.com/2022/09/frontline-web-application-penetration-testing-wapt-datasheet/) - - [Understanding Who’s ACTUALLY Using that Expensive Software You’re Paying For](https://securityboulevard.com/2022/09/understanding-whos-actually-using-that-expensive-software-youre-paying-for/) - - [BSides Vancouver 2022 – Stephen Mathezer’s ‘Raising The Bar Of ICS Security’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-stephen-mathezers-raising-the-bar-of-ics-security/) - - [Third-Party Risk in the Supply Chain](https://securityboulevard.com/2022/09/third-party-risk-in-the-supply-chain/) - - [How Resource Gaps Impact Vulnerability Management Programs](https://securityboulevard.com/2022/09/how-resource-gaps-impact-vulnerability-management-programs/) - - [Introducing the Noname API Security Workshop](https://securityboulevard.com/2022/09/introducing-the-noname-api-security-workshop/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Equitysoft Technologies Pvt Ltd - SQL Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022090034) - - [kansascitynova - Sql Injection Vulnerability](https://cxsecurity.com/issue/WLB-2022090033) - - [Infix LMS 4.3.0 IFRAME Injection](https://cxsecurity.com/issue/WLB-2022090032) - - [ETAP Safety Manager 1.0.0.32 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090031) - - [Rocket LMS 1.6 Shell Upload](https://cxsecurity.com/issue/WLB-2022090030) - - [SmartRG Router 2.6.13 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090029) - - [TIBCO JasperReports Server 8.0.2 Community Edition Code Execution](https://cxsecurity.com/issue/WLB-2022090028) - - [Rocket LMS 1.6 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090027) -- Tenable Blog - - [Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)](https://www.tenable.com/blog/microsofts-september-2022-patch-tuesday-addresses-62-cves-cve-2022-37969) - - [Tuning Network Assessments for Performance and Resource Usage](https://www.tenable.com/blog/tuning-network-assessments-for-performance-and-resource-usage) -- SecWiki News - - [SecWiki News 2022-09-13 Review](http://www.sec-wiki.com/?2022-09-13) -- Recent Commits to cve:main - - [Update Tue Sep 13 10:11:36 UTC 2022](https://github.com/trickest/cve/commit/74f6ddee69b4f3632edf29940dbfc75d0b00796c) -- Files ≈ Packet Storm - - [TIBCO JasperReports Server 8.0.2 Community Edition Code Execution](https://packetstormsecurity.com/files/168368/SYSS-2022-041.txt) - - [Qualys Cloud Agent Arbitrary Code Execution](https://packetstormsecurity.com/files/168367/qca-exec.txt) - - [Red Hat Security Advisory 2022-6439-01](https://packetstormsecurity.com/files/168366/RHSA-2022-6439-01.txt) - - [Red Hat Security Advisory 2022-6443-01](https://packetstormsecurity.com/files/168365/RHSA-2022-6443-01.txt) - - [Red Hat Security Advisory 2022-6437-01](https://packetstormsecurity.com/files/168364/RHSA-2022-6437-01.txt) - - [Ubuntu Security Notice USN-5606-1](https://packetstormsecurity.com/files/168363/USN-5606-1.txt) - - [Apple Security Advisory 2022-09-12-5](https://packetstormsecurity.com/files/168362/APPLE-SA-2022-09-12-5.txt) - - [Apple Security Advisory 2022-09-12-4](https://packetstormsecurity.com/files/168361/APPLE-SA-2022-09-12-4.txt) - - [Red Hat Security Advisory 2022-6447-01](https://packetstormsecurity.com/files/168360/RHSA-2022-6447-01.txt) - - [Red Hat Security Advisory 2022-6448-01](https://packetstormsecurity.com/files/168359/RHSA-2022-6448-01.txt) - - [Red Hat Security Advisory 2022-6449-01](https://packetstormsecurity.com/files/168358/RHSA-2022-6449-01.txt) - - [Red Hat Security Advisory 2022-6450-01](https://packetstormsecurity.com/files/168357/RHSA-2022-6450-01.txt) - - [Red Hat Security Advisory 2022-6457-01](https://packetstormsecurity.com/files/168356/RHSA-2022-6457-01.txt) - - [Red Hat Security Advisory 2022-6460-01](https://packetstormsecurity.com/files/168355/RHSA-2022-6460-01.txt) - - [Red Hat Security Advisory 2022-6463-01](https://packetstormsecurity.com/files/168354/RHSA-2022-6463-01.txt) - - [Red Hat Security Advisory 2022-6432-01](https://packetstormsecurity.com/files/168353/RHSA-2022-6432-01.txt) - - [Red Hat Security Advisory 2022-6429-01](https://packetstormsecurity.com/files/168352/RHSA-2022-6429-01.txt) - - [Red Hat Security Advisory 2022-6430-01](https://packetstormsecurity.com/files/168351/RHSA-2022-6430-01.txt) - - [Academy Learning Management System 5.7 Shell Upload](https://packetstormsecurity.com/files/168350/alms57-shell.txt) - - [Rocket LMS 1.6 Cross Site Scripting](https://packetstormsecurity.com/files/168349/rocketlms16-xss.txt) - - [Rocket LMS 1.6 Shell Upload](https://packetstormsecurity.com/files/168348/rocketlms16-shell.txt) - - [Red Hat Security Advisory 2022-6422-01](https://packetstormsecurity.com/files/168347/RHSA-2022-6422-01.txt) - - [Red Hat Security Advisory 2022-6426-01](https://packetstormsecurity.com/files/168346/RHSA-2022-6426-01.txt) - - [Red Hat Security Advisory 2022-6427-01](https://packetstormsecurity.com/files/168345/RHSA-2022-6427-01.txt) - - [Red Hat Security Advisory 2022-6317-01](https://packetstormsecurity.com/files/168344/RHSA-2022-6317-01.txt) -- paper - Last paper - - [Mirai 恶意软件变体 MooBot 瞄准 D-Link 设备](https://paper.seebug.org/1966/) - - [CTF 中 linux 内核态的漏洞挖掘与利用](https://paper.seebug.org/1965/) - - [KCon 2022 议题分享：自动化 API 漏洞挖掘](https://paper.seebug.org/1964/) -- Google Online Security Blog - - [Use-after-freedom: MiraclePtr](http://security.googleblog.com/2022/09/use-after-freedom-miracleptr.html) -- Twitter @Nicolas Krassas - - [Traces of Windows remote command execution](https://twitter.com/Dinosn/status/1569767369148452865) - - [Trend Micro warns of actively exploited Apex One RCE vulnerability](https://twitter.com/Dinosn/status/1569766790808637442) - - [Patch your Mitel VoIP systems, Lorenz ransomware gang is back on the prowl](https://twitter.com/Dinosn/status/1569766710206496771) - - [New PsExec spinoff lets hackers bypass network security defenses](https://twitter.com/Dinosn/status/1569766656498614272) - - [RT nuclei: Scanning for - CVE-2022-31474: 0-day WordPress BackupBuddy plugin affects 140,000 websites via @TheHackersNews using nuclei template shared...](https://twitter.com/pdnuclei/status/1569677250198671360) - - [dismember: scan the memory of all processes](https://twitter.com/Dinosn/status/1569675677942661121) - - [Pinecone - A WLAN Red Team Framework](https://twitter.com/Dinosn/status/1569672320293404675) - - [jscythe: execute arbitrary javascript code](https://twitter.com/Dinosn/status/1569664443444826112) - - [Iranian Hackers Target High-Value Targets in Nuclear Security and Genomic Research](https://twitter.com/Dinosn/status/1569658288609820673) - - [RT BSides Zurich: We are thrilled to announce Sanaz Yashar (@sanazyashar) as our next #BSidesZH Keynote speaker. Sanaz is a senior manager at @Mandian...](https://twitter.com/BSidesZurich/status/1569604294743146496) - - [U-Haul discloses data breach exposing customer driver licenses](https://twitter.com/Dinosn/status/1569580548842201088) - - [GitHub - thiagopeixoto/massayo: Massayo is a small proof-of-concept Rust library which removes AV/EDR hooks in a given system DLL by loading a freshy ...](https://twitter.com/Dinosn/status/1569580390284935175) - - [Cisco Data Breach Attributed to Lapsus$ Ransomware Group](https://twitter.com/Dinosn/status/1569580336065003521) - - [Apple Warns of New 0-Day CVE-2022-32917 Flaw on iOS, macOS](https://twitter.com/Dinosn/status/1569580159648382976) - - [Pro-Palestinian group GhostSec hacked Berghof PLCs in Israel](https://twitter.com/Dinosn/status/1569579932426067969) - - [Part 2 – iOS Native Code Obfuscation and Syscall Hooking](https://twitter.com/Dinosn/status/1569579779317276672) - - [Chinese-linked cyber crims nab $529 million from Indian nationals](https://twitter.com/Dinosn/status/1569579725663703040) - - [RT kmkz: JOP ROCKET: a tool designed to help facilitate JOP gadget discovery in an x86 Windows environment. This tool was released at DEF CON 27](https://twitter.com/kmkz_security/status/1569563078475370499) -- ElcomSoft blog - - [Entering DFU: iPhone 8, 8 Plus, and iPhone X](https://blog.elcomsoft.com/2022/09/entering-dfu-iphone-8-8-plus-and-iphone-x/) -- 一个被知识诅咒的人 - - [史上最全的Go语言模块（Module）管理详解（基于Go1.19）](https://blog.csdn.net/nokiaguy/article/details/126827058) -- Sploitus.com Exploits RSS Feed - - [Infix LMS 4.3.0 IFRAME Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37955&utm_source=rss&utm_medium=rss) - - [Infix LMS 4.3.0 Shell Upload Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37956&utm_source=rss&utm_medium=rss) - - [ESM ETAP Safety Manager 1.0.0.32 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37957&utm_source=rss&utm_medium=rss) - - [Rocket LMS 1.6 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168348&utm_source=rss&utm_medium=rss) - - [Rocket LMS 1.6 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168349&utm_source=rss&utm_medium=rss) - - [Academy Learning Management System 5.7 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168350&utm_source=rss&utm_medium=rss) - - [TIBCO JasperReports Server 8.0.2 Community Edition Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168368&utm_source=rss&utm_medium=rss) - - [kampag CMS Local File Download / Disclosure Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37958&utm_source=rss&utm_medium=rss) - - [SmartRG Router 2.6.13 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37954&utm_source=rss&utm_medium=rss) - - [Exploit for OS Command Injection in Openssl exploit](https://sploitus.com/exploit?id=33186A5F-0C7E-5542-AEC3-BEC940C50B5C&utm_source=rss&utm_medium=rss) -- 安全客-有思想的安全新媒体 - - [解读《2022年Q1手机安全状况报告》热门“五杀”剧本](https://www.anquanke.com/post/id/273844) - - [美国因阿尔巴尼亚网络攻击对伊朗情报部实施制裁](https://www.anquanke.com/post/id/280029) - - [Lorenz 勒索软件通过通信系统入侵企业网络](https://www.anquanke.com/post/id/280023) - - [报告：近1/4遭受勒索软件攻击医疗机构病人死亡率上升](https://www.anquanke.com/post/id/280012) - - [乌方称通过网络攻击瘫痪了2400多个俄罗斯网站](https://www.anquanke.com/post/id/280007) - - [统计：近6年黑客企图入侵韩政府网络近56万次](https://www.anquanke.com/post/id/279984) - - [微软：伊朗黑客使用BitLocker加密Windows系统](https://www.anquanke.com/post/id/279868) - - [北约机密文件从葡萄牙被盗后流入暗网](https://www.anquanke.com/post/id/279889) - - [黑客袭击频发 澳大利亚网络安全保险费飙升80%](https://www.anquanke.com/post/id/279975) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities with 5 Critical, plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories.](https://blog.qualys.com/category/vulnerabilities-threat-research) -- 先知安全技术社区 - - [从mcms历史漏洞中捡漏](https://xz.aliyun.com/t/11695) - - [网鼎CTF之findIT题解—Spring通用MemShell改造](https://xz.aliyun.com/t/11688) -- Trustwave Blog - - [MailMarshal Upgrade Boosts ‘Hard to Detect’ Phishing by 40%](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/mailmarshal-upgrade-boosts-hard-to-detect-phishing/) -- 安全脉搏 - - [ARM架构的一次充电](https://www.secpulse.com/archives/187046.html) - - [三星承认泄露部分客户的详细信息](https://www.secpulse.com/archives/187020.html) - - [免杀基础（1）-免杀技术及原理](https://www.secpulse.com/archives/187017.html) -- 先知安全技术社区 - - [从mcms历史漏洞中捡漏](https://xz.aliyun.com/t/11695) - - [网鼎CTF之findIT题解—Spring通用MemShell改造](https://xz.aliyun.com/t/11688) -- 跳跳糖 - 安全与分享社区 - - [PHP Phar反序列化浅学习](https://tttang.com/archive/1732/) - - [OSCP tips and tricks（译文）](https://tttang.com/archive/1734/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [安全玻璃盒|《数字金融软件供应链安全解决方案》](https://www.4hou.com/posts/2JAv) - - [黑客组织Cloaked Ursa 开始尝试使用在线存储服务、DropBox和GoogleDrive发起攻击](https://www.4hou.com/posts/4K4V) - - [被窃取的加密货币能否追回？](https://www.4hou.com/posts/QLmY) - - [静态IP是什么意思？和动态IP 有什么区别](https://www.4hou.com/posts/BEvJ) - - [获取IP地址的途径有哪些，要如何保护IP地址不被窃取？](https://www.4hou.com/posts/AOXO) -- Bug Bounty in InfoSec Write-ups on Medium - - [Exploiting OAuth authentication vulnerabilities Part III](https://infosecwriteups.com/exploiting-oauth-authentication-vulnerabilities-part-iii-e3db79c83359?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [What’s New in SAP Analytics Cloud Release 2022.19](https://blogs.sap.com/2022/09/13/whats-new-in-sap-analytics-cloud-release-2022.19/) - - [SAP S/4HANA Digital Supply Chain Edition for a modular conversion to Cloud](https://blogs.sap.com/2022/09/13/sap-s-4hana-digital-supply-chain-edition-for-a-modular-conversion-to-cloud/) - - [The evolution and future of Advanced Planning and Scheduling (APS) systems](https://blogs.sap.com/2022/09/13/the-evolution-and-future-of-advanced-planning-and-scheduling-aps-systems/) - - [Achieving Paperless Direct Debiting with SAP](https://blogs.sap.com/2022/09/13/achieving-paperless-direct-debiting-with-sap/) - - [Reference Data Management for SAP Master Data Governance](https://blogs.sap.com/2022/09/13/reference-data-management-for-sap-master-data-governance/) - - [ML and actual costing in SAP S/4 Hana](https://blogs.sap.com/2022/09/13/ml-and-actual-costing-in-sap-s-4-hana/) - - [Product Hierarchy in Margin analysis](https://blogs.sap.com/2022/09/13/product-hierarchy-in-margin-analysis/) - - [Tailored Journey to Operational Excellence in the Food Industry with SAP S/4HANA Cloud](https://blogs.sap.com/2022/09/13/tailored-journey-to-operational-excellence-in-the-food-industry-with-sap-s-4hana-cloud/) -- Didier Stevens - - [Quickpost: “Exploding Multimeter”](https://blog.didierstevens.com/2022/09/13/quickpost-exploding-multimeter/) -- 博客园 - 挖洞的土拨鼠 - - [智能网联汽车渗透测试 第一篇 实验环境准备 - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16689997.html) -- blog.avast.com EN - - [Misinformation and propaganda in the authoritarian internet](https://blog.avast.com/misinformation-propaganda-authoritarian-internet) -- CFC4N的博客 - - [eCapture旁观者：Android HTTPS明文抓包，无需CA证书](https://www.cnxct.com/ecapture-for-android/) -- Webroot Blog - - [Spending time with the Girl Scouts of Greater Chicago at Northwest Indiana’s CampCEO](https://www.webroot.com/blog/2022/09/12/spending-time-with-the-girl-scouts-of-greater-chicago-at-northwest-indianas-campceo/) -- Malwarebytes Labs - - [Steam account credentials phished in browser-in-a-browser attack](https://www.malwarebytes.com/blog/news/2022/09/steam-account-credentials-phished-by-browser-in-browser-attack) - - [Important update! iPhones, Macs, and more vulnerable to zero-day bug](https://www.malwarebytes.com/blog/news/2022/09/update-now-apple-devices-are-exposed-to-a-new-zero-day-flaw) - - [Update now! Google patches vulnerabilities for Pixel mobile phones](https://www.malwarebytes.com/blog/news/2022/09/update-now-google-patches-vulnerabilities-for-pixel-mobile-phones) - - [BackupBuddy WordPress plugin vulnerable to exploitation, update now!](https://www.malwarebytes.com/blog/news/2022/09/backupbuddy-wordpress-plugin-vulnerable-to-exploitation-update-now) - - [Apple puts the password on life support with passkey](https://www.malwarebytes.com/blog/news/2022/09/apple-puts-the-password-on-life-support-with-passkey) -- Reverse Engineering - - [Part 2 – iOS Native Code Obfuscation and Syscall Hooking](https://www.reddit.com/r/ReverseEngineering/comments/xcyy8r/part_2_ios_native_code_obfuscation_and_syscall/) - - [Fixing the Roland CM-500 Vibrato Bug \ VOGONS](https://www.reddit.com/r/ReverseEngineering/comments/xcwkjk/fixing_the_roland_cm500_vibrato_bug_vogons/) -- HAHWUL - - [OAST에 Hint를 더하다](https://www.hahwul.com/2022/09/13/oast-power-up/) -- The Daily Swig | Cybersecurity news and views - - [Let’s Encrypt builds infrastructure to support browser-based certificate revocation revival](https://portswigger.net/daily-swig/lets-encrypt-builds-infrastructure-to-support-browser-based-certificate-revocation-revival) -- Black Hills Information Security - - [Talkin’ About Infosec News – 9/13/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-9-13-2022/) - - [Linux System Call Monitoring](https://www.blackhillsinfosec.com/linux-system-call-monitoring/) -- 绿盟科技技术博客 - - [TLS指纹分析研究（上）](http://blog.nsfocus.net/tls1-0/) - - [绿盟科技威胁周报（2022.09.05-2022.09.11）](http://blog.nsfocus.net/weeklyreport37/) -- Blog - Praetorian - - [Framework Selection: How to Architect a Systematic Security Program – Part 1](https://www.praetorian.com/blog/how-to-architect-a-systematic-security-program/) -- Twitter @Keiran Smith (Affix) - - [When manually monitoring the @ChargePlaceScot app results in missing out on charging opportunities, Write a bot #automation #bots #evcharging](https://twitter.com/cli/status/1569693744831799299) - - [RT Gabriele Corno: I think having an animal in our life makes us better humans](https://twitter.com/Gabriele_Corno/status/1569612627470417920) - - [Really not a fan of the #monarchy or the union. But you assholes picketing a funeral and a greiving family stinks of @GodHatesFags. Have some respect ...](https://twitter.com/cli/status/1569602174270820353) -- Twitter @hakivvi - - [Re @maherazz2 Well, there it is ;) Congratulations mate!](https://twitter.com/hakivvi/status/1569667355587878915) - - [RT maher azz: CVE-2022-37706 is a 0day that was found on Enlightenment window manager. This vulnerability is critical and can be used to Escalate Priv...](https://twitter.com/maherazz2/status/1569665311707734023) -- 体验盒子 - - [PHP多维数组二维数组查找、搜索、判断](https://www.uedbox.com/post/68510/) -- HackerNews - - [思科确认 Yanluowang 勒索软件团伙泄露了公司数据](https://hackernews.cc/archives/41468) - - [乌方：网络攻击瘫痪俄罗斯 2400 个网站](https://hackernews.cc/archives/41466) - - [黑客利用伪造的弹出登录窗口窃取 Steam 帐户](https://hackernews.cc/archives/41463) - - [苹果发布 iOS 和 macOS 更新以修复积极利用的零日漏洞](https://hackernews.cc/archives/41454) - - [WordPress 插件曝出零日漏洞，已被积极在野利用](https://hackernews.cc/archives/41449) - - [Google 宣布完成收购 Mandiant，提升网络威胁情报能力](https://hackernews.cc/archives/41444) - - [量子密码学：让量子计算机背后的黑客无功而返](https://hackernews.cc/archives/41438) -- bishopfox.com - - [Introducing: CloudFox](https://bishopfox.com/blog/introducing-cloudfox) -- KitPloit - PenTest & Hacking Tools - - [Pinecone - A WLAN Red Team Framework](http://www.kitploit.com/2022/09/pinecone-wlan-red-team-framework.html) -- 李劼杰的博客 - - [安全工具 EasyPen alpha 1.0 发布](https://www.lijiejie.com/easypen-alpha-1-0-released/) -- 看雪学院 - - [利用AndroidNativeEmu完成多层jni调用的模拟](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458469186&idx=1&sn=638f144efc64341100fcda3989241b2c&chksm=b18e73c886f9fade876f212d26b818af1a054da7b582477595eea5a1a73ccee4144acdd9697e&scene=58&subscene=0#rd) - - [波及16个都道县！日本电信运营商KDDI再出故障](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458469186&idx=2&sn=e3b47da449548666e58108e70de3c129&chksm=b18e73c886f9fade08e467c2ae371a6176c0e20da54b3b7e4d8fbf9ea78c6c9ec61501a5021e&scene=58&subscene=0#rd) - - [《安卓逆向入门》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458469186&idx=3&sn=cebd744d179d83d9ea938ad5b7d06689&chksm=b18e73c886f9fadee097bf3f70af5b5937dac49d919df2e2cf1220f6c3709a7738ef1568344a&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(09-13)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958687&idx=1&sn=c21e18a1f086003f98554a5a3e9ebb33&chksm=8baecd00bcd9441636d6ceaaba7d7f863248ef9a03844803cae50acf587845b5136182a9874f&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】梯度泄露攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649777555&idx=1&sn=736bec7f7dfc4223ff3c1c45a9211194&chksm=889355fcbfe4dceadb8438b0318c7b883562414ba2a7a0e1b40cd290e44c8137ff1ccc4a9791&scene=58&subscene=0#rd) - - [【安全头条】北约机密文件从葡萄牙被盗后流入暗网](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649777555&idx=2&sn=0e29183742277430cb3e4f2b0ff1da41&chksm=889355fcbfe4dceac1f4ad10e54fb3b3d1dffcfb47996d72bc8b6abea2782986125c72123cce&scene=58&subscene=0#rd) -- 博客园 - nice_0e3 - - [Nancy 反序列化漏洞分析 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16690665.html) -- 雷神众测 - - [雷神众测漏洞周报2022.9.05-2022.9.11](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652499643&idx=1&sn=e3f3fc8f34444e02d6d98b03c2fd4218&chksm=f2584d08c52fc41efd5dc4fea1f9e9b9f2c35d8531c5c90d251bc8ae0b1aafd4b49eb3a1e714&scene=58&subscene=0#rd) -- 互联网安全内参 - - [美军下一代战略武器“哨兵洲际导弹”网络安全怎么做？](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505892&idx=1&sn=b059faefbad1eeed621250b29e5c2bcc&chksm=ebfa90c4dc8d19d20424fff7dd58cc470e7e566a9d1e6bbd391aae622408149d72c65cd204ad&scene=58&subscene=0#rd) - - [北京地铁全线车站闸机无法查验健康码信息](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505892&idx=2&sn=84f8a4a40509042d34de99f683c8b626&chksm=ebfa90c4dc8d19d2e5b68d94771d40b6aa04a3467547009fd27bad718f224b75a13aa04d17f1&scene=58&subscene=0#rd) - - [近6年黑客企图入侵韩国政府网络近56万次](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505892&idx=3&sn=b361edec01300f2c2178c38080037fd8&chksm=ebfa90c4dc8d19d26c21ac74608e71170f250b46beea862ec0a4e1544d2b12469e65f6d7bf1f&scene=58&subscene=0#rd) - - [乌克兰网络攻击致2400多个俄罗斯网站瘫痪，含俄最大银行、俄媒体](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505892&idx=4&sn=caa39aad90f15d57d0140ccb7dca8d50&chksm=ebfa90c4dc8d19d2c37b1716e4d605f897bf151b28b3eac8425efdfebf1e982896a922937e00&scene=58&subscene=0#rd) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 谷歌花54亿美元收购Mandiant；黑客企图入侵韩国政府56万次](https://www.freebuf.com/news/344393.html) - - [思科确认 Yanluowang 勒索软件团伙泄露了公司数据](https://www.freebuf.com/news/344378.html) - - [大事件！乌方：网络攻击已瘫痪俄罗斯2400个网站](https://www.freebuf.com/articles/344375.html) - - [健康医疗数据跨境流动合规分析](https://www.freebuf.com/articles/neopoints/344369.html) - - [黑客利用伪造的弹出登录窗口窃取Steam帐户](https://www.freebuf.com/news/344356.html) -- 丁爸情报分析师的工具箱 - - [【资源】103个供调查人员使用的黑客，破解和网络犯罪论坛资源](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651132008&idx=1&sn=ae13cc7e75e88eff98ffe0727f9e62a0&chksm=f1af6752c6d8ee447f47c387d77213e0bae7539c6c8f7c965f967e395e34549ffca6fb640f3f&scene=58&subscene=0#rd) -- 奇安信CERT - - [安全热点周报|第二百六十一期](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496910&idx=1&sn=315bb0c8848df941c0c6b629082ca150&chksm=fe79d056c90e594067a177de88d2eac900e16a571ce86767e755b8dd5eb8ea31fbf23fe7ec7f&scene=58&subscene=0#rd) -- 安全牛 - - [简析欺骗式防御技术的价值与应用](https://www.aqniu.com/homenews/88951.html) - - [ISACA中国2022年度大会将于10月召开](https://www.aqniu.com/homenews/88950.html) - - [直播预告 | 网安大讲堂（42期）：高级Web安全专家（OSWE）认证介绍（二）](https://www.aqniu.com/homenews/88949.html) - - [安全玻璃盒|《数字金融软件供应链安全解决方案》](https://www.aqniu.com/vendor/88948.html) -- 极客公园 - - [雷军这本小米商业实验的「论文」，该怎么看？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967260&idx=1&sn=6cb8dbed66e7fac2a1506145dc77c928&chksm=7e546cea4923e5fcbd58d5d988187ced2775434a88188abf5d3be562ee5121cb79abdb9f41b0&scene=58&subscene=0#rd) - - [算力越高，车越智能？新造车「算力大战」背后的真相是啥？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967232&idx=1&sn=149ad31903ee8904b740507489b14111&chksm=7e546cf64923e5e0f47aea49e26a4e0932fcd083bdfaebe401bc12980efafc6f6bcb147c2eae&scene=58&subscene=0#rd) - - [把开源项目变成创业公司，难在哪里？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967232&idx=2&sn=c93c250a66504351b000e8deb4efc49a&chksm=7e546cf64923e5e02c99991bdf2c6be2a65694e098aa66701c62c7ca3bae1cd15bfb9d1654db&scene=58&subscene=0#rd) - - [苹果 iOS 16 正式版发布；星巴克推出 Web 3 平台；迪士尼发布漫威宇宙新项目，「王者·灭霸」要来了 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967213&idx=1&sn=30fb8582dde8c0ac7b0ac2275b0e3c91&chksm=7e546c9b4923e58dcde694f2890f15d9ffce4c9aefdbc19d7c2c7a3515e81903adb6913d2ab3&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220913期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531133&idx=1&sn=f900b3f14ebf0e0b7044d512f7a5bed6&chksm=c1e9f62cf69e7f3a6431949776a3fbf76f72e67b638969aa304532bbaf86ee61ae820a57c68d&scene=58&subscene=0#rd) - - [百尺竿头 更进一步 探秘西门子软PLC](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531133&idx=2&sn=1cdf4d7b9938debe805a043ba4ac0eb3&chksm=c1e9f62cf69e7f3a87db6064c956942d7acc7e87c2a78871e194473d5ec9b9077baa2b047fd9&scene=58&subscene=0#rd) - - [国家互联网信息办公室关于《网信部门行政执法程序规定（征求意见稿）》](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531133&idx=3&sn=5cf15c0e65d61c8cfb6b3da4d7999663&chksm=c1e9f62cf69e7f3ac72dca03ffff98965226155b7645c41771d5859835641ddb87f16aed1652&scene=58&subscene=0#rd) - - [勒索软件攻击呈上升趋势](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531133&idx=4&sn=48ca022f8897067cc8686fbca7784124&chksm=c1e9f62cf69e7f3a3bcb0eebe204c9f9dadcd7379625e0de51459c6e6745c51bca9e08e41dd1&scene=58&subscene=0#rd) -- 且听安全 - - [CVE-2022-34747 ZyXel NAS设备格式化字符串漏洞分析与复现](https://mp.weixin.qq.com/s?__biz=Mzg3MTU0MjkwNw==&mid=2247491481&idx=1&sn=8865b32e49a41b456eb8010dd27a04bb&chksm=cefda68df98a2f9b219be69fdd8b2b611f0064402144bc07121dcc7f993964ae0b180edda8ce&scene=58&subscene=0#rd) -- 情报分析师 - - [如何进行人员跟踪（下）（附电子教程）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650516112&idx=1&sn=b135288c28d7f8493543204b0e84b1ef&chksm=871684dbb0610dcd147fd2fae16475ee8c8c0f8c456c42512b3504e5b9877161b68d04141a5a&scene=58&subscene=0#rd) - - [为什么 OSINT 工具并不总是解决方案](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650516112&idx=2&sn=87f0fb99973e2385e52aed080a497db6&chksm=871684dbb0610dcd40fd6ee12e321ed73a1a7d4fea6a734fe45dab49f72f60fa64f58ea28446&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [破解BurpSuite Pro 2022.9 (有变化)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486184&idx=1&sn=090f6f4bacecd06258f8f57a7e873605&chksm=fab2c9d7cdc540c1eddd8cf3524bdca0190fc29b17ce894de55a2c91f7cfbda5fcb4a13f9a0a&scene=58&subscene=0#rd) -- 安全牛 - - [简析欺骗式防御技术的价值与应用](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118531&idx=1&sn=0ea5ead53816ca91dd57a70a5d803375&chksm=bd146b108a63e20642108cf9a507aadcf55aaefb00de663eb839c1ae9ea4f8ea47679bf068f2&scene=58&subscene=0#rd) - - [ISACA中国2022年度大会将于10月召开](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118531&idx=2&sn=db72f10c7741204e2bc6c18e1a8dae71&chksm=bd146b108a63e20637743cd031108375d0964d812c1074cd762d169dacef79fe971a64a765b5&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（42期）：高级Web安全专家（OSWE）认证介绍（二）](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118531&idx=3&sn=d7e0a4cb0f6231081d6d10c3056eaaf4&chksm=bd146b108a63e20623be5e00f9278f3483609a19678069941d64728a573c83473fcfe29f8562&scene=58&subscene=0#rd) -- 腾讯安全应急响应中心 - - [想见你想见你｜和QQ邮箱一起守护美好](https://mp.weixin.qq.com/s?__biz=MjM5NzE1NjA0MQ==&mid=2651206062&idx=1&sn=60564d12e104300c7b95f12e8267c68d&chksm=bd2cd4088a5b5d1e2b77268433f185e1b62d3b29ec564ed4d5ef5eac5e4ad5aa894a2e656567&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [Microsoft VPN远程代码执行漏洞分析1-CVE-2022-23252](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496393&idx=1&sn=2e9b49f125f3e1213066ef38c214c5eb&chksm=fa522777cd25ae61f3c4710f8d30f952e8c54e7fead74bb15b25a18d3958c3e80875c2c41598&scene=58&subscene=0#rd) -- 星阑科技 - - [【技术干货】CVE-2022-22978 Spring-security 认证绕过漏洞分析和漏洞挖掘思考](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495686&idx=1&sn=69667841f86fbf5f4743e7a76d5a42dd&chksm=c0075d9af770d48c7980bb487b21fea572848511a162f8e2a2f246f82b346fbcc4f69857971b&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [原创 | 百尺竿头 更进一步 探秘西门子软PLC](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531410&idx=1&sn=61307bab873b52b47779d2e86a4be639&chksm=fa93cd53cde44445e43e4032c9a395a38c7a8b292ac4d3327ed270671970fc4cf0bb601dfa64&scene=58&subscene=0#rd) - - [医疗保健和公共卫生部门频繁的勒索软件攻击加剧了对该行业OT/IoT环境的安全担忧](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531410&idx=2&sn=110fd4c89604a31711d9d85541b86c26&chksm=fa93cd53cde4444574f587f067308c32abff1220b2752e652b5abd1f751b58b391ceb5dcfe39&scene=58&subscene=0#rd) - - [乌克兰最大电信运营商如何应对俄乌网络战？](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531410&idx=3&sn=67a9c792993df283ebe5ad19f611b686&chksm=fa93cd53cde444458c67b73c9793a66571829120dfa3bba8ed47efaaaa2b8a661f6786c63c89&scene=58&subscene=0#rd) -- Beacon Tower Lab - - [VMware Tools本地提权漏洞CVE-2022-31676分析与复现（1）](https://mp.weixin.qq.com/s?__biz=MzkzNjMxNDM0Mg==&mid=2247485348&idx=1&sn=700b30c98292f2253bdf81aa3a73ba8d&chksm=c2a1d32df5d65a3b57f5d7aa1fb72564de6931061ba1eb2e9d005fc941236d61391afa214f42&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】北京地铁全线车站闸机无法查验健康码信息，采取人工核验引导乘客进站](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016897&idx=1&sn=d0e2a213a7cbe51e1aa8a1ad8010ab2b&chksm=f36fbd41c4183457e065786dd55dea92040e5dba689b1efca4b414c2ee9ec9ce58c758015056&scene=58&subscene=0#rd) - - [【安全圈】美NSA专用网络武器“饮茶”攻击西工大间谍模块重要细节曝光](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016897&idx=2&sn=163feec36295b6a255f91c35bda588f3&chksm=f36fbd41c41834579282ea2935428a554d1d4022f35b408ee82005fba6dc84028d521990ca35&scene=58&subscene=0#rd) - - [【安全圈】乌克兰网络攻击致俄罗斯2400多网站瘫痪，含俄最大银行媒体](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016897&idx=3&sn=22c01dcd6def3552e805fe6b2ee96fd6&chksm=f36fbd41c4183457650cfa9dd7b298291a2030c0edbbd5b14e76b20ca2cf9692ca2283b65c96&scene=58&subscene=0#rd) - - [【安全圈】索尼PS5服务器崩溃：所有游戏都进不去](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016897&idx=4&sn=a995c4c3dc7930e857995ffb67f27169&chksm=f36fbd41c4183457fc8d6349540c3292cc1cc759c9b465f7be5a743743c3b2d4328654523a56&scene=58&subscene=0#rd) - - [【安全圈】黑客利用伪造的弹出登录窗口窃取Steam帐户](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016897&idx=5&sn=4280f373f0d642d1e9743b70e17fed0f&chksm=f36fbd41c4183457b7377873e901012dbeaf8d0e12503050ddbdfb5d6ee2b155f1826f6b9f19&scene=58&subscene=0#rd) - - [【安全圈】美国加拿大日本多家能源公司遭黑客集团Lazarus攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652016897&idx=6&sn=217752f019694f40a146a704a5741a18&chksm=f36fbd41c4183457f3d2486bdea12b5bba89e8cac24f4d8c201685d3d021593a52cd864443ca&scene=58&subscene=0#rd) -- 网安寻路人 - - [美国FTC准备制定规则，打击商业监视和不严格的数据安全做法](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495775&idx=1&sn=78feb3fd82ff6d64654342af156291cf&chksm=97e94db5a09ec4a34ba1c21d1a7ac706f32dd660b4e65f92abdfebcf0f682690931fd955a569&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [最后6小时||XCon2022启幕在即，早鸟票抢售即将结束！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550244&idx=1&sn=7df4011a3664cedc13e30d99fa827683&chksm=e915d51ede625c0860265fad4b4a6747d87a44a5fcde2b7a594d0e9e60066f8e119a0226873e&scene=58&subscene=0#rd) - - [被窃取的加密货币能否追回？](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550244&idx=2&sn=0fb4429728b449ce146ab23fed0c0b21&chksm=e915d51ede625c08f1854ea9d8e2e14b68056f9bc74f342162ff8a70f0d7d088bc7439c4e47b&scene=58&subscene=0#rd) - - [黑客组织Cloaked Ursa 开始尝试使用在线存储服务、DropBox和GoogleDrive发起攻击](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550244&idx=3&sn=28ff856efd553ddccec1b389f4f92b2a&chksm=e915d51ede625c08d9a03fc938c7def6b50a31aa50bb96789168e4a745ec3e18e2f019c8bbac&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-15.md b/archive/2022/2022-09-15.md deleted file mode 100644 index a8be4e249f..0000000000 --- a/archive/2022/2022-09-15.md +++ /dev/null @@ -1,288 +0,0 @@ -# 每日安全资讯（2022-09-15） - -- Sploitus.com Exploits RSS Feed - - [Rocket LMS 1.6 Shell Upload Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37960&utm_source=rss&utm_medium=rss) - - [Rocket LMS 1.6 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37959&utm_source=rss&utm_medium=rss) - - [Academy Learning Management System 5.7 Shell Upload Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37961&utm_source=rss&utm_medium=rss) - - [WordPress WPGateway 3.5 Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:168369&utm_source=rss&utm_medium=rss) - - [TIBCO JasperReports Server 8.0.2 Community Edition Code Execution Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37962&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Zlib exploit](https://sploitus.com/exploit?id=2EF519E9-1FB0-5978-80E6-42B558A3B3B0&utm_source=rss&utm_medium=rss) - - [Exploit for Missing Authorization in Samba Rsync exploit](https://sploitus.com/exploit?id=943DB0F0-F2AB-5166-9D88-62FA18433BBD&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [Say Hello to Crazy Thin ‘Deep Insert’ ATM Skimmers](https://securityboulevard.com/2022/09/say-hello-to-crazy-thin-deep-insert-atm-skimmers/) - - [Patch Tuesday Advisory – September 2022](https://securityboulevard.com/2022/09/patch-tuesday-advisory-september-2022/) - - [Blog: How BluBracket identifies risks in source code to enhance code security](https://securityboulevard.com/2022/09/blog-how-blubracket-identifies-risks-in-source-code-to-enhance-code-security/) - - [Register Now: SOC 2? Who Cares? (And Why You Should)](https://securityboulevard.com/2022/09/register-now-soc-2-who-cares-and-why-you-should/) - - [5 P’s to Start Quantitative Risk Management – No 4 Process](https://securityboulevard.com/2022/09/5-ps-to-start-quantitative-risk-management-no-4-process/) - - [BSides Vancouver 2022 – Bishakha Jain’s ‘The Cybersecurity Mindset: A Ceaseless Erudition’](https://securityboulevard.com/2022/09/bsides-vancouver-2022-bishakha-jains-the-cybersecurity-mindset-a-ceaseless-erudition/) - - [What is Attack Surface Management and How Has it Changed?](https://securityboulevard.com/2022/09/what-is-attack-surface-management-and-how-has-it-changed/) - - [What Does East-West Mean in an Atomized Network?](https://securityboulevard.com/2022/09/what-does-east-west-mean-in-an-atomized-network/) -- Files ≈ Packet Storm - - [Faraday 4.1.0](https://packetstormsecurity.com/files/168383/faraday-4.1.0.tar.gz) - - [Ubuntu Security Notice USN-5611-1](https://packetstormsecurity.com/files/168382/USN-5611-1.txt) - - [Ubuntu Security Notice USN-5610-1](https://packetstormsecurity.com/files/168381/USN-5610-1.txt) - - [Ubuntu Security Notice USN-5583-2](https://packetstormsecurity.com/files/168380/USN-5583-2.txt) - - [Red Hat Security Advisory 2022-6504-01](https://packetstormsecurity.com/files/168379/RHSA-2022-6504-01.txt) - - [Red Hat Security Advisory 2022-6507-01](https://packetstormsecurity.com/files/168378/RHSA-2022-6507-01.txt) - - [Red Hat Security Advisory 2022-6503-01](https://packetstormsecurity.com/files/168377/RHSA-2022-6503-01.txt) - - [Red Hat Security Advisory 2022-6502-01](https://packetstormsecurity.com/files/168376/RHSA-2022-6502-01.txt) - - [Red Hat Security Advisory 2022-6505-01](https://packetstormsecurity.com/files/168375/RHSA-2022-6505-01.txt) - - [Red Hat Security Advisory 2022-6506-01](https://packetstormsecurity.com/files/168374/RHSA-2022-6506-01.txt) - - [Ubuntu Security Notice USN-5609-1](https://packetstormsecurity.com/files/168373/USN-5609-1.txt) - - [Red Hat Security Advisory 2022-6322-01](https://packetstormsecurity.com/files/168372/RHSA-2022-6322-01.txt) - - [Ubuntu Security Notice USN-5608-1](https://packetstormsecurity.com/files/168371/USN-5608-1.txt) - - [Ubuntu Security Notice USN-5607-1](https://packetstormsecurity.com/files/168370/USN-5607-1.txt) - - [WordPress WPGateway 3.5 Privilege Escalation](https://packetstormsecurity.com/files/168369/wpgateway35-escalate.txt) -- NOSEC 安全讯息平台 - 漏洞预警 - - [【安全通报】2022年9月微软漏洞补丁日修复多个高危漏洞](https://nosec.org/home/detail/5036.html) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Qualys Cloud Agent Arbitrary Code Execution](https://cxsecurity.com/issue/WLB-2022090037) - - [STORAGE UNIT RENTAL MANAGEMENT SYSTEM v1.0 vulnerable to Stored Cross Site Scripting (XSS) attack](https://cxsecurity.com/issue/WLB-2022090036) - - [WordPress WPGateway 3.5 Privilege Escalation](https://cxsecurity.com/issue/WLB-2022090035) -- Microsoft Security Blog - - [Implementing a Zero Trust strategy after compromise recovery](https://www.microsoft.com/security/blog/2022/09/14/implementing-a-zero-trust-strategy-after-compromise-recovery/) -- 安全客-有思想的安全新媒体 - - [快递信息泄露成诈骗帮凶，社交账号、经济能力、消费习惯全被掌握](https://www.anquanke.com/post/id/274066) - - [WPGateway插件零日漏洞在攻击中被积极利用](https://www.anquanke.com/post/id/280121) - - [正式开源！无恒实验室推出appshark自动化漏洞及隐私合规检测工具](https://www.anquanke.com/post/id/280006) - - [黑客入侵Magento供应链攻击软件供应商](https://www.anquanke.com/post/id/280128) - - [安全事件周报 (09.05-09.12)](https://www.anquanke.com/post/id/280042) - - [出售儿童被盗身份，税务欺诈团伙头目被判入狱](https://www.anquanke.com/post/id/280125) - - [数字安全观察每周简报【安全事件篇】 2022.08.31-2022.09.06](https://www.anquanke.com/post/id/280044) - - [亲巴黑客组织GhostSec，入侵以色列Berghof PLC](https://www.anquanke.com/post/id/280109) - - [黑客新工具，可窃取Gmail、雅虎、Outlook等电子邮件](https://www.anquanke.com/post/id/280106) - - [网络安全的三大支柱和攻击向量](https://www.anquanke.com/post/id/280003) - - [iOS 15.7与iOS 16同步推送：包含重要安全漏洞修复](https://www.anquanke.com/post/id/280036) - - [乌方称通过网络攻击瘫痪了2400多个俄罗斯网站](https://www.anquanke.com/post/id/280033) -- Tenable Blog - - [CVE-2022-40139: Vulnerability in Trend Micro Apex One Exploited in the Wild](https://www.tenable.com/blog/cve-2022-40139-vulnerability-in-trend-micro-apex-one-exploited-in-the-wild) -- Recent Commits to cve:main - - [Update Wed Sep 14 10:00:56 UTC 2022](https://github.com/trickest/cve/commit/36326fb218634371a4d673447408a2ae8d879d03) -- 先知安全技术社区 - - [CVE-2022-1292的分析](https://xz.aliyun.com/t/11703) - - [Gitlab常见漏洞复现及后利用](https://xz.aliyun.com/t/11690) -- 先知安全技术社区 - - [CVE-2022-1292的分析](https://xz.aliyun.com/t/11703) - - [Gitlab常见漏洞复现及后利用](https://xz.aliyun.com/t/11690) -- obaby@mars - - [魔咒](http://h4ck.org.cn/2022/09/%e9%ad%94%e5%92%92/) -- Twitter @Nicolas Krassas - - [Attacking the Android kernel using the Qualcomm TrustZone](https://twitter.com/Dinosn/status/1570145897484255234) - - [Codecepticon - An offensive security obfuscator for C#, VBA, and PowerShell](https://twitter.com/Dinosn/status/1570145804626829315) - - [SDomDiscover - A Easy-To-Use Python Tool To Perform DNS Recon](https://twitter.com/Dinosn/status/1570115945653321729) - - [Caching the Un-cacheables - Abusing URL Parser Confusions (Web Cache Poisoning Technique)](https://twitter.com/Dinosn/status/1570115674260774916) - - [TeamTNT Hits 150K Docker Containers via Malicious Cloud Images](https://twitter.com/Dinosn/status/1570115553121144832) - - [Phishing page embeds keylogger to steal passwords as you type](https://twitter.com/Dinosn/status/1570115214510792706) - - [Breach Of Software Maker Used To Backdoor As Many As 200,000 Servers](https://twitter.com/Dinosn/status/1570114999007289346) - - [New Lenovo BIOS updates fix security bugs in hundreds of models](https://twitter.com/Dinosn/status/1570114942883201024) - - [Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs](https://twitter.com/Dinosn/status/1570108135410470912) - - [RT Alexandre Borges: After a break, the fifth article in the Malware Analysis Series (MAS) is available: (link): Good reading and have an excellent da...](https://twitter.com/ale_sp_brazil/status/1570071964592529408) - - [Researchers Detail OriginLogger RAT — Successor to Agent Tesla Malware](https://twitter.com/Dinosn/status/1570068921608278018) - - [Google and Meta fined over $70m for privacy violations in Korea](https://twitter.com/Dinosn/status/1570055730429829121) - - [SparklingGoblin APT Hackers Using New Linux Variant of SideWalk Backdoor](https://twitter.com/Dinosn/status/1570055657969143816) - - [Find way more from the Wayback Machine!](https://twitter.com/Dinosn/status/1570011569664270336) - - [RT Tamir Zahavi-Brunner: New blog post :) A pretty unique Android vulnerability I found, which allowed me to exploit the kernel by using the TrustZone...](https://twitter.com/tamir_zb/status/1569978905112768512) - - [RT memN0ps: Re @Dinosn](https://twitter.com/memN0ps/status/1569961651885199361) - - [CVE-2022-35405 Manage engines RCE (Password Manager Pro, PAM360 and Access Manager Plus)](https://twitter.com/Dinosn/status/1569959238474031104) - - [A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red Team operations, Bug Bounty and more](https://twitter.com/Dinosn/status/1569957860007706624) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [单点故障全网瘫痪？且看网络流量“指挥大师”来如何破解](https://www.4hou.com/posts/mXV0) - - [漏洞预警|golang net/url 路径穿越漏洞](https://www.4hou.com/posts/l6V6) - - [KCon 2022 演讲 PPT 新鲜出炉！](https://www.4hou.com/posts/jJV5) - - [+1进阶，见证未来｜第十一届KCon黑客大会后记（附回看链接）](https://www.4hou.com/posts/kMgX) - - [Coremail&奇安信2021邮箱安全报告：正常邮件数量首超普通垃圾邮件，防护初见成效](https://www.4hou.com/posts/17zj) - - [清华大学：应对二十大保障，邮件系统安全先行](https://www.4hou.com/posts/N1jz) - - [VMware Tools本地提权漏洞CVE-2022-31676分析与复现（1）](https://www.4hou.com/posts/9X73) - - [XReward再回归||活力厂商开放麦，精彩议程第一弹！](https://www.4hou.com/posts/8Y7o) - - [嘶吼安全产业研究院 | 《致虚极・守静笃 工控安全产业竞合力洞察报告2022》重磅发布！](https://www.4hou.com/posts/6V79) - - [新型气隙攻击利用MEMS陀螺仪隐蔽超声信道泄露数据](https://www.4hou.com/posts/zllY) - - [APT Lazarus利用macOS恶意软件针对工程师进行攻击](https://www.4hou.com/posts/8YKL) - - [360杜跃进：保护“东数西算”工程数据流动安全 服务数字中国战略](https://www.4hou.com/posts/7J7A) - - [定位新一代智能模糊测试技术提供商，「云起无垠」宣布完成数千万元天使轮融资](https://www.4hou.com/posts/4KD6) - - [DT时代数据安全新变革 | 奇安信发布国内首款流量解密编排器](https://www.4hou.com/posts/3J0Q) -- paper - Last paper - - [基于图卷积神经网络的 web 登录入口识别方法](https://paper.seebug.org/1969/) - - [二进制漏洞学习笔记 - PWN 篇](https://paper.seebug.org/1968/) - - [+1进阶，护航未来 | KCon 2022 黑客大会部分议题 PPT 公布](https://paper.seebug.org/1967/) -- 安全脉搏 - - [实战 | 无视杀软使用远控工具进行横向移动Tips](https://www.secpulse.com/archives/187087.html) - - [实战|一次对BC网站的渗透测试](https://www.secpulse.com/archives/187059.html) - - [Coremail&奇安信2021邮箱安全报告：正常邮件数量首超普通垃圾邮件，防护初见成效](https://www.secpulse.com/archives/187054.html) -- Sucuri Blog - - [Gambling Spam in Visual Composer Raw HTML Element: [vc_raw_html]](https://blog.sucuri.net/2022/09/gambling-spam-in-visual-composer-raw-html-element-vc_raw_html.html) -- unSafe.sh - 不安全 - - [Endpoint, Identity and Cloud | Top Cyber Attacks of 2022 (So Far)](https://buaq.net/go-126606.html) - - [5 technologies that help prevent cyberattacks for SMBs](https://buaq.net/go-126654.html) - - [Machine Learning on Geographical Data](https://buaq.net/go-126609.html) - - [CVE-2022-1292的分析](https://buaq.net/go-126611.html) - - [Gitlab常见漏洞复现及后利用](https://buaq.net/go-126612.html) - - [开学季打折：MarginNote / 白描 / TextSeek / CareUEyes 等软件 6 折起](https://buaq.net/go-126624.html) -- Forcepoint - - [Securing data in cloud apps with Agentless DLP](https://www.forcepoint.com/blog/insights/securing-data-cloud-apps-agentless-dlp) -- SecWiki News - - [SecWiki News 2022-09-14 Review](http://www.sec-wiki.com/?2022-09-14) -- loecho@垃圾桶 - - [Behinder3-Beta11 实战下的二次开发 （5）](https://1oecho.github.io/u1UGWxram/) - - [工具开发：冰蝎4.5 实战化-功能改造](https://1oecho.github.io/Behinder4.5/) - - [实战化工具： YsoMakePayload](https://1oecho.github.io/woodpcker-makeYso/) -- Didier Stevens - - [Quickpost: An Inefficient Powerbank](https://blog.didierstevens.com/2022/09/14/quickpost-an-inefficient-powerbank/) -- SAP Blogs - - [Price Optimization: Staying Competitive, Sustainable and Profitable](https://blogs.sap.com/2022/09/14/price-optimization-staying-competitive-sustainable-and-profitable/) - - [An approach to secure multiple integrated SAP CAP java applications with a common XSUAA instance](https://blogs.sap.com/2022/09/14/an-approach-to-secure-multiple-integrated-sap-cap-java-applications-with-a-common-xsuaa-instance/) - - [Every Journey is Different: The RISE Customer Storytelling Series](https://blogs.sap.com/2022/09/14/every-journey-is-different-the-rise-customer-storytelling-series/) - - [Driving business app adoption –– can it be that simple?](https://blogs.sap.com/2022/09/14/driving-business-app-adoption-can-it-be-that-simple/) - - [How to Use Dynamic Pictures on Document Generation](https://blogs.sap.com/2022/09/14/how-to-use-dynamic-pictures-on-document-generation/) - - [Getting Started with SAP Cloud Identity Service – Authentication (Admin User)](https://blogs.sap.com/2022/09/14/getting-started-with-sap-cloud-identity-service-authentication-admin-user/) - - [Realizing a Clean SAP Core: A pragmatic approach towards digital transformation](https://blogs.sap.com/2022/09/14/realizing-a-clean-sap-core-a-pragmatic-approach-towards-digital-transformation/) - - [Connecting Focused Build with External DevOps API](https://blogs.sap.com/2022/09/14/connecting-focused-build-with-external-devops-api/) -- Application Security Blog - - [CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS](https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/) -- Sucuri Blog - - [Gambling Spam in Visual Composer Raw HTML Element: [vc_raw_html]](https://blog.sucuri.net/2022/09/gambling-spam-in-visual-composer-raw-html-element-vc_raw_html.html) -- Twitter @bytehx - - [RT Henry Chen: CVE-2022-39135 Apache Calcite Avatica XXE](https://twitter.com/chybeta/status/1569937246626922497) -- Trustlook blog - - [VirusTotal APK 病毒检测统计 20220101-20220831](https://blog.trustlook.com/virustotal-apk-bing-du-jian-ce-tong-ji-202201-202208/) - - [VirusTotal APK Malware Detection Data 20220101-20220831](https://blog.trustlook.com/virustotal-apk-malware-detection-data-202201-202208/) -- Malwarebytes Labs - - [5 technologies that help prevent cyberattacks for SMBs](https://www.malwarebytes.com/blog/business/2022/09/5-technologies-that-help-prevent-cyber-attacks-for-smbs) - - [The privacy concerns of tying SIM cards to real identities](https://www.malwarebytes.com/blog/news/2022/09/the-privacy-concerns-of-tying-sim-cards-to-real-identities) - - [Update now! Microsoft patches two zero-days](https://www.malwarebytes.com/blog/news/2022/09/update-now-microsoft-patches-two-zero-days) - - [WPGateway WordPress plugin vulnerability could allow full site takeover](https://www.malwarebytes.com/blog/news/2022/09/wpgateway-wordpress-plugin-vulnerability-could-allow-full-site-takeover) - - [How to help your child manage their online reputation](https://www.malwarebytes.com/blog/personal/2022/09/how-to-help-your-child-manage-their-online-reputation) -- Reverse Engineering - - [Algebraic Separation Logic [PDF]](https://www.reddit.com/r/ReverseEngineering/comments/xdovmp/algebraic_separation_logic_pdf/) - - [An Introduction to Separation Logic (Preliminary Draft) [PDF, authored by Reynolds]](https://www.reddit.com/r/ReverseEngineering/comments/xdn665/an_introduction_to_separation_logic_preliminary/) -- SentinelOne - - [Endpoint, Identity and Cloud | Top Cyber Attacks of 2022 (So Far)](https://www.sentinelone.com/blog/endpoint-identity-and-cloud-top-cyber-attacks-of-2022-so-far/) -- NEW JERSEY TRANSPORTATION - - [5 Music Funding Secrets – How Can I Fund My Music Projects Without Working a Regular Job?](http://lvwei.me/5-music-funding-secrets-how-can-i-fund-my-music-projects-without-working-a-regular-job/) -- rtl-sdr.com - - [Frugal Radio KrakenSDR Part 2: Vehicle Direction Finding Tests](https://www.rtl-sdr.com/frugal-radio-krakensdr-part-2-vehicle-direction-finding-tests/) - - [Open Source Military TAK Android App Supports RTL-SDR ADS-B Tracking](https://www.rtl-sdr.com/open-source-military-tak-android-app-supports-rtl-sdr-ads-b-tracking/) - - [An Inside Look into FlightAware’s RTL-SDR](https://www.rtl-sdr.com/an-inside-look-into-flightawares-rtl-sdr/) -- 绿盟科技技术博客 - - [绿盟科技参与编制的《物联网操作系统安全白皮书》正式发布](http://blog.nsfocus.net/iotwhitepaper/) -- HackerNews - - [黑客利用 WPGateway 零日漏洞，28 万网站险遭攻击](https://hackernews.cc/archives/41486) - - [黑客组织 GhostSec 称入侵以色列 55 家 Berghof PLC](https://hackernews.cc/archives/41482) - - [趋势科技修复已被积极利用的 Apex One 零日漏洞](https://hackernews.cc/archives/41477) - - [近 6 年黑客企图入侵韩国政府网络近 56 万次](https://hackernews.cc/archives/41474) - - [加州极端高温使 Twitter 失去了一个关键数据中心](https://hackernews.cc/archives/41471) -- 安全牛 - - [SharkTeam：十大智能合约安全威胁之权限漏洞](https://www.aqniu.com/vendor/89047.html) - - [齐向东：DT时代需警惕加密攻击这只“灰犀牛”](https://www.aqniu.com/vendor/89043.html) - - [超7成网络攻击用加密“隐身” 奇安信发布国内首款流量解密编排器](https://www.aqniu.com/homenews/89034.html) - - [请收藏！7门免费的线上网络安全大师课](https://www.aqniu.com/hometop/89025.html) - - [快讯 丨 创新安全厂商云起无垠宣布完成数千万元天使轮融资](https://www.aqniu.com/homenews/89024.html) - - [安全牛课堂 丨 一位70后女生的CISSP备考突围经历](https://www.aqniu.com/homenews/89023.html) - - [2022年国家网络安全宣传周暨上海地区“数据安全技术与应用主题活动”圆满举办](https://www.aqniu.com/industry/88975.html) - - [新华三孙松儿：落实安全前置才能解决资源投入与成效体验不成正比的长期矛盾](https://www.aqniu.com/industry/88974.html) - - [奇安信联合Croemail发布《2021中国企业邮箱安全性研究报告》](https://www.aqniu.com/vendor/88973.html) - - [你只需要一项技术就能解决替代VBA的新兴资安威胁: Visual Studio Tools for Office (VSTO)](https://www.aqniu.com/vendor/88972.html) - - [OPSWAT在2022全球OT网络安全市场分析中被评为战略创新者](https://www.aqniu.com/vendor/88971.html) - - [OPSWAT 加入AWS独立软件供应商加速计画](https://www.aqniu.com/vendor/88970.html) - - [进阶多变的电子邮件攻击，如何利用零信任机制有效防御](https://www.aqniu.com/industry/88969.html) - - [零信任与安全边界如何有效的防护企业安全](https://www.aqniu.com/industry/88968.html) - - [恶意软件Emotet卷土重来滥用.LNK文件进行攻击，你只需要一项技术就能有效保护组织](https://www.aqniu.com/industry/88977.html) -- 博客园 - 渗透测试中心 - - [2022年川渝网络与信息安全职业技能竞赛-个人初赛writeup - 渗透测试中心](https://www.cnblogs.com/backlion/p/16693244.html) -- Trustlook blog - - [VirusTotal APK 病毒检测统计 20220101-20220831](https://blog.trustlook.com/virustotal-apk-bing-du-jian-ce-tong-ji-202201-202208/) - - [VirusTotal APK Malware Detection Data 20220101-20220831](https://blog.trustlook.com/virustotal-apk-malware-detection-data-202201-202208/) -- 奇客Solidot–传递最新科技情报 - - [为什么一部分人不会感染新冠](https://www.solidot.org/story?sid=72767) - - [科学家发现空气污染导致肺癌的机制](https://www.solidot.org/story?sid=72766) - - [Goolge Android 反垄断案上诉失败但罚款略降](https://www.solidot.org/story?sid=72765) - - [YouTube 主播用 /pol/ 讨论版内容训练 AI](https://www.solidot.org/story?sid=72764) - - [腾讯网易一年来首次获得新游戏版号](https://www.solidot.org/story?sid=72763) - - [Google 和 Meta 因非法收集个人信息被韩国罚款千亿韩元](https://www.solidot.org/story?sid=72762) - - [Blue Origin 的 New Shepard 火箭发射失败](https://www.solidot.org/story?sid=72761) - - [现代操作系统如何启动的魔法](https://www.solidot.org/story?sid=72760) - - [无处不在的塑料可能助长了肥胖](https://www.solidot.org/story?sid=72759) - - [南极“末日冰川”加速融化](https://www.solidot.org/story?sid=72758) - - [Google 在欧洲面临 250 亿欧元的反垄断罚款](https://www.solidot.org/story?sid=72757) - - [Twitter 投资者批准马斯克的收购交易](https://www.solidot.org/story?sid=72756) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | Google和Meta被罚千亿韩元；吹哨人指控Twitter“重利润，轻安全”](https://www.freebuf.com/news/344522.html) - - [重磅消息，《网络安全法》或迎来修改](https://www.freebuf.com/news/344516.html) - - [大手笔！谷歌花54亿美金收购网络安全公司 Mandiant](https://www.freebuf.com/news/344484.html) - - [工控攻击！黑客组织GhostSec 称入侵以色列55 家Berghof PLC](https://www.freebuf.com/articles/ics-articles/344476.html) -- 看雪学院 - - [荣耀，助力2022 SDC-第六届安全开发者峰会，共建安全新生态](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458469629&idx=1&sn=76eff8357886e2505c9e2afde78c4cf9&chksm=b18e747786f9fd61747a6f7337a48fa4798fce41fd65e3cffdb4a55c595f4f05d43c2b80029c&scene=58&subscene=0#rd) - - [Windows驱动编程之NDIS(VPN)](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458469629&idx=2&sn=cb8d5b1269f16be059a94df0ee1aaf3e&chksm=b18e747786f9fd61cb8eb67df4f3a18c86fd54318897b5a7ed4677e3cf0d04ae5641bd4deb33&scene=58&subscene=0#rd) - - [修复两个零日、五个严重漏洞，微软本月累积更新发布](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458469629&idx=3&sn=cb463369b466e7dc9945310ad7c5912b&chksm=b18e747786f9fd614cf809c09eccd5b78d9166b96d451f6f356ac22e37bb92c4ebea477f7899&scene=58&subscene=0#rd) - - [《安卓逆向入门》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458469629&idx=4&sn=e0955b94f050c065b9ac36d2cb81f98b&chksm=b18e747786f9fd61529264de09a165e24f6182825e5ab5bd537b8c7556f856211009928d41f8&scene=58&subscene=0#rd) -- 安全分析与研究 - - [关于勒索病毒你不得不懂的知识点](https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247487516&idx=1&sn=83ba2ebf2d2a8e80c61e0dacb18df69d&chksm=902fbf34a758362235ae3e570fd932a84ecc6e44eb7c1bdd5914ca77b5c9a6868b017e5e33a2&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(09-14)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958691&idx=1&sn=d99e3f522e5ba8131d11f4a368e99756&chksm=8baecd3cbcd9442a8a121e84f84997120201dc912bc8314fd5fe2e10bcc2fa7f2c05ce670c85&scene=58&subscene=0#rd) -- 互联网安全内参 - - [俄罗斯主要电视台又一次播放“反战信息”：遭亲乌黑客劫持](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505912&idx=1&sn=f92d754e899becbb5fc068eee0e5fee1&chksm=ebfa90d8dc8d19ce5eb49b3f12e9369da43b836827e6e03be68a67af46e8f27d9106a343445d&scene=58&subscene=0#rd) - - [重磅！《网络安全法》将迎来修改，拟作四大修改](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505912&idx=2&sn=01b5f5d6bb5c47dc06951243017ac9b8&chksm=ebfa90d8dc8d19ce19d4133ce195af8664da1f0bc85e7ee1b5cfc09d865d1e6903bac54890d6&scene=58&subscene=0#rd) - - [美国FTC将制定规则，打击商业监视和不严格的数据安全做法](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505912&idx=3&sn=b9c53fc083e2d8af38fe3b931c574367&chksm=ebfa90d8dc8d19cec3d8fd80602ec9521f1a3031c1fbff2644da4920fc41e19c7ef7589789c9&scene=58&subscene=0#rd) - - [卡巴斯基发布《2022年上半年工业自动化系统威胁格局》报告](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247505912&idx=4&sn=ce7cf7f42efa661b11ce238dba0d4f76&chksm=ebfa90d8dc8d19ce97c7911b0942855613f8e885106be62ca14268faedc2ea4f153bfdacdc2e&scene=58&subscene=0#rd) -- 奇安信威胁情报中心 - - [来自Kimsuky组织的突刺：多种攻击武器针对韩国的定向猎杀](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247503764&idx=1&sn=021b9bf3df041d29ea8f22c2282c9446&chksm=ea6638e3dd11b1f586c43ffe848a14017d5884172520e06f0d08cb22f6b36685c51113ba5549&scene=58&subscene=0#rd) -- 腾讯科恩实验室 - - [新型漏洞威胁如何高效防御？9月15日19点腾讯安全专家带你揭秘](https://mp.weixin.qq.com/s?__biz=MzU1MjgwNzc4Ng==&mid=2247503981&idx=1&sn=d273e181fa33ce870f0e361e118437cc&chksm=fbfeec68cc89657e8a48ce9e1243d8fc99b1d1301e4bd162df88de3f9631657681d6a181de17&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [解读trifinite.group对特斯拉的安全研究](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531214&idx=1&sn=f2f94fbf52b07d7681ad1a439fdb0ed6&chksm=c1e9f69ff69e7f89d4fabf3bcf1c5bfa3a97aa23842ea2a3b1be4c5cc69ae560482406aab5fd&scene=58&subscene=0#rd) - - [方滨兴：破解隐私保护与数据要素流动相悖之局](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531214&idx=2&sn=5246b6b332f51a35d2afca9160400bfc&chksm=c1e9f69ff69e7f89fb5679ea35e8aa6403c14e166fa1a790115dc0033123e0b650f19063c31d&scene=58&subscene=0#rd) - - [大事件！乌方：网络攻击已瘫痪俄罗斯2400个网站](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531214&idx=3&sn=533c004dd685a80bc26eedc05fa4ccf1&chksm=c1e9f69ff69e7f899fdda6038b98e8f6e89917fdeceb475dcf393653cd70721d755973381df8&scene=58&subscene=0#rd) - - [黑客组织Cloaked Ursa 开始尝试使用在线存储服务、DropBox和GoogleDrive发起攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531214&idx=4&sn=4ac09d6a5409b823a315cab021b5a12f&chksm=c1e9f69ff69e7f89b124beb6363bb57562d211722cb3f57fa6e5a610ae3ba3204304fefffdec&scene=58&subscene=0#rd) -- 安全牛 - - [请收藏！7门免费的线上网络安全大师课](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118562&idx=1&sn=cf7332d4e34fecbffb310dabf9a9ba76&chksm=bd146b318a63e227a5ad61e5d93ce26b57029fada949c7a6f1706c98bf230dbccd2ddf20271b&scene=58&subscene=0#rd) - - [快讯 丨 创新安全厂商云起无垠宣布完成数千万元天使轮融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118562&idx=2&sn=4db5fef7be6b88fafa2eaa15d6cb56f3&chksm=bd146b318a63e227ba821294ca637a7a28db29043d36273621b1472563e49349403389c78433&scene=58&subscene=0#rd) - - [安全牛课堂 丨 一位70后女生的CISSP备考突围经历](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118562&idx=3&sn=d7e2c99f55c057eea1b86f72b937a035&chksm=bd146b318a63e2277c658881b6989a09beefa154875d0b781ee92a0e35f49e72ab4555296ceb&scene=58&subscene=0#rd) -- 奇安信CERT - - [微软2022年9月补丁日多产品安全漏洞风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496920&idx=1&sn=09fcc34d768b47dd47376d87691593e6&chksm=fe79d040c90e59569dc9862f0352e851df661195710ff9869713259eafbf2d9bb3bd583938f1&scene=58&subscene=0#rd) -- 腾讯安全威胁情报中心 - - [新型漏洞威胁如何高效防御？9月15日19点腾讯安全专家带你揭秘](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247500606&idx=1&sn=3459777890e655e63f94dcc8acd6b09c&chksm=ec9f1a4ddbe8935b4c47fc510f393c39499a7255451891eeae70f1fb60bae6d2902adecd901f&scene=58&subscene=0#rd) -- 情报分析师 - - [成功审讯的技巧（附《有效的面谈和审讯技术教程》383页）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650516186&idx=1&sn=94c3f8800cd5413a9143df431a7ce9bc&chksm=87168491b0610d87bec57c18f162503b1b5030ea5c9ee8d6e4fb47e89ad545084ec1870ea565&scene=58&subscene=0#rd) - - [英国国家执法数据服务（LEDS）|新的警察巨型数据库](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650516186&idx=2&sn=58e70ab58aae2395dafc25b192c6d409&chksm=87168491b0610d873a58bacba9ad7bcc0abcbd67622a62ff2fb1b8badfa3e0294ee54c5c31ba&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [SDomDiscover - A Easy-To-Use Python Tool To Perform DNS Recon](http://www.kitploit.com/2022/09/sdomdiscover-easy-to-use-python-tool-to.html) -- 极客公园 - - [AI 自己也没想到，它下一个颠覆的居然是「成人产业」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967306&idx=1&sn=755ec8716025ff475ac4ccef49533e20&chksm=7e546c3c4923e52aeb17448c93a35af66c80c6ea163d86362afcb00b6e8c2aa12dd72b84461d&scene=58&subscene=0#rd) - - [苹果或将在 App Store 加更多广告；蓝色起源首发火箭失败坠毁；Netflix《鱿鱼游戏》斩获艾美奖 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967276&idx=1&sn=eb683b52307c6571b1b89778dcb62005&chksm=7e546cda4923e5ccd3cfb957911b6ca61c08a41df6634c139ee406922b4228195525cdcf9ae0&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [省省省，签名也去重：带有去重功能的云数据完整性审计](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247493302&idx=1&sn=ff687f4d6628ed613cc8b79ddd9b98d4&chksm=e84c4069df3bc97f1bb22ce80ceed512687fe0db3732fe7c41eba555efc0b23e16857ff4d6cf&scene=58&subscene=0#rd) -- 绿盟科技CERT - - [【安全更新】微软9月安全更新多个产品高危漏洞通告](https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247487663&idx=2&sn=40d714ecfa2e2951f59b96b5b71e5e19&chksm=c2c647a4f5b1ceb28051d8ae201d907e13d85f0d2829aa6f4f76f84bd5475c697e1607869c4a&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [【风险提示】天融信关于微软9月安全更新中重要漏洞的风险提示](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495845&idx=1&sn=757f3a4e7883d23f00831a7b433e85df&chksm=ce96bd9bf9e1348dfeddd178b9971831b97160ae40dfd0f6f98c2f86ceb3ba81ef52801647bf&scene=58&subscene=0#rd) - - [每日攻防资讯简报[Sep.14th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495845&idx=2&sn=e35772a3e59fcb87d2db7a052fb52e9a&chksm=ce96bd9bf9e1348dea0ab2640f6086b6d5bcc20c0aed9259ca23206d8ea92030a2003db5115e&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [PbootCMS历史漏洞分析 0x01](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496409&idx=1&sn=dfb92078804e6eed5a061cec8c088faa&chksm=fa522767cd25ae712b0c3fdc33d582db11cd1a97585e0f3303b8071275b3db1546086c4ae8e7&scene=58&subscene=0#rd) -- 中国信息安全 - - [通知 | 《关于修改〈中华人民共和国网络安全法〉的决定（征求意见稿）》公开征求意见](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165476&idx=1&sn=c446365333a5f9c8b2245d823ee7b213&chksm=8b5ef29dbc297b8b391dac223cbff9d8c1fedc1ac65fca5c34bbaf49b1edf5fd4e61796c5d11&scene=58&subscene=0#rd) - - [公安部：全力挤压“网络水军”违法犯罪活动空间，切实维护网络公共秩序](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165476&idx=2&sn=c1d4e982fc48968f1c0250f571f865cb&chksm=8b5ef29dbc297b8b06f82e2cc54158c6aa500d4db4ad6a221d957e41414dc07debd2ff881e8f&scene=58&subscene=0#rd) - - [聚焦 | 护航数字经济 2022数据安全技术大会加快落地应用](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165476&idx=3&sn=e18bddd13e3abc56dbe9eb02de4be2e2&chksm=8b5ef29dbc297b8bfdb773c146ceae13089caaffe905ed185fe95e4de6fb50cf16fa7cc62049&scene=58&subscene=0#rd) - - [新华三孙松儿：落实安全前置才能解决资源投入与成效体验不成正比的长期矛盾](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165476&idx=4&sn=a56e67c8dba44f6bf218decc178183b3&chksm=8b5ef29dbc297b8b658740a8f523fa2aa989ec4a201ca47e0f36c253e0503c87b5fd6ddc8937&scene=58&subscene=0#rd) - - [通知 | 国家标准《信息安全技术 网络数据分类分级要求（征求意见稿）》公开征求意见](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165476&idx=5&sn=6cc85f14a8fe314d987811972dfe4d90&chksm=8b5ef29dbc297b8b2186b728f68887fbeaf024f2075de6b7ee96a02b763d20e25f48873a8e0b&scene=58&subscene=0#rd) - - [专家观点 | 关键信息基础设施保护走实向深](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165476&idx=6&sn=bc58b4e398e998fe5d7179521842d00f&chksm=8b5ef29dbc297b8b1662d63d64eef9e26121b984d9e602a1c2a2089d59feeba3cdaae256af46&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [案例研究｜证券行业如何做好API安全治理，保障流动数据安全？](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247494339&idx=1&sn=c625143f7d637e56ea489bc09c32c274&chksm=eb12ccf8dc6545ee7a62063925d8079fa57bec3971273a1456acb718ff313318a5f25f8217f2&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [嘶吼安全产业研究院 | 《致虚极・守静笃 工控安全产业竞合力洞察报告2022》重磅发布！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550391&idx=1&sn=9f69235fddac48ed2f598deb953a5b95&chksm=e915d58dde625c9b9f7c5d5160b91dc9b290660226cf7d7e2f99d93a0ae13910289dcad9098a&scene=58&subscene=0#rd) - - [XReward再回归||活力厂商开放麦，精彩议程第一弹！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550391&idx=2&sn=d6f22e4670a8f7b04772dffbdd25a299&chksm=e915d58dde625c9bf8af2b04117ca12c0c07518caca954a9548fe8d6a4aaf6f7861305d91cf4&scene=58&subscene=0#rd) - - [新型气隙攻击利用MEMS陀螺仪隐蔽超声信道泄露数据](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550391&idx=3&sn=1320c7fe564417b1ef553822d38c6c07&chksm=e915d58dde625c9b2d2ae261d7550fd741253982985b6134070c3815e22ac8002c90d717ba85&scene=58&subscene=0#rd) - - [APT Lazarus利用macOS恶意软件针对工程师进行攻击](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550391&idx=4&sn=1e85901afe8d52cd90cd1cba2c035088&chksm=e915d58dde625c9bb516b3875cac0a516ee31764614212d21c5bf622803e5b063cfd2241caa2&scene=58&subscene=0#rd) - - [定位新一代智能模糊测试技术提供商，「云起无垠」宣布完成数千万元天使轮融资](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550391&idx=5&sn=2c27c392ceda05daf4945c703465aa74&chksm=e915d58dde625c9b0b73f46adb90f9827dfd1b3a3a64066bf3f7a7213d5e4dce7c7712340083&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】为报复公司拖欠工资，运维远控并删除数据库文件致县级公共卫生平台无法运转！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017030&idx=1&sn=65db87c2eeb69f16a074f9e18c3bd040&chksm=f36fbdc6c41834d00ed2b80db00ec0b20951ca6e3c7689d73d3650cf71c12f9c56a75e376756&scene=58&subscene=0#rd) - - [【安全圈】俄罗斯法院对谷歌处以 3.6 亿美元罚款：屡次未删除非法内容](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017030&idx=2&sn=7a6f62a9993c33ef6f90957a23b9d1f4&chksm=f36fbdc6c41834d053f0626b6db366c4081565754ed4675874fd5ba941f33cc3f4e3ac8affbc&scene=58&subscene=0#rd) - - [【安全圈】Talos警告Lazarus黑客正利用Log4j漏洞入侵美国能源公司](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017030&idx=3&sn=3461a82798e3ec0a48b8bcc094819de2&chksm=f36fbdc6c41834d011a1661fa32e34d8e6f59376bc6b83b10d6188c6f423ae67541ba02b4ae0&scene=58&subscene=0#rd) - - [【安全圈】思科确认 Yanluowang 勒索软件团伙泄露了公司数据](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017030&idx=4&sn=327e52a9d8b6488b91d69705fccccfce&chksm=f36fbdc6c41834d0472364ee19a82b1b2759ea1b7a92d2af6433315b4205e9039b53c6d61916&scene=58&subscene=0#rd) - - [【安全圈】黑客袭击频发 澳大利亚网络安全保险费飙升80%](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017030&idx=5&sn=129b642000be3bc919dc2af29fec977e&chksm=f36fbdc6c41834d03d9e1c78747c7c51ad907c324e3fd19b124d073c7fb25f4c172016ceb379&scene=58&subscene=0#rd) -- 字节跳动技术团队 - - [前端监控系列3 ｜ 如何衡量一个站点的性能好坏](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247498655&idx=1&sn=a6fa58a08e4964c0de867214e6f0d968&chksm=e9d3307ddea4b96bb6de34868ca942f69f7f73927a901e9ef6f96bcd633d7d28bc02aadcd11c&scene=58&subscene=0#rd) - - [【活动推荐】前端性能最新技术分享 + 字节跳动内部实践](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247498655&idx=2&sn=3156c61d1096462f048d3e50c4acbb47&chksm=e9d3307ddea4b96b55ac89c7f22149f8f6f858eee0fcb019d8c6f3e2192eb0dfc2b61d9ed010&scene=58&subscene=0#rd) -- 代码卫士 - - [微软补丁星期二值得关注的漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513971&idx=1&sn=a96bbeda0b7a0d9df01ce667900321cd&chksm=ea948619dde30f0f90befd2e027230569d8ee5170c881a341474a921aa2ee684ec8bcd9c03d4&scene=58&subscene=0#rd) - - [趋势科技修复又一个已遭利用的Apex One漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513971&idx=2&sn=e4ccf27e2628af5d0016b4b5f9385131&chksm=ea948619dde30f0f97cc248ac9a1d2d7798573ed43876f19e4b1849ebe2ef2a02e8627f3a28a&scene=58&subscene=0#rd) -- 天书奇坛TFT - - [【打击整治养老诈骗】微视频｜“孝”里藏刀](https://mp.weixin.qq.com/s?__biz=MzkwNjM0NDg1MQ==&mid=2247485148&idx=1&sn=bec4cdd395f22ad7d1a716fdbfecf103&chksm=c0e8a620f79f2f365d47921ad243de3f645ece013b4e905df6d3ecf360feb1ef5d479d7377da&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-16.md b/archive/2022/2022-09-16.md deleted file mode 100644 index 220d5e7994..0000000000 --- a/archive/2022/2022-09-16.md +++ /dev/null @@ -1,226 +0,0 @@ -# 每日安全资讯（2022-09-16） - -- Sploitus.com Exploits RSS Feed - - [WordPress WPGateway 3.5 Privilege Escalation Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37964&utm_source=rss&utm_medium=rss) - - [News247 News Magazine 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168384&utm_source=rss&utm_medium=rss) - - [Gitea 1.16.6 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168400&utm_source=rss&utm_medium=rss) - - [Gitea 1.16.6 - Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37963&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=B3FA563A-700E-5088-8CCB-1E38A738B7E9&utm_source=rss&utm_medium=rss) - - [Exploit for Use of Hard-coded Credentials in Automationanywhere Automation 360 exploit](https://sploitus.com/exploit?id=62FB9B44-1DB9-5F48-9733-DACB4E55A1C8&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Apache Http Server exploit](https://sploitus.com/exploit?id=D0E79214-C9E8-52BD-BC24-093970F5F34E&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=7FAB36AD-345E-5C1B-B259-20BF0E7DE97A&utm_source=rss&utm_medium=rss) -- Trustwave Blog - - [Trustwave Government Solutions Applauds CISA’s Strategic Plan’s Emphasis on Collaborating with the Private Sector](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-government-solutions-applauds-cisas-strategic-plans-emphasis-on-collaborating-with-the-private-sector/) -- Microsoft Security Blog - - [Test your team’s security readiness with the Gone Phishing Tournament](https://www.microsoft.com/security/blog/2022/09/15/test-your-teams-security-readiness-with-the-gone-phishing-tournament/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Gitea 1.16.6 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090040) - - [News247 News Magazine 1.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090039) - - [Genesys PureConnect - Interaction Web Tools XSS](https://cxsecurity.com/issue/WLB-2022090038) -- Recent Commits to cve:main - - [Update Thu Sep 15 10:03:29 UTC 2022](https://github.com/trickest/cve/commit/19ea37c85958bfc6505f0c4e99c32ccfb589f6c0) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-6542-01](https://packetstormsecurity.com/files/168399/RHSA-2022-6542-01.txt) - - [Red Hat Security Advisory 2022-6527-01](https://packetstormsecurity.com/files/168398/RHSA-2022-6527-01.txt) - - [Red Hat Security Advisory 2022-6540-01](https://packetstormsecurity.com/files/168397/RHSA-2022-6540-01.txt) - - [Red Hat Security Advisory 2022-6539-01](https://packetstormsecurity.com/files/168396/RHSA-2022-6539-01.txt) - - [Ubuntu Security Notice USN-5613-1](https://packetstormsecurity.com/files/168395/USN-5613-1.txt) - - [Ubuntu Security Notice USN-5612-1](https://packetstormsecurity.com/files/168394/USN-5612-1.txt) - - [Ubuntu Security Notice USN-5606-2](https://packetstormsecurity.com/files/168393/USN-5606-2.txt) - - [Red Hat Security Advisory 2022-6526-01](https://packetstormsecurity.com/files/168392/RHSA-2022-6526-01.txt) - - [Red Hat Security Advisory 2022-6308-01](https://packetstormsecurity.com/files/168391/RHSA-2022-6308-01.txt) - - [Red Hat Security Advisory 2022-6522-01](https://packetstormsecurity.com/files/168390/RHSA-2022-6522-01.txt) - - [Red Hat Security Advisory 2022-6520-01](https://packetstormsecurity.com/files/168389/RHSA-2022-6520-01.txt) - - [Red Hat Security Advisory 2022-6523-01](https://packetstormsecurity.com/files/168388/RHSA-2022-6523-01.txt) - - [Red Hat Security Advisory 2022-6517-01](https://packetstormsecurity.com/files/168387/RHSA-2022-6517-01.txt) - - [Red Hat Security Advisory 2022-6518-01](https://packetstormsecurity.com/files/168386/RHSA-2022-6518-01.txt) - - [Red Hat Security Advisory 2022-6521-01](https://packetstormsecurity.com/files/168385/RHSA-2022-6521-01.txt) - - [News247 News Magazine 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/168384/news247nm10-xss.txt) - - [Gitea 1.16.6 Remote Code Execution](https://packetstormsecurity.com/files/168400/gitea1166-exec.rb.txt) -- 先知安全技术社区 - - [不常见的内存与流量取证 -- WMCTF 2022 1!5!](https://xz.aliyun.com/t/11699) - - [CVE-2020-8558-跨主机访问127.0.0.1](https://xz.aliyun.com/t/11674) - - [红日安全团队ATT&CK(二)实战系列靶场](https://xz.aliyun.com/t/11676) - - [“黑猫”又伸出恶魔之手？揭秘BlackCat病毒的三重勒索](https://xz.aliyun.com/t/11656) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [奇安信数据交易沙箱获2022 年大数据产业发展试点示范项目](https://www.4hou.com/posts/vJ7r) - - [XCon2022分会场 | 干货拉满，无缝衔接||XReward精彩议题第二弹！](https://www.4hou.com/posts/pV66) - - [数据治理：全面保护数据的五个贴士](https://www.4hou.com/posts/WBvg) - - [Snatch，BianLian 和 Agenda都出现了最新的变体](https://www.4hou.com/posts/GKA0) - - [盛邦安全发布首个网络空间地图——网络空间坤舆图，为新基建提供数字安全底图](https://www.4hou.com/posts/gXV6) -- 美团技术团队 - - [目标检测开源框架YOLOv6全面升级，更快更准的2.0版本来啦](https://tech.meituan.com/2022/09/15/yolov6-2.0.html) - - [美团隐私计算平台通过行业权威认证](https://tech.meituan.com/2022/09/15/meituan-privacy-preserving-computation.html) - - [自动化测试在美团外卖的实践与落地](https://tech.meituan.com/2022/09/15/automated-testing-in-meituan.html) -- unSafe.sh - 不安全 - - [不常见的内存与流量取证 -- WMCTF 2022 1!5!](https://buaq.net/go-126784.html) - - [CVE-2020-8558-跨主机访问127.0.0.1](https://buaq.net/go-126785.html) - - [红日安全团队ATT&CK(二)实战系列靶场](https://buaq.net/go-126786.html) -- 安全脉搏 - - [信息收集系列(一)——域名收集](https://www.secpulse.com/archives/187201.html) - - [NTLMRelay的利用](https://www.secpulse.com/archives/187146.html) - - [安全工具 EasyPen alpha 1.0 发布](https://www.secpulse.com/archives/187138.html) - - [Java反序列化之原生](https://www.secpulse.com/archives/186319.html) -- Blog & What's New | Offensive Security - - [Staged Payloads from Kali Linux | PT Phone Home – DNS](https://www.offensive-security.com/offsec/staged-payloads-from-kalki-linux-pt-phone-hone-dns/) -- Security Boulevard - - [Smart Phone, Smart Watch, Smart Pay, Smart?](https://securityboulevard.com/2022/09/smart-phone-smart-watch-smart-pay-smart/) - - [Better Together: Banyan Security and SentinelOne](https://securityboulevard.com/2022/09/better-together-banyan-security-and-sentinelone/) - - [Using Machine Identity Management to Extend Zero Trust to Partners](https://securityboulevard.com/2022/09/using-machine-identity-management-to-extend-zero-trust-to-partners/) - - [How Delphix Helps Ensure Gramm-Leach-Bliley Act (GLBA) Compliance](https://securityboulevard.com/2022/09/how-delphix-helps-ensure-gramm-leach-bliley-act-glba-compliance/) - - [The Week in Cybersecurity: U.S. mandates federal agencies use secure third-party software tools](https://securityboulevard.com/2022/09/the-week-in-cybersecurity-u-s-mandates-federal-agencies-use-secure-third-party-software-tools/) - - [What is Agentless Scanning & Do I Need It?](https://securityboulevard.com/2022/09/what-is-agentless-scanning-do-i-need-it/) - - [What the White House Memo on Supply Chain Security Means for You](https://securityboulevard.com/2022/09/what-the-white-house-memo-on-supply-chain-security-means-for-you/) - - [Demand for Identity Security Drives CyberArk Channel Growth](https://securityboulevard.com/2022/09/demand-for-identity-security-drives-cyberark-channel-growth/) - - [How do I display my brand’s logo in emails?](https://securityboulevard.com/2022/09/how-do-i-display-my-brands-logo-in-emails/) -- Twitter @Nicolas Krassas - - [SharpImpersonation - A User Impersonation Tool - Via Token Or Shellcode Injection](https://twitter.com/Dinosn/status/1570486415435378689) - - [This Hacker Is Trying To Close The Gender Pay Gap In Cybersecurity](https://twitter.com/Dinosn/status/1570486302688284672) - - [Re @mr_mitm curl also complains, curl curl: (60) SSL certificate problem: unable to get local issuer certificate ...](https://twitter.com/Dinosn/status/1570485845974740992) - - [Re @mr_mitm You have incomplete chain there,](https://twitter.com/Dinosn/status/1570485537940840448) - - [Password cracking wordlists update](https://twitter.com/Dinosn/status/1570482655237672961) - - [Iran steps up its cybercrime game and Uncle Sam punches back](https://twitter.com/Dinosn/status/1570482485317754881) - - [Relay Attack against Teslas](https://twitter.com/Dinosn/status/1570482340702429185) - - [Re @mr_mitm Hi, please have a look at your cert,](https://twitter.com/Dinosn/status/1570480615413190659) - - [The Blind Spots of BloodHound](https://twitter.com/Dinosn/status/1570479361211486209) - - [Researchers Warn of Self-Spreading Malware Targeting Gamers via YouTube](https://twitter.com/Dinosn/status/1570479200326545409) - - [Buffer overflow in the OpenRazer open-source kernel drivers causing denial of service and privilege escalation.](https://twitter.com/Dinosn/status/1570479067933310977) - - [RT PT SWARM: ⚓️ New article by our researcher @m1ke_n1: "Jetty Features for Hacking Web Apps". Read the research:](https://twitter.com/ptswarm/status/1570416044002447362) - - [A Detailed Analysis of the Quantum Ransomware [PDF]](https://twitter.com/Dinosn/status/1570393152032505856) - - [CVE-2022-37706 LPE, A reliable exploit + write-up to elevate privileges to root. (Tested on Ubuntu 22.04)](https://twitter.com/Dinosn/status/1570387766873300992) - - [unblob: Extract files from any kind of container formats](https://twitter.com/Dinosn/status/1570383124088979456) - - [Webworm Hackers Using Modified RATs in Latest Cyber Espionage Attacks](https://twitter.com/Dinosn/status/1570382363586138112) - - [RT Ron Chan: It has been a while since my last blog post. Today I'm starting a new blog series about smart contracts security. It's going to be fun! T...](https://twitter.com/ngalongc/status/1570358915371798533) - - [Threat Hunting queries for various attacks](https://twitter.com/Dinosn/status/1570311653350309902) - - [RT Maurice Heumann: I finally reversed and bypassed Call of Duty: Black Ops 3's DRM. The game has more than 400 integrity checks that seem to self-adj...](https://twitter.com/momo5502/status/1570266208569786369) -- paper - Last paper - - [Android NFC 条件竞争漏洞分析（CVE-2021-0870）](https://paper.seebug.org/1970/) -- 跳跳糖 - 安全与分享社区 - - [Go AST 浅析与CTF中的实战运用](https://tttang.com/archive/1736/) -- 安全客-有思想的安全新媒体 - - [为什么会接到境外电话？真是从国外打来的吗？原来诈骗有“道具”](https://www.anquanke.com/post/id/275224) - - [Lorenz Ransomware利用Mitel VoIP系统破坏商业网络](https://www.anquanke.com/post/id/280236) - - [网络钓鱼页面嵌入键盘记录程序窃取密码](https://www.anquanke.com/post/id/280202) - - [美国政府制裁十名勒索软件攻击相关伊朗人](https://www.anquanke.com/post/id/280198) - - [安全->云安全->多云安全](https://www.anquanke.com/post/id/275777) - - [FBI：黑客从医疗保健支付处理商窃取数百万美元](https://www.anquanke.com/post/id/280190) - - [推特被指控重利润轻安全，并存严重漏洞](https://www.anquanke.com/post/id/280183) - - [Google和Meta因非法收集个人信息被韩国罚款千亿韩元](https://www.anquanke.com/post/id/280153) - - [数字安全观察每周简报【技术趋势篇】2022.08.31-2022.09.06](https://www.anquanke.com/post/id/279750) - - [亲巴黑客组织GhostSec入侵以色列Berghof PLC](https://www.anquanke.com/post/id/280147) -- obaby@mars - - [WordPress 评论显示IP归属地插件–WP-UserAgent[增强版]](http://h4ck.org.cn/2022/09/wordpress-%e8%af%84%e8%ae%ba%e6%98%be%e7%a4%baip%e5%bd%92%e5%b1%9e%e5%9c%b0%e6%8f%92%e4%bb%b6-wp-useragent%e5%a2%9e%e5%bc%ba%e7%89%88/) -- 先知安全技术社区 - - [不常见的内存与流量取证 -- WMCTF 2022 1!5!](https://xz.aliyun.com/t/11699) - - [CVE-2020-8558-跨主机访问127.0.0.1](https://xz.aliyun.com/t/11674) - - [红日安全团队ATT&CK(二)实战系列靶场](https://xz.aliyun.com/t/11676) - - [“黑猫”又伸出恶魔之手？揭秘BlackCat病毒的三重勒索](https://xz.aliyun.com/t/11656) -- Tenable Blog - - [AA22-257A: Cybersecurity Agencies Issue Joint Advisory on Iranian Islamic Revolutionary Guard Corps-Affiliated Attacks](https://www.tenable.com/blog/aa22-257a-cybersecurity-joint-advisory-on-iranian-islamic-revolutionary-guard-ransomware) -- SecWiki News - - [SecWiki News 2022-09-15 Review](http://www.sec-wiki.com/?2022-09-15) -- Chromium Blog - - [Speeding up Chrome on Android Startup with Freeze Dried Tabs](http://blog.chromium.org/2022/09/speeding-up-chrome-on-android-startup.html) -- Sucuri Blog - - [Magento Supply Chain Attack Targets Extension Developer FishPig](https://blog.sucuri.net/2022/09/magento-supply-chain-attack-targets-extension-developer-fishpig.html) -- Forcepoint - - [The Art of Zero Trust](https://www.forcepoint.com/blog/insights/EMEA-zero-trust-day-barcelona) -- Hack Inn - - [Kcon 2022](https://www.hackinn.com/index.php/archives/801/) -- Trail of Bits Blog - - [It pays to be Circomspect](https://blog.trailofbits.com/2022/09/15/it-pays-to-be-circomspect/) -- SpiderLabs Blog from Trustwave - - [Retaliation by the Pro-Russian Group KillNet](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/retaliation-by-the-pro-russian-group-killnet/) -- Didier Stevens - - [Update: virustotal-search.py Version 0.1.7](https://blog.didierstevens.com/2022/09/15/update-virustotal-search-py-version-0-1-7/) -- SAP Blogs - - [Automating Creation of Purchase Order Process with MS Teams](https://blogs.sap.com/2022/09/15/automating-creation-of-purchase-order-process-with-ms-teams/) - - [Get Ready for the 2022 Edition of the SAP Conference on Global Trade and Tax!](https://blogs.sap.com/2022/09/15/get-ready-for-the-2022-edition-of-the-sap-conference-on-global-trade-and-tax/) - - [Send Survey as using SuccessFactors Business Scenario integration with Qualtrics](https://blogs.sap.com/2022/09/15/send-survey-as-using-successfactors-business-scenario-integration-with-qualtrics/) - - [Consistent languages for UI5 controls, backend data and metadata](https://blogs.sap.com/2022/09/15/consistent-languages-for-ui5-controls-backend-data-and-metadata/) - - [Product Documentation and User Assistance for SAP Enterprise Product Development, Release 2208](https://blogs.sap.com/2022/09/15/product-documentation-and-user-assistance-for-sap-enterprise-product-development-release-2208/) - - [Concento RDG provides an effortless Cross Entity Rule Derivation](https://blogs.sap.com/2022/09/15/concento-rdg-provides-an-effortless-cross-entity-rule-derivation/) - - [xP&A: The New Approach to Navigating Market Uncertainties and Driving Business Value](https://blogs.sap.com/2022/09/15/xpa-the-new-approach-to-navigating-market-uncertainties-and-driving-business-value/) - - [Learn how to interpret your SAP Innovation and Optimization Pathfinder report](https://blogs.sap.com/2022/09/15/learn-how-to-interpret-your-sap-innovation-and-optimization-pathfinder-report/) - - [where my cool (SAP) stuff happens …](https://blogs.sap.com/2022/09/15/where-my-cool-sap-stuff-happens/) -- GuidePoint Security - - [GRIT Ransomware Report: August 2022](https://www.guidepointsecurity.com/blog/grit-ransomware-report-august-2022/) -- SentinelOne - - [From the Front Lines | Slam! Anatomy of a Publicly-Available Ransomware Builder](https://www.sentinelone.com/blog/from-the-front-lines-slam-anatomy-of-a-publicly-available-ransomware-builder/) -- blog.avast.com EN - - [Questions to Ask Yourself Before Sending Sexy Photo | Avast](https://blog.avast.com/questions-sending-sexy-photos) -- Sucuri Blog - - [Magento Supply Chain Attack Targets Extension Developer FishPig](https://blog.sucuri.net/2022/09/magento-supply-chain-attack-targets-extension-developer-fishpig.html) -- The Daily Swig | Cybersecurity news and views - - [Open source CMS TYPO3 tackles XSS vulnerability](https://portswigger.net/daily-swig/open-source-cms-typo3-tackles-xss-vulnerability) - - [WAPPLES web application firewall faulted for multiple flaws](https://portswigger.net/daily-swig/wapples-web-application-firewall-faulted-for-multiple-flaws) -- Securelist - - [Self-spreading stealer attacks gamers via YouTube](https://securelist.com/self-spreading-stealer-attacks-gamers-via-youtube/107407/) -- Malwarebytes Labs - - [School app Seesaw compromised to send shock NSFW image](https://www.malwarebytes.com/blog/news/2022/09/popular-learning-platform-seesaw-compromised-to-disperse-adult-media) - - [Explained: Fuzzing for security](https://www.malwarebytes.com/blog/news/2022/09/explained-fuzzing-for-security) - - [Here are the new security and privacy features of iOS 16](https://www.malwarebytes.com/blog/news/2022/09/here-are-the-new-security-and-privacy-features-of-ios-16) - - [Cyber threat hunting for SMBs: How MDR can help](https://www.malwarebytes.com/blog/business/2022/09/cyber-threat-hunting-for-smbs-how-mdr-can-help) -- Reverse Engineering - - [A Detailed Analysis of the Quantum Ransomware [PDF]](https://www.reddit.com/r/ReverseEngineering/comments/xev41r/a_detailed_analysis_of_the_quantum_ransomware_pdf/) -- Twitter @Keiran Smith (Affix) - - [Re @ThatPodcastChap Not seen a full sized scanner in a while haha you need to get yourself one of these](https://twitter.com/cli/status/1570332477951967232) - - [RT Latest in space: BREAKING 🚨: Large meteor spotted burning up over Scotland and Northern Ireland](https://twitter.com/latestinspace/status/1570230392598167552) -- Black Hills Information Security - - [So You Want to Build a Conference Hardware Badge!](https://www.blackhillsinfosec.com/so-you-want-to-build-a-conference-hardware-badge/) -- 安全牛 - - [国内首个！顶象发布《人脸识别安全白皮书》](https://www.aqniu.com/presentation/89117.html) - - [2022年网络安全威胁态势研究：攻击面增长将成常态，七成企业尚未做好应对准备！](https://www.aqniu.com/hometop/89067.html) - - [众图识人宣布完成数千万元 PreA 轮融资](https://www.aqniu.com/homenews/89068.html) - - [直播预告 | 网安大讲堂（43期）：我国数据跨境合规治理与实践](https://www.aqniu.com/homenews/89066.html) - - [RASP技术进阶系列（二）：东西向Web流量的智能检测防御](https://www.aqniu.com/vendor/89065.html) - - [斩获双奖 | 悬镜安全亮相IDC 2022 CSO全球网络安全峰会](https://www.aqniu.com/vendor/89064.html) - - [深圳CA携手赢达信国密安全浏览器，共筑国密生态安全](https://www.aqniu.com/industry/89063.html) - - [重磅发布丨慧御网站IPv6转换服务系统](https://www.aqniu.com/vendor/89062.html) - - [重磅发布丨慧御网站安全云防护系统信创版](https://www.aqniu.com/vendor/89061.html) - - [重磅发布丨慧御Web应用防护系统强势来袭](https://www.aqniu.com/vendor/89060.html) - - [SharkTeam：8月Web3安全报告](https://www.aqniu.com/vendor/89059.html) -- KitPloit - PenTest & Hacking Tools - - [SharpImpersonation - A User Impersonation Tool - Via Token Or Shellcode Injection](http://www.kitploit.com/2022/09/sharpimpersonation-user-impersonation.html) -- 绿盟科技技术博客 - - [安全领域中使用机器学习的注意事项](http://blog.nsfocus.net/machinelearning/) - - [告警全量分诊思路分析](http://blog.nsfocus.net/alert/) - - [区块链密码基础之签名算法（一）](http://blog.nsfocus.net/blockchainsignature/) - - [融合与共生：区块链之智能合约](http://blog.nsfocus.net/blockchain/) - - [TLS指纹分析研究（下）](http://blog.nsfocus.net/tls2-0/) - - [微软9月安全更新多个产品高危漏洞通告](http://blog.nsfocus.net/septmicrosoft/) -- 奇客Solidot–传递最新科技情报 - - [Patagonia 创始人捐出公司对抗气候变化](https://www.solidot.org/story?sid=72778) - - [Linus Torvalds 谈工作、Rust 和 M2 MacBook Air 笔电](https://www.solidot.org/story?sid=72777) - - [John Deere 预测到 2030 年软件收入将占到十分之一](https://www.solidot.org/story?sid=72776) - - [《模拟人生4》将成为免费游戏](https://www.solidot.org/story?sid=72775) - - [以太坊切换到权益证明，矿工涌向 ETC](https://www.solidot.org/story?sid=72774) - - [FishPig 电商软件遭攻击被植入后门](https://www.solidot.org/story?sid=72773) - - [加州起诉亚马逊涉嫌垄断](https://www.solidot.org/story?sid=72772) - - [百度的自然语言图像合成模型有敏感词限制](https://www.solidot.org/story?sid=72771) - - [TikTok 高管接受美国参议院的询问](https://www.solidot.org/story?sid=72770) - - [美国财政部澄清对 Tornado Cash 的制裁不涉及分享源代码](https://www.solidot.org/story?sid=72769) - - [韩国对 Do Kwon 发出逮捕令](https://www.solidot.org/story?sid=72768) -- Checkmarx.com - - [A Developer’s View: What Kind of AST Event Correlation Is Needed in MAD?](https://checkmarx.com/blog/a-developers-view-what-kind-of-ast-event-correlation-is-needed-in-mad/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 美国宣布制裁10名伊朗网军成员；六成受访者认为曾被“杀熟”](https://www.freebuf.com/articles/344641.html) - - [前安全主管指控Twitter“重利润，轻安全”](https://www.freebuf.com/news/344617.html) - - [国外超流行的同性恋APP，被黑灰产盯上了](https://www.freebuf.com/news/344555.html) - - [赠书福利 | 国内首部身份安全专业书籍《身份攻击向量》](https://www.freebuf.com/fevents/344543.html) -- 美团技术团队 - - [目标检测开源框架YOLOv6全面升级，更快更准的2.0版本来啦](https://tech.meituan.com/2022/09/15/yolov6-2.0.html) - - [美团隐私计算平台通过行业权威认证](https://tech.meituan.com/2022/09/15/meituan-privacy-preserving-computation.html) - - [自动化测试在美团外卖的实践与落地](https://tech.meituan.com/2022/09/15/automated-testing-in-meituan.html) -- HackerNews - - [国外流行的同性恋 APP 被黑灰产们盯上了](https://hackernews.cc/archives/41510) - - [CISA 在其已知漏洞目录中又增加了 2 个安全漏洞](https://hackernews.cc/archives/41504) - - [俄罗斯主要电视台又一次播放“反战信息”：遭亲乌黑客劫持](https://hackernews.cc/archives/41500) - - [受欢迎的学校短信应用 Seesaw 遭黑客攻击，向家长发送露骨的图像](https://hackernews.cc/archives/41494) - - [针对亚洲政府的网络间谍活动已长达近两年之久](https://hackernews.cc/archives/41492) -- 嘶吼专业版 - - [数据治理：全面保护数据的五个贴士](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550428&idx=1&sn=b270d45d169b13ce65ceba3bbfcd29a9&chksm=e915d5e6de625cf0a6a54872cb2336fd2a8c6adc369c132af455ea3e6835e62f771f19a39472&scene=58&subscene=0#rd) - - [XCon2022分会场 | 干货拉满，无缝衔接||XReward精彩议题第二弹！](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550428&idx=2&sn=14dfbe352a3406aeffca423e208fef1a&chksm=e915d5e6de625cf0ccb2f27eaea3ec79a53cea9bfce2b26473e0083188a203b51db6ee73fc33&scene=58&subscene=0#rd) - - [Snatch，BianLian 和 Agenda都出现了最新的变体](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550428&idx=3&sn=20acce5d47c126d0fcc943483a504298&chksm=e915d5e6de625cf07e10b9df7ece1d85a138804ffe5f2bdd8a15a98c56a0e3382b38dda6bce9&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Sep.15th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495847&idx=1&sn=e9c62ef2b5e689209a3b05e9262b1402&chksm=ce96bd99f9e1348f1ef6721c96a7cca487140455288ad0ca17f5833b963106489333d123105a&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-17.md b/archive/2022/2022-09-17.md deleted file mode 100644 index d1731acc42..0000000000 --- a/archive/2022/2022-09-17.md +++ /dev/null @@ -1,242 +0,0 @@ -# 每日安全资讯（2022-09-17） - -- Trustwave Blog - - [Compliance: The False Sense of Security.](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/compliance-the-false-sense-of-security/) -- Recent Commits to cve:main - - [Update Fri Sep 16 10:02:49 UTC 2022](https://github.com/trickest/cve/commit/0056c7471e6ab5cd9a41bfb5bf5589e5bd9681b4) -- bunnie's blog - - [Fully Oxidizing `ring`: Creating a Pure Rust TLS Stack Based on `rustls` + `ring`](https://www.bunniestudios.com/blog/?p=6521) -- Files ≈ Packet Storm - - [SAP SAPControl Web Service Interface Local Privilege Escalation](https://packetstormsecurity.com/files/168409/SA-20220915-0.txt) - - [Palo Alto Networks Authenticated Remote Code Execution](https://packetstormsecurity.com/files/168408/panos_op_cmd_exec.rb.txt) - - [Packet Fence 12.0.0](https://packetstormsecurity.com/files/168407/packetfence-12.0.0.tar.gz) - - [SAP SAProuter Improper Access Control](https://packetstormsecurity.com/files/168406/SA-20220914-0.txt) - - [Ubuntu Security Notice USN-5615-1](https://packetstormsecurity.com/files/168405/USN-5615-1.txt) - - [Ubuntu Security Notice USN-5614-1](https://packetstormsecurity.com/files/168404/USN-5614-1.txt) - - [Social Share Button 2.2.3 SQL Injection](https://packetstormsecurity.com/files/168403/ssb223-sql.txt) - - [Rocket LMS 1.6 SQL Injection](https://packetstormsecurity.com/files/168402/rocketlms16-sql.txt) - - [Chrome LinkToTextMenuObserver::CompleteWithError Heap Use-After-Free](https://packetstormsecurity.com/files/168401/GS20220916134029.tgz) -- Twitter @Nicolas Krassas - - [LastPass says hackers had internal access for four days](https://twitter.com/Dinosn/status/1570860283794685954) - - [Re @Octoberfest73 Thank you :)](https://twitter.com/Dinosn/status/1570858872709197825) - - [Massive Data Breach at Uber](https://twitter.com/Dinosn/status/1570819500723032065) - - [Hacker sells stolen Starbucks data of 219,000 Singapore customers](https://twitter.com/Dinosn/status/1570818997175857152) - - [Bitdefender releases free decryptor for LockerGoga ransomware](https://twitter.com/Dinosn/status/1570818891840098304) - - [Researchers Find Link b/w PrivateLoader and Ruzki Pay-Per-Install Services](https://twitter.com/Dinosn/status/1570818839826558976) - - [XLL_Phishing - XLL Phishing Tradecraft](https://twitter.com/Dinosn/status/1570766476973592577) - - [msmap: Memory WebShell Generator](https://twitter.com/Dinosn/status/1570758217856323584) - - [kubeeye: audit tool for Kubernetes](https://twitter.com/Dinosn/status/1570750789014130690) - - [A Basic Guide to iOS Testing in 2022](https://twitter.com/Dinosn/status/1570750723977261056) - - [DylibHijackTest: Discover DYLD_INSERT_LIBRARIES hijacks on macOS](https://twitter.com/Dinosn/status/1570750652456005632) - - [Hackers Targeting WebLogic Servers and Docker APIs for Mining Cryptocurrencies](https://twitter.com/Dinosn/status/1570750534600261636) - - [Exploring Common API Hacks](https://twitter.com/Dinosn/status/1570645662425026560) - - [RT Katie🌻Moussouris (she/her): Pour one out for the security response team at Uber. Hardcoded secrets in a powershell script got them powershellack...](https://twitter.com/k8em0/status/1570642933778620417) - - [RT HAHWUL: Release #dalfox v2.8.0🚀 I updated the dalfox after a long time. Some enhancements, Improve performance and --report flags have been adde...](https://twitter.com/hahwul/status/1570640062421045250) - - [Hive ransomware claims cyberattack on Bell Canada subsidiary](https://twitter.com/Dinosn/status/1570638741424967681) - - [Hackers trojanize PuTTY SSH client to backdoor media company](https://twitter.com/Dinosn/status/1570635955685715968) - - [RT Corben Leo: Re Apparently there was an internal network share that contained powershell scripts... "One of the powershell scripts contained the use...](https://twitter.com/hacker_/status/1570582547415068672) -- Security Boulevard - - [The Implications of the Uber Breach](https://securityboulevard.com/2022/09/the-implications-of-the-uber-breach/) - - [The Internet of Things Needs Crypto-Agility and PKI to Survive Quantum Computing Attacks — Here’s Why](https://securityboulevard.com/2022/09/the-internet-of-things-needs-crypto-agility-and-pki-to-survive-quantum-computing-attacks-heres-why/) - - [Exciting News from Hyperproof: We’re Joining Forces with Grant Thornton](https://securityboulevard.com/2022/09/exciting-news-from-hyperproof-were-joining-forces-with-grant-thornton%ef%bf%bc/) - - [BSidesLV 2022 Lucky13 BreakingGround – Rock Stevens’ And Matt Hand’s ‘Watching the Watchers: Exploiting Vulnerable Monitoring Solutions’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-breakingground-rock-stevens-and-matt-hands-watching-the-watchers-exploiting-vulnerable-monitoring-solutions/) - - [Botched Crypto Mugging Lands Three U.K. Men in Jail](https://securityboulevard.com/2022/09/botched-crypto-mugging-lands-three-u-k-men-in-jail/) - - [Veracode’s State of the Union 2022 – Techstrong TV](https://securityboulevard.com/2022/09/veracodes-state-of-the-union-2022-techstrong-tv/) - - [Seesaw: Popular elementary school app used to distribute obscene image](https://securityboulevard.com/2022/09/seesaw-popular-elementary-school-app-used-to-distribute-obscene-image/) - - [COURT DOC: USA v. Mansour Ahmadi, Ahmad Khatibi, Amir Hossein Nickaein Ravari](https://securityboulevard.com/2022/09/court-doc-usa-v-mansour-ahmadi-ahmad-khatibi-amir-hossein-nickaein-ravari/) - - [Ransomware: 3 ways to protect your business](https://securityboulevard.com/2022/09/ransomware-3-ways-to-protect-your-business/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Palo Alto Networks Authenticated Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090045) - - [SAP SAPControl Web Service Interface Local Privilege Escalation](https://cxsecurity.com/issue/WLB-2022090044) - - [SAP SAProuter Improper Access Control](https://cxsecurity.com/issue/WLB-2022090043) - - [Social Share Button 2.2.3 SQL Injection](https://cxsecurity.com/issue/WLB-2022090042) - - [Rocket LMS 1.6 SQL Injection](https://cxsecurity.com/issue/WLB-2022090041) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-sept-16) -- Sploitus.com Exploits RSS Feed - - [News247 News Magazine 1.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37965&utm_source=rss&utm_medium=rss) - - [Palo Alto Networks Authenticated Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168408&utm_source=rss&utm_medium=rss) - - [Rocket LMS 1.6 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168402&utm_source=rss&utm_medium=rss) - - [Social Share Button 2.2.3 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168403&utm_source=rss&utm_medium=rss) - - [SAP SAProuter Improper Access Control exploit](https://sploitus.com/exploit?id=PACKETSTORM:168406&utm_source=rss&utm_medium=rss) - - [SAP SAPControl Web Service Interface Local Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:168409&utm_source=rss&utm_medium=rss) -- 安全客-有思想的安全新媒体 - - [活动｜发射羊羊！陌陌、创新产品双倍季](https://www.anquanke.com/post/id/280256) - - [记录一次平平无奇的云上攻防过程](https://www.anquanke.com/post/id/280140) - - [欧盟提议对数码产品制造商实行严格的网络安全规则](https://www.anquanke.com/post/id/280303) - - [Hive勒索软件宣布对贝尔子公司网络攻击事件负责](https://www.anquanke.com/post/id/280297) - - [Bitbucket Server CVE-2022-36804 漏洞分析](https://www.anquanke.com/post/id/280193) - - [朝鲜黑客部署木马版PuTTY SSH盯上媒体](https://www.anquanke.com/post/id/280290) - - [新恶意软件捆绑包借YouTube 游戏视频扩散](https://www.anquanke.com/post/id/280279) - - [数字安全观察每周简报【行业动态篇】2022.08.31-2022.09.06](https://www.anquanke.com/post/id/280059) - - [国内知名游戏公司遭黑客入侵，幕后黑手竟是内鬼](https://www.anquanke.com/post/id/280273) - - [一例APP绕过root检测解密](https://www.anquanke.com/post/id/280145) - - [谷歌54亿收购网络安全公司Mandiant，成其史上第二大收购案](https://www.anquanke.com/post/id/280268) - - [印尼政府成立数据保护工作组防数据泄露](https://www.anquanke.com/post/id/280246) - - [美国政府制裁十名勒索软件攻击相关伊朗人](https://www.anquanke.com/post/id/280232) - - [中国国防报：强化高校网络安全刻不容缓](https://www.anquanke.com/post/id/280249) -- unSafe.sh - 不安全 - - [The Good, the Bad and the Ugly in Cybersecurity – Week 38](https://buaq.net/go-126924.html) - - [Zero-Day Exploit Detection Using Machine Learning](https://buaq.net/go-126916.html) - - [Uber hacked](https://buaq.net/go-126964.html) - - [XLL_Phishing - XLL Phishing Tradecraft](https://buaq.net/go-126915.html) - - [本周看什么 | 最近值得一看的 7 部作品](https://buaq.net/go-126912.html) - - [派周报 Vol. 009：知果罪果，其惟春秋](https://buaq.net/go-126913.html) - - [@你，招人！本周岗位更新](https://buaq.net/go-126901.html) - - [招生！2022年《安卓高级研修班》秋季班](https://buaq.net/go-126900.html) - - [行业唯一｜天地和兴荣膺2022“安永复旦最具潜力企业”大奖](https://buaq.net/go-126906.html) - - [实例解析Java反射](https://buaq.net/go-126897.html) - - [中国企业力推混合办公，又如何应对勒索软件与挖矿木马？](https://buaq.net/go-126895.html) - - [阿里云盘、百度盘还能这样用啊。](https://buaq.net/go-126945.html) - - [A Basic Guide to iOS Testing in 2022 | Bugcrowd](https://buaq.net/go-126886.html) - - [AList – 聚合阿里云盘、百度网盘、PikPak、WebDav 等 18 款网盘：文件预览、上传/下载，直接播放视频](https://buaq.net/go-126887.html) -- SecWiki News - - [SecWiki News 2022-09-16 Review](http://www.sec-wiki.com/?2022-09-16) -- 先知安全技术社区 - - [一些BAT的XSS实例（四）高级篇](https://xz.aliyun.com/t/11705) - - [利用ASP.NET Web API Help Page文件上传](https://xz.aliyun.com/t/11697) - - [基于netfilter的rootkit](https://xz.aliyun.com/t/11673) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [行业唯一｜天地和兴荣膺2022“安永复旦最具潜力企业”大奖](https://www.4hou.com/posts/gXV9) - - [TP-Link TL-WR841N 设备上的漏洞（CVE-2022-30024）分析](https://www.4hou.com/posts/kMM5) - - [CopperStealer传播基于恶意Chromium的浏览器扩展来窃取加密货币](https://www.4hou.com/posts/WBpv) -- 先知安全技术社区 - - [一些BAT的XSS实例（四）高级篇](https://xz.aliyun.com/t/11705) - - [利用ASP.NET Web API Help Page文件上传](https://xz.aliyun.com/t/11697) - - [基于netfilter的rootkit](https://xz.aliyun.com/t/11673) -- 安全脉搏 - - [实例解析Java反射](https://www.secpulse.com/archives/187255.html) - - [浅谈网络钓鱼技术](https://www.secpulse.com/archives/187246.html) - - [【漏洞预警】Golang net/url 目录遍历漏洞](https://www.secpulse.com/archives/187230.html) - - [住宅代理IP在网络攻击中的作用](https://www.secpulse.com/archives/187220.html) -- 跳跳糖 - 安全与分享社区 - - [java免杀合集](https://tttang.com/archive/1739/) -- 傲慢的上校的专栏 - - [jsoninclude.include.non_null 不起作用问题](https://blog.csdn.net/aomandeshangxiao/article/details/126890766) -- Forcepoint - - [Uber Hack – What we know so far](https://www.forcepoint.com/blog/x-labs/uber-hack-what-we-know-so-far) -- blog.avast.com EN - - [Seesaw: Popular elementary school app used to distribute obscene image](https://blog.avast.com/seesaw-school-app-hack) - - [Ransomware: 3 ways to protect your business](https://blog.avast.com/ransomware-protect-business) - - [Autonomous stores could change the retail game](https://blog.avast.com/autonomous-stores-risks) -- SpookySec - - [Deception in Depth - Building Deceptions from Breaches](https://blog.spookysec.net//DnD-building-from-breaches/) -- SAP Blogs - - [SAP Landscape Management Cloud & ABAP PCA (Post Copy Automation)](https://blogs.sap.com/2022/09/16/sap-landscape-management-cloud-abap-pca-post-copy-automation/) - - [Realignment in Margin Analysis](https://blogs.sap.com/2022/09/16/realignment-in-margin-analysis/) - - [Entry and Flow of S/4 HANA CATS Time Records](https://blogs.sap.com/2022/09/16/entry-and-flow-of-s-4-hana-cats-time-records/) - - [PI\PO OAuth Logs with XPI Inspector](https://blogs.sap.com/2022/09/16/pipo-oauth-logs-with-xpi-inspector/) - - [Integrating SAP with other applications using Red Hat Integration](https://blogs.sap.com/2022/09/16/integrating-sap-with-other-applications-using-red-hat-integration/) - - [SAP Fiori development newsletter September 2022](https://blogs.sap.com/2022/09/16/sap-fiori-development-newsletter-september-2022/) - - [SAP Enterprise Support Value Map for SAP Digital Supply Chain is Now Live!](https://blogs.sap.com/2022/09/16/sap-enterprise-support-value-map-for-sap-digital-supply-chain-is-now-live/) - - [PILS Partner Meet-Up EMEA – Virtual Edition – Ideate, Co-innovate, Certify and Operate](https://blogs.sap.com/2022/09/16/pils-partner-meet-up-emea-virtual-edition-ideate-co-innovate-certify-and-operate/) - - [Don’t miss anything at Devtoberfest: Make your plans now](https://blogs.sap.com/2022/09/16/dont-miss-anything-at-devtoberfest-make-your-plans-now/) - - [FAQ: Customer Interaction Center](https://blogs.sap.com/2022/09/16/faq-customer-interaction-center/) -- Reverse Engineering - - [mast1c0re: Hacking the PS4 / PS5 through the PS2 Emulator - Part 1 - Escape](https://www.reddit.com/r/ReverseEngineering/comments/xfemab/mast1c0re_hacking_the_ps4_ps5_through_the_ps2/) - - [IDA Pro Named, Computer, and Floating Licenses are no longer subscription based](https://www.reddit.com/r/ReverseEngineering/comments/xfg7x8/ida_pro_named_computer_and_floating_licenses_are/) -- Hex Rays - - [Igor’s tip of the week #106: Outlined functions](https://hex-rays.com/blog/igors-tip-of-the-week-106-outlined-functions/) -- The Daily Swig | Cybersecurity news and views - - [NETGEAR resolves router vulnerabilities in bundled gaming component](https://portswigger.net/daily-swig/netgear-resolves-router-vulnerabilities-in-bundled-gaming-component) - - [Uber hack linked to hardcoded secrets spotted in powershell script](https://portswigger.net/daily-swig/uber-hack-linked-to-hardcoded-secrets-spotted-in-powershell-script) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 38](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-38-4/) -- Wallarm - - [How Uber was hacked in 2022](https://lab.wallarm.com/how-uber-was-hacked/) -- Malwarebytes Labs - - [Uber hacked](https://www.malwarebytes.com/blog/news/2022/09/uber-hacked-again-in-what-seems-an-uber-hack-this-time) -- 安全牛 - - [中国企业力推混合办公，又如何应对勒索软件与挖矿木马？](https://www.aqniu.com/industry/89179.html) - - [数安小课堂 | 第1期：浅谈大数据环境下的数据安全治理研究](https://www.aqniu.com/vendor/89165.html) - - [安全牛课堂 丨 PRINCE2受控环境下的项目管理](https://www.aqniu.com/homenews/89164.html) - - [区块链真的安全吗？8大应用安全风险需关注！](https://www.aqniu.com/hometop/89158.html) - - [新华三业务驱动与云原生安全赋能“长三角网络安全协同发展”](https://www.aqniu.com/homenews/89157.html) - - [SharkTeam：十大智能合约安全威胁之合约升级漏洞](https://www.aqniu.com/vendor/89135.html) - - [2022vivo“千镜杯”正式开赛，为守护用户安全而战！](https://www.aqniu.com/activity-meeting/89127.html) - - [行业唯一｜天地和兴荣膺2022“安永复旦最具潜力企业”大奖](https://www.aqniu.com/vendor/89121.html) -- Twitter @hakivvi - - [RT Chromium Disclosed Security Bugs: Security: ChromeOS root privilege escalation (debugd, shill-scripts, minijail0, authpolicyd) (reward: $37500)](https://twitter.com/BugsChromium/status/1570837931111202820) -- 绿盟科技技术博客 - - [区块链密码基础之签名算法（二）](http://blog.nsfocus.net/blockchainsignature2-0/) - - [省省省，签名也去重：带有去重功能的云数据完整性审计](http://blog.nsfocus.net/data%c2%b7/) - - [5G安全：5G-AKA链接攻击及对策](http://blog.nsfocus.net/5g-aka/) - - [2022 国际网络安全顶会观察之NDSS](http://blog.nsfocus.net/2022ndss/) - - [识别网络爬虫的策略分析](http://blog.nsfocus.net/crawler-2/) -- FreeBuf网络安全行业门户 - - [FreeBuf周报 | 《网络安全法》将迎来修改；乌克兰网络攻击瘫痪俄罗斯2400个网站](https://www.freebuf.com/news/344710.html) - - [网安大国系列 | 澳大利亚：来自大洋孤岛的隐忧](https://www.freebuf.com/articles/others-articles/344697.html) - - [新的恶意软件包通过YouTube视频自我传播](https://www.freebuf.com/news/344691.html) - - [攻击溯源的成本与难度 | FreeBuf甲方群话题讨论](https://www.freebuf.com/articles/neopoints/344674.html) - - [全国信安标委发布《信息安全技术 网络数据分类分级要求》（征求意见稿）](https://www.freebuf.com/news/344672.html) - - [借悼念伊丽莎白二世女王之名，攻击者发起大规模网络钓鱼攻击](https://www.freebuf.com/news/344662.html) -- HackerNews - - [伊朗勒索软件组织攻击美国企业，遭美政府溯源真实身份并制裁](https://hackernews.cc/archives/41533) - - [新的恶意软件包通过 YouTube 视频自我传播](https://hackernews.cc/archives/41527) - - [借悼念伊丽莎白二世女王之名，攻击者发起大规模网络钓鱼攻击](https://hackernews.cc/archives/41523) - - [马斯克指责推特隐瞒数据安全漏洞 称其明显构成欺诈](https://hackernews.cc/archives/41521) - - [有黑客在 Edge 浏览器“My Feed”页面投放技术诈骗广告](https://hackernews.cc/archives/41516) -- 看雪学院 - - [“羊了个羊”通关修改思路](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458470353&idx=1&sn=839285154848281f43b27a87174fbe2d&chksm=b18e775b86f9fe4df826077af98bac83f1190c29893ed4c67c948085c35f714abfbaffaabdd0&scene=58&subscene=0#rd) - - [热衷游戏作弊及破解？小心下载了恶意软件](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458470353&idx=2&sn=931473976b67fd7b589202dffe9dbd6b&chksm=b18e775b86f9fe4d7e630338899bd4a6eed9ce82454b44af0710711806a64bdb8a01e85f966d&scene=58&subscene=0#rd) - - [@你，招人！本周岗位更新](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458470353&idx=3&sn=52788f64aadefbad0a209dc6b2927821&chksm=b18e775b86f9fe4d71a9b4962fc70e6aaa348c2beecc3a8f02fc7bbc5980be29a8dee67bd711&scene=58&subscene=0#rd) - - [招生！2022年《安卓高级研修班》秋季班](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458470353&idx=4&sn=62e635a5698f40189cbf81e089844a8f&chksm=b18e775b86f9fe4d8f12ccc631108dcf0ab64d75b8bd018670a408057d341d7ecfb7362325c7&scene=58&subscene=0#rd) -- KitPloit - PenTest & Hacking Tools - - [XLL_Phishing - XLL Phishing Tradecraft](http://www.kitploit.com/2022/09/xllphishing-xll-phishing-tradecraft.html) -- 奇客Solidot–传递最新科技情报 - - [杀猪盘新招：强迫受害者从事网络诈骗](https://www.solidot.org/story?sid=72788) - - [Uber 系统遭黑客入侵](https://www.solidot.org/story?sid=72787) - - [黑客使用木马版 PuTTY SSH 客户端植入后门](https://www.solidot.org/story?sid=72786) - - [FTC 将打击对零工的剥削](https://www.solidot.org/story?sid=72785) - - [惠普为用 DMR 阻止使用第三方墨水而赔偿欧洲客户 135 万美元](https://www.solidot.org/story?sid=72784) - - [新冠死亡病例数降至两年半以来的最低水平](https://www.solidot.org/story?sid=72783) - - [拜登政府加强审查外国对美科技投资](https://www.solidot.org/story?sid=72782) - - [Backblaze 的数据显示固态硬盘可靠性强于机械硬盘](https://www.solidot.org/story?sid=72781) - - [Adobe 以 200 亿美元收购 Figma](https://www.solidot.org/story?sid=72780) - - [Google 砍掉研发部门 Area 120 半数项目](https://www.solidot.org/story?sid=72779) -- 代码卫士 - - [优步被黑，内部系统受陷，漏洞报告被盗](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513988&idx=1&sn=512f50328bad39cab97a240c184bc7ce&chksm=ea9486eedde30ff8572a7444f4f52b015f9bfd058124dd3d017529d471f6db94e6474fea07d9&scene=58&subscene=0#rd) - - [开源CMS TYPO3中存在XSS漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247513988&idx=2&sn=d8e2aa2199ecfa383521908c1073c29b&chksm=ea9486eedde30ff81f3dd92049688847d298f700e6c02f09be03797789e7985c8a14915576a5&scene=58&subscene=0#rd) -- 信安之路 - - [最近在做什么？](https://mp.weixin.qq.com/s?__biz=MzI5MDQ2NjExOQ==&mid=2247497967&idx=1&sn=a6a61cc88bd66c1fb7076445f9b96861&chksm=ec1dc8c7db6a41d1e32b31f8acc5a76c675c24587b5983b828614f294521aed88e7ff4b19cc6&scene=58&subscene=0#rd) -- 腾讯玄武实验室 - - [每日安全动态推送(09-16)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958699&idx=1&sn=85304f4beb0c262cae5d2970d27eb256&chksm=8baecd34bcd94422a2b42b7a0ed528db12b1cc9eeb242386206109b876f26e7bf12960b73169&scene=58&subscene=0#rd) -- 安全学术圈 - - [2022年度河南省网络密码技术重点实验室资助课题公示](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247488164&idx=1&sn=5ff7c16c39918c9a56a7edbb4014ef40&chksm=fe2eed2fc9596439d0580ebb1eab5d3a7ada7584d2e6f293cd9854ff93366aa4edfbf55003e8&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [区块链密码基础之签名算法（二）](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247493340&idx=1&sn=db8db6177029ed88c7da4b893b06f4d4&chksm=e84c4003df3bc915c84e87449ace1fe81fdb0b49ad582f53f16c7a66c9a354552a0e07ac0092&scene=58&subscene=0#rd) -- 博客园 - 渗透测试中心 - - [JWT认证攻击详解总结 - 渗透测试中心](https://www.cnblogs.com/backlion/p/16699442.html) -- 奇安信威胁情报中心 - - [每周高级威胁情报解读(2022.09.08~09.15)](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247503823&idx=1&sn=46ed2e00edd2495e0249be5a9f8c732d&chksm=ea6638b8dd11b1ae88a07f03a9c180d6570d3b6f0ea924d4f3a14ff2842cb240de2326b4e9c1&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【资料】卡巴斯基犯罪软件报告：现代勒索软件团伙的常见TTP](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651132045&idx=1&sn=b076fd461a5944230842f3b403c2526d&chksm=f1af67b7c6d8eea15f7bca9a5c4c1bf2f1deb5e3a99c757f28e0691e2098c548773df7cf96ad&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】国内知名游戏公司被黑客入侵 警方抓获2名幕后黑手](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017403&idx=1&sn=bfe029909230e276278d0aa694ae1b52&chksm=f36fbebbc41837ad8c2c61fc075392f9879ada0f80cf20782e7f822508dff855a47840706cc6&scene=58&subscene=0#rd) - - [【安全圈】比特币、以太坊再现断崖式暴跌！4.8万人近14亿元资金遭血洗](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017403&idx=2&sn=08e04899532e25ffe26b64d2cad34ae6&chksm=f36fbebbc41837add40daa246c1bdfdb2293eb0cf36beab32f5ba88f3edf15e9353fb2121460&scene=58&subscene=0#rd) - - [【安全圈】Google和Meta因非法收集个人信息被韩国罚款千亿韩元](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017403&idx=3&sn=53597fe168aeb5753dbf7b67285eaaa2&chksm=f36fbebbc41837adc4636febe840f5ef25418b9a4537376e4d20174abcfdaae557031ac25563&scene=58&subscene=0#rd) - - [【安全圈】网络钓鱼页面嵌入键盘记录程序窃取密码](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017403&idx=4&sn=d5bcba15482293829588fcc7adc6e256&chksm=f36fbebbc41837ad8c90d9b34ab139a501fdf654924119b727ae2f4d1a84cb99fd810ef49140&scene=58&subscene=0#rd) - - [【安全圈】CISA 在其已知漏洞目录中又增加了 2 个安全漏洞](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652017403&idx=5&sn=d7e367f0feb39def28f9fda5c7f90ac1&chksm=f36fbebbc41837add953d530035179dd90cf167ac95d69488c53bb7042884b53d812f33ba797&scene=58&subscene=0#rd) -- 星阑科技 - - [金秋福利来袭，速来抽奖！](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495747&idx=1&sn=a4b7aa0cbfa53d59b025f7c4b3b93b68&chksm=c0075ddff770d4c9887fb54c9adddf4959f8f7ec8e20f6698cd91bd27e8fef4d9ac29cc066ba&scene=58&subscene=0#rd) -- 情报分析师 - - [从犯罪现场到法庭（附犯罪现场调查案例研究教程）236页](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650516382&idx=1&sn=44c2f28258ba4090184e1773820c1103&chksm=871685d5b0610cc3a25a8f107993ab2d6b15edea0796cbd2dc42679908713473735e62b778db&scene=58&subscene=0#rd) - - [美国陆军未来作战白皮书《操作机器人和自主系统以支持多域作战》｜62页](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650516382&idx=2&sn=43c3288f3d6829178eaf23a74f938426&chksm=871685d5b0610cc342825584efceebb42badb3ae44f38aabfc95122c0009f77a1a6da35ab676&scene=58&subscene=0#rd) -- 奇安信CERT - - [奇安信集团2022年9月补丁库更新通告第一次更新](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247496938&idx=1&sn=d1d8829b9b9804e7a2e8de9f16e89996&chksm=fe79d072c90e5964bd8a953faf10bd6def8b007205f9b906eba6a4cf5a051c18e59e70b11193&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [爆款小游戏 “羊了个羊” 关卡逻辑分析](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496457&idx=1&sn=3fb39e7ead0f39901beab7dacf0933bc&chksm=fa5226b7cd25afa17a25ef8739d3482e9e07e7a161406033b415807e4957b6c0b1a612811e3d&scene=58&subscene=0#rd) -- 青藤云安全 - - [继5700万条数据泄露后，网约车巨头Uber承认再遭黑客攻击](https://mp.weixin.qq.com/s?__biz=MzAwNDE4Mzc1NA==&mid=2650838221&idx=1&sn=649e77094e5cfb6359fe5caba4fc9bb3&chksm=80dbf768b7ac7e7e8064a49cc42f1e86a57d6a1584c6d45382822c6d2c9dfa9d177432a3813c&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [Jeddak亮相2022世界人工智能大会|隐私计算的实践与探索](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489725&idx=1&sn=2ed05ce6e5da3715244cd62031c2bd57&chksm=fa9ee3ebcde96afd58bcb0946caa67a4a713fb30b4bb8999664c3792f0a9f2134fc760790602&scene=58&subscene=0#rd) - - [报名开启｜ByteSRC邀您参与白帽成长营](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489725&idx=2&sn=897ca37e4ece0c7c557bd7b215c2cc9e&chksm=fa9ee3ebcde96afd62243d0fe96d0de59cee53c72c78e5a6109773ae39e489e32949eee9f34b&scene=58&subscene=0#rd) -- 阿里安全响应中心 - - [报名开启｜6家SRC邀您参与白帽成长营](https://mp.weixin.qq.com/s?__biz=MzIxMjEwNTc4NA==&mid=2652992837&idx=1&sn=981519988a324fcc51e346d9a7943e8e&chksm=8c9efa12bbe97304ed7f3a86998342d864fd3d9f3467a1c1547474194460ea2bb035ddafd396&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [数字化新业态下数据安全创新-token化](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247490433&idx=1&sn=f0f8e6007b312604f24c13e3e37967ac&chksm=ec1bfa52db6c73445317d56f4de386d9613b4ca3b7dfcbe9eaf671e7645bd6dad957e9c1db85&scene=58&subscene=0#rd) -- 安全牛 - - [区块链真的安全吗？8大应用安全风险需关注！](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118629&idx=1&sn=a1a03bad3bee939cf43cae8610b5e89a&chksm=bd146cf68a63e5e072a54e8f25c63d8926b14d01fec25c553962af4536426cc9bfac4eff878e&scene=58&subscene=0#rd) - - [安全牛课堂 丨 PRINCE2受控环境下的项目管理](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118629&idx=2&sn=6e137aa780581d9d46cabfa2fdd2f176&chksm=bd146cf68a63e5e00d982a19d077dbce795172cff5b383cb750d67a3b31436594204020d20d5&scene=58&subscene=0#rd) -- 极客公园 - - [Adobe 200 亿美元收购设计平台 Figma；以太坊完成合并，告别「挖矿」；耐克开发「修鞋」机器人 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967436&idx=1&sn=2d199b30b17115d205bb2f57bac61bbf&chksm=7e546fba4923e6accc8987020d1cbf743c966b030cad6573e1b02c083944d0461ff789c94c75&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-18.md b/archive/2022/2022-09-18.md deleted file mode 100644 index e81c21b572..0000000000 --- a/archive/2022/2022-09-18.md +++ /dev/null @@ -1,63 +0,0 @@ -# 每日安全资讯（2022-09-18） - -- Twitter @Nicolas Krassas - - [DeathSleep - A PoC Implementation For An Evasion Technique To Terminate The Current Thread And Restore It Before Resuming Execution, While Implementin...](https://twitter.com/Dinosn/status/1571181912713986048) - - [HTB: StreamIO](https://twitter.com/Dinosn/status/1571181848478220288) - - [Hacker Couple Deleted Hotel Chain Data For Fun](https://twitter.com/Dinosn/status/1571181783873470464) - - [New York ambulance service discloses data breach after ransomware attack](https://twitter.com/Dinosn/status/1571181716139540493) - - [CISA adds Stuxnet bug to its Known Exploited Vulnerabilities Catalog](https://twitter.com/Dinosn/status/1571163673804132353) - - [Can reflections in eyeglasses actually leak info from Zoom calls? Here's a study into it](https://twitter.com/Dinosn/status/1571163453011726337) - - [Uber Claims No Sensitive Data Exposed in Latest Breach… But There's More to This](https://twitter.com/Dinosn/status/1571163338783997953) - - [RT reverseame: Popular NFT Marketplace Phished for $540M](https://twitter.com/reverseame/status/1571091536674279425) - - [Hackers Had Access to LastPass's Development Systems for Four Days](https://twitter.com/Dinosn/status/1570989065486606336) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [保护物联网设备远离网络攻击的五个步骤](https://www.4hou.com/posts/q8Xr) - - [MICROSOFT WINDOWS NFS V4中发现一个远程代码执行漏洞](https://www.4hou.com/posts/RBnR) -- unSafe.sh - 不安全 - - [DeathSleep - A PoC Implementation For An Evasion Technique To Terminate The Current Thread And Restore It Before Resuming Execution, While Implementing Page Protection Changes During No Execution](https://buaq.net/go-126997.html) - - [更新 watchOS 9 正式版后，这些功能值得一试](https://buaq.net/go-126992.html) - - [看起来很酷，就送个码。](https://buaq.net/go-126989.html) - - [一次不成功的MEMORY.DMP分析](https://buaq.net/go-127023.html) - - [智力不够，就不要来挑战这个游戏了！](https://buaq.net/go-126986.html) - - [InPaper – 42 种布局，无限量壁纸，创造性的自动化壁纸应用[iPhone/iPad]](https://buaq.net/go-126984.html) - - [AOD、灵动岛、相机，这才是 Pro 的完全体？iPhone 14 Pro 首发体验](https://buaq.net/go-126987.html) - - [保护物联网设备远离网络攻击的五个步骤](https://buaq.net/go-126982.html) - - [MICROSOFT WINDOWS NFS V4中发现一个远程代码执行漏洞](https://buaq.net/go-126983.html) - - [一派·Podcast | 毕业论文避坑指南](https://buaq.net/go-126988.html) - - [Arch Linux 邮件列表的变化](https://buaq.net/go-126966.html) - - [Uber Hack – What we know so far](https://buaq.net/go-126939.html) - - [Seesaw: Popular elementary school app used to distribute obscene image](https://buaq.net/go-126933.html) - - [Ransomware: 3 ways to protect your business](https://buaq.net/go-126934.html) - - [How Uber was hacked in 2022](https://buaq.net/go-126936.html) -- SecWiki News - - [SecWiki News 2022-09-17 Review](http://www.sec-wiki.com/?2022-09-17) -- Security Boulevard - - [Uber Data Breach is Worst Case Scenario](https://securityboulevard.com/2022/09/uber-data-breach-is-worst-case-scenario/) - - [BSidesLV 2022 Lucky13 BreakingGround – IDigitalFlame ‘So You Wanta Build A C2?’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-breakingground-idigitalflame-so-you-wanta-build-a-c2/) - - [How to Build a Zero Trust Security Architecture with Your Technology](https://securityboulevard.com/2022/09/how-to-build-a-zero-trust-security-architecture-with-your-technology/) -- obaby@mars - - [PyCharm 2022.2 修改启动图片](http://h4ck.org.cn/2022/09/pycharm-2022-2-%e4%bf%ae%e6%94%b9%e5%90%af%e5%8a%a8%e5%9b%be%e7%89%87/) -- Sploitus.com Exploits RSS Feed - - [Exploit for CRLF Injection in Catchethq Catchet exploit](https://sploitus.com/exploit?id=AAB95082-FA5E-592D-A514-EB82DC0E4955&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Zimbra Collaboration exploit](https://sploitus.com/exploit?id=A6071ED1-4DD2-5D98-9131-FEFBE84B4664&utm_source=rss&utm_medium=rss) -- Recent Commits to cve:main - - [Update Sat Sep 17 10:03:10 UTC 2022](https://github.com/trickest/cve/commit/211ca80dfc31728f279d6b578202b91deb499433) -- WeiyiGeek Blog - - [个人随记/国学/命理天地四柱八字学](https://blog.weiyigeek.top/2022/9-17-index.html) -- SAP Blogs - - [Universal Allocations – Top Down Distribution](https://blogs.sap.com/2022/09/17/universal-allocations-top-down-distributions/) - - [Data Catalog with SAP – Quo Vadis?](https://blogs.sap.com/2022/09/17/data-catalog-with-sap-quo-vadis/) -- Reverse Engineering - - [Unity + Photon - UDP Port unreachable](https://www.reddit.com/r/ReverseEngineering/comments/xgqtxe/unity_photon_udp_port_unreachable/) -- KitPloit - PenTest & Hacking Tools - - [DeathSleep - A PoC Implementation For An Evasion Technique To Terminate The Current Thread And Restore It Before Resuming Execution, While Implementing Page Protection Changes During No Execution](http://www.kitploit.com/2022/09/deathsleep-poc-implementation-for.html) -- 奇客Solidot–传递最新科技情报 - - [为什么 Craigslist 的界面和 25 年前一样](https://www.solidot.org/story?sid=72795) - - [两越南黑客出于找乐删除洲际酒店集团的数据库](https://www.solidot.org/story?sid=72794) - - [凹语言支持 Chrome 浏览器执行](https://www.solidot.org/story?sid=72793) - - [美国司法部成立专门机构打击加密货币犯罪](https://www.solidot.org/story?sid=72792) - - [EVGA 终止与英伟达的合作完全退出显卡市场](https://www.solidot.org/story?sid=72790) - - [英特尔将弃用奔腾和赛扬品牌](https://www.solidot.org/story?sid=72789) -- 青衣十三楼飞花堂 - - [cby的日常(before 2022.8.15)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486192&idx=1&sn=aee743469c5490a6721c18d893c02a5a&chksm=fab2c9cfcdc540d9ee922d4eed599d73b9b9e4e155a5bdedfaa9596a4354d33d0676d803ab39&scene=58&subscene=0#rd) - - [一次不成功的MEMORY.DMP分析](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486188&idx=1&sn=7f58aa5caafde8d33ae4eae8ba950a1d&chksm=fab2c9d3cdc540c5e108791ba4be468e506968edd495ee3313d28a1342b2a1b25db62a1db97e&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-19.md b/archive/2022/2022-09-19.md deleted file mode 100644 index c47f2a03ee..0000000000 --- a/archive/2022/2022-09-19.md +++ /dev/null @@ -1,82 +0,0 @@ -# 每日安全资讯（2022-09-19） - -- SecWiki News - - [SecWiki News 2022-09-18 Review](http://www.sec-wiki.com/?2022-09-18) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [CodoForum v5.1 Remote Code Execution (RCE)](https://cxsecurity.com/issue/WLB-2022090046) -- Sploitus.com Exploits RSS Feed - - [SoX 14.4.2 (wav.c) Division By Zero exploit](https://sploitus.com/exploit?id=ZSL-2022-5712&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-37706 exploit](https://sploitus.com/exploit?id=D2078F87-CBCF-5F4A-83A4-81D121282290&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-2588 exploit](https://sploitus.com/exploit?id=9E1C498D-25A3-57B2-A391-764CDA0E674F&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [FISSURE - Frequency Independent SDR-based Signal Understanding and Reverse Engineering](https://twitter.com/Dinosn/status/1571488452226555904) - - [RT Lars Karlslund: Stuck on a network with no credentials? No worry, you can anonymously bruteforce Active Directory controllers for usernames over LD...](https://twitter.com/lkarlslund/status/1571456663051280390) - - [Re @windsheep_ @Grammarly Possibly same case](https://twitter.com/Dinosn/status/1571422917354991618) - - [Google, Microsoft can get your passwords via web browser's spellcheck](https://twitter.com/Dinosn/status/1571379915517296640) - - [requests-ip-rotator: A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute...](https://twitter.com/Dinosn/status/1571376799661301760) -- Security Boulevard - - [RiskLens Fast Facts on Cyber Risk in Manufacturing](https://securityboulevard.com/2022/09/risklens-fast-facts-on-cyber-risk-in-manufacturing/) - - [BSidesLV 2022 Lucky13 BreakingGround – Jonathan Leitschuh’s And Patrick Way’s ‘Scaling The Security Researcher To Eliminate OSS Vulnerabilities Once And For All’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-breakingground-jonathan-leitschuhs-and-patrick-ways-scaling-the-security-researcher-to-eliminate-oss-vulnerabilities-once-and-for-all/) - - [How to Present Compliance ROI to Leadership: Some Thoughts on the Value of Showing Value](https://securityboulevard.com/2022/09/how-to-present-compliance-roi-to-leadership-some-thoughts-on-the-value-of-showing-value/) - - [Trends in Developing a New Cyber Workforce Strategy](https://securityboulevard.com/2022/09/trends-in-developing-a-new-cyber-workforce-strategy/) - - [The Storage Manager’s Quick-Guide to Ransomware Resiliency](https://securityboulevard.com/2022/09/the-storage-managers-quick-guide-to-ransomware-resiliency/) -- unSafe.sh - 不安全 - - [PE-bear - Portable Executable reversing tool with a friendly GUI](https://buaq.net/go-127084.html) - - [New Tool: split-overlap.py](https://buaq.net/go-127078.html) - - [FISSURE - Frequency Independent SDR-based Signal Understanding and Reverse Engineering](https://buaq.net/go-127074.html) - - [苹果 QQ for Mac 全新体验版下载 - 新一代架构重构版 (音视频通话/深色模式/实况文本等)](https://buaq.net/go-127085.html) - - [它是真的强大，以至于没办法收费...](https://buaq.net/go-127064.html) - - [图形方格纸 MyGraphPaper – 免费、可自定义的纸张模板、方格笔记本、打印纸](https://buaq.net/go-127062.html) - - [iOS 16 锁屏小组件怎么玩？不妨试试这些 App](https://buaq.net/go-127063.html) - - [一个真实案例启示：不要轻易相信一名黑客的承诺](https://buaq.net/go-127054.html) - - [防火墙漏洞使用户很容易受到黑客的主动攻击](https://buaq.net/go-127055.html) - - [[送码] 白描 App 推出 Windows 版，朝「最佳中文 OCR 识别工具」更进一步](https://buaq.net/go-127059.html) -- Recent Commits to cve:main - - [Update Sun Sep 18 10:02:34 UTC 2022](https://github.com/trickest/cve/commit/3f2423f1814b623a0c545cc57ad8e3b92b112af6) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [一个真实案例启示：不要轻易相信一名黑客的承诺](https://www.4hou.com/posts/jJgR) - - [防火墙漏洞使用户很容易受到黑客的主动攻击](https://www.4hou.com/posts/ZXXJ) -- Planet Classpath - - [Mark Wielaard: Sourceware Infrastructure / Conservancy / GNU Toolchain at Cauldron](https://gnu.wildebeest.org/blog/mjw/2022/09/18/sourceware-infrastructure-conservancy-gnu-toolchain-at-cauldron/) -- Twitter @bytehx - - [RT Mohsin Khan 🇮🇳: Thread about hunting on the main application 🧵 1. Check the login process - Do they allow signup with email or Google etc ...](https://twitter.com/tabaahi_/status/1571386282835873792) -- SAP Blogs - - [Concept of Condition Technique – SAP EWM](https://blogs.sap.com/2022/09/18/concept-of-condition-technique-sap-ewm/) - - [Passo a Passo: atualização de dados em massa utilizando a transação MASS no S/4HANA](https://blogs.sap.com/2022/09/18/passo-a-passo-atualizacao-de-dados-em-massa-utilizando-a-transacao-mass-no-s-4hana/) - - [Creator Spotlight: Get real-time COVID-19 data for every location with COVO](https://blogs.sap.com/2022/09/18/creator-spotlight-get-real-time-covid-19-data-for-every-location-with-covo/) - - [Analytics paves the way of becoming an intelligent enterprise](https://blogs.sap.com/2022/09/18/analytics-paves-the-way-of-becoming-an-intelligent-enterprise/) - - [CONCENTO RDG – Single Value Derivation Rule ( String Concatenation & Arithmetic Operation ) in BRF+](https://blogs.sap.com/2022/09/18/concento-rdg-single-value-derivation-rule-string-concatenation-arithmetic-operation-in-brf/) - - [HANA project : Generate project documentation (init)](https://blogs.sap.com/2022/09/18/hana-project-generate-project-documentation-init/) - - [How to find email address of SAP User id the smart way?](https://blogs.sap.com/2022/09/18/how-to-find-email-address-of-sap-user-id-the-smart-way/) - - [Supply Chain Visibility beyond EDI’s](https://blogs.sap.com/2022/09/18/supply-chain-visibility-beyond-edis/) -- Didier Stevens - - [New Tool: split-overlap.py](https://blog.didierstevens.com/2022/09/18/new-tool-split-overlap-py/) -- Reverse Engineering - - [PE-bear - Portable Executable reversing tool with a friendly GUI](https://www.reddit.com/r/ReverseEngineering/comments/xhhggz/pebear_portable_executable_reversing_tool_with_a/) - - [Tesla Charge Port Remote Signal](https://www.reddit.com/r/ReverseEngineering/comments/xhvj9y/tesla_charge_port_remote_signal/) - - [Reversing Shorts [YouTube channel]](https://www.reddit.com/r/ReverseEngineering/comments/xhsvnm/reversing_shorts_youtube_channel/) -- KitPloit - PenTest & Hacking Tools - - [FISSURE - Frequency Independent SDR-based Signal Understanding and Reverse Engineering](http://www.kitploit.com/2022/09/fissure-frequency-independent-sdr-based.html) -- 博客园 - 郑瀚Andrew - - [安吉青山廊璞石山居公寓 项目可行性分析 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16705126.html) -- 博客园 - 渗透测试中心 - - [第五届美团网络安全高校挑战赛团体初赛writeup - 渗透测试中心](https://www.cnblogs.com/backlion/p/16704171.html) -- Twitter @Keiran Smith (Affix) - - [Re @grantmac_ @ChargePlaceScot Im not storing the data. Just polling their API for now. Might store it as a time series and analyse the best times to ...](https://twitter.com/cli/status/1571430696564162560) -- 奇客Solidot–传递最新科技情报 - - [上月集成电路产量大幅下跌](https://www.solidot.org/story?sid=72798) - - [仍在销售软盘的商人](https://www.solidot.org/story?sid=72797) - - [美国 CISA 下令修补 Stuxnet 攻击使用的漏洞](https://www.solidot.org/story?sid=72796) -- 黑海洋 - WIKI - - [js 图标 base64加密 和 解密](https://blog.upx8.com/2988) - - [羊了个羊在线刷通关网站源码](https://blog.upx8.com/2981) - - [羊了个羊在线刷99999999次通关数](https://blog.upx8.com/2980) - - [羊了个羊游戏h5网页版源码泄露](https://blog.upx8.com/2986) - - [最新免费QQ密绑泄露检测源码支持反查-带后台带接口](https://blog.upx8.com/2987) - - [站长必备工具，免费 APP 网站隐私政策生成器](https://blog.upx8.com/2985) - - [2022年升级版知识付费变现微信小程序源码](https://blog.upx8.com/2984) - - [WPS Office 2019 v11.8.2.11734 专业增强版（内置序列号激活）](https://blog.upx8.com/2983) - - [小鸡模拟器TV版 9.9.9 破解版 去升级无限玩](https://blog.upx8.com/2982) - - [Yoco（百度文库下载器）](https://blog.upx8.com/2979) -- 极客公园 - - [NASA 在火星发现大量有机物；英伟达合作伙伴：从此不产新显卡；中国有望推太空旅行，票价 200 万元起 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967535&idx=1&sn=709e0d75d4a1deec2dcd483a1c60ee42&chksm=7e546fd94923e6cf75bddb86e0e46d378d5d7ac5018a2c14acd32035b22c51e31542e5bc7bcc&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-20.md b/archive/2022/2022-09-20.md deleted file mode 100644 index 96c4fb4170..0000000000 --- a/archive/2022/2022-09-20.md +++ /dev/null @@ -1,207 +0,0 @@ -# 每日安全资讯（2022-09-20） - -- Security Boulevard - - [Edge Data Center Operations Needs Modern DCIM Software](https://securityboulevard.com/2022/09/edge-data-center-operations-needs-modern-dcim-software/) - - [In the News | Announcing ManagedMethods’ New Google Chat Monitoring and Updated Policy Functions](https://securityboulevard.com/2022/09/in-the-news-announcing-managedmethods-new-google-chat-monitoring-and-updated-policy-functions/) - - [BSidesLV 2022 Lucky13 BreakingGround – Jonathan Fischer’s And Jeremy Miller’s ‘Injectyll-HIDe: Hardware Implants At Scale’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-breakingground-jonathan-fischers-and-jeremy-millers-injectyll-hide-hardware-implants-at-scale/) - - [Key takeaways from Gartner IAM summit 2022](https://securityboulevard.com/2022/09/key-takeaways-from-gartner-iam-summit-2022/) - - [Kubernetes security, cost avoidance an’ policy go ‘and in ‘and](https://securityboulevard.com/2022/09/kubernetes-security-cost-avoidance-an-policy-go-and-in-and/) - - [Automate Policy Checks for Your CI/CD: OpenCredo Secure Software Pipeline Verifier](https://securityboulevard.com/2022/09/automate-policy-checks-for-your-ci-cd-opencredo-secure-software-pipeline-verifier/) - - [Sunsetting legacy Cybersecurity Process for Better Optimization and Security Modernization](https://securityboulevard.com/2022/09/sunsetting-legacy-cybersecurity-process-for-better-optimization-and-security-modernization/) - - [Victims of Gym Phone Theft Lose $10,000 Each (Because SMS 2FA)](https://securityboulevard.com/2022/09/gym-theft-sms-2fa-richixbw/) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5617-1](https://packetstormsecurity.com/files/168421/USN-5617-1.txt) - - [Ubuntu Security Notice USN-5613-2](https://packetstormsecurity.com/files/168420/USN-5613-2.txt) - - [VIAVIWEB Wallpaper Admin SQL Injection / Shell Upload](https://packetstormsecurity.com/files/168419/viaviwebwallpaper-sqlshell.txt) - - [Ubuntu Security Notice USN-5616-1](https://packetstormsecurity.com/files/168418/USN-5616-1.txt) - - [SoX 14.4.2 Division-By-Zero / Denial Of Service](https://packetstormsecurity.com/files/168417/ZSL-2022-5712.tgz) - - [Red Hat Security Advisory 2022-6551-01](https://packetstormsecurity.com/files/168416/RHSA-2022-6551-01.txt) - - [PhotoSync 4.7 Local File Inclusion](https://packetstormsecurity.com/files/168415/photosync47-lfi.txt) - - [Owlfiles File Manager 12.0.1 Path Traversal / Local File Inclusion](https://packetstormsecurity.com/files/168414/owlfilesfm1201-traversal.txt) - - [Red Hat Security Advisory 2022-6541-01](https://packetstormsecurity.com/files/168413/RHSA-2022-6541-01.txt) - - [OpenCart 3.x Newsletter Custom Popup 4.0 SQL Injection](https://packetstormsecurity.com/files/168412/opencart3xncp-sql.txt) - - [WordPress GetYourGuide Ticketing 1.0.1 Cross Site Scripting](https://packetstormsecurity.com/files/168411/wpgetyourguideticketing101-xss.txt) - - [Genesys PureConnect Cross Site Scripting](https://packetstormsecurity.com/files/168410/genesyspureconnect-xss.txt) -- Twitter @Nicolas Krassas - - [pamspy: Credentials Dumper for Linux using eBPF](https://twitter.com/Dinosn/status/1571921356941570048) - - [CATS - REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints](https://twitter.com/Dinosn/status/1571913874802380802) - - [Large-Scale Collection of Cell Phone Data at US Borders](https://twitter.com/Dinosn/status/1571913302544097287) - - [Revolut security breach: data of +50,000 users exposed](https://twitter.com/Dinosn/status/1571912919297789954) - - [Google Says It Accidentally Paid A Self Proclaimed Hacker $250,000](https://twitter.com/Dinosn/status/1571912702322442240) - - [GPT-3 'prompt injection' attack causes bad bot manners](https://twitter.com/Dinosn/status/1571867852289851392) - - [RT Pew: It seems finally my exploit is public, stay tuned for my writeup though.](https://twitter.com/TheGrandPew/status/1571847052962975745) - - [Europol and Bitdefender Release Free Decryptor for LockerGoga Ransomware](https://twitter.com/Dinosn/status/1571821545546301441) - - [Living Off The Land: Suspicious System32](https://twitter.com/Dinosn/status/1571821474943565825) - - [RT carlospolop: Yes, there is a NEW HACKTRICKS. Yes, I want to make it public. We just need to reach 10.000 points: - Like this = 1 point - Retweet th...](https://twitter.com/carlospolopm/status/1571793200490188803) - - [30 Search Engines for Cybersecurity Researchers (Part 2 of 3)](https://twitter.com/Dinosn/status/1571776113046609922) - - [Converts a EXE into DLL](https://twitter.com/Dinosn/status/1571745979841548288) - - [Find secrets and passwords in container images and file systems](https://twitter.com/Dinosn/status/1571745912086736909) - - [Tomcat Weak Password Batch Scanner](https://twitter.com/Dinosn/status/1571745497089556480) - - [PE-bear - Portable Executable reversing tool with a friendly GUI](https://twitter.com/Dinosn/status/1571734790122147840) - - [Netgear Routers impacted by FunJSQ Game Acceleration Module flaw](https://twitter.com/Dinosn/status/1571734747822555137) - - [GTA 6 source code and videos leaked after Rockstar Games hack](https://twitter.com/Dinosn/status/1571734636916523008) - - [TeamTNT is back and targets servers to run Bitcoin encryption solvers](https://twitter.com/Dinosn/status/1571734476148858880) - - [Experts warn of critical flaws in Flexlan devices that provide WiFi on airplanes](https://twitter.com/Dinosn/status/1571734437456388099) -- SecWiki News - - [SecWiki News 2022-09-19 Review](http://www.sec-wiki.com/?2022-09-19) -- unSafe.sh - 不安全 - - [goby指纹提取与yara逆向.md](https://buaq.net/go-127253.html) - - [X康防火墙RCE分析](https://buaq.net/go-127254.html) -- Chromium Blog - - [Announcing the Launch of the Chrome Root Program](http://blog.chromium.org/2022/09/announcing-launch-of-chrome-root-program.html) -- 先知安全技术社区 - - [goby指纹提取与yara逆向.md](https://xz.aliyun.com/t/11701) - - [X康防火墙RCE分析](https://xz.aliyun.com/t/11704) - - [记一次较为详细的某CMS代码审计](https://xz.aliyun.com/t/11714) -- paper - Last paper - - [针对U盘文件的盗与防攻略](https://paper.seebug.org/1972/) - - [黑客在 Microsoft Edge 新闻源页面投放技术诈骗广告](https://paper.seebug.org/1971/) -- Recent Commits to cve:main - - [Update Mon Sep 19 10:11:50 UTC 2022](https://github.com/trickest/cve/commit/f0b13ef483c3064aa1c492d88214eeb08b77d4a3) -- Sploitus.com Exploits RSS Feed - - [Owlfiles File Manager 12.0.1 Path Traversal / Local File Inclusion exploit](https://sploitus.com/exploit?id=PACKETSTORM:168414&utm_source=rss&utm_medium=rss) - - [OpenCart 3.x Newsletter Custom Popup 4.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168412&utm_source=rss&utm_medium=rss) - - [WordPress GetYourGuide Ticketing 1.0.1 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37971&utm_source=rss&utm_medium=rss) - - [Social Share Buttons 2.2.3 SQL injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37972&utm_source=rss&utm_medium=rss) - - [Owlfiles File Manager 12.0.1 Path Traversal / Local File Inclusion Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-37967&utm_source=rss&utm_medium=rss) - - [VIAVIWEB Wallpaper Admin SQL Injection / Shell Upload Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-37966&utm_source=rss&utm_medium=rss) - - [PhotoSync 4.7 Local File Inclusion Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37968&utm_source=rss&utm_medium=rss) - - [Genesys PureConnect Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37970&utm_source=rss&utm_medium=rss) - - [OpenCart 3.x Newsletter Custom Popup 4.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37969&utm_source=rss&utm_medium=rss) - - [PhotoSync 4.7 Local File Inclusion exploit](https://sploitus.com/exploit?id=PACKETSTORM:168415&utm_source=rss&utm_medium=rss) - - [VIAVIWEB Wallpaper Admin SQL Injection / Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168419&utm_source=rss&utm_medium=rss) - - [WordPress GetYourGuide Ticketing 1.0.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168411&utm_source=rss&utm_medium=rss) - - [Genesys PureConnect Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168410&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Initialization in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=BB30BDE6-E8F6-5ECC-9BF0-0D35F0A1FA7A&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=D91040D5-0198-5447-9A80-6E82D8023302&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Atlassian Bitbucket exploit](https://sploitus.com/exploit?id=93E1AD8B-C5DE-5A5E-86E3-5BDFA59A047A&utm_source=rss&utm_medium=rss) -- 安全脉搏 - - [户外服装品牌TheNorthFace遭遇撞库 撞库究竟如何成功窃取账户信息](https://www.secpulse.com/archives/187277.html) -- 安全客-有思想的安全新媒体 - - [CVE-2022-22963 SpringCloud Function SpEL注入漏洞分析](https://www.anquanke.com/post/id/280278) - - [TeamTNT劫持服务器，运行比特币加密解算器](https://www.anquanke.com/post/id/280364) - - [越南情侣黑客为找乐，删洲际酒店集团数据库](https://www.anquanke.com/post/id/280372) - - [黑客公布PS4、PS5主机永久破解漏洞：索尼无法修复](https://www.anquanke.com/post/id/280358) - - [数字安全观察每周简报【政策消息篇】2022.08.31-2022.09.06](https://www.anquanke.com/post/id/280066) - - [《GTA6》源代码泄露，黑客要价5位数已有人付款!](https://www.anquanke.com/post/id/280344) - - [18岁少年黑进Uber，攻破内部系统盗取漏洞报告](https://www.anquanke.com/post/id/280337) - - [黑客曝特斯拉拥有可疑代码：或用于碰撞测试作弊](https://www.anquanke.com/post/id/280328) - - [DPC攻击事件分析](https://www.anquanke.com/post/id/280257) - - [朝鲜黑客部署木马版PuTTY SSH盯上媒体](https://www.anquanke.com/post/id/280315) -- Envato Tuts+ Code - Mobile Development - - [Android From Scratch: Understanding Views And View Groups](https://code.tutsplus.com/tutorials/android-from-scratch-understanding-views-and-view-groups--cms-26043) -- 先知安全技术社区 - - [goby指纹提取与yara逆向.md](https://xz.aliyun.com/t/11701) - - [X康防火墙RCE分析](https://xz.aliyun.com/t/11704) - - [记一次较为详细的某CMS代码审计](https://xz.aliyun.com/t/11714) -- 跳跳糖 - 安全与分享社区 - - [MacOS 水坑攻击组合拳分析复现](https://tttang.com/archive/1745/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [XCon2022为技·敢破||破以入光，逆浪生长！——XCon2022在京成功举办](https://www.4hou.com/posts/kMVx) - - [LastPass开发者系统遭到黑客攻击，源代码被盗](https://www.4hou.com/posts/q8p2) - - [中国IPv6“高速公路“全面建成，IANA被管理权限移交，IP地址管理何去何从](https://www.4hou.com/posts/YXBp) -- Bug Bounty in InfoSec Write-ups on Medium - - [How I abused the file upload function to get a high severity vulnerability in Bug Bounty](https://infosecwriteups.com/how-i-abused-the-file-upload-function-to-get-a-high-severity-vulnerability-in-bug-bounty-7cdcf349080b?source=rss----7b722bfd1b8d--bug_bounty) - - [How I Found My FIRST Vulnerability/Bug Bounty and How You Can Too: Part 2](https://infosecwriteups.com/how-i-found-my-first-vulnerability-bug-bounty-and-how-you-can-too-part-2-2e8681f4e3b7?source=rss----7b722bfd1b8d--bug_bounty) - - [How I Found My FIRST Vulnerability/Bug Bounty and How You Can Too: Part 1](https://infosecwriteups.com/how-i-found-my-first-vulnerability-bug-bounty-and-how-you-can-too-part-1-f2dd0b7d7665?source=rss----7b722bfd1b8d--bug_bounty) - - [Cool Recon techniques every hacker misses! Episode 2](https://infosecwriteups.com/cool-recon-techniques-every-hacker-misses-episode-2-8024e8338756?source=rss----7b722bfd1b8d--bug_bounty) -- Twitter @bytehx - - [RT 𝚛𝚎𝚣𝟶: Have a file upload that only accepts images? Try this imagetragick payload: %!PS userdict /setpagedevice undef save legal { null ...](https://twitter.com/rez0__/status/1571913355761426432) - - [RT Ben Sadeghipour: This is how a hacker (nojob) was able to find a vulnerability in @port_finance and collect a bounty worth over $600,000 through @i...](https://twitter.com/NahamSec/status/1571879545686593537) - - [RT Henry Chen: CVE-2022-36804 Bitbucket Server RCE](https://twitter.com/chybeta/status/1571772438433910787) - - [RT ϻг_ϻε: Actually it looks like @b1u3r already found the same JNDI ObjectFactory RCE technique as me. Awesome work dude! Read about it here:](https://twitter.com/steventseeley/status/1571675512229212160) -- Securelist - - [External attack surface and ongoing cybercriminal activity in APAC region](https://securelist.com/external-attack-surface-and-ongoing-cybercriminal-activity-in-apac-region/107430/) -- MALware FORensics SECurity - - [Tactics, the killer of YOLO command lines?](http://malforsec.blogspot.com/2022/09/tactics-killer-of-yolo-command-lines.html) -- SentinelOne - - [CISO Wins | A 5-Phase Ramp up Strategy for Success on a New Job](https://www.sentinelone.com/blog/ciso-wins-a-5-phase-ramp-up-strategy-for-success-on-a-new-job/) -- SAP Blogs - - [Support Spotlight: Service Landscape Directory. Find the solution with Guided Answers.](https://blogs.sap.com/2022/09/19/support-spotlight-service-landscape-directory.-find-the-solution-with-guided-answers./) - - [SAP PaPM Cloud Integration with SAP BW](https://blogs.sap.com/2022/09/19/sap-papm-cloud-integration-with-sap-bw/) - - [New SAP Signavio research explores the whys and hows of digitalizing cash management](https://blogs.sap.com/2022/09/19/new-sap-signavio-research-explores-the-whys-and-hows-of-digitalizing-cash-management/) - - [CloudFoundry – Lost or Missing OrgManager](https://blogs.sap.com/2022/09/19/cloudfoundry-lost-or-missing-orgmanager/) - - [How To Configure LIFO Picking In SAP Warehouse Management](https://blogs.sap.com/2022/09/19/how-to-configure-lifo-picking-in-sap-warehouse-management/) - - [Basic Transportation Management. Integrated, transparent and efficient logistics execution.](https://blogs.sap.com/2022/09/19/basic-transportation-management.-integrated-transparent-and-efficient-logistics-execution./) - - [Kostenfreies Webseminar: SAP Data Warehouse Cloud & SAP BW Bridge: Hybride Modell-Szenarien](https://blogs.sap.com/2022/09/19/kostenfreies-webseminar-sap-data-warehouse-cloud-sap-bw-bridge-hybride-modell-szenarien/) - - [How to Create RAP Business Events in SAP BTP ABAP Environment](https://blogs.sap.com/2022/09/19/how-to-create-rap-business-events-in-sap-btp-abap-environment/) - - [Pass dynamic table as reference out of method](https://blogs.sap.com/2022/09/19/pass-dynamic-table-as-reference-out-of-method/) -- Didier Stevens - - [Update: strings.py Version 0.0.8](https://blog.didierstevens.com/2022/09/19/update-strings-py-version-0-0-8/) -- Malwarebytes Labs - - [EDR vs MDR vs XDR – What’s the Difference?](https://www.malwarebytes.com/blog/business/2022/09/edr-vs-mdr-vs-xdr--whats-the-difference) - - [Hookup site targeted by typo-squatters](https://www.malwarebytes.com/blog/news/2022/09/contact-site-subject-of-typo-squatting-for-dubious-advertising-extensions-and-fake-warnings) - - [A week in security (September 12 – 18)](https://www.malwarebytes.com/blog/news/2022/09/a-week-in-security-september-12--18) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/xi4kb0/rreverseengineerings_weekly_questions_thread/) -- The Daily Swig | Cybersecurity news and views - - [‘Security teams often fight against developers taking control’ of AppSec: Tanya Janca on the drive to DevSecOps adoption](https://portswigger.net/daily-swig/security-teams-often-fight-against-developers-taking-control-of-appsec-tanya-janca-on-the-drive-to-devsecops-adoption) -- 安全牛 - - [重庆大学×深信服：要得，安全运营巴适的板！](https://www.aqniu.com/industry/89244.html) - - [直播预告 | 网安大讲堂（44期）：高级Web安全专家（OSWE）认证介绍（三）](https://www.aqniu.com/homenews/89237.html) - - [安全头条 |工信部组织征集2022年移动物联网应用典型案例；奇安信发布流量解密编排器](https://www.aqniu.com/homenews/89238.html) - - [现代企业必备的9种网络安全能力](https://www.aqniu.com/hometop/89239.html) - - [XCTF高校网络安全专题挑战赛 | 总决赛圆满落幕！](https://www.aqniu.com/vendor/89198.html) - - [ChainAegis链上分析：以太坊合并后，中心化风险是否加剧？](https://www.aqniu.com/vendor/89196.html) - - [数字引领医疗，安芯网盾CEO姜向前提出基于内存保护创造网络攻防“疫苗”](https://www.aqniu.com/vendor/89195.html) - - [客户更青睐什么样的安全托管服务？](https://www.aqniu.com/industry/89199.html) - - [网络安全守护计划 | 重保不必“007”，也能7*24H安全无忧！](https://www.aqniu.com/industry/89197.html) - - [梆梆安全构建电子政务移动安全主动防御体系入选《2022年网络安全优秀创新成果大赛专刊》](https://www.aqniu.com/vendor/89190.html) -- Akkuman 的博客 - - [xp 兼容的 go-sciter](//hacktech.cn/2022/09/19/go-sciter-xp/) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（2022.09.12-2022.09.18）](http://blog.nsfocus.net/weeklyreport38/) -- 体验盒子 - - [flutter获取debug证书信息SHA1](https://www.uedbox.com/post/68536/) - - [Flutter 3：如何扩展 ThemeData](https://www.uedbox.com/post/68529/) - - [如何使用 Provider 在 Flutter 中创建动态主题](https://www.uedbox.com/post/68526/) - - [如何将 Flutter 应用主题默认设置为深色暗黑？](https://www.uedbox.com/post/68520/) -- 倾旋的博客 - - [我的三年红队生涯总结](https://payloads.online/archivers/2022-09-19/1/) -- KitPloit - PenTest & Hacking Tools - - [CATS - REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints](http://www.kitploit.com/2022/09/cats-rest-api-fuzzer-and-negative.html) -- 黑海洋 - WIKI - - [羊了个羊快捷版_2.0【自定义通关次数、加入羊群、免抓包、输入自己ID即可】](https://blog.upx8.com/2989) -- 博客园 - 郑瀚Andrew - - [关于云计算、云安全、业务规划方面的若干重新思考 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16702176.html) -- 奇客Solidot–传递最新科技情报 - - [毅力号漫游车在火星上发现丰富有机物](https://www.solidot.org/story?sid=72811) - - [研究显示纳米塑料如何损伤人类肝脏和肺细胞](https://www.solidot.org/story?sid=72810) - - [重庆出现首例输入性猴痘病例](https://www.solidot.org/story?sid=72809) - - [Google 和 Meta 的广告帝国正面临挑战](https://www.solidot.org/story?sid=72808) - - [日本勒索软件攻击数量大幅增长](https://www.solidot.org/story?sid=72807) - - [黑客以 1 万美元出售 GTA V 源代码和素材](https://www.solidot.org/story?sid=72806) - - [Avast 收购流行扩展 I don't care about cookies](https://www.solidot.org/story?sid=72805) - - [GPS 干扰器被用于劫持卡车和干扰无人机](https://www.solidot.org/story?sid=72804) - - [中国半导体市场受到经济衰退的影响](https://www.solidot.org/story?sid=72803) - - [中国工厂加快自动化](https://www.solidot.org/story?sid=72802) - - [新锂金属电池在实验室中能 3 分钟充满电](https://www.solidot.org/story?sid=72801) - - [台湾连续两天发生 6 级以上地震](https://www.solidot.org/story?sid=72800) - - [黑客泄露 GTA6 测试视频](https://www.solidot.org/story?sid=72799) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 三分之一企业未加密云端敏感数据；美驻华使领馆过度采集中方雇员信息](https://www.freebuf.com/news/344893.html) - - [碰撞测试作弊假？黑客曝光特斯拉使用“特殊代码”](https://www.freebuf.com/news/344842.html) - - [“泄露”的咖啡！黑客出售近22万名新加坡星巴克顾客数据](https://www.freebuf.com/news/344836.html) - - [公有云攻防系列——云服务利用篇](https://www.freebuf.com/articles/blockchain-articles/344831.html) - - [FreeBuf早报 | 美成立专门机构打击加密货币犯罪；洲际酒店遭黑客破坏性攻击](https://www.freebuf.com/articles/344823.html) -- 雷神众测 - - [雷神众测漏洞周报2022.09.13-2022.09.18-4](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652499819&idx=1&sn=796b70af8f78e533b8336ad39c1c6f69&chksm=f2584cd8c52fc5cee0b21e61cbd7db0c63e6d11d7f51677dad213a8f3a340dba1754bd4bafe8&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [黑产团伙是如何窃取你的快递信息的](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247491707&idx=1&sn=a702ddf517ac992dfadd9a177b4849e5&chksm=ec699053db1e1945dddb9cf72f2aa27c8d09b9bd1debe37113bcf6e00a21ef3e92ae23bb0aaa&scene=58&subscene=0#rd) -- HackerNews - - [Chrome / Edge 中拼写检查功能或导致用户个人信息失窃](https://hackernews.cc/archives/41563) - - [“泄露”的咖啡！黑客出售近 22 万名新加坡星巴克顾客数据](https://hackernews.cc/archives/41560) - - [碰撞测试作弊假？黑客曝光特斯拉使用“特殊代码”](https://hackernews.cc/archives/41557) - - [Netgear 路由器受到 FunJSQ 游戏加速模块漏洞的影响](https://hackernews.cc/archives/41551) - - [谷歌 Meta 未经同意跨平台收集信息，韩国开一千亿最大罚单](https://hackernews.cc/archives/41547) - - [LastPass 表示在检测并驱逐前，黑客访问内部系统已有 4 天](https://hackernews.cc/archives/41544) -- 58安全应急响应中心 - - [开源 | antenna-tools 更方便的chrome扩展](https://mp.weixin.qq.com/s?__biz=MzU4NTMzNjU4Mw==&mid=2247489253&idx=1&sn=7d31e68eb3ae1a3235fc6f04c3920d3f&chksm=fd8d448dcafacd9b48e566de0f86678d549763dff13edb4a2619f3a34fcbc64cffa8a70c4d67&scene=58&subscene=0#rd) -- 情报分析师 - - [【地缘情报】印度相关资料大汇总](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650516578&idx=1&sn=802c3278f8f1fedff49f1c2b21a86916&chksm=87168229b0610b3f7e3fbaffd2a44c41f2a8788a362e6e7a733a148d9bcbf271d78563fed413&scene=58&subscene=0#rd) - - [揭秘TAO：美国国家安全局APT-C-40黑客组织幕后黑手](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650516578&idx=2&sn=fd04f561485e3446bd8ea066b61d39a9&chksm=87168229b0610b3f6f4e3fc3602f064a262684c43036839893d468db266adc707e07f27ccbe0&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】如何利用API对AI发动攻击？](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649777771&idx=1&sn=d64c31888144715eeeb8e16e8fe72146&chksm=88935604bfe4df12aa6ced7562701c1a61dd5c59aa3867372ac9960c41f10c308d932034bb4b&scene=58&subscene=0#rd) - - [【安全头条】朝鲜黑客部署木马版PuTTY SSH盯上媒体](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649777771&idx=2&sn=04a772ca9f10c4fd531c842f36210b07&chksm=88935604bfe4df12d4d9088e594222366a331a6a66952cdf14705659eee3f67ecb3ac8cd5e27&scene=58&subscene=0#rd) -- Beacon Tower Lab - - [某知名系统漏洞挖掘与利用思路探索](https://mp.weixin.qq.com/s?__biz=MzkzNjMxNDM0Mg==&mid=2247485389&idx=1&sn=b2f35e1b9509f99a6cc415626cac88f3&chksm=c2a1d344f5d65a52084fe7bb79b631f63310bc91ad7d024d314b1b673d0e732411d10dc9adc9&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-21.md b/archive/2022/2022-09-21.md deleted file mode 100644 index 0d3329e209..0000000000 --- a/archive/2022/2022-09-21.md +++ /dev/null @@ -1,231 +0,0 @@ -# 每日安全资讯（2022-09-21） - -- Security Boulevard - - [What I Need to be a SOC Rock Star](https://securityboulevard.com/2022/09/what-i-need-to-be-a-soc-rock-star/) - - [Moving from Insider Risk to Insider Threat: Disgruntled Employees and Looming Layoffs](https://securityboulevard.com/2022/09/moving-from-insider-risk-to-insider-threat-disgruntled-employees-and-looming-layoffs/) - - [Ahmed Masud Chats about Innovative Ways to Combat Ransomware and Protect Data](https://securityboulevard.com/2022/09/ahmed-masud-chats-about-innovative-ways-to-combat-ransomware-and-protect-data/) - - [BSidesLV 2022 Lucky13 BreakingGround – Amanda Walker’s ‘Keynote – Beyond Logs And Time Series: Observability For Security & Privacy’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-breakingground-amanda-walkers-keynote-beyond-logs-and-time-series-observability-for-security-privacy/) - - [Why WireGuard is Better than IPsec and SSL for ZTNA](https://securityboulevard.com/2022/09/why-wireguard-is-better-than-ipsec-and-ssl-for-ztna/) - - [Celebrating Sonatypers](https://securityboulevard.com/2022/09/celebrating-sonatypers/) - - [Situational Awareness in Russia: Neo-Nazi Mercenary Groups, PMCs, and Illicit Financing](https://securityboulevard.com/2022/09/situational-awareness-in-russia-neo-nazi-mercenary-groups-pmcs-and-illicit-financing/) - - [The Role of API Security in Digital Transformation](https://securityboulevard.com/2022/09/the-role-of-api-security-in-digital-transformation/) - - [XKCD ‘Interruption’](https://securityboulevard.com/2022/09/xkcd-interruption/) -- Files ≈ Packet Storm - - [Zeek 5.0.2](https://packetstormsecurity.com/files/168436/zeek-5.0.2.tar.gz) - - [Ubuntu Security Notice USN-5619-1](https://packetstormsecurity.com/files/168435/USN-5619-1.txt) - - [Arm Mali CSF Missing Buffer Size Check](https://packetstormsecurity.com/files/168434/GS20220920141716.tgz) - - [Arm Mali Race Condition](https://packetstormsecurity.com/files/168433/GS20220920141404.tgz) - - [Arm Mali Physical Address Exposure](https://packetstormsecurity.com/files/168432/GS20220920141211.tgz) - - [Arm Mali Released Buffer Use-After-Free](https://packetstormsecurity.com/files/168431/GS20220920140731.tgz) - - [Backdoor.Win32.Hellza.120 MVID-2022-0641 Remote Command Execution](https://packetstormsecurity.com/files/168430/MVID-2022-0641.txt) - - [Backdoor.Win32.Hellza.120 MVID-2022-0642 Authentication Bypass](https://packetstormsecurity.com/files/168429/MVID-2022-0642.txt) - - [Blink1Control2 2.2.7 Weak Password Encryption](https://packetstormsecurity.com/files/168428/blink1control2227-insecure.txt) - - [ProcessMaker Privilege Escalation](https://packetstormsecurity.com/files/168427/Processmaker-PoC-by-Sornram9254.py.txt) - - [Red Hat Security Advisory 2022-6537-01](https://packetstormsecurity.com/files/168426/RHSA-2022-6537-01.txt) - - [Buffalo TeraStation Network Attached Storage (NAS) 1.66 Authentication Bypass](https://packetstormsecurity.com/files/168425/buffalotsnas166-bypass.txt) - - [Trojan.Ransom.Ryuk.A MVID-2022-0640 Code Execution](https://packetstormsecurity.com/files/168424/MVID-2022-0640.txt) - - [Bookwyrm 0.4.3 Authentication Bypass](https://packetstormsecurity.com/files/168423/bookwyrm043-bypass.txt) - - [Trojan-Dropper.Win32.Corty.10 MVID-2022-0639 Insecure Credential Storage](https://packetstormsecurity.com/files/168422/MVID-2022-0639.txt) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [PhotoSync 4.7 Local File Inclusion](https://cxsecurity.com/issue/WLB-2022090056) - - [WordPress GetYourGuide Ticketing 1.0.1 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090055) - - [Owlfiles File Manager 12.0.1 Path Traversal / Local File Inclusion](https://cxsecurity.com/issue/WLB-2022090054) - - [ProcessMaker Privilege Escalation](https://cxsecurity.com/issue/WLB-2022090053) - - [Blink1Control2 2.2.7 Weak Password Encryption](https://cxsecurity.com/issue/WLB-2022090052) - - [Bookwyrm 0.4.3 Authentication Bypass](https://cxsecurity.com/issue/WLB-2022090051) - - [Trojan-Dropper.Win32.Corty.10 / Insecure Credential Storage](https://cxsecurity.com/issue/WLB-2022090050) - - [Backdoor.Win32.Hellza.120 / Authentication Bypass](https://cxsecurity.com/issue/WLB-2022090049) - - [Backdoor.Win32.Hellza.120 / Unauthorized Remote Command Execution](https://cxsecurity.com/issue/WLB-2022090048) - - [Trojan.Ransom.Ryuk.A / Arbitrary Code Execution](https://cxsecurity.com/issue/WLB-2022090047) -- Microsoft Security Blog - - [New Windows 11 security features are designed for hybrid work](https://www.microsoft.com/security/blog/2022/09/20/new-windows-11-security-features-are-designed-for-hybrid-work/) -- SecWiki News - - [SecWiki News 2022-09-20 Review](http://www.sec-wiki.com/?2022-09-20) -- 先知安全技术社区 - - [对writeObject流程动点手脚](https://xz.aliyun.com/t/11720) - - [关于"linux capability"的两个特殊案例](https://xz.aliyun.com/t/11716) - - [GenieACS CVE-2021-46704认证前RCE漏洞分析](https://xz.aliyun.com/t/11722) -- Sploitus.com Exploits RSS Feed - - [Bookwyrm v0.4.3 - Authentication Bypass Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37974&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Hellza.120 MVID-2022-0642 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:168429&utm_source=rss&utm_medium=rss) - - [Trojan-Dropper.Win32.Corty.10 MVID-2022-0639 Insecure Credential Storage exploit](https://sploitus.com/exploit?id=PACKETSTORM:168422&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Hellza.120 MVID-2022-0641 Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168430&utm_source=rss&utm_medium=rss) - - [Trojan.Ransom.Ryuk.A MVID-2022-0640 Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168424&utm_source=rss&utm_medium=rss) - - [Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37973&utm_source=rss&utm_medium=rss) - - [Bookwyrm 0.4.3 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:168423&utm_source=rss&utm_medium=rss) - - [Blink1Control2 2.2.7 - Weak Password Encryption Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37975&utm_source=rss&utm_medium=rss) - - [Blink1Control2 2.2.7 Weak Password Encryption exploit](https://sploitus.com/exploit?id=PACKETSTORM:168428&utm_source=rss&utm_medium=rss) - - [ProcessMaker Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:168427&utm_source=rss&utm_medium=rss) - - [Buffalo TeraStation Network Attached Storage (NAS) 1.66 Authentication Bypass exploit](https://sploitus.com/exploit?id=PACKETSTORM:168425&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Atlassian Bitbucket exploit](https://sploitus.com/exploit?id=2F640351-5EB0-5CEE-9708-5FBA0CA9E296&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Apache Http Server exploit](https://sploitus.com/exploit?id=CF47F8BF-37F7-5EF9-ABAB-E88ECF6B64FE&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [White House Statement On Cryptocurrency Regulation](https://twitter.com/Dinosn/status/1572274081608925184) - - [Game dev 2K’s support site hacked to push malware via fake tickets](https://twitter.com/Dinosn/status/1572273996015742977) - - [Bitbucket RCE analysis,](https://twitter.com/Dinosn/status/1572233732366700544) - - [Grand Theft Auto 6 Maker Confirms Source Code, Vids Stolen In Cyber-Heist](https://twitter.com/Dinosn/status/1572233033712795649) - - [ChromeLoader Can Overload Systems With Malware](https://twitter.com/Dinosn/status/1572232999823118337) - - [Kam1n0 - Assembly Analysis Platform](https://twitter.com/Dinosn/status/1572228329822126081) - - [Microsoft Defender for Endpoint will turn on tamper protection by default](https://twitter.com/Dinosn/status/1572228216831483906) - - [Credit Card Fraud That Bypasses 2FA](https://twitter.com/Dinosn/status/1572201504102023173) - - [Vulnerabilities Identified in EZVIZ Smart Cams](https://twitter.com/Dinosn/status/1572194763880935424) - - [CVE-2022-3239: Linux Kernel Privilege Escalation Vulnerability](https://twitter.com/Dinosn/status/1572173789286526977) - - [TripleCross: Linux eBPF rootkit](https://twitter.com/Dinosn/status/1572160490201313280) - - [DNS Zone Takeovers - Short Walkthrough](https://twitter.com/Dinosn/status/1572092766632677377) -- paper - Last paper - - [404星链计划 | 新收录3个安全团队的开源工具！速看！](https://paper.seebug.org/1974/) - - [CVE-2021-34866 Linux 内核提权漏洞分析](https://paper.seebug.org/1973/) -- unSafe.sh - 不安全 - - [对writeObject流程动点手脚](https://buaq.net/go-127424.html) - - [关于"linux capability"的两个特殊案例](https://buaq.net/go-127425.html) - - [GenieACS CVE-2021-46704认证前RCE漏洞分析](https://buaq.net/go-127426.html) - - [Abusing Broken Link In Fitbit (Google Acquisition)To Collect BugBounty Reports On Behalf Of Google !](https://buaq.net/go-127411.html) - - [Kiwi Farms breached, user data potentially exposed](https://buaq.net/go-127461.html) - - [r35tart/RW_Password: 此项目用来提取收集以往泄露的密码中符合条件的强弱密码](https://buaq.net/go-127407.html) - - [Out Of Band Update: Cobalt Strike 4.7.1](https://buaq.net/go-127406.html) - - [American Airlines suffers data breach after phishing incident](https://buaq.net/go-127462.html) - - [A vulnerability in the way Linux handles the CLOCK_THREAD_CPUTIME_ID allows local attackers to reach a race condition and use this to elevate their privileges to root](https://buaq.net/go-127403.html) - - [Enhancing Zero Day Protection for Organizations Across the Globe](https://buaq.net/go-127410.html) - - [FreeBuf早报 | 优步深陷数据泄露泥潭；印度尼西亚通过《数据隐私法》](https://buaq.net/go-127460.html) -- 安全客-有思想的安全新媒体 - - [黑客组织Sandworm冒充电信提供商攻击乌克兰实体](https://www.anquanke.com/post/id/280464) - - [Microsoft 365网络钓鱼攻击冒充美国政府机构](https://www.anquanke.com/post/id/280461) - - [B站基于Clickhouse的下一代日志体系建设实践](https://www.anquanke.com/post/id/280350) - - [欧洲刑警组织发布免费LockerGoga 勒索软件解密器！](https://www.anquanke.com/post/id/280468) - - [再活跃！Emotet僵尸网络分发Quantum和BlackCat勒索软件](https://www.anquanke.com/post/id/280369) - - [针对Uber被黑客攻击事件的简单分析](https://www.anquanke.com/post/id/280444) - - [数字安全观察每周简报【安全事件篇】2022.09.07-2022.09.13](https://www.anquanke.com/post/id/280398) - - [数字化新业态下数据安全创新-token化](https://www.anquanke.com/post/id/280321) - - [日本上半年“勒索病毒”受害114起，同比增加8成](https://www.anquanke.com/post/id/280452) - - [Revolut遭黑客入侵，0.16% 的客户数据被暴露](https://www.anquanke.com/post/id/280445) -- Tenable Blog - - [Finally Finding the 'Unknown Unknowns' Across Your Entire Attack Surface](https://www.tenable.com/blog/finally-finding-the-unknown-unknowns-across-your-entire-attack-surface) -- 安全脉搏 - - [实战绕过某WAF+拿shell组合拳](https://www.secpulse.com/archives/187347.html) - - [【绿盟科技】2023届校园招聘正式启动 搜寻未来网安英雄](https://www.secpulse.com/archives/187287.html) - - [nps之Socks流量分析以及未授权复现](https://www.secpulse.com/archives/187307.html) - - [渗透常用数据库综合利用工具](https://www.secpulse.com/archives/187297.html) - - [【漏洞预警】vm2沙箱逃逸漏洞](https://www.secpulse.com/archives/187290.html) -- bunnie's blog - - [Book Review: Open Circuits](https://www.bunniestudios.com/blog/?p=6558) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [嘶吼专访 | 融安网络创始人陈桂耀：创业是一条通往山顶的路，你只能上，不能下](https://www.4hou.com/posts/wg8w) - - [Uber被黑：内部系统数据泄露、漏洞报告被窃](https://www.4hou.com/posts/pV61) - - [某知名系统漏洞挖掘与利用思路探索](https://www.4hou.com/posts/EQ7N) - - [北信源持续领跑终端安全管理市场，累计15年位居中国终端安全管理市场占有率第一！](https://www.4hou.com/posts/O92g) -- obaby@mars - - [GAY 免费域名](http://h4ck.org.cn/2022/09/gay-%e5%85%8d%e8%b4%b9%e5%9f%9f%e5%90%8d/) -- Forcepoint - - [Enhancing Zero Day Protection for Organizations Across the Globe](https://www.forcepoint.com/blog/insights/enhancing-zero-day-protection-webinar-29-september) -- 跳跳糖 - 安全与分享社区 - - [零基础要如何破除 IO_FILE 利用原理的迷雾](https://tttang.com/archive/1742/) -- Bug Bounty in InfoSec Write-ups on Medium - - [How I Hacked my College’s student portal](https://infosecwriteups.com/how-i-hacked-my-colleges-student-portal-f51775d75a3d?source=rss----7b722bfd1b8d--bug_bounty) - - [Bypassing CSRF Protection (I)](https://infosecwriteups.com/bypassing-csrf-protection-i-bc014384d0aa?source=rss----7b722bfd1b8d--bug_bounty) - - [Abusing Broken Link In Fitbit (Google Acquisition)To Collect BugBounty Reports On Behalf Of Google !](https://infosecwriteups.com/abusing-broken-link-in-fitbit-google-acquisition-to-collect-bugbounty-reports-on-behalf-of-google-5885a556eb7c?source=rss----7b722bfd1b8d--bug_bounty) - - [Cross-site request forgery (CSRF) Explained and Exploited I](https://infosecwriteups.com/cross-site-request-forgery-csrf-explained-and-exploited-i-db464a61a582?source=rss----7b722bfd1b8d--bug_bounty) -- blog.avast.com EN - - [How Uber was hacked — again](https://blog.avast.com/uber-hack) - - [Is Free Wi-Fi Really Safe? | Avast](https://blog.avast.com/is-free-wi-fi-really-safe-avast) -- SAP Blogs - - [Increase the potential of your business – Best practices to capture, nurture and convert business leads](https://blogs.sap.com/2022/09/20/increase-the-potential-of-your-business-best-practices-to-capture-nurture-and-convert-business-leads/) - - [Fieldglass Features: #7 Sending Job postings to suppliers – cut your sourcing cycle times](https://blogs.sap.com/2022/09/20/fieldglass-features-7-sending-job-postings-to-suppliers-cut-your-sourcing-cycle-times/) - - [Managing technical users for BTP platform access](https://blogs.sap.com/2022/09/20/managing-technical-users-for-btp-platform-access/) - - [Basic QM setup with Usage Decision only and with least QM master data](https://blogs.sap.com/2022/09/20/basic-qm-setup-with-usage-decision-only-and-with-least-qm-master-data/) - - [Integration: The Critical Path to Rapid Innovation](https://blogs.sap.com/2022/09/20/integration-the-critical-path-to-rapid-innovation/) - - [Accelerating Aerospace organizational innovation, speed and resilience with Digital Technologies](https://blogs.sap.com/2022/09/20/accelerating-aerospace-organizational-innovation-speed-and-resilience-with-digital-technologies/) - - [Scan Business Card to Business Partner](https://blogs.sap.com/2022/09/20/scan-business-card-to-business-partner/) - - [Everything you need to know about MRP Areas in S/4HANA](https://blogs.sap.com/2022/09/20/everything-you-need-to-know-about-mrp-areas-in-s-4hana/) -- Malwarebytes Labs - - [Kiwi Farms breached, user data potentially exposed](https://www.malwarebytes.com/blog/news/2022/09/kiwifarms-breached-user-data-potentially-exposed) - - [American Airlines suffers data breach after phishing incident](https://www.malwarebytes.com/blog/news/2022/09/american-airlines-suffers-data-breach-after-phishing-incident) - - [Grand Theft Auto 6 suffers grand theft](https://www.malwarebytes.com/blog/news/2022/09/grand-theft-auto-6-suffers-grand-theft) -- Didier Stevens - - [Update: My Python Templates Version 0.0.8](https://blog.didierstevens.com/2022/09/20/update-my-python-templates-version-0-0-8/) -- Sucuri Blog - - [A Guide to Virtual Patching for Website Vulnerabilities](https://blog.sucuri.net/2022/09/a-guide-to-virtual-patching-for-website-vulnerabilities.html) -- Sucuri Blog - - [A Guide to Virtual Patching for Website Vulnerabilities](https://blog.sucuri.net/2022/09/a-guide-to-virtual-patching-for-website-vulnerabilities.html) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Exposing a Compilation of Known Ransomware Group's Dark Web Onion Web Sites - An OSINT Analysis - Part Two](https://ddanchev.blogspot.com/2022/09/exposing-compilation-of-known.html) -- 先知安全技术社区 - - [对writeObject流程动点手脚](https://xz.aliyun.com/t/11720) - - [关于"linux capability"的两个特殊案例](https://xz.aliyun.com/t/11716) - - [GenieACS CVE-2021-46704认证前RCE漏洞分析](https://xz.aliyun.com/t/11722) -- The Daily Swig | Cybersecurity news and views - - [Parse Server fixes brute-forcing bug that put sensitive user data at risk](https://portswigger.net/daily-swig/parse-server-fixes-brute-forcing-bug-that-put-sensitive-user-data-at-risk) -- Reverse Engineering - - [A vulnerability in the way Linux handles the CLOCK_THREAD_CPUTIME_ID allows local attackers to reach a race condition and use this to elevate their privileges to root](https://www.reddit.com/r/ReverseEngineering/comments/xj834s/a_vulnerability_in_the_way_linux_handles_the/) -- Microsoft Security Response Center - - [Defense-in-Depth Updates for Azure Identity SDK and Azure Key Vault SDK plus Best Practice Implementation Guidance](https://msrc-blog.microsoft.com/2022/09/20/defense-in-depth-updates-for-azure-identity-sdk-and-azure-key-vault-sdk-plus-best-practice-implementation-guidance/) -- Exploit-DB.com RSS Feed - - [[local] Blink1Control2 2.2.7 - Weak Password Encryption](https://www.exploit-db.com/exploits/51014) - - [[webapps] Bookwyrm v0.4.3 - Authentication Bypass](https://www.exploit-db.com/exploits/51013) - - [[webapps] Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass](https://www.exploit-db.com/exploits/51012) - - [[remote] Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/51011) - - [[remote] Mobile Mouse 3.6.0.4 - Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/51010) -- 博客园 - nice_0e3 - - [VMware Carbon Black App Control漏洞分析 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16714250.html) -- KitPloit - PenTest & Hacking Tools - - [Kam1n0 - Assembly Analysis Platform](http://www.kitploit.com/2022/09/kam1n0-assembly-analysis-platform.html) -- Twitter @hakivvi - - [RT x86matthew: Exploiting a Seagate service to create a SYSTEM shell (CVE-2022-40286) A brief overview of reverse-engineering a Windows service to dis...](https://twitter.com/x86matthew/status/1572293283761758210) - - [RT Austin Hudson: Partially patched in July of 2022 unless someone knows of another way to reach CSRSS. Cheap admin-kernel boundary bug, still easily ...](https://twitter.com/ilove2pwn_/status/1572290530142310400) -- 绿盟科技技术博客 - - [2022年网络空间安全事件简析](http://blog.nsfocus.net/2022cyberspaceincidents-analysis/) -- HackerNews - - [安全公司 Bitdefender 无偿放出 LockerGoga 勒索软件解密器](https://hackernews.cc/archives/41593) - - [攻击者正冒充美国政府机构骗取承包商 Office 账户](https://hackernews.cc/archives/41588) - - [Rockstar Games 证实黑客窃取了《侠盗猎车手6》的早期片段](https://hackernews.cc/archives/41580) - - [Emotet 僵尸网络开始分发 Quantum 和 BlackCat 勒索软件](https://hackernews.cc/archives/41574) - - [Revolut 遭遇黑客入侵，少量用户数据被暴露](https://hackernews.cc/archives/41570) -- 安全牛 - - [“内网危机”直击企业要害 北信源筑牢企业内网安全高墙](https://www.aqniu.com/vendor/89292.html) - - [“网课爆破”频发，信源密信以“智”制“爆”，护航校园“云课堂”安全](https://www.aqniu.com/vendor/89293.html) - - [警惕以太坊合并后的重放攻击：Omni跨链桥被攻击事件分析](https://www.aqniu.com/vendor/89291.html) - - [XCon2022为技·敢破||破以入光，逆浪生长！——XCon2022在京成功举办](https://www.aqniu.com/vendor/89265.html) - - [北京大学陈钟：关键信息基础设施安全保护实践三点体会](https://www.aqniu.com/homenews/89264.html) - - [2022企业漏洞管理状况调查：7成企业缺乏有效的漏洞管理计划](https://www.aqniu.com/hometop/89263.html) - - [常态化疫情之下，工作秘密和个人隐私的保护 ——北信源对近期成都3起违反工作纪律失泄密案件的思考](https://www.aqniu.com/industry/89249.html) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 优步深陷数据泄露泥潭；印度尼西亚通过《数据隐私法》](https://www.freebuf.com/news/345041.html) - - [Rockstar Games遭黑客攻击，《侠盗猎车手6》90个开发视频外泄](https://www.freebuf.com/articles/game/344978.html) - - [无间道！ "沙虫 "组织冒充乌克兰电信公司投放恶意软件](https://www.freebuf.com/news/344955.html) - - [继北京健康宝后，澳门健康码又遭境外势力攻击](https://www.freebuf.com/articles/neopoints/344963.html) - - [这些观点掷地有声！FreeBuf网安智库说第四季圆满落幕](https://www.freebuf.com/articles/344951.html) - - [攻击者正冒充美国政府机构骗取承包商Office账户](https://www.freebuf.com/news/344938.html) - - [实战某高校的一次挖矿病毒的应急处置](https://www.freebuf.com/articles/web/344921.html) -- Blog - Praetorian - - [Developing a Hidden Virtual File System Capability That Emulates the Uroburos Rootkit](https://www.praetorian.com/blog/developing-a-vfs-that-emulates-uroburos-rootkit/) -- 体验盒子 - - [PHP/JAVA判断点是否在多边形区域围栏内](https://www.uedbox.com/post/68539/) -- 黑海洋 - WIKI - - [Another Redis Desktop Manager](https://blog.upx8.com/2992) - - [RedisView(Redis数据库图形化界面工具)](https://blog.upx8.com/2991) - - [yysms短信系统源码](https://blog.upx8.com/2990) -- 奇客Solidot–传递最新科技情报 - - [英伟达发布 GeForce RTX 40 系列显卡](https://www.solidot.org/story?sid=72825) - - [韩国求助国际刑警组织通缉 Do Kwon](https://www.solidot.org/story?sid=72824) - - [儿童每周会因为过度沉迷社交网络损失一个晚上的睡眠](https://www.solidot.org/story?sid=72823) - - [软件工程师做增高手术](https://www.solidot.org/story?sid=72822) - - [2021 年坠落在英国的陨石中发现水](https://www.solidot.org/story?sid=72821) - - [Rust 将进入 Linux 6.1](https://www.solidot.org/story?sid=72820) - - [国际象棋比赛现在就像打扑克牌](https://www.solidot.org/story?sid=72819) - - [Uber 将入侵归咎于一家承包商](https://www.solidot.org/story?sid=72818) - - [从下一代数据中心的角度，谈谈为何Web3终将到来](https://www.solidot.org/story?sid=72817) - - [研究估计地球有 2 万万亿只蚂蚁](https://www.solidot.org/story?sid=72816) - - [Unicode 15 发布](https://www.solidot.org/story?sid=72815) - - [抗议 Mahsa Amini 死亡伊朗部分地区短时间断网](https://www.solidot.org/story?sid=72814) - - [自称代表小型应用开发商的游说组织的最大金主是苹果](https://www.solidot.org/story?sid=72813) - - [退休工程师开发的二合一计算器应用意外火爆](https://www.solidot.org/story?sid=72812) -- 博客园 - 郑瀚Andrew - - [重启右脑 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16709783.html) -- OPPO安全应急响应中心 - - [技术分享 | 无监督算法在OPPO黑产团伙挖掘中的实践](https://mp.weixin.qq.com/s?__biz=MzUyNzc4Mzk3MQ==&mid=2247490323&idx=1&sn=f980aabe2f85b1b3706aad4fe4795bbb&chksm=fa7b1a5fcd0c9349b89344c09a21d1053f9915a17f9c9f3b03e68943672507ea27c6720ac830&scene=58&subscene=0#rd) - - [活动正式开启｜OSRC邀您加入双11安全保卫战](https://mp.weixin.qq.com/s?__biz=MzUyNzc4Mzk3MQ==&mid=2247490323&idx=2&sn=df22d7ff72ea0ed9580fc15b20c5d1da&chksm=fa7b1a5fcd0c9349caecd67c4d1440e7fce042517d9aab8a52c6b7fa305ff6b08254099b016d&scene=58&subscene=0#rd) -- 绿盟科技金融事业部 - - [数据安全助力金融行业数据要素化快速发展](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247492276&idx=1&sn=f47fa2ce9b4eeca28b878648c370629b&chksm=eaac71f3dddbf8e532e3c9f2b8f947e8b4e2790e771eff0790ec40215d772a27ab73c5dfbdd6&scene=58&subscene=0#rd) -- Yak Project - - [你们要的 [Yaklang websocket劫持]教程来了！](https://mp.weixin.qq.com/s?__biz=Mzk0MTM4NzIxMQ==&mid=2247490408&idx=1&sn=515ba1fda183bdcaccba35af1f49c4b4&chksm=c2d267ccf5a5eeda1267d1d5be0a3f73cb842658a349c92d45394cb3e5f80331b5b00364e200&scene=58&subscene=0#rd) -- 网安国际 - - [【网络安全研究进展系列】PalmTree：一种面向指令嵌入的汇编语言模型](https://mp.weixin.qq.com/s?__biz=MzA4ODYzMjU0NQ==&mid=2652311559&idx=1&sn=023d224749cd9593328ac0f3629c0570&chksm=8bc48d89bcb3049f7cc410a4a972c5f584d4bff57dbcf9896df14c88c823f00d7fe617fd104e&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-22.md b/archive/2022/2022-09-22.md deleted file mode 100644 index e99c91007e..0000000000 --- a/archive/2022/2022-09-22.md +++ /dev/null @@ -1,255 +0,0 @@ -# 每日安全资讯（2022-09-22） - -- Security Boulevard - - [Excited to be Steering Strategies at Arkose Labs to Help Eliminate Botnet Attacks](https://securityboulevard.com/2022/09/excited-to-be-steering-strategies-at-arkose-labs-to-help-eliminate-botnet-attacks/) - - [What Is Cryptojacking? How It Works and How to Protect Against It](https://securityboulevard.com/2022/09/what-is-cryptojacking-how-it-works-and-how-to-protect-against-it/) - - [BSidesLV 2022 Lucky13 BreakingGround – Vladimir De Turckheim’s ‘Everything I Know About Prototype Pollutions: How To React When Confronted To A Brand New Vulnerability’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-breakingground-vladimir-de-turckheims-everything-i-know-about-prototype-pollutions-how-to-react-when-confronted-to-a-brand-new-vulnerability/) - - [Daniel Stori’s ‘The Realist Manager’](https://securityboulevard.com/2022/09/daniel-storis-the-realist-manager/) - - [Meet Our Mayhem Heroes: Raj Shah](https://securityboulevard.com/2022/09/meet-our-mayhem-heroes-raj-shah/) - - [Frontline PCI-Pro™ Datasheet](https://securityboulevard.com/2022/09/frontline-pci-pro-datasheet/) - - [Protecting Healthcare Organizations from Ransomware Attacks](https://securityboulevard.com/2022/09/protecting-healthcare-organizations-from-ransomware-attacks/) - - [SIM Swapper Abducted, Beaten, Held for $200k Ransom](https://securityboulevard.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/) - - [Security tool integration can make or break secure development – ESG report](https://securityboulevard.com/2022/09/security-tool-integration-can-make-or-break-secure-development-esg-report/) - - [A Comprehensive Guide to SOPS: Managing Your Secrets Like A Visionary, Not a Functionary](https://securityboulevard.com/2022/09/a-comprehensive-guide-to-sops-managing-your-secrets-like-a-visionary-not-a-functionary/) -- Recent Commits to cve:main - - [Update Wed Sep 21 10:06:55 UTC 2022](https://github.com/trickest/cve/commit/0709e86340a29de39813f342104fab705637a378) -- Twitter @Nicolas Krassas - - [The art and science behind Microsoft threat hunting: Part 2](https://twitter.com/Dinosn/status/1572649652926976001) - - [Rewards plus: Fake mobile banking rewards apps lure users to install info-stealing RAT on Android devices](https://twitter.com/Dinosn/status/1572649055427198976) - - [Malwarebytes blocks Google, YouTube as malware](https://twitter.com/Dinosn/status/1572648952020799491) - - [Unpatched 15-year old Python bug allows code execution in 350k projects](https://twitter.com/Dinosn/status/1572648681282875392) - - [Over 39,000 Unauthenticated Redis Instances Found Exposed on the Internet](https://twitter.com/Dinosn/status/1572607202556272647) - - [Threat actors abuse LinkedIn slink (Smart Link) to bypass Secure Email Gateways (SEGs)](https://twitter.com/Dinosn/status/1572597498694500355) - - [Crypto Biz Wintermute Loses $160 Million In Cyber Heist](https://twitter.com/Dinosn/status/1572580119784587265) - - [$35 Million Fine For Morgan Stanley After Unencrypted, Unwiped Harddrives Are Auctioned](https://twitter.com/Dinosn/status/1572580014104907777) - - [User claim he hacked a Lockbit Server and release builder & more](https://twitter.com/Dinosn/status/1572568100192800769) - - [Native function and Assembly Code Invocation](https://twitter.com/Dinosn/status/1572567902775283712) - - [Prefetch Hash Cracker: brute-force prefetch hashes](https://twitter.com/Dinosn/status/1572567626353897472) - - [Automatic Cheating Detection in Human Racing](https://twitter.com/Dinosn/status/1572554887568953344) - - [Ox4Shell: Deobfuscate Log4Shell payloads](https://twitter.com/Dinosn/status/1572534573229305859) - - [Critical Remote Hack Flaws Found in Dataprobe's Power Distribution Units](https://twitter.com/Dinosn/status/1572514053473574912) - - [Record DDoS Attack with 25.3 Billion Requests Abused HTTP/2 Multiplexing](https://twitter.com/Dinosn/status/1572514004001755142) -- unSafe.sh - 不安全 - - [CVE-2022-33980命令执行漏洞分析](https://buaq.net/go-127583.html) - - [从前端代码审计挖掘未授权进入后台到文件上传拿下某色情网站](https://buaq.net/go-127584.html) - - [Dll劫持注入从原理到白加黑漏洞利用](https://buaq.net/go-127585.html) - - [Vulnerable children's identities used in tax fraud scheme](https://buaq.net/go-127610.html) - - [FreeBuf早报 | 两家中国电信公司被美列入威胁名单；游戏2K网站遭黑客攻击](https://buaq.net/go-127633.html) - - [Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime](https://buaq.net/go-127567.html) - - [5 things to teach your kids about social media](https://buaq.net/go-127611.html) -- Microsoft Security Blog - - [Rewards plus: Fake mobile banking rewards apps lure users to install info-stealing RAT on Android devices](https://www.microsoft.com/security/blog/2022/09/21/rewards-plus-fake-mobile-banking-rewards-apps-lure-users-to-install-info-stealing-rat-on-android-devices/) - - [The art and science behind Microsoft threat hunting: Part 2](https://www.microsoft.com/security/blog/2022/09/21/the-art-and-science-behind-microsoft-threat-hunting-part-2/) -- Sploitus.com Exploits RSS Feed - - [WiFi Mouse 1.8.3.4 - Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37977&utm_source=rss&utm_medium=rss) - - [Unified Remote Authentication Bypass / Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168456&utm_source=rss&utm_medium=rss) - - [ProcessMaker Privilege Escalation Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37976&utm_source=rss&utm_medium=rss) - - [WiFiMouse 1.8.3.4 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168457&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Preservation of Permissions in Processmaker exploit](https://sploitus.com/exploit?id=881ACD21-E8A6-5E8D-9069-C67EC36B29E4&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-39197 exploit](https://sploitus.com/exploit?id=2A487E4D-AFC5-5E92-98D3-835F27535FF1&utm_source=rss&utm_medium=rss) - - [Exploit for Expression Language Injection in Apache Log4J exploit](https://sploitus.com/exploit?id=6E4D24C6-CAF4-5CCB-83A7-844F830C86FC&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5625-1](https://packetstormsecurity.com/files/168455/USN-5625-1.txt) - - [Ubuntu Security Notice USN-5626-1](https://packetstormsecurity.com/files/168454/USN-5626-1.txt) - - [Ubuntu Security Notice USN-5623-1](https://packetstormsecurity.com/files/168453/USN-5623-1.txt) - - [Ubuntu Security Notice USN-5624-1](https://packetstormsecurity.com/files/168452/USN-5624-1.txt) - - [Ubuntu Security Notice USN-5622-1](https://packetstormsecurity.com/files/168451/USN-5622-1.txt) - - [Ubuntu Security Notice USN-5621-1](https://packetstormsecurity.com/files/168450/USN-5621-1.txt) - - [Red Hat Security Advisory 2022-6580-01](https://packetstormsecurity.com/files/168449/RHSA-2022-6580-01.txt) - - [Red Hat Security Advisory 2022-6592-01](https://packetstormsecurity.com/files/168448/RHSA-2022-6592-01.txt) - - [Red Hat Security Advisory 2022-6590-01](https://packetstormsecurity.com/files/168447/RHSA-2022-6590-01.txt) - - [Red Hat Security Advisory 2022-6582-01](https://packetstormsecurity.com/files/168446/RHSA-2022-6582-01.txt) - - [Red Hat Security Advisory 2022-6585-01](https://packetstormsecurity.com/files/168445/RHSA-2022-6585-01.txt) - - [Unified Remote Authentication Bypass / Code Execution](https://packetstormsecurity.com/files/168456/unified_remote_rce.rb.txt) - - [American Fuzzy Lop plus plus 4.03c](https://packetstormsecurity.com/files/168444/AFLplusplus-4.03c.tar.gz) - - [Ubuntu Security Notice USN-5618-1](https://packetstormsecurity.com/files/168443/USN-5618-1.txt) - - [Red Hat Security Advisory 2022-6595-01](https://packetstormsecurity.com/files/168442/RHSA-2022-6595-01.txt) - - [Red Hat Security Advisory 2022-6608-01](https://packetstormsecurity.com/files/168441/RHSA-2022-6608-01.txt) - - [Red Hat Security Advisory 2022-6610-01](https://packetstormsecurity.com/files/168440/RHSA-2022-6610-01.txt) - - [Red Hat Security Advisory 2022-6634-01](https://packetstormsecurity.com/files/168439/RHSA-2022-6634-01.txt) - - [WiFiMouse 1.8.3.4 Remote Code Execution](https://packetstormsecurity.com/files/168457/wifimouse1834-exec.txt) - - [Red Hat Security Advisory 2022-6536-01](https://packetstormsecurity.com/files/168438/RHSA-2022-6536-01.txt) - - [Red Hat Security Advisory 2022-6602-01](https://packetstormsecurity.com/files/168437/RHSA-2022-6602-01.txt) -- 先知安全技术社区 - - [CVE-2022-33980命令执行漏洞分析](https://xz.aliyun.com/t/11723) - - [从前端代码审计挖掘未授权进入后台到文件上传拿下某色情网站](https://xz.aliyun.com/t/11729) - - [Dll劫持注入从原理到白加黑漏洞利用](https://xz.aliyun.com/t/11711) -- 安全脉搏 - - [PyPI供应链攻击频发，W4SP盯上用户的私密数据](https://www.secpulse.com/archives/187483.html) - - [​网络攻击中常见掩盖真实IP的攻击方式及虚假IP地址追踪溯源方法](https://www.secpulse.com/archives/187472.html) - - [警惕破解软件！APS 窃密木马已感染万余台设备](https://www.secpulse.com/archives/187438.html) - - [“暗黑天使”降临：DarkAngels勒索病毒全揭秘](https://www.secpulse.com/archives/187387.html) -- 先知安全技术社区 - - [CVE-2022-33980命令执行漏洞分析](https://xz.aliyun.com/t/11723) - - [从前端代码审计挖掘未授权进入后台到文件上传拿下某色情网站](https://xz.aliyun.com/t/11729) - - [Dll劫持注入从原理到白加黑漏洞利用](https://xz.aliyun.com/t/11711) -- 跳跳糖 - 安全与分享社区 - - [ASP.NET 无文件攻击入侵检测](https://tttang.com/archive/1744/) -- 安全客-有思想的安全新媒体 - - [间谍组织Worok大揭底](https://www.anquanke.com/post/id/280580) - - [针对云计算服务环境下关键信息基础设施安全保障的思考](https://www.anquanke.com/post/id/280572) - - [加强持续风险监测安全运营 构建数字政府安全保障体系](https://www.anquanke.com/post/id/280476) - - [白帽发现严重漏洞，Arbitrum奖励400以太币](https://www.anquanke.com/post/id/280536) - - [为防网络攻击，俄外交部着手改进电子签证系统](https://www.anquanke.com/post/id/280521) - - [5 种常见的前端加密渗透场景及案例](https://www.anquanke.com/post/id/280470) - - [韩国国防部下设战争纪念馆遭黑客网络攻击，未泄露军事资料](https://www.anquanke.com/post/id/280515) - - [美国航空集团称数据外泄事件影响了少数客户](https://www.anquanke.com/post/id/280511) -- ongoing by Tim Bray - - [Luxury media](https://www.tbray.org/ongoing/When/202x/2022/09/21/Luxury-Media) -- Trustwave Blog - - [Trustwave’s Open Arms Approach to Recruiting](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwaves-open-arms-approach-to-recruiting/) - - [Trustwave Named to MSSP Alert's Top 250 MSSPs List for 2022](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-named-to-mssp-alerts-top-250-mssps-list-for-2022/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [再居高位！Fortinet 连续三年蝉联Gartner SD-WAN 魔力象限领导者](https://www.4hou.com/posts/ZXov) - - [【技术原创】渗透技巧——从VMware ESXI横向移动到Windows虚拟机](https://www.4hou.com/posts/VZ5X) - - [通过开源、多平台代码签名扩展 Apple 生态系统访问权限](https://www.4hou.com/posts/jJM5) - - [打造密码硬核技术 三未信安重磅推出全“芯”系列密码卡、密码机](https://www.4hou.com/posts/RB0L) -- paper - Last paper - - [浅谈被动式 IAST 产品与技术实现](https://paper.seebug.org/1975/) -- SAP Blogs - - [Concento RDG provides an effortless way to assign the Email Template to the Workflow](https://blogs.sap.com/2022/09/21/concento-rdg-provides-an-effortless-way-to-assign-the-email-template-to-the-workflow/) - - [How to Remove Discrepancies Related to the Sale orders and Deliveries from MD04](https://blogs.sap.com/2022/09/21/how-to-remove-discrepancies-related-to-the-sale-orders-and-deliveries-from-md04/) - - [Guest Blog Post from IDC: How to Avoid the Increasing Complexity of the Affordable Care Act (ACA)](https://blogs.sap.com/2022/09/21/guest-blog-post-from-idc-how-to-avoid-the-increasing-complexity-of-the-affordable-care-act-aca/) - - [Guest Blog Post from IDC: HR Compliance Comes in Many Forms](https://blogs.sap.com/2022/09/21/guest-blog-post-from-idc-hr-compliance-comes-in-many-forms/) - - [SAP HANA Cloud goes “multi-environment”: Part 2- getting started](https://blogs.sap.com/2022/09/21/sap-hana-cloud-goes-multi-environment-part-2-getting-started/) - - [SAP HANA Cloud goes “multi-environment”: Part 1- feature overview](https://blogs.sap.com/2022/09/21/sap-hana-cloud-goes-multi-environment-part-1-feature-overview/) - - [Debug Java Code in Agentry Cloud Edition (ACE)](https://blogs.sap.com/2022/09/21/debug-java-code-in-agentry-cloud-edition-ace-2/) - - [Dear FP&A Leaders: Transform your business and take planning to the next level with Extended Planning & Analysis](https://blogs.sap.com/2022/09/21/dear-fpa-leaders-transform-your-business-and-take-planning-to-the-next-level-with-extended-planning-analysis/) - - [SAP Enterprise Product Development (EPD) for Utilities & Energy: Provide resilient service delivery in a sustainable way](https://blogs.sap.com/2022/09/21/sap-enterprise-product-development-epd-for-utilities-energy-provide-resilient-service-delivery-in-a-sustainable-way/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Dancho Danchev's Disappearance - 2010 - Official Complaint Against Republic of Bulgaria Regarding Dancho Danchev's Illegal Law Enforcement Arrest Home Molestation and Kidnapping Attempt - A Compilation - Part Two](https://ddanchev.blogspot.com/2022/09/dancho-danchevs-disappearance-2010.html) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-09-21 - IcedID (Bokbot) with Cobalt Strike](https://www.malware-traffic-analysis.net/2022/08/31/index.html) -- Twitter @bytehx - - [RT shubs: My colleague @TheGrandPew discovered a pre-authentication remote command execution vulnerability in Atlassian Bitbucket. You can read his wr...](https://twitter.com/infosec_au/status/1572735333690912769) - - [RT Omer Gil: New research: How we abused repository webhooks to access internal CI systems at scale. 1/](https://twitter.com/omer_gil/status/1572599690100621312) -- SentinelOne - - [Investing in Tomorrow | Why We Started S Ventures](https://www.sentinelone.com/blog/investing-in-tomorrow-why-we-started-s-ventures/) -- Sick Codes – Security Research, Hardware & Software Hacking, Consulting, Linux, IoT, Cloud, Embedded, Arch, Tweaks & Tips! - - [ASRock Rack Aspeed Ast2500 BMC/IPMI Reset Fixes (American Megatrends)](https://sick.codes/asrock-rack-aspeed-ast2500-bmc-ipmi-reset-fixes-american-megatrends/) -- Application Security Blog - - [BSIMM13: Trends and recommendations to help improve your software security program](https://www.synopsys.com/blogs/software-security/bsimm-trends-and-recommendations/) -- Intigriti - - [Edit & Remove Messages](https://blog.intigriti.com/2022/09/21/edit-remove-messages/) - - [Yahoo’s 1337UP0822 live hacking event rallies researchers from around the world](https://blog.intigriti.com/2022/09/21/yahoo-1337up0822-live-hacking-event-round-up/) -- Reverse Engineering - - [Analyzing BSD Kernels for Uninitialized Memory Disclosures using Binary Ninja](https://www.reddit.com/r/ReverseEngineering/comments/xka2pb/analyzing_bsd_kernels_for_uninitialized_memory/) - - [Binary Analysis and Similarity Platform](https://www.reddit.com/r/ReverseEngineering/comments/xjv7pb/binary_analysis_and_similarity_platform/) - - [Winbindex Download Links - From 80% to 100%⁠(-⁠ish)](https://www.reddit.com/r/ReverseEngineering/comments/xjuzno/winbindex_download_links_from_80_to_100ish/) -- Hexacorn - - [Inserting data into other processes’ address space, part 1a](https://www.hexacorn.com/blog/2022/09/21/inserting-data-into-other-processes-address-space-part-1a/) -- Malwarebytes Labs - - [Vulnerable children's identities used in tax fraud scheme](https://www.malwarebytes.com/blog/news/2022/09/vulnerable-childrens-identities-used-in-tax-fraud-scheme) - - [5 things to teach your kids about social media](https://www.malwarebytes.com/blog/personal/2022/09/5-things-to-teach-your-kids-about-social-media) - - [Scammers send fake 'Energy Bills Support Scheme' texts](https://www.malwarebytes.com/blog/news/2022/09/energy-scammers-send-fake-energy-bills-support-scheme-texts) - - [Tax refund phish logs keystrokes to swipe personal details](https://www.malwarebytes.com/blog/news/2022/09/tax-refund-phish-logs-keystrokes-to-swipe-personal-details) -- KitPloit - PenTest & Hacking Tools - - [NimGetSyscallStub - Get Fresh Syscalls From A Fresh Ntdll.Dll Copy](http://www.kitploit.com/2022/09/nimgetsyscallstub-get-fresh-syscalls.html) -- Hack Inn - - [HITCON 2022](https://www.hackinn.com/index.php/archives/806/) -- rtl-sdr.com - - [SDRSharp Big Guide Book Updated to V5.3](https://www.rtl-sdr.com/sdrsharp-big-guide-book-updated-to-v5-3/) - - [Detecting Starlink Satellites with a Portable Raspberry Pi + RTL-SDR](https://www.rtl-sdr.com/detecting-starlink-satellites-with-a-portable-raspberry-pi-rtl-sdr/) - - [SatDump ReWork Release with Significant Feature and GUI Updates](https://www.rtl-sdr.com/satdump-rework-release-with-significant-feature-and-gui-updates/) -- 安全牛 - - [海云安出席深圳市网络安全宣传周电信日活动暨第三届“网络安全圳先行”高峰论坛](https://www.aqniu.com/industry/89331.html) - - [再居高位！Fortinet 连续三年蝉联Gartner SD-WAN 魔力象限领导者](https://www.aqniu.com/vendor/89327.html) - - [亚信安全勒索治理「方舟」正式上线！ 勒索体检中心全面开放](https://www.aqniu.com/vendor/89326.html) - - [VMware年度网络安全报告的八个关键发现](https://www.aqniu.com/hometop/89313.html) - - [产业观察 丨 亚信安全发布全面勒索治理“方舟计划”](https://www.aqniu.com/homenews/89315.html) - - [安全牛课堂 丨 培养员工网络安全意识的7个习惯及建议](https://www.aqniu.com/homenews/89316.html) - - [天翼云探索践行零信任 重塑企业网络安全边界](https://www.aqniu.com/vendor/89314.html) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 两家中国电信公司被美列入威胁名单；游戏2K网站遭黑客攻击](https://www.freebuf.com/news/345213.html) - - [信阳师范学院曝“学信网信息泄露”，学院：已报警，涉事学生干部被撤职](https://www.freebuf.com/news/345201.html) - - [全球十大国家级APT组织排行榜发布](https://www.freebuf.com/articles/345180.html) - - [为儿童隐私实施“最高标准”！加州通过《互联网隐私立法》](https://www.freebuf.com/news/345177.html) - - [黑客从Wintermute加密货币做市商处窃取1.62亿美元](https://www.freebuf.com/news/345135.html) -- HackerNews - - [黑客从 Wintermute 加密货币做市商处窃取 1.62 亿美元](https://hackernews.cc/archives/41623) - - [Dataprobe 配电装置中发现关键远程黑客漏洞](https://hackernews.cc/archives/41612) - - [美国航空公司披露了一起数据泄露事件](https://hackernews.cc/archives/41610) - - [一黑客兜售印尼 13 亿手机卡用户数据，公开嘲讽多名高官](https://hackernews.cc/archives/41607) - - [黑客升级钓鱼活动，欺骗重要机构/大型企业员工提交 Microsoft 365 凭证](https://hackernews.cc/archives/41603) - - [印度尼西亚通过备受瞩目的数据隐私法，刑罚最高可至监禁六年](https://hackernews.cc/archives/41600) - - [俄罗斯沙虫黑客冒充乌克兰电信公司投放恶意软件](https://hackernews.cc/archives/41596) -- 体验盒子 - - [PHP计算查找多个字符串最长公共前缀](https://www.uedbox.com/post/68552/) - - [复杂数据源中小区/学校/区域信息的归一化探讨](https://www.uedbox.com/post/68544/) - - [PHP小技巧之计算文本相似度](https://www.uedbox.com/post/68543/) -- 奇客Solidot–传递最新科技情报 - - [加密货币做市商 Wintermute DeFi 业务遭攻击损失 1.6 亿美元](https://www.solidot.org/story?sid=72838) - - [Wasmtime 1.0 发布](https://www.solidot.org/story?sid=72837) - - [YouTube 的不喜欢按钮对减少类似推荐基本无效](https://www.solidot.org/story?sid=72836) - - [微软开始推送 Windows 11 2022](https://www.solidot.org/story?sid=72835) - - [《星际公民(Star Citizen)》筹集的资金突破五亿美元](https://www.solidot.org/story?sid=72834) - - [Firefox 105.0 释出](https://www.solidot.org/story?sid=72833) - - [欧盟开放 Web 搜索项目启动](https://www.solidot.org/story?sid=72832) - - [LibreOffice 在 Mac App Store 的版本开始收费](https://www.solidot.org/story?sid=72831) - - [科学家发现端粒 DNA 新结构](https://www.solidot.org/story?sid=72830) - - [当 AI 问蠢问题它会更快变聪明](https://www.solidot.org/story?sid=72829) - - [NASA 韦伯望远镜发布火星红外照片](https://www.solidot.org/story?sid=72828) - - [Debian 投票是否允许默认加载非自由固件](https://www.solidot.org/story?sid=72827) - - [报道否认 TikTok 与母公司保持距离](https://www.solidot.org/story?sid=72826) -- The Daily Swig | Cybersecurity news and views - - [Prototype pollution bug in Chromium bypassed Sanitizer API](https://portswigger.net/daily-swig/prototype-pollution-bug-in-chromium-bypassed-sanitizer-api) -- 黑海洋 - WIKI - - [x-ui支持多协议多用户的 xray 面板](https://blog.upx8.com/2995) - - [X-UI面板搭建多协议、多用户代理服务，支持CDN（科学上网）](https://blog.upx8.com/2994) - - [IJPay 支付](https://blog.upx8.com/2993) -- 腾讯玄武实验室 - - [每日安全动态推送(09-21)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958711&idx=1&sn=99c65e3e60fb2cd68f813f58db7ccb90&chksm=8baecd28bcd9443ee0a6726f4be008b8416f3cea2d1011fc47a0e6aa1e857a29dc4c19ca2654&scene=58&subscene=0#rd) -- 绿盟科技技术博客 - - [数据收集活动安全风险探讨](http://blog.nsfocus.net/risk-of-data-collection/) - - [安全多方计算（5）：隐私集合求交方案汇总分析](http://blog.nsfocus.net/private-set-intersection-analysis/) -- 丁爸情报分析师的工具箱 - - [【企业介绍】深圳中科爱讯科技有限公司](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651132133&idx=1&sn=831a14415a3db3d1a362c6d829694d21&chksm=f1af67dfc6d8eec95680c31b08563d9e70ab1bb8c0202bb862bb3172e6cc2a0d4eca57e5c055&scene=58&subscene=0#rd) -- 看雪学院 - - [2022羊城杯竞赛 Web题目解析](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458470815&idx=1&sn=e3b1f30be482eac6852aea28e1b4cf91&chksm=b18e791586f9f00377d2275ff77b44bb386646d14e28065e110a0bcdeba1b0c05247ab3e31f5&scene=58&subscene=0#rd) - - [2K Games证实其支持平台被黑，玩家收到恶意电子邮件](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458470815&idx=2&sn=836767c8286c0d117984e485097bb042&chksm=b18e791586f9f003b7deebf9def13b11fc47d536584526c3fd2d8130878c66ea546a707ad57e&scene=58&subscene=0#rd) - - [反勒索软件开发实战篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458470815&idx=3&sn=1f0ec55a71071fd0d53ebbaad0f67f6d&chksm=b18e791586f9f00376703a22833ead17d7210f1452ebac2d2abb54c9100b37e5d0c266cc43d2&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [来势汹汹！StrivePhish钓鱼组织大爆发，至少千人已中招](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247496303&idx=1&sn=6d04fc3d71e0ba6ca9c8bb4bb6a504b2&chksm=cfca917bf8bd186db326ce607cf87c0dd14c8995efdd71cf2d524d364b4324364e8628c35155&scene=58&subscene=0#rd) -- 安全威胁情报 - - [18岁黑客是如何入侵Uber公司的？](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650174281&idx=1&sn=d38ef1eadd30e15c88a5b4dfd66bb676&chksm=f44888f5c33f01e37788a85d966eb6a3382d33c7f864afca2f542e3dd9bea1e78d639227447b&scene=58&subscene=0#rd) -- 极客公园 - - [别把抖音想「小」了](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652968180&idx=1&sn=36a67b3159bf1f76860f3e72c94a8fe1&chksm=7e5469424923e054961887d17679c1ca17428f73b1c38dca35d603428ab5d65e7716f7cff494&scene=58&subscene=0#rd) - - [真极客都懂的七个「梗」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967738&idx=1&sn=7bab541ebb5221dd4313b9ffb56725e6&chksm=7e546e8c4923e79a5fe7b205bb8b257eb06d2c2c3939a4de70ad90006ce231a5c4b8684c3d6f&scene=58&subscene=0#rd) - - [Robot as a Service，开启机器人赛道新模式](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967738&idx=2&sn=1f612093d49af55d01eddac3f769b7f2&chksm=7e546e8c4923e79af40088f0e8850fee001ef0b1a87e65655dc0690437744062f740cfab0af8&scene=58&subscene=0#rd) - - [英伟达 RTX 40 系列显卡发售；拼多多海外暂不上线砍一刀；李佳琦复播，商品不见一线大牌 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652967737&idx=1&sn=d20e79689c9fa043014012612ab5ccaa&chksm=7e546e8f4923e799d358c42c92e0b21ceee44d5f81476c7e3c4a7d068232b99e7b6426354d14&scene=58&subscene=0#rd) -- 云鼎实验室 - - [你引用的开源代码，可能夹带了漏洞](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247494694&idx=1&sn=e906ee103224b8a823d19aca3ecb180e&chksm=fd7910a0ca0e99b6955c33c29d8b39a2e51d041a43c80a2cc142ece0f5b83f6a12422b71b67c&scene=58&subscene=0#rd) -- 慢雾科技 - - [揭秘以太坊 Vanity 生成器 Profanity 私钥破解漏洞](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247496425&idx=1&sn=f0c3c882070605665fc0f700ea6c6e4c&chksm=fdde8c6ecaa905781a105137828a1c2e7b0705cb2260c76ffad5f997978197627fbecc0b4e36&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.09.21）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491427&idx=1&sn=292640f5cba0212420a959d53496664f&chksm=fe251a62c95293748053e5d33687964ee1b97ad103774de31e4fab6e2f44b012c4f5141501c5&scene=58&subscene=0#rd) -- NOVASEC - - [CS4.5粗略预防CVE-2022-39197 XSS RCE](https://mp.weixin.qq.com/s?__biz=MzUzODU3ODA0MA==&mid=2247488155&idx=1&sn=afdbe0f1cb8e91c0517f25c74289b6cf&chksm=fad4cf8ccda3469a8804c422f609401e3875d0596aceaed715f119301d211207a315b6c358fb&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-09-21](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492766&idx=1&sn=4bb12e52b7873cfc41b6daad2b877422&chksm=c063ca47f71443510f2035d5a326896cafd5af669925a27ad8c7be4c7b007abca001a1a6b892&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [对数字政府安全技术合规分析的建议](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531332&idx=1&sn=7617e11e2294d82dee71bde2ac208175&chksm=c1e9f715f69e7e030a76a638112232dc1bf1e3fd4c01fdad447090e1c8059bb10719122b4f58&scene=58&subscene=0#rd) - - [LastPass开发者系统遭到黑客攻击，源代码被盗](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531332&idx=2&sn=da21ef251051fedb9c193dd73ef15db8&chksm=c1e9f715f69e7e0368ade1c6658a88105161661832cdc54df6bf895425c4b77eede068e258a9&scene=58&subscene=0#rd) - - [俄乌网络战新动作！“沙虫”冒充乌克兰电信部署恶意软件](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531332&idx=3&sn=982e6dbd46b2ec7b50587a79f01391e3&chksm=c1e9f715f69e7e0342e523f355966d09a04ddd1c754a631b5e029b443bd60330f336337820fe&scene=58&subscene=0#rd) -- 安全客 - - [【技术分享】反后门攻击](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649778056&idx=1&sn=57ba27041990ef9c859830080adb9a9d&chksm=889357e7bfe4def11cad1bb0acaaed3db88ae122614132a11f1d6fe34d6e75a314a413000673&scene=58&subscene=0#rd) - - [【安全头条】为防网络攻击，俄外交部着手改进电子签证系统](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649778056&idx=2&sn=ebff376bf173eacf10247a48aafdb178&chksm=889357e7bfe4def1cf597f75036603f98574569ae2ed10b008d8f2a7373c93f837ee14ef37f6&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [老树开新花 | .NET MVC上传绕过解析ascx](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486399&idx=1&sn=1b891333ceb6ee6aa39d416a5a662e68&chksm=fa5aa552cd2d2c4455ca64d8741fadb469410b5827610d1f18201fff0ea8542068fddbbf5ee3&scene=58&subscene=0#rd) -- 网安寻路人 - - [英国《有效的人工智能保障生态系统路线图》（中译文）](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247495907&idx=1&sn=98b352b4129403e81d0e211626b0cc8f&chksm=97e94d09a09ec41f7962507e3c379938b6d5774e43af0e7a6038a91f945ed61ea1f63dbef8f9&scene=58&subscene=0#rd) -- 中国信息安全 - - [专题·数字政府安全 | 数字政府网络安全体系建设的实践与思考](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165715&idx=1&sn=36283418f9c2867ff52ce401bb2b7d5f&chksm=8b5ef3aabc297abc3477a2dca3a723fbc012afe760c329779b4218df91941a539b40806e31d5&scene=58&subscene=0#rd) - - [关注 | 公安机关加强国际执法合作深入推进打击治理电信网络诈骗犯罪](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165715&idx=2&sn=050fc331259cbbbafa4fab51d4a5c368&chksm=8b5ef3aabc297abc63a419f1aa3d2ddcf58447b3c6a9c3f65e7769d7d407050cb617fd6d6204&scene=58&subscene=0#rd) - - [观点 | 强化高校网络安全刻不容缓](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165715&idx=3&sn=fce1bb5ca9f33358df3b00349be74ea7&chksm=8b5ef3aabc297abcf96f5401c16d44d7a13b679187bddfda49ae5298bc0e781256195fe4b248&scene=58&subscene=0#rd) - - [行业 | “自主创芯”，三未信安打造密码硬核技术](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165715&idx=4&sn=9153bf184a3816edf9791e1d78e8a3f0&chksm=8b5ef3aabc297abcfbbff3017f001f6deb202960f1b6291087cf0932069eb71ce92ce9c2e428&scene=58&subscene=0#rd) - - [警惕 | 这175家“国企”，都是假的！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664165715&idx=5&sn=679425081520c9b79e36b695798fec68&chksm=8b5ef3aabc297abc8b8a20f616f6b06ed5626bca6ff7647c22837c09bdadbed58cfda0475cfe&scene=58&subscene=0#rd) -- 星阑科技 - - [星阑科技受邀参加《中华人民共和国网络安全法》修改线上专题研讨会](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495825&idx=1&sn=a29fcb5b75fb39474958c452addb20b9&chksm=c0075d0df770d41b5a812b8a535a8398404947bea15021353c310e740a5317dae0bf830517c3&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [【技术原创】渗透技巧——从VMware ESXI横向移动到Windows虚拟机](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550739&idx=1&sn=15440c91b391911a2a5771f3c05b6e80&chksm=e915d729de625e3f789159d490cf9693f5decd7e3f0fb785f864b8f82913463042c918f5c462&scene=58&subscene=0#rd) - - [通过开源、多平台代码签名扩展 Apple 生态系统访问权限](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247550739&idx=2&sn=b68e6861c8adeae21453510179058b1c&chksm=e915d729de625e3fb9f2cc3a7a6885ab2075892c5b5954298a915f579207983627a27759aee4&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [2022年第五空间网络安全大赛WriteUp | Reverse & Pwn & Crypto](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496531&idx=1&sn=85890fd728bf45d8496b1b04eb74251a&chksm=fa5226edcd25affb0772635eb87fa7e8ce181589f36d94a11377acfd0ce2e42166e4e85202bb&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Sep.21th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495855&idx=1&sn=aed77d00fd606c9ade8ecfe1008a552f&chksm=ce96bd91f9e13487a335b851ebfccf615d65ee20f7e912428576bab9fa78a63c3985cb43357b&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-23.md b/archive/2022/2022-09-23.md deleted file mode 100644 index 544214ec28..0000000000 --- a/archive/2022/2022-09-23.md +++ /dev/null @@ -1,233 +0,0 @@ -# 每日安全资讯（2022-09-23） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Buffalo TeraStation Network Attached Storage (NAS) 1.66 Authentication Bypass](https://cxsecurity.com/issue/WLB-2022090063) - - [VIAVIWEB Wallpaper Admin SQL Injection / Shell Upload](https://cxsecurity.com/issue/WLB-2022090062) - - [Conti Ransom / Arbitrary Code Execution](https://cxsecurity.com/issue/WLB-2022090061) - - [Unified Remote Authentication Bypass / Code Execution](https://cxsecurity.com/issue/WLB-2022090060) - - [AjaXplorer 4.2.3 - Stored Cross-Site Scripting (XSS)](https://cxsecurity.com/issue/WLB-2022090059) - - [WiFiMouse 1.8.3.4 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090058) - - [KFM Kae's File Manager - ALL - Reflected Cross-Site Scripting (XSS)](https://cxsecurity.com/issue/WLB-2022090057) -- Microsoft Security Blog - - [Malicious OAuth applications used to compromise email servers and spread spam](https://www.microsoft.com/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/) -- Trustwave Blog - - [Trustwave Recognized in Gartner® 2022 Market Guide for Managed SIEM Services](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-recognized-in-gartner-2022-market-guide-for-managed-siem-services/) -- Verne in GitHub - - [使用开源 Wakapi 代替 WakaTime 统计编码时间](https://einverne.github.io/post/2022/09/wakapi-usage.html) -- Recent Commits to cve:main - - [Update Thu Sep 22 10:03:20 UTC 2022](https://github.com/trickest/cve/commit/70c503c2ea12b688fe61be5473f65158c59f50ef) -- Files ≈ Packet Storm - - [Bitbucket Git Command Injection](https://packetstormsecurity.com/files/168470/bitbucket_git_cmd_injection.rb.txt) - - [Ubuntu Security Notice USN-5628-1](https://packetstormsecurity.com/files/168469/USN-5628-1.txt) - - [Ubuntu Security Notice USN-5627-1](https://packetstormsecurity.com/files/168468/USN-5627-1.txt) - - [Red Hat Security Advisory 2022-6681-01](https://packetstormsecurity.com/files/168467/RHSA-2022-6681-01.txt) - - [Linux Stable 5.4 / 5.10 Use-After-Free / Race Condition](https://packetstormsecurity.com/files/168466/GS20220922155445.tgz) - - [WorkOrder CMS 0.1.0 Cross Site Scripting](https://packetstormsecurity.com/files/168465/workordercms010-xss.txt) - - [WorkOrder CMS 0.1.0 SQL Injection](https://packetstormsecurity.com/files/168464/workordercms010-sql.txt) - - [Ubuntu Security Notice USN-5626-2](https://packetstormsecurity.com/files/168463/USN-5626-2.txt) - - [Red Hat Security Advisory 2022-6535-01](https://packetstormsecurity.com/files/168462/RHSA-2022-6535-01.txt) - - [Red Hat Security Advisory 2022-6536-01](https://packetstormsecurity.com/files/168461/RHSA-2022-6536-01.txt) - - [Red Hat Security Advisory 2022-6531-01](https://packetstormsecurity.com/files/168460/RHSA-2022-6531-01.txt) - - [Multix 2.4 Cross Site Request Forgery](https://packetstormsecurity.com/files/168459/multix24-xsrf.txt) - - [Multix 2.4 Cross Site Scripting](https://packetstormsecurity.com/files/168458/multix24-xss.txt) -- Tenable Blog - - [$1 Billion State and Local Cybersecurity Grant Program Now Open for Applicants](https://www.tenable.com/blog/1-billion-state-and-local-cybersecurity-grant-program-now-open-for-applicants) -- Sploitus.com Exploits RSS Feed - - [Multix 2.4 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168458&utm_source=rss&utm_medium=rss) - - [Unified Remote Authentication Bypass / Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37978&utm_source=rss&utm_medium=rss) - - [WorkOrder CMS 0.1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168464&utm_source=rss&utm_medium=rss) - - [Multix 2.4 Cross Site Request Forgery exploit](https://sploitus.com/exploit?id=PACKETSTORM:168459&utm_source=rss&utm_medium=rss) - - [Bitbucket Git Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168470&utm_source=rss&utm_medium=rss) - - [WorkOrder CMS 0.1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168465&utm_source=rss&utm_medium=rss) - - [Exploit for Deserialization of Untrusted Data in Sitecore Experience Platform exploit](https://sploitus.com/exploit?id=5ADD851A-6D91-54B6-8986-62346355A89F&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Wso2 Identity Server Analytics exploit](https://sploitus.com/exploit?id=43567D55-406B-5681-975B-FD3C7A49489D&utm_source=rss&utm_medium=rss) -- 先知安全技术社区 - - [某开源堡垒机历史漏洞分析](https://xz.aliyun.com/t/11721) -- ElcomSoft blog - - [iOS Forensic Toolkit 8.0 Now Official: Bootloader-Level Extraction for 76 Devices](https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-now-official-bootloader-level-extraction-for-76-devices/) - - [iOS 16: Extracting the File System and Keychain from A11 Devices](https://blog.elcomsoft.com/2022/09/ios-16-extracting-the-file-system-and-keychain-from-a11-devices/) -- 先知安全技术社区 - - [某开源堡垒机历史漏洞分析](https://xz.aliyun.com/t/11721) -- 跳跳糖 - 安全与分享社区 - - [PPL利用](https://tttang.com/archive/1743/) -- 安全客-有思想的安全新媒体 - - [新西兰拟修订《2020年隐私法》的通知义务](https://www.anquanke.com/post/id/280584) - - [针对法语非洲国家的大型金融机构攻击活动](https://www.anquanke.com/post/id/280576) - - [FBI：伊朗黑客在阿尔巴尼亚政府网络潜伏长达14个月](https://www.anquanke.com/post/id/280627) - - [巴西黑客发现拜仁官网漏洞告知俱乐部，获赠穆勒签名球衣](https://www.anquanke.com/post/id/280616) - - [关于勒索病毒你不得不懂的知识点](https://www.anquanke.com/post/id/280498) - - [距离压倒一切！近源渗透如何乱军中取上将之首](https://www.anquanke.com/post/id/280615) - - [英国将修改《在线安全法案》限制成年人“合法但有害”内容](https://www.anquanke.com/post/id/280566) - - [安全事件周报 (09.13-09.18)](https://www.anquanke.com/post/id/280612) - - [黑客活动猖獗：2K发公告表示服务网站遭到黑客攻击](https://www.anquanke.com/post/id/280608) - - [数字安全观察每周简报【行业动态篇】2022.09.07-2022.09.13](https://www.anquanke.com/post/id/280433) - - [马来西亚继续调查黑客入侵公务员工资系统](https://www.anquanke.com/post/id/280555) - - [《网络安全法》首次修订 监管加码反向拉升数字安全行业景气度](https://www.anquanke.com/post/id/280552) - - [Tomcat WebSocket内存马实现原理](https://www.anquanke.com/post/id/280529) -- Twitter @Nicolas Krassas - - [San Francisco Cops Can Now Use Private Cameras To Monitor Events](https://twitter.com/Dinosn/status/1572990702463623169) - - [AV Used By Millions Blocked All Google Sites By Mistake, Sowing Chaos](https://twitter.com/Dinosn/status/1572990688937246720) - - [Revealed: US Military Bought Mass Monitoring Tool That Includes Internet Browsing, Email Data](https://twitter.com/Dinosn/status/1572990581697310721) - - [Technical Advisory – Multiple Vulnerabilities in Juplink RX4-1800 WiFi Router (CVE-2022-37413, CVE-2022-37414)](https://twitter.com/Dinosn/status/1572990535316475905) - - [Making HTTP header injection critical via response queue poisoning](https://twitter.com/Dinosn/status/1572986879896682496) - - [Optus notifies customers of cyberattack compromising customer information](https://twitter.com/Dinosn/status/1572986842265563136) - - [Cambodian authorities crack down on cyber slavery amid international pressure](https://twitter.com/Dinosn/status/1572986789568323586) - - [Hackers stealing GitHub accounts using fake CircleCI notifications](https://twitter.com/Dinosn/status/1572986509195870208) - - [evilgophish: Combination of evilginx2 and GoPhish](https://twitter.com/Dinosn/status/1572968305408839683) - - [OSRipper - AV Evading OSX Backdoor And Crypter Framework](https://twitter.com/Dinosn/status/1572966525761355778) - - [A technical analysis of the leaked LockBit 3.0 builder](https://twitter.com/Dinosn/status/1572966410233561090) - - [IT Security Takeaways from the Wiseasy Hack](https://twitter.com/Dinosn/status/1572960495413469184) - - [Raspberry Robin’s Roshtyak: A Little Lesson in Trickery](https://twitter.com/Dinosn/status/1572922308615970818) - - [Researchers Disclose Critical Vulnerability in Oracle Cloud Infrastructure](https://twitter.com/Dinosn/status/1572912843225276416) - - [RT PortSwigger Research: Web cache poisoning makes everything better. Netlify’s Next.js exposed everyone using netlify-ipx including numerous Web3 si...](https://twitter.com/PortSwiggerRes/status/1572857855736434688) - - [RT DAssetTrade: Dear researchers, Launched bug bounty transaction!!! $7,000 locked in it. Anybody can try to hack the transaction and take out $7,000....](https://twitter.com/DassetTrade/status/1572854898110402561) - - [Collection of Azure Tools to Pull down for Attacking an Env](https://twitter.com/Dinosn/status/1572829022286913540) -- paper - Last paper - - [erlang-distribution-protocol 安全问题研究](https://paper.seebug.org/1978/) - - [CVE-2022-22963 SpringCloud Function SpEL 注入漏洞分析](https://paper.seebug.org/1977/) - - [CVE-2022-34916 Apache Flume 远程代码执行漏洞分析](https://paper.seebug.org/1976/) -- unSafe.sh - 不安全 - - [某开源堡垒机历史漏洞分析](https://buaq.net/go-127735.html) - - [Technical Advisory – Multiple Vulnerabilities in Juplink RX4-1800 WiFi Router (CVE-2022-37413, CVE-2022-37414)](https://buaq.net/go-127725.html) - - [Making HTTP header injection critical via response queue poisoning](https://buaq.net/go-127723.html) - - [A technical analysis of the leaked LockBit 3.0 builder](https://buaq.net/go-127720.html) - - [Medtronic's MiniMed 600 series insulin pumps potentially at risk of compromise, says FDA](https://buaq.net/go-127757.html) - - [Five Things You Need to Start Right Now to Get Ready for PCI DSS v4.0](https://buaq.net/go-127724.html) - - [Protecting a Hot Wallet Service](https://buaq.net/go-127722.html) -- Security Boulevard - - [The Reason You Need to Have Complete Visibility of all Your Assets and Security Controls](https://securityboulevard.com/2022/09/the-reason-you-need-to-have-complete-visibility-of-all-your-assets-and-security-controls/) - - [Student Arrested for Threatening Nuclear Attack Over Sports Event](https://securityboulevard.com/2022/09/student-arrested-for-threatening-nuclear-attack-over-sports-event/) - - [Integrating code security tools with developer workflows](https://securityboulevard.com/2022/09/integrating-code-security-tools-with-developer-workflows/) - - [SafeBreach Coverage for US-CERT Alert (AA22-264A) – HomeLand Justice Threat Group](https://securityboulevard.com/2022/09/safebreach-coverage-for-us-cert-alert-aa22-264a-homeland-justice-threat-group/) - - [From Data Breach to Dependable Alert](https://securityboulevard.com/2022/09/from-data-breach-to-dependable-alert/) - - [Wicked Good Development Episode 15: Russ Eling Talks Founding OSS Consultants and Open Source Compliance](https://securityboulevard.com/2022/09/wicked-good-development-episode-15-russ-eling-talks-founding-oss-consultants-and-open-source-compliance/) - - [Video: 5 Ps to Start Quantitative Risk Management – No 5 Performance](https://securityboulevard.com/2022/09/video-5-ps-to-start-quantitative-risk-management-no-5-performance/) - - [Five Key Takeaways from the 2022 Channel Futures MSP Summit](https://securityboulevard.com/2022/09/five-key-takeaways-from-the-2022-channel-futures-msp-summit/) - - [BSidesLV 2022 Lucky13 BreakingGround – Eric Kuehn’s, Mic Whitehorn-Gillam’s ‘Cookie Monster: Exfiltrating Data And More, Byte By Tasty Byte’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-breakingground-eric-kuehns-mic-whitehorn-gillams-cookie-monster-exfiltrating-data-and-more-byte-by-tasty-byte/) - - [The Week in Cybersecurity: Is Lapsus$ back in action?](https://securityboulevard.com/2022/09/the-week-in-cybersecurity-is-lapsus-back-in-action/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [奇安信获AutoSec安全之星2022年度汽车网络安全突出贡献奖](https://www.4hou.com/posts/03m7) - - [漏洞预警|Apache Kafka 拒绝服务漏洞](https://www.4hou.com/posts/6Vv7) - - [权威研报：知道创宇抗DDoS产品居市场竞争力领导者象限](https://www.4hou.com/posts/7Jww) - - [侠盗猎车手游戏源码和视频泄露](https://www.4hou.com/posts/17n3) - - [俄罗斯Sandworm黑客冒充乌克兰电信公司投放恶意软件](https://www.4hou.com/posts/PJ9z) - - [Lilith僵尸网络及其背后的Jester黑客团伙跟进分析](https://www.4hou.com/posts/oJmK) - - [提升公众反诈意识 共筑坚实防线：腾讯“反诈在行动”助力全民反诈](https://www.4hou.com/posts/2JoJ) -- Envato Tuts+ Code - Mobile Development - - [Understanding Native, WebView, and Hybrid Templates for Android Apps in 2022](https://code.tutsplus.com/articles/understanding-native-webview-and-hybrid-templates-for-android-apps--cms-33473) -- Sucuri Blog - - [How to Fix Google Ads Disapproved Due to Malicious Software](https://blog.sucuri.net/2022/09/how-to-fix-google-ads-disapproved-due-to-malicious-software.html) -- GuidePoint Security - - [Five Things You Need to Start Right Now to Get Ready for PCI DSS v4.0](https://www.guidepointsecurity.com/blog/five-things-you-need-to-start-right-now-to-get-ready-for-pci-dss-v4-0/) -- Bug Bounty in InfoSec Write-ups on Medium - - [OSINT Information Gathering with Informer](https://infosecwriteups.com/osint-information-gathering-with-informer-28176a704cf6?source=rss----7b722bfd1b8d--bug_bounty) - - [How I hacked an exam portal and got access to 10K+ users data including webcams](https://infosecwriteups.com/how-i-hacked-exam-portal-and-got-access-to-10k-users-data-including-webcams-ec2262b43df7?source=rss----7b722bfd1b8d--bug_bounty) -- Forcepoint - - [Protecting a Hot Wallet Service](https://www.forcepoint.com/blog/x-labs/protecting-hot-wallet-service) -- Malwarebytes Labs - - [Medtronic's MiniMed 600 series insulin pumps potentially at risk of compromise, says FDA](https://www.malwarebytes.com/blog/news/2022/09/medtronics-minimed-600-series-insulin-pumps-potentially-at-risk-of-compromise-says-fda) - - [Update Firefox and Thunderbird now! Mozilla patches several high risk vulnerabilities](https://www.malwarebytes.com/blog/news/2022/09/update-firefox-and-thunderbird-now-mozilla-patches-several-high-risk-vulnerabilities) - - [Morgan Stanley's years-long "extensive failure" to protect customer data ends in huge fine](https://www.malwarebytes.com/blog/news/2022/09/morgan-stanleys-years-long-extensive-failure-to-protect-customer-data-ends-in-huge-fine) - - [2K games helpdesk abused to spread RedLine malware](https://www.malwarebytes.com/blog/news/2022/09/2k-games-helpdesk-abused-to-spread-redline-malware) -- Didier Stevens - - [Quickpost: Tuning The Electric Energy Consumption Of My TV](https://blog.didierstevens.com/2022/09/22/quickpost-tuning-the-electric-energy-consumption-of-my-tv/) -- PortSwigger Research - - [Making HTTP header injection critical via response queue poisoning](https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning) -- Reverse Engineering - - [Quokka: A Fast and Accurate Binary Exporter](https://www.reddit.com/r/ReverseEngineering/comments/xl6g6m/quokka_a_fast_and_accurate_binary_exporter/) - - [A technical analysis of the leaked LockBit 3.0 builder](https://www.reddit.com/r/ReverseEngineering/comments/xl26dw/a_technical_analysis_of_the_leaked_lockbit_30/) - - [Raspberry Robin’s Roshtyak: A Little Lesson in Trickery](https://www.reddit.com/r/ReverseEngineering/comments/xky2f2/raspberry_robins_roshtyak_a_little_lesson_in/) - - [Unflattening ConfuserEx .NET Code in IDA](https://www.reddit.com/r/ReverseEngineering/comments/xl0mga/unflattening_confuserex_net_code_in_ida/) - - [Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions](https://www.reddit.com/r/ReverseEngineering/comments/xks4wz/efficient_deobfuscation_of_linear_mixed/) -- Sucuri Blog - - [How to Fix Google Ads Disapproved Due to Malicious Software](https://blog.sucuri.net/2022/09/how-to-fix-google-ads-disapproved-due-to-malicious-software.html) -- SAP Blogs - - [Best SAP Cloud Application stack 🛡](https://blogs.sap.com/2022/09/22/best-sap-cloud-application-stack-%f0%9f%9b%a1/) - - [Change owner of content resources](https://blogs.sap.com/2022/09/22/now-you-can-change-owner-of-your-content-resources/) - - [CPG Roadshow: Accelerate innovations with sustainability](https://blogs.sap.com/2022/09/22/cpg-roadshow-accelerate-innovations-with-sustainability/) - - [Introduction to the Live Session: Getting Started on SAP Commerce Cloud Spartacus Development](https://blogs.sap.com/2022/09/22/introduction-to-the-live-session-getting-started-on-sap-commerce-cloud-spartacus-development/) - - [Issues we experienced when transferring data from SAP to Azure Data Lake in SAP DS](https://blogs.sap.com/2022/09/22/issues-we-experienced-when-transferring-data-from-sap-to-azure-data-lake-in-sap-ds/) - - [EU Taxonomy for Financial Companies – The Green Asset Ratio](https://blogs.sap.com/2022/09/22/eu-taxonomy-for-financial-companies-the-green-asset-ratio/) - - [Third-Party Order Processing in SAP Business ByDesign system](https://blogs.sap.com/2022/09/22/third-party-order-processing-in-sap-business-bydesign-system/) - - [RAP Node Extensibility – How to create a custom child node for standard object](https://blogs.sap.com/2022/09/22/rap-node-extensibility-how-to-create-a-custom-child-node-for-standard-object/) - - [Technical Details for SAP TM Planning Profile and Settings](https://blogs.sap.com/2022/09/22/technical-details-for-sap-tm-planning-profile-and-settings/) - - [8 ways to increase your query performance in SAP Data Warehouse Cloud when federating from Big Query](https://blogs.sap.com/2022/09/22/8-ways-to-increase-your-query-performance-in-sap-data-warehouse-cloud-when-federating-from-big-query/) -- daniel.haxx.se - - [Taking curl documentation quality up one more notch](https://daniel.haxx.se/blog/2022/09/22/taking-curl-documentation-quality-up-one-more-notch/) -- bishopfox.com - - [(In)Secure by Design](https://bishopfox.com/blog/in-secure-by-design) -- KitPloit - PenTest & Hacking Tools - - [OSRipper - AV Evading OSX Backdoor And Crypter Framework](http://www.kitploit.com/2022/09/osripper-av-evading-osx-backdoor-and.html) -- HackerNews - - [五分之二美国消费者数据被盗，企业也难逃攻击者“毒手”](https://hackernews.cc/archives/41658) - - [未打补丁的 Atlassian Confluence 服务器被黑客部署加密矿工](https://hackernews.cc/archives/41651) - - [深陷安全事件泥潭，优步数据泄露何时休？](https://hackernews.cc/archives/41645) - - [Imperva 拦截了 253 亿请求的 DDoS 攻击](https://hackernews.cc/archives/41641) - - [美国 FCC 将中国联通、太平洋网络列入国家安全威胁名单](https://hackernews.cc/archives/41638) - - [2K Games 公告：其支持社区遭黑客入侵，请勿打开相关电子邮件](https://hackernews.cc/archives/41634) - - [韩国战争纪念馆遭黑客网络攻击，官方称未泄露军事资料](https://hackernews.cc/archives/41631) - - [欧洲又一国家议会遭攻击，工作停顿多天](https://hackernews.cc/archives/41628) -- The Daily Swig | Cybersecurity news and views - - [Tarfile path traversal bug from 2007 still present in 350k open source repos](https://portswigger.net/daily-swig/tarfile-path-traversal-bug-from-2007-still-present-in-350k-open-source-repos) -- 体验盒子 - - [PHP四种相似度检测方案+改进计算字符串相似度的函数similar_text()、levenshtein()](https://www.uedbox.com/post/68558/) -- 奇客Solidot–传递最新科技情报 - - [Ask.FM 3.5 亿用户数据库在黑客论坛出售](https://www.solidot.org/story?sid=72850) - - [Telegram 上的人肉搜索问题](https://www.solidot.org/story?sid=72849) - - [NASA 准备测试飞行器将小行星撞离轨道](https://www.solidot.org/story?sid=72848) - - [中年做噩梦可能是认知衰退的信号](https://www.solidot.org/story?sid=72847) - - [研究发现高脂肪饮食会刺激骨骼产生炎症免疫细胞](https://www.solidot.org/story?sid=72846) - - [美国 Charter 通信公司因其技工谋杀客户被罚 11 亿美元](https://www.solidot.org/story?sid=72845) - - [苹果计划到 2025 年将四分之一的生产转移到印度](https://www.solidot.org/story?sid=72844) - - [Getty Images 禁止 AI 生成的图像](https://www.solidot.org/story?sid=72843) - - [Larry Page 投资的飞车公司裁员](https://www.solidot.org/story?sid=72842) - - [Meta 计划削减至少 10% 的开支](https://www.solidot.org/story?sid=72841) - - [英伟达 CEO 称显卡降价早已是过去时](https://www.solidot.org/story?sid=72840) - - [伊朗再次切断互联网和移动服务](https://www.solidot.org/story?sid=72839) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 韩国战争纪念馆遭黑客攻击；中国联通回应被美FCC列入安全威胁清单](https://www.freebuf.com/news/345329.html) - - [开源代码库攻击在三年间暴涨7倍](https://www.freebuf.com/news/345307.html) - - [五分之二美国消费者数据被盗,企业也难逃攻击者“毒手”](https://www.freebuf.com/news/345281.html) - - [WebSocket的利用方式](https://www.freebuf.com/articles/web/345226.html) -- 博客园 - 渗透测试中心 - - [2022年第五空间网络安全大赛WriteUp - 渗透测试中心](https://www.cnblogs.com/backlion/p/16717964.html) -- 绿盟科技研究通讯 - - [攻击推理，一文了解“离地攻击”的攻与防](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247493414&idx=1&sn=727e4cb0d0a222632f495b2a1d0665d3&chksm=e84c41f9df3bc8ef45363224737df76ffd0d722e65c6d84e49bf34bc542d5ce50c4452e68890&scene=58&subscene=0#rd) -- 黑海洋 - WIKI - - [亚马逊Amazon S3 CloudBerry Explorerv 授权破解版](https://blog.upx8.com/2997) - - [AWS 域转移到其他AWS账号](https://blog.upx8.com/2996) -- 代码卫士 - - [Cobalt Strike 远程代码执行漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514056&idx=1&sn=489ac21f2dc7107d9761186e3dd7d283&chksm=ea9486a2dde30fb4eafe6158ad59e258c50a18c960de4de7dea19ef5248f190232c7019708d1&scene=58&subscene=0#rd) -- 安全牛 - - [奇安信获AutoSec安全之星2022年度汽车网络安全突出贡献奖](https://www.aqniu.com/vendor/89421.html) - - [白山云零信任Access2.0升级发布，让办公安全更简单、更高效！](https://www.aqniu.com/vendor/89413.html) - - [安全牛课堂 丨 医疗健康行业数据安全治理实践访谈录](https://www.aqniu.com/homenews/89401.html) - - [简析企业供应链安全的风险挑战与管理实践](https://www.aqniu.com/hometop/89400.html) - - [SharkTeam：十大智能合约安全威胁之函数恶意初始化](https://www.aqniu.com/vendor/89381.html) - - [数字医疗时代的数据安全如何保障？](https://www.aqniu.com/industry/89376.html) - - [一体机支持使用硬件设备的国密加密，支持用户自定义认证逻辑，JumpServer堡垒机v2.26.0发布](https://www.aqniu.com/industry/89361.html) - - [Coremail邮件安全提醒：企业年审，银行通知必须加入QQ群？被盯上的财务，小心诈骗邮件](https://www.aqniu.com/industry/89351.html) -- 安全圈 - - [【安全圈】学信网信息泄露！别让信息裸奔，现已立案调查](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018219&idx=1&sn=85d88a9405659b68790a714674e5c28e&chksm=f36fba6bc418337d1cc8211f72fb160866d0fee61b1fdc85760e0066e583a886997fd6320638&scene=58&subscene=0#rd) - - [【安全圈】被罚2.47亿：42台服务器丢失，泄露 1500 万客户数据！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018219&idx=2&sn=76a84c8df8d465b018392706be81510e&chksm=f36fba6bc418337dda2ae38bc7de1a922fae9a1890a95e4a15337ace88bd0dd3cc0d4f26fa29&scene=58&subscene=0#rd) - - [【安全圈】警惕！黑客在 Microsoft Edge 新闻源页面投放诈骗广告](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018219&idx=3&sn=af70a7014009325181243e95c8b2f8b5&chksm=f36fba6bc418337d7746d345bfc1179d9cb39eb0ae9b53111c1fa9463173a35c9f191d9beed7&scene=58&subscene=0#rd) - - [【安全圈】小心！使用谷歌等浏览器内置的增强拼写检查将被泄密](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018219&idx=4&sn=4d499652d014fa5b7593c0db53a0c4e6&chksm=f36fba6bc418337d2db7134b6b6ca72a6d2415c8dfb091dde952aeebc247000e6a1895c0ab4b&scene=58&subscene=0#rd) - - [【安全圈】黑客窃取 1.62 亿美元加密货币资产！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018219&idx=5&sn=acf14f39abe9602977c25cc7279520d6&chksm=f36fba6bc418337dd1455c752bbd969f610f092e49c82aa8d508a56d9408ba7ab4d1351d6a20&scene=58&subscene=0#rd) - - [【安全圈】伊朗本周一再次发生严重的互联网服务中断](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018219&idx=6&sn=fa7cfd887d74fdc53a28fa59e5c28210&chksm=f36fba6bc418337d626cf950dcc875e961854877427c13ebbd304996c07fff8d0030b24c4e76&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [浅析GDPR中的个人数据访问权](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247489382&idx=1&sn=06bde0565ab562349cac2c9cd19aaedb&chksm=e9b9310adeceb81ca2294dec93247cf0348174b744d51169a17a356f9c6ec3de0ecc38c3b706&scene=58&subscene=0#rd) -- 美团安全应急响应中心 - - [高校挑战赛 | MT-CTF初赛结果揭晓，决赛战斗一触即发！](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247490477&idx=1&sn=dfa8a565fd97f1ba9ab1e8e79b749df9&chksm=ec1bfa7edb6c736843b28d75f6a801e8438ab426c8a01bc9c7472a875a46f537b4772f050c9a&scene=58&subscene=0#rd) - - [参赛手册 ｜ MT- CTF决赛参赛手册，请选手们仔细阅读](https://mp.weixin.qq.com/s?__biz=MzI5MDc4MTM3Mg==&mid=2247490477&idx=2&sn=bac864cf9724d7bf80850852f892535e&chksm=ec1bfa7edb6c7368a8aa1fa8ce9893aaa5f215e5ceb9c1b680ad677e813692e7dfdc874ea8d7&scene=58&subscene=0#rd) -- Black Hills Information Security - - [Talkin’ About Infosec News – 9/22/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-9-22-2022/) - - [Avoiding Memory Scanners](https://www.blackhillsinfosec.com/avoiding-memory-scanners/) -- 字节跳动技术团队 - - [Flink OLAP 助力 ByteHTAP 亮相数据库顶会 VLDB](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247499035&idx=1&sn=b06788904270e262e0befd4454f4ce9a&chksm=e9d336f9dea4bfefbcdef6830c7a059be1834cfda8fab7980fb208911803262f30673014a5d2&scene=58&subscene=0#rd) -- Yak Project - - [插件分析|Yaklang SQL Injection 检测启发式算法](https://mp.weixin.qq.com/s?__biz=Mzk0MTM4NzIxMQ==&mid=2247490841&idx=1&sn=f3f6fbffd9bfde4aa9cf0d17cff1621d&chksm=c2d261bdf5a5e8abb7fe9caaf3d54c838ffb03b9f382ad0071c0d3dea7b58bad979b087cd156&scene=58&subscene=0#rd) - - [Yakit插件征集活动获奖名单出炉！](https://mp.weixin.qq.com/s?__biz=Mzk0MTM4NzIxMQ==&mid=2247490841&idx=2&sn=f411e00c17169e713378913d56135de0&chksm=c2d261bdf5a5e8ab6cc0f08578248ded40087aec2762b95979881102b7e5e07b192916837f82&scene=58&subscene=0#rd) -- 网安国际 - - [【网络安全研究进展系列】CROSSLINE 攻击：打破 AMD 安全加密虚拟化的“通过崩溃实现安全”的内存壁垒](https://mp.weixin.qq.com/s?__biz=MzA4ODYzMjU0NQ==&mid=2652311569&idx=1&sn=e1a098d5ca251dab40fccdbb251df44d&chksm=8bc48d9fbcb30489ad62070ed7c1518b2776639d7b6a57fda848dd7237aee8eb2c2291e3bfaa&scene=58&subscene=0#rd) -- 字节跳动安全中心 - - [重新起航 | 9.26日安全范儿约你共论云安全实战之道](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247489754&idx=1&sn=1fcc135abd349621a4176097b4f0f2f6&chksm=fa9ee38ccde96a9ac42c64e13bafd050c922f694e3e9c955802503cadad215bcb006f41ce14d&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-24.md b/archive/2022/2022-09-24.md deleted file mode 100644 index 906d24ace3..0000000000 --- a/archive/2022/2022-09-24.md +++ /dev/null @@ -1,223 +0,0 @@ -# 每日安全资讯（2022-09-24） - -- Twitter @Nicolas Krassas - - [Apparently Europol Is Hoarding Personal Data](https://twitter.com/Dinosn/status/1573378184820969472) - - [ModSecurity WAF bypasses via 0days](https://twitter.com/Dinosn/status/1573377377421651968) - - [Sony Reintroduced A PS4 Bug On PS5 Which Could Have Led To A Jailbreak](https://twitter.com/Dinosn/status/1573377327480045569) - - [npm packages used by crypto exchanges compromised](https://twitter.com/Dinosn/status/1573377216871862274) - - [UK Police arrests teen believed to be behind Uber, Rockstar hacks](https://twitter.com/Dinosn/status/1573376533951303681) - - [Tool for Sizing Solidity Smart Contract Audits](https://twitter.com/Dinosn/status/1573376180904132608) - - [Researchers Uncover New Metador APT Targeting Telcos, ISPs, and Universities](https://twitter.com/Dinosn/status/1573376103938666498) - - [Sophos warns of new firewall RCE bug exploited in attacks](https://twitter.com/Dinosn/status/1573376055427170304) - - [Iran blocks Whatsapp, Instagram as citizens protest death of Mahsa Amini](https://twitter.com/Dinosn/status/1573361363346681857) - - [SSRF vulnerabilities and where to find them](https://twitter.com/Dinosn/status/1573299874124251136) - - [bbot: OSINT automation for hackers](https://twitter.com/Dinosn/status/1573297873944551424) - - [Conti Ransom / Arbitrary Code Execution](https://twitter.com/Dinosn/status/1573281079083077632) - - [BigQuery SQL Injection Cheat Sheet](https://twitter.com/Dinosn/status/1573280853093978114) - - [Leaking Screen Information on Zoom Calls through Reflections in Eyeglasses](https://twitter.com/Dinosn/status/1573280803978878976) - - [RDPHijack: uses WinStationConnect API to perform local/remote RDP session hijacking](https://twitter.com/Dinosn/status/1573278499468722177) - - [RT kmkz: Our exploit is now publicly available: #firefox #exploit](https://twitter.com/kmkz_security/status/1573275949449224193) - - [Australian Telecoms company Optus discloses security breach](https://twitter.com/Dinosn/status/1573274376027480064) - - [TAP Air Portugal - 5,067,990 breached accounts](https://twitter.com/Dinosn/status/1573274268971974657) - - [RT SickSec 🇲🇦: Great JSON-FUZZER ✌️ SQL Injection Command Injection LDAP Injection NoSQL Injection Format String Injection Local File Inclusio...](https://twitter.com/OriginalSicksec/status/1573241713975775233) -- SecWiki News - - [SecWiki News 2022-09-23 Review](http://www.sec-wiki.com/?2022-09-23) -- Sploitus.com Exploits RSS Feed - - [Multix 2.4 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37988&utm_source=rss&utm_medium=rss) - - [Wordpress WP-UserOnline 2.88.0 Plugin - Stored Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37982&utm_source=rss&utm_medium=rss) - - [Multix 2.4 Cross Site Request Forgery Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37987&utm_source=rss&utm_medium=rss) - - [TP-Link Tapo c200 1.1.15 - Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37979&utm_source=rss&utm_medium=rss) - - [TP-Link Tapo c200 1.1.15 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168472&utm_source=rss&utm_medium=rss) - - [WordPress 3dady Real-Time Web Stats 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168480&utm_source=rss&utm_medium=rss) - - [Teleport v10.1.1 - Remote Code Execution Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37981&utm_source=rss&utm_medium=rss) - - [Feehi CMS 2.1.1 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168476&utm_source=rss&utm_medium=rss) - - [Feehi CMS 2.1.1 - Remote Code Execution (Authenticated) Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37980&utm_source=rss&utm_medium=rss) - - [WordPress WP-UserOnline 2.88.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168479&utm_source=rss&utm_medium=rss) - - [WorkOrder CMS 0.1.0 Cross Site Scripting / SQL Injection Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-37986&utm_source=rss&utm_medium=rss) - - [Bitbucket Git Command Injection Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37985&utm_source=rss&utm_medium=rss) - - [Testa 3.5.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168474&utm_source=rss&utm_medium=rss) - - [Wordpress 3dady real-time web stats 1.0 Plugin - Stored Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37983&utm_source=rss&utm_medium=rss) - - [Teleport 10.1.1 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168477&utm_source=rss&utm_medium=rss) - - [Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37984&utm_source=rss&utm_medium=rss) - - [Exploit for Cross-site Scripting in Helpsystems Cobalt Strike exploit](https://sploitus.com/exploit?id=E57D7390-D325-5650-B6FC-64843D9D8268&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Atlassian Bitbucket exploit](https://sploitus.com/exploit?id=FF5905BF-CFF6-58CC-95A4-32C01239A6CF&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=695F2F3F-E377-59B0-8A5F-4D36BE54BA18&utm_source=rss&utm_medium=rss) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-sept-23) -- Recent Commits to cve:main - - [Update Fri Sep 23 10:02:12 UTC 2022](https://github.com/trickest/cve/commit/f0e347d20789e52f00b4b259b5bd8f1944a9eb98) -- ElcomSoft blog - - [iOS 16: SEP Hardening, New Security Measures and Their Forensic Implications](https://blog.elcomsoft.com/2022/09/ios-16-sep-hardening-new-security-measures-and-their-forensic-implications/) -- 跳跳糖 - 安全与分享社区 - - [Dubbo反序列化漏洞分析集合2](https://tttang.com/archive/1747/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [一部以网络安全为题材的网络剧——《你安全吗？》](https://www.4hou.com/posts/nJo4) - - [XCon专访 | 百度安全部副总经理冯景辉：百度AI安全建设的两个核心要点](https://www.4hou.com/posts/l6ml) - - [Linux恶意软件兴起：保护开源软件（OSS）的9个技巧](https://www.4hou.com/posts/vJ7V) - - [TeamTNT 的 DockerHub 凭据泄露漏洞](https://www.4hou.com/posts/KE2r) -- 安全客-有思想的安全新媒体 - - [勒索病毒 Phobos v2.9.1 版本分析](https://www.anquanke.com/post/id/280634) - - [黑客利用虚假CircleCI 通知窃取GitHub帐户](https://www.anquanke.com/post/id/280685) - - [Magento漏洞被广泛用户黑客攻击活动](https://www.anquanke.com/post/id/280680) - - [15年前未修补Python漏洞或影响35万+项目](https://www.anquanke.com/post/id/280661) - - [Ask.FM 3.5 亿用户数据库在黑客论坛出售](https://www.anquanke.com/post/id/280657) - - [数字安全观察每周简报【政策消息篇】2022.09.07-2022.09.13](https://www.anquanke.com/post/id/280439) - - [澳大利亚Optus遭受重大网络攻击，多达900万用户受影响](https://www.anquanke.com/post/id/280652) - - [自下而上的规范制定与网络安全国际规范的生成](https://www.anquanke.com/post/id/280587) - - [万代证实用户信息因黑客攻击泄露 但暂未收到勒索](https://www.anquanke.com/post/id/280648) - - [FBI：伊朗黑客在阿尔巴尼亚政府网络潜伏长达14个月](https://www.anquanke.com/post/id/280631) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5629-1](https://packetstormsecurity.com/files/168482/USN-5629-1.txt) - - [Ubuntu Security Notice USN-5631-1](https://packetstormsecurity.com/files/168481/USN-5631-1.txt) - - [WordPress 3dady Real-Time Web Stats 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/168480/wp3dadyrtws10-xss.txt) - - [WordPress WP-UserOnline 2.88.0 Cross Site Scripting](https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txt) - - [Ubuntu Security Notice USN-5632-1](https://packetstormsecurity.com/files/168478/USN-5632-1.txt) - - [Teleport 10.1.1 Remote Code Execution](https://packetstormsecurity.com/files/168477/teleport1011-exec.txt) - - [Feehi CMS 2.1.1 Remote Code Execution](https://packetstormsecurity.com/files/168476/feehicms211-exec.txt) - - [Ubuntu Security Notice USN-5634-1](https://packetstormsecurity.com/files/168475/USN-5634-1.txt) - - [Testa 3.5.1 Cross Site Scripting](https://packetstormsecurity.com/files/168474/testa351-xss.txt) - - [Ubuntu Security Notice USN-5633-1](https://packetstormsecurity.com/files/168473/USN-5633-1.txt) - - [TP-Link Tapo c200 1.1.15 Remote Code Execution](https://packetstormsecurity.com/files/168472/tplinktapoc2001115-exec.txt) - - [Ubuntu Security Notice USN-5630-1](https://packetstormsecurity.com/files/168471/USN-5630-1.txt) -- 安全脉搏 - - [干货 | WordPress网站渗透方法指南](https://www.secpulse.com/archives/187638.html) - - [端口开放测试](https://www.secpulse.com/archives/187604.html) - - [蜻蜓点水binlog](https://www.secpulse.com/archives/187589.html) -- Blog & What's New | Offensive Security - - [In the Hunt for the Auto Login Setup Process](https://www.offensive-security.com/offsec/in-the-hunt-for-the-auto-login-setup-process/) -- Security Boulevard - - [Why Winston Churchill Named America’s M4 Tank “Sherman”](https://securityboulevard.com/2022/09/why-winston-churchill-named-americas-m4-tank-sherman/) - - [StackHawk Expands API Security Testing Suite](https://securityboulevard.com/2022/09/stackhawk-expands-api-security-testing-suite/) - - [BSidesLV 2022 Lucky13 BreakingGround – Shreyas Rami’s, Shaun Jones’ ‘Ransomware Emulation Done Right’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-breakingground-shreyas-ramis-shaun-jones-ransomware-emulation-done-right/) - - [Accused Russian RSOCKS Botmaster Arrested, Requests Extradition to U.S.](https://securityboulevard.com/2022/09/accused-russian-rsocks-botmaster-arrested-requests-extradition-to-u-s/) - - [The Increasing Insider Risk of Emerging Healthcare Technology](https://securityboulevard.com/2022/09/the-increasing-insider-risk-of-emerging-healthcare-technology/) - - [Daniel Stori’s ‘The Ketchup Gun’](https://securityboulevard.com/2022/09/daniel-storis-the-ketchup-gun/) - - [WEBINAR: Bundling Up: The Importance of Layering Offensive Security Solutions](https://securityboulevard.com/2022/09/webinar-bundling-up-the-importance-of-layering-offensive-security-solutions/) - - [How Russians Are Reacting to Putin’s Conscription Gamble](https://securityboulevard.com/2022/09/how-russians-are-reacting-to-putins-conscription-gamble/) - - [Active Directory Attack Scenarios: The Path from Printer to Domain Admin](https://securityboulevard.com/2022/09/active-directory-attack-scenarios-the-path-from-printer-to-domain-admin/) - - [Telepathic Declassification](https://securityboulevard.com/2022/09/telepathic-declassification/) -- gynvael.coldwind//vx.log (en) - - [Crow HTTP framework use-after-free](https://gynvael.coldwind.pl/?id=753) - - [Crowbleed (Crow HTTP framework vulnerability)](https://gynvael.coldwind.pl/?id=752) -- unSafe.sh - 不安全 - - [In the Hunt for the Auto Login Setup Process](https://buaq.net/go-127880.html) - - [从软件仓库中移除了 python2](https://buaq.net/go-127867.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 39](https://buaq.net/go-127872.html) - - [Native function and Assembly Code Invocation - Check Point Research [IDA Appcall,Dumpulator,Unicorn Engine]](https://buaq.net/go-127870.html) - - [How I Found Multiple SQL Injections in 5 Minutes in Bug Bounty](https://buaq.net/go-127862.html) - - [Bypassing CSRF Protection (II)](https://buaq.net/go-127863.html) - - [Commercial software licenses in software due diligence](https://buaq.net/go-127864.html) - - [CobaltStrike XSS利用新姿势](https://buaq.net/go-127861.html) - - [iOS 16: SEP Hardening, New Security Measures and Their Forensic Implications](https://buaq.net/go-127859.html) - - [SCodeScanner - Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities](https://buaq.net/go-127860.html) - - [PotPlayer：长按右箭头键实现三倍速播放[AHK]](https://buaq.net/go-127850.html) - - [干货 | WordPress网站渗透方法指南](https://buaq.net/go-127855.html) - - [@你，招人！本周岗位更新](https://buaq.net/go-127858.html) - - [一部以网络安全为题材的网络剧——《你安全吗？》](https://buaq.net/go-127848.html) - - [本周看什么 | 最近值得一看的 6 部作品](https://buaq.net/go-127854.html) -- NVISO Labs - - [Cortex XSOAR Tips & Tricks – Creating indicator relationships in integrations](https://blog.nviso.eu/2022/09/23/cortex-xsoar-tips-tricks-creating-indicator-relationships-in-integrations/) -- Bug Bounty in InfoSec Write-ups on Medium - - [How I Found Multiple SQL Injections in 5 Minutes in Bug Bounty](https://infosecwriteups.com/how-i-found-multiple-sql-injections-in-5-minutes-in-bug-bounty-40155964c498?source=rss----7b722bfd1b8d--bug_bounty) - - [Bypassing CSRF Protection (II)](https://infosecwriteups.com/bypassing-csrf-protection-ii-b479009b4a7a?source=rss----7b722bfd1b8d--bug_bounty) -- Securelist - - [Mass email campaign with a pinch of targeted spam](https://securelist.com/agent-tesla-malicious-spam-campaign/107478/) -- blog.avast.com EN - - [GTA 6: Massive footage leak](https://blog.avast.com/gta-footage-leak) - - [Netiquette: Is it OK to share pictures of someone else's kids online?](https://blog.avast.com/netiquette-share-pictures-children-online) -- Application Security Blog - - [Commercial software licenses in software due diligence](https://www.synopsys.com/blogs/software-security/commercial-software-licenses-software-due-diligence/) -- SAP Blogs - - [Attract and Win the Best Talent: 5 Key Takeaways from SuccessConnect 2022](https://blogs.sap.com/2022/09/23/attract-and-win-the-best-talent-5-key-takeaways-from-successconnect-2022/) - - [What’s New in the SAP HANA Database Explorer Visual Studio Code Extension Version 1.8](https://blogs.sap.com/2022/09/23/whats-new-in-the-sap-hana-database-explorer-visual-studio-code-extension-version-1.8/) - - [A futuristic experience with SAP and Deloitte at the Smart Factory @ Wichita](https://blogs.sap.com/2022/09/23/a-futuristic-experience-with-sap-and-deloitte-at-the-smart-factory-wichita/) - - [Expense Report Posting to S/4 from Concur and Error Handling](https://blogs.sap.com/2022/09/23/expense-report-posting-to-s-4-from-concur-and-error-handling/) - - [Connecting SAP Data Warehouse Cloud OData API with PowerBI via a Blank Query](https://blogs.sap.com/2022/09/23/connecting-sap-data-warehouse-cloud-odata-api-with-powerbi-via-a-blank-query-2/) - - [SAP HANA Cloud – Analytic Privileges (A step-by-step guide)](https://blogs.sap.com/2022/09/23/sap-hana-cloud-analytic-privileges-a-step-by-step-guide/) - - [The evolution of data initialization in SAC Planning](https://blogs.sap.com/2022/09/23/the-evolution-of-data-initialization-in-sac-planning/) - - [List of DDIC structures with invalid Enhancement Category](https://blogs.sap.com/2022/09/23/list-of-ddic-structures-with-invalid-enhancement-category/) - - [Create Hierarchy from non-SAP Source](https://blogs.sap.com/2022/09/23/create-hierarchy-from-non-sap-source/) - - [How to Use FM – Inputs for BAPI_PROCORD_CREATE / BAPI_PRODORD_CREATE / BAPI_TRANSACTION_COMMIT](https://blogs.sap.com/2022/09/23/how-to-use-fm-inputs-for-bapi_procord_create-bapi_prodord_create-bapi_transaction_commit/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 39](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-39-4/) -- The Daily Swig | Cybersecurity news and views - - [Netlify vulnerable to XSS, SSRF attacks via cache poisoning](https://portswigger.net/daily-swig/netlify-vulnerable-to-xss-ssrf-attacks-via-cache-poisoning) - - [CI/CD servers readily breached by abusing  SCM webhooks, researchers find](https://portswigger.net/daily-swig/ci-cd-servers-readily-breached-by-abusing-nbsp-scm-webhooks-researchers-find) - - [#AttachMe Oracle cloud bug exposed volumes to data theft, hijack](https://portswigger.net/daily-swig/attachme-oracle-cloud-bug-exposed-volumes-to-data-theft-hijack) -- Malwarebytes Labs - - [Malwarebytes recognized as endpoint security leader by G2](https://www.malwarebytes.com/blog/business/2022/09/malwarebytes-recognized-as-endpoint-security-leader-by-g2) - - [A first look at the builder for LockBit 3.0 Black](https://www.malwarebytes.com/blog/news/2022/09/lockbit-builder-leaked-by-disgruntled-developer) -- Hex Rays - - [Igor’s tip of the week #107: Multiple return values](https://hex-rays.com/blog/igors-tip-of-the-week-107-multiple-return-values/) -- Exploit-DB.com RSS Feed - - [[webapps] Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)](https://www.exploit-db.com/exploits/51023) - - [[webapps] Aero CMS v0.0.1 - SQLi](https://www.exploit-db.com/exploits/51022) - - [[webapps] Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)](https://www.exploit-db.com/exploits/51021) - - [[webapps] Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)](https://www.exploit-db.com/exploits/51020) - - [[remote] Teleport v10.1.1 - Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/51019) - - [[webapps] Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/51018) - - [[webapps] TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/51017) -- Reverse Engineering - - [Native function and Assembly Code Invocation - Check Point Research [IDA Appcall,Dumpulator,Unicorn Engine]](https://www.reddit.com/r/ReverseEngineering/comments/xlyep3/native_function_and_assembly_code_invocation/) - - [Druva inSync for Mac Local Privilege Escalation](https://www.reddit.com/r/ReverseEngineering/comments/xloqy5/druva_insync_for_mac_local_privilege_escalation/) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Upcoming Launch of Dancho Danchev's Dark Web Content Media Empire! Visit Us Today!](https://ddanchev.blogspot.com/2022/09/upcoming-launch-of-dancho-danchevs-dark.html) -- Twitter @bytehx - - [RT H4x0r.DZ: Backup Files (does not exist on any Fuzzing wordlist ! ) hostname*com/hostname.rar , .sql.tar & .tar.gz & .tar.bzip2 & .tar & .sql.bz2 & ...](https://twitter.com/h4x0r_dz/status/1573318682230530048) - - [RT Detectify: While #SSRFs are not a new threat vector, they are often misunderstood and confused with CSRFs. In this article, @hakluke outlines what ...](https://twitter.com/detectify/status/1573287583991439364) - - [RT Nicolas Krassas: BigQuery SQL Injection Cheat Sheet](https://twitter.com/Dinosn/status/1573280853093978114) - - [RT Lohitaksh Nandan: Mobile Application Penetration Testing Cheat Sheet #cybersecurity #bugbounty #bugbountytips #hacking](https://twitter.com/NandanLohitaksh/status/1573280841262051328) - - [RT Six2dez: This is a superb article for pentesting Cisco networks](https://twitter.com/Six2dez1/status/1573255369446797312) - - [RT Nicolas Krassas: Re @jas502n](https://twitter.com/Dinosn/status/1573183619128037383) -- Twitter @Keiran Smith (Affix) - - [RT George Eaton: A graduate earning £50k will pay a *higher* marginal rate (51%) than someone on £150K (42%) A graduate earning £25k will pay a 40%...](https://twitter.com/georgeeaton/status/1573249403795939328) -- 博客园 - 渗透测试中心 - - [红队框架列表 - 渗透测试中心](https://www.cnblogs.com/backlion/p/16721896.html) -- HackerNews - - [研究人员披露了 Oracle 云基础设施中的严重漏洞，现已修复](https://hackernews.cc/archives/41665) - - [攻击洛杉矶学区的黑客团伙向校方发出赎金要求](https://hackernews.cc/archives/41663) -- webs3c - Latest posts - - [A Detailed Talk about K8S Cluster Security from the Perspective of Attackers (Part 2)](https://webs3c.com/t/a-detailed-talk-about-k8s-cluster-security-from-the-perspective-of-attackers-part-2/213#post_1) - - [A Detailed Talk about K8S Cluster Security from the Perspective of Attackers (Part 1)](https://webs3c.com/t/a-detailed-talk-about-k8s-cluster-security-from-the-perspective-of-attackers-part-1/212#post_1) -- 黑海洋 - WIKI - - [一条命令绕过宝塔强制绑定账号](https://blog.upx8.com/2998) -- KitPloit - PenTest & Hacking Tools - - [SCodeScanner - Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities](http://www.kitploit.com/2022/09/scodescanner-stands-for-source-code.html) -- Think -Love -Share - - [Pre-Auth Remote Code Execution - Web Page Test](https://thinkloveshare.com/hacking/preauth_remote_code_execution_web_page_test/) -- 博客园 - 郑瀚Andrew - - [设计思考者 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16712800.html) -- 绿盟科技技术博客 - - [VMware 16+Ubuntu 22安装VMwareTools](http://blog.nsfocus.net/vmware-16ubuntu-22vmwaretools/) -- 杨龙 - - [Nginx限流](https://www.yanglong.pro/nginx%e9%99%90%e6%b5%81/) -- 奇客Solidot–传递最新科技情报 - - [英国病毒治疗癌症临床试验取得成果](https://www.solidot.org/story?sid=72864) - - [Jingyao Liu 诉刘强东案将于下月初庭审](https://www.solidot.org/story?sid=72863) - - [Facebook 可能在明年一月解除对特朗普账号的封锁](https://www.solidot.org/story?sid=72862) - - [Google FCM 被屏蔽](https://www.solidot.org/story?sid=72861) - - [奥密克戎仍是新冠最主要变异株](https://www.solidot.org/story?sid=72860) - - [参与四天工作制试点的企业称生产力没有下降](https://www.solidot.org/story?sid=72859) - - [摩根大通 CEO 称加密代币是去中心化庞氏骗局](https://www.solidot.org/story?sid=72858) - - [Google 挑战杜比全景声和杜比视界](https://www.solidot.org/story?sid=72857) - - [更多华裔科学家返回中国](https://www.solidot.org/story?sid=72856) - - [伊朗限制访问 Instagram 和 WhatsApp](https://www.solidot.org/story?sid=72855) - - [波音同意支付 2 亿美元和解 737 MAX 坠机相关调查](https://www.solidot.org/story?sid=72854) - - [汤加火山喷发短期加剧全球暖化](https://www.solidot.org/story?sid=72853) - - [《环球时报》报道指 NSA 入侵电信基础网络设施](https://www.solidot.org/story?sid=72852) - - [日本将开放入境](https://www.solidot.org/story?sid=72851) -- 安全牛 - - [无惧勒索攻击风暴 「方舟」勒索治理体检中心上线](https://www.aqniu.com/vendor/89452.html) - - [威胁暴露面管理（CTEM）应用优化的三大要点](https://www.aqniu.com/hometop/89441.html) - - [提升安全事件响应能力的难点与建议](https://www.aqniu.com/homenews/89442.html) - - [安全牛课堂丨防止网络钓鱼攻击的10种方法](https://www.aqniu.com/homenews/89443.html) - - [数据安全合规研讨会暨“数据安全共同体计划”智享数安第八期圆满落幕](https://www.aqniu.com/vendor/89424.html) -- FreeBuf网络安全行业门户 - - [FreeBuf周报 | Python曝出15年老洞可影响35万余项目；印尼通过数据隐私法](https://www.freebuf.com/news/345452.html) - - [“羊了个羊”一直在被黑客攻击！](https://www.freebuf.com/articles/345430.html) - - [研究人员披露了 Oracle 云基础设施中的严重漏洞，现已修复](https://www.freebuf.com/news/345399.html) - - [Python 15年未修的漏洞可能影响 35万余个项目，速查](https://www.freebuf.com/news/345395.html) -- Checkmarx.com - - [Empower Your Developers Through Gamified Learning With Checkmarx Codebashing](https://checkmarx.com/blog/empower-your-developers-through-gamified-learning-with-checkmarx-codebashing/) diff --git a/archive/2022/2022-09-25.md b/archive/2022/2022-09-25.md deleted file mode 100644 index 3eae7562bd..0000000000 --- a/archive/2022/2022-09-25.md +++ /dev/null @@ -1,64 +0,0 @@ -# 每日安全资讯（2022-09-25） - -- Security Boulevard - - [Unclaimed U.S. Lynching Monuments Display Lack of Redress](https://securityboulevard.com/2022/09/unclaimed-u-s-lynching-monuments-display-lack-of-redress/) - - [Embedded Secrets in Webpage DOMs](https://securityboulevard.com/2022/09/embedded-secrets-in-webpage-doms/) - - [BSidesLV 2022 Lucky13 CommonGround – Chris Kubecka’s ‘Russian Malware In The Ukraine War’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-commonground-chris-kubeckas-russian-malware-in-the-ukraine-war/) -- SecWiki News - - [SecWiki News 2022-09-24 Review](http://www.sec-wiki.com/?2022-09-24) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [WorkOrder CMS 0.1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022090069) - - [WorkOrder CMS 0.1.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090068) - - [Multix 2.4 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090067) - - [Teleport 10.1.1 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090066) - - [TP-Link Tapo c200 1.1.15 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090065) - - [Testa 3.5.1 Online Test Management System Reflected Cross-Site Scripting (XSS)](https://cxsecurity.com/issue/WLB-2022090064) -- Sploitus.com Exploits RSS Feed - - [Exploit for Cross-site Scripting in Helpsystems Cobalt Strike exploit](https://sploitus.com/exploit?id=21793A5E-BBA4-5AA7-9837-395B11AFF136&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Openssl exploit](https://sploitus.com/exploit?id=4680E9A3-19BA-54E9-9551-5076BCA80524&utm_source=rss&utm_medium=rss) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [Windows Server服务中的身份验证漏洞的安全风险](https://www.4hou.com/posts/q86G) - - [一个15年前的Python漏洞肆虐全球软件界](https://www.4hou.com/posts/9XyP) -- unSafe.sh - 不安全 - - [MSSQL使用CLR程序集来执行命令 - Y4er的博客](https://buaq.net/go-127958.html) - - [用它，终于治好了我的「标签页」毛病](https://buaq.net/go-127947.html) - - [Pax - CLI Tool For PKCS7 Padding Oracle Attacks](https://buaq.net/go-127948.html) - - [具透 | iOS 16 通知管理迷思，一个通知的 N 种呈现方式](https://buaq.net/go-127939.html) - - [Windows Server服务中的身份验证漏洞的安全风险](https://buaq.net/go-127930.html) - - [一个15年前的Python漏洞肆虐全球软件界](https://buaq.net/go-127931.html) - - [数字文具盒｜Word 写论文，也可以很好用](https://buaq.net/go-127935.html) - - [timwhitez starred ScreenShot](https://buaq.net/go-127924.html) - - [timwhitez starred SleepKiller](https://buaq.net/go-127925.html) - - [Timer countdown used on nuttx events](https://buaq.net/go-127940.html) - - [Malwarebytes recognized as endpoint security leader by G2](https://buaq.net/go-127899.html) -- Twitter @Nicolas Krassas - - [Microsoft SQL servers hacked in TargetCompany ransomware attacks](https://twitter.com/Dinosn/status/1573718950168432649) - - [HTB: Seventeen](https://twitter.com/Dinosn/status/1573717396711510020) - - [Kiwi Farms Website Hacked! Admin Warns of Data Leak](https://twitter.com/Dinosn/status/1573717343024386049) - - [Data of millions of users exposed in Australia’s 2nd-largest telecom firm breach](https://twitter.com/Dinosn/status/1573717207795875841) - - [Pax - CLI Tool For PKCS7 Padding Oracle Attacks](https://twitter.com/Dinosn/status/1573649458264416259) - - [RT SecurityTrails: A critical RCE vulnerability in Cloud Mobility for Dell EMC Storage (with a 10/10 score) could allow a non-privileged user to achie...](https://twitter.com/securitytrails/status/1573591739658604545) - - [Hacking the PS4 / PS5 through the PS2 Emulator - Part 1 - Escape](https://twitter.com/Dinosn/status/1573568202348568582) - - [CVE-2022-35256 - HTTP Request Smuggling in NodeJS](https://twitter.com/Dinosn/status/1573503621760696335) - - [Significant customer data exposed in attack on Australian telco](https://twitter.com/Dinosn/status/1573503160001380381) - - [Sophos warns of a new actively exploited flaw in Firewall product](https://twitter.com/Dinosn/status/1573502542490779656) - - [A first look at the builder for LockBit 3.0 Black](https://twitter.com/Dinosn/status/1573495718920208392) -- Recent Commits to cve:main - - [Update Sat Sep 24 09:58:33 UTC 2022](https://github.com/trickest/cve/commit/1ceab1efa5123ee2e79eb5d53ef8adfe458525b3) -- SAP Blogs - - [Supply Chain Optimization is the Cornerstone of Sustainability Improvement](https://blogs.sap.com/2022/09/24/supply-chain-optimization-is-the-cornerstone-of-sustainability-improvement/) - - [Hana Table Migration using Export & Import](https://blogs.sap.com/2022/09/24/hana-table-migration-using-export-import/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-09-23 - IcedID (Bokbot) with Cobalt Strike](https://www.malware-traffic-analysis.net/2022/09/23/index.html) -- 奇客Solidot–传递最新科技情报 - - [Arch Linux 停止支持 Python 2](https://www.solidot.org/story?sid=72869) - - [Mozilla 指责 Google、苹果和微软强迫用户使用默认浏览器](https://www.solidot.org/story?sid=72868) - - [黑客利用 BGP 劫持 IP 段窃取了约 23 万美元加密货币](https://www.solidot.org/story?sid=72867) - - [Windows 11 2022 更新后英伟达显卡出现性能问题](https://www.solidot.org/story?sid=72866) - - [伦敦警方逮捕一名与《GTV6》泄露相关的 17 岁少年](https://www.solidot.org/story?sid=72865) -- 黑海洋 - WIKI - - [安卓手机号码批量导入通讯录（安卓苹果手机教程）](https://blog.upx8.com/3001) - - [TreeNMS for Redis, memcached（可以批量复制redis key键值）](https://blog.upx8.com/3000) - - [在线玩反恐精英、红色警戒2](https://blog.upx8.com/2999) -- KitPloit - PenTest & Hacking Tools - - [Pax - CLI Tool For PKCS7 Padding Oracle Attacks](http://www.kitploit.com/2022/09/pax-cli-tool-for-pkcs7-padding-oracle.html) diff --git a/archive/2022/2022-09-26.md b/archive/2022/2022-09-26.md deleted file mode 100644 index 7391d1cd57..0000000000 --- a/archive/2022/2022-09-26.md +++ /dev/null @@ -1,73 +0,0 @@ -# 每日安全资讯（2022-09-26） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Bitbucket Git Command Injection](https://cxsecurity.com/issue/WLB-2022090072) - - [WordPress WP-UserOnline 2.88.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090071) - - [Feehi CMS 2.1.1 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090070) -- Security Boulevard - - [The Benefits of Sock Puppets in Open-Source Intelligence (OSINT)](https://securityboulevard.com/2022/09/the-benefits-of-sock-puppets-in-open-source-intelligence-osint/) - - [BSidesLV 2022 Lucky13 CommonGround – Shea Nangle’s, Wendy Knox Everette’s ‘I’m A Little Bit (FedRAMP) Country, I’m A Little Bit SOC2 ‘n Roll’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-commonground-shea-nangles-wendy-knox-everettes-im-a-little-bit-fedramp-country-im-a-little-bit-soc2-n-roll/) - - [Book Review: ‘If It’s Smart, It’s Vulnerable’](https://securityboulevard.com/2022/09/book-review-if-its-smart-its-vulnerable/) -- Twitter @Nicolas Krassas - - [Comprehensive List of CVE PoC's](https://twitter.com/Dinosn/status/1574078237046513665) - - [Sleep obfuscation technique leveraging waitable timers to evade memory scanners.](https://twitter.com/Dinosn/status/1574012296887734273) - - [PSAsyncShell - PowerShell Asynchronous TCP Reverse Shell](https://twitter.com/Dinosn/status/1574012157800349696) - - [Re @Nutritionist_AP :D](https://twitter.com/Dinosn/status/1574009338003423234) - - [RT Anderson Nascimento: /dev/kmem + GDB Stub = kmemd This is an introduction to kmemd - a tool for exploring a live Linux kernel’s memory in a non-in...](https://twitter.com/andersonc0d3/status/1573986822950211584) - - [American Airlines learned it was breached from phishing targets](https://twitter.com/Dinosn/status/1573903599045861376) - - [Covid antigen test results of 1.7m Indian and foreign nationals leaked online](https://twitter.com/Dinosn/status/1573903548408111107) - - [Windows 11 now warns when typing your password in Notepad, websites](https://twitter.com/Dinosn/status/1573903491604643840) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-28282 exploit](https://sploitus.com/exploit?id=AFB54C5F-461A-5A0D-828A-2E3995744A32&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Atlassian Bitbucket exploit](https://sploitus.com/exploit?id=56B682D7-17D2-522C-9D1C-67C86911E78F&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-09-25 Review](http://www.sec-wiki.com/?2022-09-25) -- Recent Commits to cve:main - - [Update Sun Sep 25 09:57:15 UTC 2022](https://github.com/trickest/cve/commit/9047d44af689c52268da08cffb7c9b6a3449a1e3) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [三成热门的PyPI软件包被误标为是恶意软件包](https://www.4hou.com/posts/2JJK) - - [浏览器扩展 比你想象得更危险](https://www.4hou.com/posts/GK7y) -- cloud world - - [2022 40 Open source weekly report](https://cloudsjhan.github.io/2022/09/25/2022-40-Open-source-weekly-report/) -- MaskRay - - [Layering check with Clang](https://maskray.me/blog/2022-09-25-layering-check-with-clang) -- Didier Stevens - - [Taking A Look At PNG Files with pngdump.py Beta Version 0.0.3](https://blog.didierstevens.com/2022/09/25/taking-a-look-at-png-files-with-pngdump-py-beta-version-0-0-3/) -- Twitter @bytehx - - [RT Today Cyber News: 📄 Collection of Logger++ filters to find vulnerabilities in API Small collection of filters for Logger ++, which will help you...](https://twitter.com/TodayCyberNews/status/1573917762145382400) - - [RT ShreKy: Test for #SSRF Bypasses easier ➡️ #bugbounty #bugbountytips #cybersecurity #cybersecuritytips #infosec #CTF](https://twitter.com/shrekysec/status/1573831191630946306) - - [RT ShreKy: BEST XSS Payload lists: 1. Ghetto Bypass - 2. Payloadbox - 3. @BugBountyHunt3r XSS Methodology - 4. @PortSwigger XSS Cheat Sheet - #bugboun...](https://twitter.com/shrekysec/status/1573829647388770305) -- SAP Blogs - - [Periodificación de Pedido de Compra con Accrual Engine – SAP S/4HANA On-Premise](https://blogs.sap.com/2022/09/25/periodificacionde-pedido-de-compra-con-accrual-engine-sap-s-4hana-on-premise/) - - [SAP S/4 Transitions — acceleration of SAP Business Technology Platform activities](https://blogs.sap.com/2022/09/25/sap-s-4-transitions-acceleration-of-sap-business-technology-platform-activities/) - - [The impact of 2027 on SAP customers](https://blogs.sap.com/2022/09/25/the-impact-of-2027-on-sap-customers/) - - [RITA: Registration for Indirect Taxation Abroad – More Than Just a Nice Name](https://blogs.sap.com/2022/09/25/rita-registration-for-indirect-taxation-abroad-more-than-just-a-nice-name/) - - [Retroactive Accounting functionality in HCM payroll PART-II](https://blogs.sap.com/2022/09/25/retroactive-accounting-functionality-in-hcm-payroll-part-ii/) - - [Zehn kritische Erfolgsfaktoren für Digitalisierungsprojekte – #1 Executive Sponsorship](https://blogs.sap.com/2022/09/25/zehn-kritische-erfolgsfaktoren-fur-digitalisierungsprojekte-1-executive-sponsorship/) - - [How to delete/remove SM58 TRFC failed entries using transaction ID](https://blogs.sap.com/2022/09/25/how-to-delete-remove-sm58-trfc-failed-entries-using-transaction-id/) - - [Have you ever wanted to build an AI?](https://blogs.sap.com/2022/09/25/have-you-ever-wanted-to-build-an-ai/) - - [如何使用盘点API过账到上期间](https://blogs.sap.com/2022/09/25/%e5%a6%82%e4%bd%95%e4%bd%bf%e7%94%a8%e7%9b%98%e7%82%b9api%e8%bf%87%e8%b4%a6%e5%88%b0%e4%b8%8a%e6%9c%9f%e9%97%b4/) - - [Join forces with us and collaborate on the SAP Custom Domain Service guides!](https://blogs.sap.com/2022/09/25/join-forces-with-us-and-collaborate-on-the-sap-custom-domain-service-guides/) -- Reverse Engineering - - [Comprehensive List of CVE PoC's](https://www.reddit.com/r/ReverseEngineering/comments/xnr75o/comprehensive_list_of_cve_pocs/) -- KitPloit - PenTest & Hacking Tools - - [PSAsyncShell - PowerShell Asynchronous TCP Reverse Shell](http://www.kitploit.com/2022/09/psasyncshell-powershell-asynchronous.html) -- 奇客Solidot–传递最新科技情报 - - [AV1 更新减少三分之一 CPU 编码时间](https://www.solidot.org/story?sid=72873) - - [韦伯望远镜拍摄到海王星环结构最清晰视图](https://www.solidot.org/story?sid=72872) - - [北京公交司机配发情绪感知设备](https://www.solidot.org/story?sid=72871) - - [Tornado Cash 代码重返 GitHub](https://www.solidot.org/story?sid=72870) -- 安全分析与研究 - - [透过安全事件剖析黑客组织攻击技术](https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247487545&idx=1&sn=414682781f8583da4c18fb043ecb0ef0&chksm=902fbf11a75836071d9bc99dac70602b58d59539c821173d3765e550b1e69b23a59c44af8048&scene=58&subscene=0#rd) -- 杨龙 - - [学习笔记：docker image ls -a 和 docker images](https://www.yanglong.pro/%e5%ad%a6%e4%b9%a0%e7%ac%94%e8%ae%b0%ef%bc%9adocker-image-ls-a-%e5%92%8c-docker-images/) -- 黑海洋 - WIKI - - [客服系统源码搭建](https://blog.upx8.com/3003) - - [Python在线运行工具（附演示站）](https://blog.upx8.com/3002) -- 极客公园 - - [你的下一件「时尚单品」，可能是软件「编」出来的](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652968562&idx=1&sn=24b9c0bac57015d70e4f8f112d920cb5&chksm=7e546bc44923e2d26cf17992b6b10544df11955d68440fb0bcba0a6f5dc29682c671e30f918a&scene=58&subscene=0#rd) - - [科技新趋势：工业数字化、存算一体芯片、微生态制药和英伟达的元宇宙新思考](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652968562&idx=2&sn=ead88256d1133c9d979c186a8838949e&chksm=7e546bc44923e2d2491ddc0f6a77a9294a2ccffa61a4805934da84665b92d75713cc00c97cec&scene=58&subscene=0#rd) - - [国内首个元宇宙大学院系设立；小鹏汽车首批 S4 超快充站上线；《权力的游戏》NFT 来了 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652968560&idx=1&sn=d90fb637425d16d7c54af350fee5bdf6&chksm=7e546bc64923e2d098f8dcc66d51d1781e0a258c2a9bcad1c7d65765565c744c5925e5fc9d8e&scene=58&subscene=0#rd) -- 网安杂谈 - - [烟火成都，安然归来！2022 CCS成都网络安全大会暨数据治理峰会再定档！9月26日重新启幕！](https://mp.weixin.qq.com/s?__biz=MzAwMTMzMDUwNg==&mid=2650886992&idx=1&sn=38ce72f6343b1a258dd027dae0c512c5&chksm=812eaf75b6592663002dc5a2ec3d5976eeaf995e002b607d866e0784c6610be1e255d5b7a2a5&scene=58&subscene=0#rd) - - [广东法院发布依法惩治电信网络诈骗犯罪典型案例](https://mp.weixin.qq.com/s?__biz=MzAwMTMzMDUwNg==&mid=2650886992&idx=2&sn=a23bc45774ca3e756f049489817e407f&chksm=812eaf75b6592663704c3a76e016f450e712f6e7af3446f0ffbc50049b6679c3f5fba184750e&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-27.md b/archive/2022/2022-09-27.md deleted file mode 100644 index 4eab2c16bf..0000000000 --- a/archive/2022/2022-09-27.md +++ /dev/null @@ -1,253 +0,0 @@ -# 每日安全资讯（2022-09-27） - -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5637-1](https://packetstormsecurity.com/files/168512/USN-5637-1.txt) - - [Gentoo Linux Security Advisory 202209-15](https://packetstormsecurity.com/files/168510/glsa-202209-15.txt) - - [OpenStego Free Steganography Solution 0.8.5](https://packetstormsecurity.com/files/168511/openstego-0.8.5.zip) - - [GNUnet P2P Framework 0.17.6](https://packetstormsecurity.com/files/168508/gnunet-0.17.6.tar.gz) - - [Ubuntu Security Notice USN-5636-1](https://packetstormsecurity.com/files/168507/USN-5636-1.txt) - - [WiFi Mouse 1.8.3.4 Remote Code Execution](https://packetstormsecurity.com/files/168509/wifi_mouse_rce.rb.txt) - - [Veritas Backup Exec Agent Remote Code Execution](https://packetstormsecurity.com/files/168506/beagent_sha_auth_rce.rb.txt) - - [Gentoo Linux Security Advisory 202209-14](https://packetstormsecurity.com/files/168505/glsa-202209-14.txt) - - [Backdoor.Win32.Augudor.b MVID-2022-0644 Code Execution](https://packetstormsecurity.com/files/168504/MVID-2022-0644.txt) - - [Red Hat Security Advisory 2022-6560-01](https://packetstormsecurity.com/files/168503/RHSA-2022-6560-01.txt) - - [WordPress Forym 1.5.7 Cross Site Scripting](https://packetstormsecurity.com/files/168502/wpforym157-xss.txt) - - [Gentoo Linux Security Advisory 202209-13](https://packetstormsecurity.com/files/168501/glsa-202209-13.txt) - - [WordPress Sabai Discuss 1.4.13 Cross Site Scripting](https://packetstormsecurity.com/files/168500/wpsabaidiscuss1413-xss.txt) - - [Gentoo Linux Security Advisory 202209-12](https://packetstormsecurity.com/files/168499/glsa-202209-12.txt) - - [Online Diagnostic Lab Management System 1.0 SQL Injection / Shell Upload](https://packetstormsecurity.com/files/168498/odlms10-sqlbypassshell.txt) - - [Gentoo Linux Security Advisory 202209-11](https://packetstormsecurity.com/files/168497/glsa-202209-11.txt) - - [WooCommerce BRW Booking Rental 1.3.1 Cross Site Scripting](https://packetstormsecurity.com/files/168496/brw131-xss.txt) - - [Backdoor.Win32.Psychward.b MVID-2022-0645 Hardcoded Credential](https://packetstormsecurity.com/files/168495/MVID-2022-0645.txt) - - [Gentoo Linux Security Advisory 202209-10](https://packetstormsecurity.com/files/168494/glsa-202209-10.txt) - - [Gentoo Linux Security Advisory 202209-09](https://packetstormsecurity.com/files/168493/glsa-202209-09.txt) - - [Backdoor.Win32.Bingle.b MVID-2022-0643 Hardcoded Credential](https://packetstormsecurity.com/files/168492/MVID-2022-0643.txt) - - [Ubuntu Security Notice USN-5635-1](https://packetstormsecurity.com/files/168491/USN-5635-1.txt) - - [Active eCommerce CMS 6.3.0 Cross Site Scripting](https://packetstormsecurity.com/files/168490/activeecomcms630-xss.txt) - - [Active eCommerce CMS 6.3.0 Arbitrary File Download](https://packetstormsecurity.com/files/168489/activeecomcms630-disclose.txt) - - [Gentoo Linux Security Advisory 202209-08](https://packetstormsecurity.com/files/168488/glsa-202209-08.txt) -- SecWiki News - - [SecWiki News 2022-09-26 Review](http://www.sec-wiki.com/?2022-09-26) -- Sploitus.com Exploits RSS Feed - - [osCommerce Shopping Cart 4 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168486&utm_source=rss&utm_medium=rss) - - [Veritas Backup Exec Agent Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168506&utm_source=rss&utm_medium=rss) - - [Active eCommerce CMS 6.3.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168490&utm_source=rss&utm_medium=rss) - - [WordPress Sabai Discuss 1.4.13 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168500&utm_source=rss&utm_medium=rss) - - [Online Diagnostic Lab Management System 1.0 SQL Injection / Shell Upload Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37992&utm_source=rss&utm_medium=rss) - - [Online Diagnostic Lab Management System 1.0 SQL Injection / Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168498&utm_source=rss&utm_medium=rss) - - [Active eCommerce CMS 6.3.0 Arbitrary File Download Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37990&utm_source=rss&utm_medium=rss) - - [WordPress Forym 1.5.7 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168502&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Psychward.b MVID-2022-0645 Hardcoded Credential exploit](https://sploitus.com/exploit?id=PACKETSTORM:168495&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Bingle.b MVID-2022-0643 Hardcoded Credential exploit](https://sploitus.com/exploit?id=PACKETSTORM:168492&utm_source=rss&utm_medium=rss) - - [Active eCommerce CMS 6.3.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37989&utm_source=rss&utm_medium=rss) - - [WiFi Mouse 1.8.3.4 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37994&utm_source=rss&utm_medium=rss) - - [Active eCommerce CMS 6.3.0 Arbitrary File Download exploit](https://sploitus.com/exploit?id=PACKETSTORM:168489&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Augudor.b MVID-2022-0644 Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168504&utm_source=rss&utm_medium=rss) - - [pfBlockerNG 2.1.4_26 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168484&utm_source=rss&utm_medium=rss) - - [WooCommerce BRW Booking Rental 1.3.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168496&utm_source=rss&utm_medium=rss) - - [Veritas Backup Exec Agent Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37993&utm_source=rss&utm_medium=rss) - - [LivelyCart Pro 3 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168487&utm_source=rss&utm_medium=rss) - - [pfBlockerNG 2.1.4_26 Shell Upload Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37991&utm_source=rss&utm_medium=rss) - - [WiFi Mouse 1.8.3.4 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168509&utm_source=rss&utm_medium=rss) - - [Exploit for Use After Free in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=D632E896-5824-5634-95FB-A564581718DA&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Atlassian Bitbucket exploit](https://sploitus.com/exploit?id=DAAA47B0-5637-5160-BCB3-E488B5CF3512&utm_source=rss&utm_medium=rss) - - [Exploit for Cross-site Scripting in Helpsystems Cobalt Strike exploit](https://sploitus.com/exploit?id=39C06FA8-9CBB-51CF-8271-479B054966B7&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=D96A8735-A598-5768-9E82-E755A4155405&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=A8E3F65D-BE00-5E3F-BD91-A0A5A8692D4E&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [Ransomware Recovery: How to Respond to Ransomware Attacks](https://securityboulevard.com/2022/09/ransomware-recovery-how-to-respond-to-ransomware-attacks/) - - [Optus Faces $1Million Ransom Due to Cloud Misconfiguration](https://securityboulevard.com/2022/09/optus-faces-1million-ransom-due-to-cloud-misconfiguration/) - - [Weekly Email Security News Recap #3 [September 2022]](https://securityboulevard.com/2022/09/weekly-email-security-news-recap-3-september-2022/) - - [BSidesLV 2022 Lucky13 CommonGround – David Levitsky’s And Matthew J. Lorimor’s ‘Whose Encryption Key Is This? It’s A Secret To Everybody’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-commonground-david-levitskys-and-matthew-j-lorimors-whose-encryption-key-is-this-its-a-secret-to-everybody/) - - [Webinar Recap: Continuously Changing Clouds Need Dynamic Security](https://securityboulevard.com/2022/09/webinar-recap-continuously-changing-clouds-need-dynamic-security/) - - [Alleged Russian RSOCKS Hacker: ‘Send Me to US’](https://securityboulevard.com/2022/09/alleged-russian-rsocks-hacker-send-me-to-us/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 400’](https://securityboulevard.com/2022/09/robert-m-lees-jeff-haas-little-bobby-comic-week-400/) - - [API Runtime Protection: Shields Right While Shifting Everywhere](https://securityboulevard.com/2022/09/api-runtime-protection-shields-right-while-shifting-everywhere/) - - [Thinking Like a Hacker: Commanding a Bot Army of Leaked Twitter Accounts](https://securityboulevard.com/2022/09/thinking-like-a-hacker-commanding-a-bot-army-of-leaked-twitter-accounts/) - - [API Security is More than Protecting B2C APIs from Bots](https://securityboulevard.com/2022/09/api-security-is-more-than-protecting-b2c-apis-from-bots/) -- 安全客-有思想的安全新媒体 - - [数字安全观察每周简报【政策消息篇】2022.09.14-2022.09.20](https://www.anquanke.com/post/id/280829) - - [俄黑客公布1500多名乌情报人员资料](https://www.anquanke.com/post/id/280816) - - [蜻蜓点水Binlog](https://www.anquanke.com/post/id/280646) - - [潜伏数月！新APT“Metador”染指电信公司、ISP和大学](https://www.anquanke.com/post/id/280744) - - [降低自动化决策对个人信息安全影响的研究](https://www.anquanke.com/post/id/280741) - - [网络雇佣兵Void Balaur盯上俄罗斯企业和政治实体](https://www.anquanke.com/post/id/280749) - - [Anonymous匿名者声称入侵俄罗斯国防部网站](https://www.anquanke.com/post/id/280739) - - [黑客利用BGP劫持IP段，窃取约23万美元加密货币](https://www.anquanke.com/post/id/280735) - - [泄露《GTA6》黑客被逮捕 仅17岁，曾攻击微软、Uber](https://www.anquanke.com/post/id/280732) - - [CVE-2022-34916 Apache Flume 远程代码执行漏洞分析](https://www.anquanke.com/post/id/280625) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [雾帜智能SOAR产品荣获第十一届“省长杯”工业设计大赛数字创意与信息服务类专项赛优胜奖](https://www.4hou.com/posts/EQ2N) - - [重保专题|6招带你轻松扫除重保期间互联网资产安全风险](https://www.4hou.com/posts/ykDV) - - [海云安出席深圳市网络安全宣传周电信日活动暨第三届“网络安全圳先行”高峰论坛](https://www.4hou.com/posts/kMlx) - - [盛邦安全入选IDC TechScape中国数据安全发展路线图推荐厂商，为API安全治理提供新思路](https://www.4hou.com/posts/AO2B) - - [网络钓鱼活动盯上PyPI用户，分发恶意代码](https://www.4hou.com/posts/2JqK) - - [Coremail邮件安全提醒：企业年审，银行通知必须加入QQ群？被盯上的财务，小心诈骗邮件](https://www.4hou.com/posts/jJkW) - - [【技术原创】渗透基础——Exchange版本探测的优化](https://www.4hou.com/posts/WBwx) - - [住宅代理IP在网络攻击中的作用](https://www.4hou.com/posts/ykOV) - - [数据安全合规研讨会暨“数据安全共同体计划”智享数安第八期圆满落幕](https://www.4hou.com/posts/zlEr) -- Twitter @Nicolas Krassas - - [Android Hardening Guide by Deep Dive Security](https://twitter.com/Dinosn/status/1574482510167375873) - - [UK May Fine TikTok $29 Million For Failing To Protect Kids](https://twitter.com/Dinosn/status/1574482191614201858) - - [Hackers use PowerPoint files for 'mouseover' malware delivery](https://twitter.com/Dinosn/status/1574481627685818368) - - [Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto](https://twitter.com/Dinosn/status/1574481538653339688) - - [Chinese Espionage Hackers Target Tibetans Using New LOWZERO Backdoor](https://twitter.com/Dinosn/status/1574481472123244547) - - [RT James Hooker: So proud of the @hackthebox_eu team - knocked it out of the park. Check out our new certification, and become a Certified Penetration...](https://twitter.com/g0blinResearch/status/1574436730178084868) - - [Interpol Seeks Arrest Of Failed Crypto-Firm Boss Do Kwon](https://twitter.com/Dinosn/status/1574434583776759808) - - [RT Hack The Box: 📣 Attention everyone: a new era of #pentesting certifications has arrived! We are proudly announcing a new certification: ready to...](https://twitter.com/hackthebox_eu/status/1574422266209005569) - - [JSON web tokens](https://twitter.com/Dinosn/status/1574388014842892288) - - [Microsoft Shift F10 bypass + Autopilot privilege escalation](https://twitter.com/Dinosn/status/1574387010164625408) - - [Metador, a never-before-seen APT targeted ISPs and telco for about 2 years](https://twitter.com/Dinosn/status/1574380833212973058) - - [SharpNamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation](https://twitter.com/Dinosn/status/1574380680854716418) - - [Firefox: heap-use-after-free in DocumentL10n::TranslateDocument PoC for CVE-2022-28282](https://twitter.com/Dinosn/status/1574337872286588929) - - [The Book Of CP-System](https://twitter.com/Dinosn/status/1574326189808033792) - - [CVE-2022-35951: Redis flaw could lead to execute arbitrary code attacks](https://twitter.com/Dinosn/status/1574325826308526081) - - [CVE-2022-36934: WhatsApp execute arbitrary code flaw](https://twitter.com/Dinosn/status/1574325761594593281) -- Recent Commits to cve:main - - [Update Mon Sep 26 10:01:16 UTC 2022](https://github.com/trickest/cve/commit/68ea638daf5deeaa2158f6080d0b010aa7ec1e82) -- The DFIR Report - - [BumbleBee: Round Two](https://thedfirreport.com/2022/09/26/bumblebee-round-two/) -- paper - Last paper - - [Bumblebee 恶意软件带着新感染技术回归](https://paper.seebug.org/1980/) - - [MiraclePtr UAF 漏洞利用缓解技术介绍](https://paper.seebug.org/1979/) -- unSafe.sh - 不安全 - - [7 Tips to Build A Banking Application That Will Be User-Friendly](https://buaq.net/go-128191.html) - - [金山云技术体 - 免费可商用中文字体下载！现代科技风格 / 适合制作 PPT 海报 LOGO 设计](https://buaq.net/go-128200.html) - - [一款可自定义自动字典生成器---火花(spark)](https://buaq.net/go-128187.html) - - [Calling in the ransomware negotiator, with Kurtis Minder: Lock and Code S03E20](https://buaq.net/go-128216.html) - - [JSON web tokens](https://buaq.net/go-128189.html) - - [Monitoring your targets for bug bounties](https://buaq.net/go-128190.html) - - [Hunting for Unsigned DLLs to Find APTs](https://buaq.net/go-128188.html) - - [Windows 11 pulls ahead of Windows 10 in anti-phishing stakes](https://buaq.net/go-128217.html) -- 安全脉搏 - - [行云海CMS之模板编辑防不胜防](https://www.secpulse.com/archives/187760.html) - - [实战某高校的一次挖矿病毒的应急处置](https://www.secpulse.com/archives/187729.html) - - [一个组合多位师傅的渗透测试字典 建议收藏](https://www.secpulse.com/archives/187713.html) - - [STOP勒索变种采用双重Fast Flux技术逃避检测](https://www.secpulse.com/archives/187655.html) -- 跳跳糖 - 安全与分享社区 - - [fuzzer AFL 源码分析（三）-反馈](https://tttang.com/archive/1707/) -- SAP Blogs - - [Build Your Own SCPI Log Reports And Deploy To SAP BTP – CPI IFlows Monitoring Tool](https://blogs.sap.com/2022/09/26/build-your-own-scpi-log-reports-and-deploy-to-sap-btp-cpi-iflows-monitoring-tool/) - - [The Hidden Gem: Data Security in SAP using UI Masking](https://blogs.sap.com/2022/09/26/the-hidden-gem-data-security-in-sap-using-ui-masking/) - - [Learning by Gaming – ERPsim business simulation with SAP S/4HANA](https://blogs.sap.com/2022/09/26/learning-by-gaming-erpsim-business-simulation-with-sap-s-4hana/) - - [SAP S/4HANA Cloud Data Migration Testing](https://blogs.sap.com/2022/09/26/sap-s-4hana-cloud-data-migration-testing/) - - [Cross HDI Container Access using User-provided service for Containers within same SAP HANA Cloud instance](https://blogs.sap.com/2022/09/26/cross-hdi-container-access-using-user-provided-service-for-containers-within-same-sap-hana-cloud-instance/) - - [How to start a graph from another graph? Use my custom operator 🦾](https://blogs.sap.com/2022/09/26/how-to-start-a-graph-from-another-graph-use-my-custom-operator-%f0%9f%a6%be/) - - [SAP Awarded 5 Best In Class Distinctions from POI’s 2022 Enterprise Planning Vendor Panorama](https://blogs.sap.com/2022/09/26/sap-awarded-5-best-in-class-distinctions-from-pois-2022-enterprise-planning-vendor-panorama/) - - [How can you install Eclipse and HANA Tools for ABAP CDS Views, HANA Modeling, and BW4/HANA Modeling](https://blogs.sap.com/2022/09/26/how-can-you-install-eclipse-and-hana-tools-for-abap-cds-views-hana-modeling-and-bw4-hana-modeling/) -- Bug Bounty in InfoSec Write-ups on Medium - - [JSON web tokens](https://infosecwriteups.com/json-web-tokens-c1f01028f5ac?source=rss----7b722bfd1b8d--bug_bounty) - - [Monitoring your targets for bug bounties](https://infosecwriteups.com/monitoring-your-targets-for-bug-bounties-36f6be3e69c9?source=rss----7b722bfd1b8d--bug_bounty) - - [HTML Injection inside Email body- The First BUG I hunted down in a Bug Bounty Platform!](https://infosecwriteups.com/html-injection-inside-email-body-the-first-bug-i-hunted-in-a-bug-bounty-platform-3c96b1e0ae9f?source=rss----7b722bfd1b8d--bug_bounty) -- Malwarebytes Labs - - [Calling in the ransomware negotiator, with Kurtis Minder: Lock and Code S03E20](https://www.malwarebytes.com/blog/podcast/2022/09/calling-in-the-ransomware-negotiator-with-kurtis-minder-lock-and-code-s03e20) - - [Windows 11 pulls ahead of Windows 10 in anti-phishing stakes](https://www.malwarebytes.com/blog/news/2022/09/windows-11-pulls-ahead-of-windows-10-in-anti-phishing-stakes) - - [Twitter fixes bug that left devices logged in after password reset](https://www.malwarebytes.com/blog/news/2022/09/twitter-fixes-bug-that-left-devices-logged-in-after-password-reset) - - [A week in security (September 19 – 25)](https://www.malwarebytes.com/blog/news/2022/09/a-week-in-security-september-19--25) - - [Critical WhatsApp vulnerabilities patched: Check you've updated!](https://www.malwarebytes.com/blog/news/2022/09/critical-whatsapp-vulnerabilities-patched-check-youve-updated) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/xobv1u/rreverseengineerings_weekly_questions_thread/) - - [Process Memory Basics for Reverse Engineers - Tracking Memory With A Debugger (OALABS Tutorial)](https://www.reddit.com/r/ReverseEngineering/comments/xosvly/process_memory_basics_for_reverse_engineers/) - - [Racoon Stealer V2 / Record Breaker Malware Analysis](https://www.reddit.com/r/ReverseEngineering/comments/xo3be3/racoon_stealer_v2_record_breaker_malware_analysis/) -- Securelist - - [NullMixer: oodles of Trojans in a single dropper](https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/) -- blog.avast.com EN - - [Scammers are most likely to pose as your friend — here's why](https://blog.avast.com/scammers-pose-friend) - - [Avast commits to becoming a founder of the OpenWallet Foundation](https://blog.avast.com/avast-founder-openwallet-foundation) -- Forcepoint - - [An Update on Forcepoint’s Digital Customer Engagement Journey](https://www.forcepoint.com/blog/insights/digital-customer-engagement-journey-michelle-punch) -- SentinelOne - - [Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto](https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/) -- KitPloit - PenTest & Hacking Tools - - [SharpNamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation](http://www.kitploit.com/2022/09/sharpnamedpipepth-pass-hash-to-named.html) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（2022.09.19-2022.09.25）](http://blog.nsfocus.net/weeklyreport39/) -- 博客园 - nice_0e3 - - [VMware Workspace ONE Access(CVE-2022-22954)漏洞分析 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16731478.html) -- HackerNews - - [“匿名者”组织声称黑进了俄罗斯国防部网站](https://hackernews.cc/archives/41697) - - [为防钓鱼，Win11 新版本在记事本、网站中输入密码时会发出警告](https://hackernews.cc/archives/41692) - - [攻击者冒充 CircleCI 平台入侵 GitHub 帐户](https://hackernews.cc/archives/41687) - - [黑客利用 Sophos 防火墙中的零日 RCE 漏洞，目前已发布补丁](https://hackernews.cc/archives/41681) -- 90Sec - 最新话题 - - [一款可自定义自动字典生成器---火花(spark)](https://forum.90sec.com/t/topic/2176) -- The Daily Swig | Cybersecurity news and views - - [Attackers abuse web security flaw in Sophos Firewall](https://portswigger.net/daily-swig/attackers-abuse-web-security-flaw-in-sophos-firewall) - - [Java template framework Pebble vulnerable to command injection](https://portswigger.net/daily-swig/java-template-framework-pebble-vulnerable-to-command-injection) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 匿名者向伊朗政府宣战；TikTok因儿童隐私数据保护面临2700万英镑罚款](https://www.freebuf.com/news/345668.html) - - [GitHub用户注意，网络钓鱼活动冒充CircleCI窃取凭证](https://www.freebuf.com/news/345637.html) - - [澳大利亚史上最大数据泄露事件，40%的居民信息被泄露](https://www.freebuf.com/news/345611.html) - - [“匿名者”组织声称黑进了俄罗斯国防部网站](https://www.freebuf.com/news/345581.html) - - [为防钓鱼，Win11新版本在记事本、网站中输入密码时会发出警告](https://www.freebuf.com/news/345570.html) - - [全国首个城市（地区）图谱 | 成都网络安全特色企业图谱（第一版）发布](https://www.freebuf.com/articles/others-articles/345552.html) -- 安全牛 - - [安芯校招直播来了！刷弹幕提问，你想知道的这里都有](https://www.aqniu.com/vendor/89546.html) - - [流动数据溯源打通安全创新与产业价值闭环 | 全息网御受邀参加2022内蒙古数据安全高峰论坛](https://www.aqniu.com/vendor/89528.html) - - [客户身份与访问管理（CIAM）常见威胁分析与应对](https://www.aqniu.com/hometop/89511.html) - - [安全头条 |公安部开展集中打击整治网络账号黑色产业链“断号”行动；中国气象局印发《气象数据开放共享实施细则（试行）》](https://www.aqniu.com/homenews/89510.html) - - [直播预告 | 网安大讲堂（45期）：高级Web安全专家（OSWE）认证介绍（四）](https://www.aqniu.com/homenews/89509.html) - - [移动大数据时代，企业如何做好个人隐私保护](https://www.aqniu.com/vendor/89519.html) - - [开启“乾坤”新世界，国投旗下美亚柏科乾坤大数据操作系统震撼发布](https://www.aqniu.com/vendor/89461.html) - - [武汉大学：浅议重保期间的邮件防护](https://www.aqniu.com/vendor/89459.html) - - [复旦大学：邮件系统安全运维实用建议](https://www.aqniu.com/vendor/89458.html) - - [江苏省第一届工控安全高层论坛暨“博御金陵”第二届网络空间安全沙龙，博智安全亮点纷呈](https://www.aqniu.com/industry/89457.html) -- 看雪学院 - - [CVE-2014-1767提权漏洞学习笔记](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458471704&idx=1&sn=7374ced93133efd064bb0e7316cd8087&chksm=b18e7d9286f9f4840a35d6618f2fa625359b1095cd8ca266fc48bfc9576e2ff0d0835b9e4ef0&scene=58&subscene=0#rd) - - [英国警方逮捕一名17岁黑客，疑为入侵Uber、R星的幕后黑手](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458471704&idx=2&sn=515d4d5cc4988eb5a147e0b9d3f75360&chksm=b18e7d9286f9f48428a4f5876c9b26fef9f369e871bd5891bd539a966ede27d4a3c6a9ae6417&scene=58&subscene=0#rd) - - [LLVM与代码混淆技术，详解3种经典代码混淆方式+2种变体](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458471704&idx=3&sn=c899e3a9ea901233e30f763a167134f9&chksm=b18e7d9286f9f484fe84cd5d5e7296c3cb439ca3bf8fe89c3eace307de36995d0c9661af6c8b&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【资料】情报分析的未来](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651132387&idx=1&sn=23bc32f2b66aae3bf37613b017292de6&chksm=f1af66d9c6d8efcfca2a65fd2a88340433397e5ab5c567f4f725b306856b565477cbcca33ac0&scene=58&subscene=0#rd) -- 体验盒子 - - [Nginx配置WebSocket【同时支持WSS与WS】](https://www.uedbox.com/post/68560/) -- 互联网安全内参 - - [印度一医疗公司毫无责任心：新冠抗原检测数据公网暴露无人处理](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506151&idx=1&sn=35280425e578041e5b03a0ccc1fad3ca&chksm=ebfa9fc7dc8d16d159acc9fe96649408d87b55213e098c696ebfc5e6d4fd1f6fb4897ef17216&scene=58&subscene=0#rd) - - [澳第二大电信公司遭黑客攻击，近千万用户信息或外泄](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506151&idx=2&sn=de76e37635bc10d5d71a7d7a1d01947a&chksm=ebfa9fc7dc8d16d170ee1e06514817836d66f238de549249d072206fc36423856fef5627e386&scene=58&subscene=0#rd) - - [仅376字节大小！新型Linux恶意软件用IoT设备挖矿](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506151&idx=3&sn=10df84d1de72467499853eb849897294&chksm=ebfa9fc7dc8d16d131a23b59479dc3fd8dff5c08aee275532d99fe2f5096153aef7354f29a5b&scene=58&subscene=0#rd) - - [针对电子监控应用生态的首次系统性分析](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506151&idx=4&sn=95ec8b293efe3e8971ee63bc57bd3fbb&chksm=ebfa9fc7dc8d16d1cb5a38881b7bbd34b4bbd7077854fdc2efb04b05e63663bba25405164d1a&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [国际刑警组织对 Do Kwon 发出红色通缉令](https://www.solidot.org/story?sid=72886) - - [20 年历史的芯片组补丁影响现代 AMD Linux 系统](https://www.solidot.org/story?sid=72885) - - [倾听陨石撞击火星表面的声音](https://www.solidot.org/story?sid=72884) - - [婴儿在子宫里对味觉和嗅觉有反应](https://www.solidot.org/story?sid=72883) - - [电动汽车充电的最佳时间并非晚上](https://www.solidot.org/story?sid=72882) - - [Google Mandiant 发现证据显示黑客与俄罗斯协同攻击](https://www.solidot.org/story?sid=72881) - - [ONLYOFFICE v7.2 发布](https://www.solidot.org/story?sid=72880) - - [全球半导体市场降温](https://www.solidot.org/story?sid=72879) - - [OpenAI 开源多语言语音识别系统 Whisper](https://www.solidot.org/story?sid=72878) - - [盗版电子书网站变成庞大的知识库](https://www.solidot.org/story?sid=72877) - - [Mozilla 重申会继续支持 WebRequst API](https://www.solidot.org/story?sid=72876) - - [TikTok 将在美国禁止所有政治筹款活动](https://www.solidot.org/story?sid=72875) - - [津巴布韦暴发麻疹疫情](https://www.solidot.org/story?sid=72874) -- 安全客 - - [【技术分享】AI中的后门攻击及防御-实战篇](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649778209&idx=1&sn=3f99bd0d4bd81c136d5bbb858c9ec724&chksm=8893584ebfe4d15803e276e4f437be8a2c02f83d12268a15887381937d893875ce98ee4d0887&scene=58&subscene=0#rd) - - [【安全头条】Ask.FM 3.5 亿用户数据库在黑客论坛出售](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649778209&idx=2&sn=29a4f749afb0208d5e997979b860d5fd&chksm=8893584ebfe4d158069f7415ff44ba808508e622b2169b558a8b6c1938041f639f66f922f80e&scene=58&subscene=0#rd) -- 杨龙 - - [笔记9：适配器模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b09%e9%80%82%e9%85%8d%e5%99%a8%e6%a8%a1%e5%bc%8f/) - - [笔记8：装饰器模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b08%e8%a3%85%e9%a5%b0%e5%99%a8%e6%a8%a1%e5%bc%8f/) - - [笔记7：策略模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b07%e7%ad%96%e7%95%a5%e6%a8%a1%e5%bc%8f/) - - [笔记6：责任链模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b06%e8%b4%a3%e4%bb%bb%e9%93%be%e6%a8%a1%e5%bc%8f/) - - [笔记5：观察者模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b05%e8%a7%82%e5%af%9f%e8%80%85%e6%a8%a1%e5%bc%8f/) - - [笔记4：单例模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b04%e5%8d%95%e4%be%8b%e6%a8%a1%e5%bc%8f/) - - [笔记3：工厂模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b03%e5%b7%a5%e5%8e%82%e6%a8%a1%e5%bc%8f/) - - [笔记2：简单工厂模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b02%e7%ae%80%e5%8d%95%e5%b7%a5%e5%8e%82%e6%a8%a1%e5%bc%8f/) - - [笔记1：多态](https://www.yanglong.pro/%e7%ac%94%e8%ae%b01%e5%a4%9a%e6%80%81/) -- 情报分析师 - - [【资料汇总】伊朗国家最新相关文件精选收集](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517132&idx=1&sn=e7295218515383a9195b226a14478237&chksm=871680c7b06109d1119c75ad46de2deb15f659860901943eefb5bde3d88ebe02ebcba9570501&scene=58&subscene=0#rd) - - [【情报课堂】地理定位：其背后的内容和方式](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517132&idx=2&sn=73d841efd039a77d84136d6269b5ee67&chksm=871680c7b06109d1fe7cb537d2b388bc84782f6cd55ae48f8e852a7e876966c61fe6167d89ca&scene=58&subscene=0#rd) -- NOVASEC - - [CS4.5修改checksum后无法上线MSF问题](https://mp.weixin.qq.com/s?__biz=MzUzODU3ODA0MA==&mid=2247488219&idx=1&sn=6172291c134dd0d328b7f89c3c4a0121&chksm=fad4cfcccda346da5cb879362c60138f8dfd989185aa96b0a1e8174a999cf97724a33358f8a6&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20220926期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531424&idx=1&sn=dcd8b103b1ea9ecdb2a051948774fbef&chksm=c1e9f7f1f69e7ee7de79d4da42b31ea8ddbcf840b90f8534b28a2e0b3a4cb044733ae9645e24&scene=58&subscene=0#rd) - - [美国关键基础设施软件供应链安全指南的十大谬误](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531424&idx=2&sn=55553eb8e99edc3b32bb0cf968d5fa5b&chksm=c1e9f7f1f69e7ee7a21aee84e0b8933b069d1ac7818b57d2d39a55f0e2b7d9037dbded18eced&scene=58&subscene=0#rd) - - [云安全将是安全领域最大的赛道](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531424&idx=3&sn=642e90b4bf892b31c7762b2665ebe6db&chksm=c1e9f7f1f69e7ee70e07c92da626481641081dfb3bd9330dde09c9fdd88f0ff47996a6a8b4d4&scene=58&subscene=0#rd) -- 中通安全应急响应中心 - - [【联合活动】秋日限定，四家SRC与你国庆共狂欢~](https://mp.weixin.qq.com/s?__biz=MzUyMTcwNTY3Mg==&mid=2247486080&idx=1&sn=5b5a6032f692abdbf1d14b5cea4a0969&chksm=f9d64b27cea1c231a7e70ffde761a6c1879af59bcbbcbdccb235510ac63dcb0be2403fa16df9&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [国家工程研究中心安全资讯周报20220926期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531658&idx=1&sn=d086393c63a8b2b3dca87dcf69bdb440&chksm=fa93ca4bcde4435d520b008decbbfdeb80f9c70af4a87e741d6743fa2c08041ef81712df6c8a&scene=58&subscene=0#rd) - - [安全威胁日益复杂 主动网络安全成为必然](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531658&idx=2&sn=f55e785225917199225014fdba5336fa&chksm=fa93ca4bcde4435d7cad11720e70295cf313d79775456e833a1b54cf4f561d9ce53a917bda2c&scene=58&subscene=0#rd) - - [提升安全事件响应能力的难点与建议](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531658&idx=3&sn=9e6362c20de70db069ff107c6a449c19&chksm=fa93ca4bcde4435dc594b8cf8c6f883bcdfea43ed9c731e178f35a5f3fe8e97ee074b77b760b&scene=58&subscene=0#rd) -- 安全牛 - - [客户身份与访问管理（CIAM）常见威胁分析与应对](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118891&idx=1&sn=1f4be5c55a5e7834e9a6e08d634172de&chksm=bd146df88a63e4ee2c4a4387ed6f120cbdddda7416199d9812225ab7444032b5bd6c2cf065e5&scene=58&subscene=0#rd) - - [安全头条 |公安部开展集中打击整治网络账号黑色产业链“断号”行动；中国气象局印发《气象数据开放共享实施细则（试行）》](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118891&idx=2&sn=2b4358bc481ea3a08b8723e4497fcae0&chksm=bd146df88a63e4ee78e2c737d85f07030464ab810e521a7ecabdc53a647d99727596c97d0bce&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（45期）：高级Web安全专家（OSWE）认证介绍（四）](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651118891&idx=3&sn=47d962a1f3112cabaa5c15033f3d79c0&chksm=bd146df88a63e4eefcff8aea94557bef846f4bebec3875e050ed94745352fb72337de6643dd5&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-28.md b/archive/2022/2022-09-28.md deleted file mode 100644 index 0e1b62d7bb..0000000000 --- a/archive/2022/2022-09-28.md +++ /dev/null @@ -1,228 +0,0 @@ -# 每日安全资讯（2022-09-28） - -- Tenable Blog - - [The shift to integrated cybersecurity platforms: a growing trend among CISOs](https://www.tenable.com/blog/the-shift-to-integrated-cybersecurity-platforms-a-growing-trend-among-cisos) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Backdoor.Win32.Psychward.b / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022090077) - - [COVESA 2.18.8 NULL Pointer Dereference / Heap Buffer Over-Read](https://cxsecurity.com/issue/WLB-2022090076) - - [Online Birth Certificate Management System 1.0 Insecure Direct Object Reference](https://cxsecurity.com/issue/WLB-2022090075) - - [Online Birth Certificate Management System 1.0 Cross Site Request Forgery](https://cxsecurity.com/issue/WLB-2022090074) - - [Food Ordering Management System 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022090073) -- SecWiki News - - [SecWiki News 2022-09-27 Review](http://www.sec-wiki.com/?2022-09-27) -- Twitter @Nicolas Krassas - - [A collection of JavaScript engine CVEs with PoCs](https://twitter.com/Dinosn/status/1574875867301421067) - - [Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation , it contains ...](https://twitter.com/Dinosn/status/1574875646211268632) - - [Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods](https://twitter.com/Dinosn/status/1574874665566216210) - - [New NullMixer dropper infects your PC with a dozen malware families](https://twitter.com/Dinosn/status/1574874035070050312) - - [FBI Helping Australian Authorities Investigate Massive Optus Data Breach: Reports](https://twitter.com/Dinosn/status/1574868545384636419) - - [Complete take-over of Cisco Unified Communications Manager due consecutively misconfigurations](https://twitter.com/Dinosn/status/1574863466732593165) - - [Whitepaper – Project Triforce: Run AFL On Everything (2017)](https://twitter.com/Dinosn/status/1574855627779805196) - - [Defense firm Elbit Systems of America discloses data breach](https://twitter.com/Dinosn/status/1574798060160434180) - - [Sandbox Scryer: open source tool for producing threat hunting and intelligence data](https://twitter.com/Dinosn/status/1574783496475795456) - - [Skidaddle Skideldi - I just pwnd your PKI](https://twitter.com/Dinosn/status/1574783404834430977) - - [A technical analysis of Pegasus for Android – Part 2](https://twitter.com/Dinosn/status/1574783267521417216) - - [Pass-the-Hash Attacks and How to Prevent them in Windows Domains](https://twitter.com/Dinosn/status/1574783221719568384) - - [Optus hacker apologizes and allegedly deletes all stolen data](https://twitter.com/Dinosn/status/1574783162881916929) - - [Microsoft bets on hardware/software duo for Win11 security](https://twitter.com/Dinosn/status/1574769819915886594) - - [North Korea's Lazarus Hackers Targeting macOS Users Interested in Crypto Jobs](https://twitter.com/Dinosn/status/1574756050653306885) - - [Microsoft announces passwordless auth, SSO for Azure Virtual Desktop](https://twitter.com/Dinosn/status/1574756001496154112) - - [Experts Uncover 85 Apps with 13 Million Downloads Involved in Ad Fraud Scheme](https://twitter.com/Dinosn/status/1574755934500519939) - - [How Quantum Physics Leads to Decrypting Common Algorithms](https://twitter.com/Dinosn/status/1574755443104260096) - - [RT 78ResearchLab: The analysis report is uploaded!](https://twitter.com/78_lab/status/1574564300462559232) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-6696-01](https://packetstormsecurity.com/files/168538/RHSA-2022-6696-01.txt) - - [Ubuntu Security Notice USN-5643-1](https://packetstormsecurity.com/files/168539/USN-5643-1.txt) - - [Suricata IDPE 6.0.7](https://packetstormsecurity.com/files/168537/suricata-6.0.7.tar.gz) - - [Ubuntu Security Notice USN-5642-1](https://packetstormsecurity.com/files/168536/USN-5642-1.txt) - - [COVESA 2.18.8 NULL Pointer Dereference / Heap Buffer Over-Read](https://packetstormsecurity.com/files/168535/SA-20220923-0.txt) - - [Ubuntu Security Notice USN-5641-1](https://packetstormsecurity.com/files/168534/USN-5641-1.txt) - - [Online Birth Certificate Management System 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/168529/obcms10persistent-xss.txt) - - [Red Hat Security Advisory 2022-6700-01](https://packetstormsecurity.com/files/168532/RHSA-2022-6700-01.txt) - - [Red Hat Security Advisory 2022-6701-01](https://packetstormsecurity.com/files/168531/RHSA-2022-6701-01.txt) - - [Ubuntu Security Notice USN-5640-1](https://packetstormsecurity.com/files/168530/USN-5640-1.txt) - - [Red Hat Security Advisory 2022-6702-01](https://packetstormsecurity.com/files/168528/RHSA-2022-6702-01.txt) - - [Red Hat Security Advisory 2022-6703-01](https://packetstormsecurity.com/files/168527/RHSA-2022-6703-01.txt) - - [Red Hat Security Advisory 2022-6707-01](https://packetstormsecurity.com/files/168526/RHSA-2022-6707-01.txt) - - [Red Hat Security Advisory 2022-6708-01](https://packetstormsecurity.com/files/168525/RHSA-2022-6708-01.txt) - - [Online Birth Certificate Management System 1.0 Insecure Direct Object Reference](https://packetstormsecurity.com/files/168524/obcms10-idor.txt) - - [Ubuntu Security Notice USN-5639-1](https://packetstormsecurity.com/files/168523/USN-5639-1.txt) - - [Online Birth Certificate Management System 1.0 Cross Site Request Forgery](https://packetstormsecurity.com/files/168522/obcms10-xsrf.txt) - - [Ubuntu Security Notice USN-5638-1](https://packetstormsecurity.com/files/168521/USN-5638-1.txt) - - [Red Hat Security Advisory 2022-6710-01](https://packetstormsecurity.com/files/168520/RHSA-2022-6710-01.txt) - - [Red Hat Security Advisory 2022-6711-01](https://packetstormsecurity.com/files/168519/RHSA-2022-6711-01.txt) - - [Red Hat Security Advisory 2022-6713-01](https://packetstormsecurity.com/files/168518/RHSA-2022-6713-01.txt) - - [Food Ordering Management System 1.0 SQL Injection](https://packetstormsecurity.com/files/168517/foms10-sql.txt) - - [Red Hat Security Advisory 2022-6714-01](https://packetstormsecurity.com/files/168516/RHSA-2022-6714-01.txt) - - [Red Hat Security Advisory 2022-6715-01](https://packetstormsecurity.com/files/168515/RHSA-2022-6715-01.txt) -- Security Boulevard - - [Ransomware and the Severe Impact on K-12 Public Schools](https://securityboulevard.com/2022/09/ransomware-and-the-severe-impact-on-k-12-public-schools/) - - [Hitchens on US-Putin relations: “If you’re faith-based you get a KGB weasel as your partner”](https://securityboulevard.com/2022/09/hitchens-on-us-putin-relations-if-youre-faith-based-you-get-a-kgb-weasel-as-your-partner/) - - [How a Common API Vulnerability Might Have Cost Telco Optus $1 Million](https://securityboulevard.com/2022/09/how-a-common-api-vulnerability-might-have-cost-telco-optus-1-million/) - - [How to Run Mayhem from a Docker Image](https://securityboulevard.com/2022/09/how-to-run-mayhem-from-a-docker-image/) - - [The Why, What and How of Vulnerability Risk Acceptance](https://securityboulevard.com/2022/09/the-why-what-and-how-of-vulnerability-risk-acceptance/) - - [Research Shows Extent of Organizational SBOM Readiness – Techstrong TV](https://securityboulevard.com/2022/09/research-shows-extent-of-organizational-sbom-readiness-techstrong-tv/) - - [BSidesLV 2022 Lucky13 CommonGround – Nimrod Stoler’s & Nethanel Coppenhagen’s ‘Trust Me, I’m A Robot: Can We Trust RPA With Our Most Guarded Secrets?’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-commonground-nimrod-stolers-nethanel-coppenhagens-trust-me-im-a-robot-can-we-trust-rpa-with-our-most-guarded-secrets/) - - [Power Utilization Percentage and ServiceNow CMDB Sync Integration](https://securityboulevard.com/2022/09/power-utilization-percentage-and-servicenow-cmdb-sync-integration/) - - [Frontline PCI-Pro™ Datasheet](https://securityboulevard.com/2022/09/frontline-pci-pro-datasheet-2/) -- 先知安全技术社区 - - [某json 1.2.80 漏洞分析](https://xz.aliyun.com/t/11727) - - [关于HTTP Request Smuggling（HTTP请求夹带）的二三事](https://xz.aliyun.com/t/11728) -- Sploitus.com Exploits RSS Feed - - [Online Birth Certificate Management System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168533&utm_source=rss&utm_medium=rss) - - [Food Ordering Management System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168517&utm_source=rss&utm_medium=rss) - - [Online Birth Certificate Management System 1.0 Insecure Direct Object Reference exploit](https://sploitus.com/exploit?id=PACKETSTORM:168524&utm_source=rss&utm_medium=rss) - - [Online Birth Certificate Management System 1.0 Cross Site Request Forgery exploit](https://sploitus.com/exploit?id=PACKETSTORM:168522&utm_source=rss&utm_medium=rss) - - [COVESA 2.18.8 NULL Pointer Dereference / Heap Buffer Over-Read exploit](https://sploitus.com/exploit?id=PACKETSTORM:168535&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Input Validation in Cisco Rv160 Firmware exploit](https://sploitus.com/exploit?id=B69B0D79-4B1C-5E72-9D58-1F835E023023&utm_source=rss&utm_medium=rss) - - [Exploit for Deserialization of Untrusted Data in Alibaba Fastjson exploit](https://sploitus.com/exploit?id=28AFA2F1-D4AE-5810-BB8D-23EDEADE7794&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=D171CB59-DCE0-586B-ADA8-ECE9FE1754FA&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Asus Rt-Ax56U Firmware exploit](https://sploitus.com/exploit?id=9E04420F-F991-57E5-952F-7EA72FBE2340&utm_source=rss&utm_medium=rss) -- 先知安全技术社区 - - [某json 1.2.80 漏洞分析](https://xz.aliyun.com/t/11727) - - [关于HTTP Request Smuggling（HTTP请求夹带）的二三事](https://xz.aliyun.com/t/11728) -- paper - Last paper - - [CVE-2022-26135 Atlassian Jira Mobile Plugin SSRF漏洞分析](https://paper.seebug.org/1981/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [360发布NSA网络攻击后续报告 周鸿祎：城市和基础设施已成网络战目标](https://www.4hou.com/posts/N1RL) - - [嘶吼专访 | 威努特技术总监郭洋：三分技术，七分管理，是做好工控安全的箴言](https://www.4hou.com/posts/q85r) - - [利用泄露的 APP_KEY 和队列利用基于 Laravel 的应用程序](https://www.4hou.com/posts/VZk5) - - [BAZARLOADER的主加载程序分析](https://www.4hou.com/posts/xj73) - - [奇安信连续四年登榜“北京民营企业百强”](https://www.4hou.com/posts/MB6Q) - - [“三重提升”保护数据安全 揭秘南阳二院数据交互安全之路](https://www.4hou.com/posts/LBRg) - - [安华金和助力徽商银行完善数据安全风险评估能力建设](https://www.4hou.com/posts/KERr) -- 跳跳糖 - 安全与分享社区 - - [php免杀合集](https://tttang.com/archive/1740/) -- 安全脉搏 - - [Adobe Reader栈溢出漏洞复现及检测](https://www.secpulse.com/archives/187832.html) - - [BGP劫持原理及如何防御](https://www.secpulse.com/archives/187787.html) - - [TCTF/0CTF 2022-Polaris Writeup](https://www.secpulse.com/archives/187829.html) -- Planet Classpath - - [Gary Benson: Container debugging minihint](https://gbenson.net/container-debugging-minihint/) -- 安全客-有思想的安全新媒体 - - [欧盟启动开放 Web 搜索项目，希望替代 Google](https://www.anquanke.com/post/id/280774) - - [中国支付清算协会发布《非银行支付机构数字化转型研究报告》](https://www.anquanke.com/post/id/280770) - - [安全威胁日益复杂 主动网络安全成为必然](https://www.anquanke.com/post/id/280766) - - [APT28借PowerPoint文件投递Graphite恶意软件](https://www.anquanke.com/post/id/280909) - - [Erbium新型密码窃取恶意软件，捆绑游戏破解、作弊程序分发](https://www.anquanke.com/post/id/280905) - - [执法部门获取加密数据的法律改革可能性](https://www.anquanke.com/post/id/280761) - - [乌克兰宣称俄罗斯计划升级对乌网络攻击](https://www.anquanke.com/post/id/280888) - - [Google Mandiant称证据显示黑客与俄罗斯协同攻击](https://www.anquanke.com/post/id/280883) - - [数字安全观察每周简报【行业动态篇】2022.09.14-2022.09.20](https://www.anquanke.com/post/id/280838) - - [西北工业大学遭受美国NSA网络攻击调查报告（之二）](https://www.anquanke.com/post/id/280894) - - [美智库发布《软件定义战争》专题报告，聚焦未来军事装备架构设计](https://www.anquanke.com/post/id/280753) - - [以色列国防巨头埃尔比特美国分公司遭黑客攻击](https://www.anquanke.com/post/id/280859) - - [勒索不成 黑客公开患者资料](https://www.anquanke.com/post/id/280855) -- Forcepoint - - [Veterans Transforming Cybersecurity at Forcepoint](https://www.forcepoint.com/blog/insights/veterans-transforming-cybersecurity-forcepoint) - - [Expanded FedRAMP Services Help Agencies Kick-Start Zero Trust Migration](https://www.forcepoint.com/blog/insights/expanded-forcepoint-one-fedramp-authorization) -- GuidePoint Security - - [Considerations for merging your IT and OT environments into ICS](https://www.guidepointsecurity.com/blog/considerations-for-merging-your-it-and-ot-environments-into-ics/) -- Recent Commits to cve:main - - [Update Tue Sep 27 10:04:10 UTC 2022](https://github.com/trickest/cve/commit/08e11ca205de4592e20412a3449aeba730595fec) -- Twitter @bytehx - - [RT Nicolas Krassas: A collection of JavaScript engine CVEs with PoCs](https://twitter.com/Dinosn/status/1574875867301421067) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Prepare Your Organization for Compliance with the NYDFS Cybersecurity Regulation](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Hack Inn - - [XCon 2022](https://www.hackinn.com/index.php/archives/807/) -- Sucuri Blog - - [New Malware Variants Serve Bogus CloudFlare DDoS Captcha](https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [Multi-Factor Authentication Vulnerabilities](https://infosecwriteups.com/multi-factor-authentication-vulnerabilities-7a4b647a7b09?source=rss----7b722bfd1b8d--bug_bounty) -- Horizon3.ai - - [Horizon3.ai Drives Global Partner-First Approach with Expansion of Partner Program](https://www.businesswire.com/news/home/20220927005772/en/Horizon3.ai-Drives-Global-Partner-First-Approach-with-Expansion-of-Partner-Program#new_tab) -- Sucuri Blog - - [New Malware Variants Serve Bogus CloudFlare DDoS Captcha](https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html) -- Malwarebytes Labs - - [Facebook users sue Meta for allegedly building "secret workaround" to Apple privacy safeguards](https://www.malwarebytes.com/blog/news/2022/09/facebook-users-sue-meta-for-attempting-to-bypass-apple-privacy-safeguards) - - [TikTok faces $28m fine for failing to protect children's privacy](https://www.malwarebytes.com/blog/news/2022/09/tiktok-faces-28m-fine-for-failing-to-protect-childrens-privacy) - - [Flaw in some ManageEngine apps is being actively exploited, says CISA](https://www.malwarebytes.com/blog/news/2022/09/cisa-reveals-flaw-in-some-manageengine-apps-is-actively-exploited) - - [Exchange servers abused for spam through malicious OAuth applications](https://www.malwarebytes.com/blog/news/2022/09/exchange-servers-abused-for-spam-through-malicious-oauth-applications) -- Application Security Blog - - [Secure cloud-native apps and APIs at the speed your business demands](https://www.synopsys.com/blogs/software-security/gartner-critical-capabilities-appsec-cloud-native-apps/) -- SAP Blogs - - [3 things to do when starting an S/4 program – Part 1](https://blogs.sap.com/2022/09/27/3-things-to-do-when-starting-an-s-4-program-part-1/) - - [JETZT VERFÜGBAR: SAP Signavio September 2022 Release – schnellere Einblicke, schnelleres Handeln](https://blogs.sap.com/2022/09/27/jetzt-verfugbar-sap-signavio-september-2022-release-schnellere-einblicke-schnelleres-handeln/) - - [OUT NOW: SAP Signavio September 2022 release – Faster time to insight, faster time to act](https://blogs.sap.com/2022/09/27/out-now-sap-signavio-september-2022-release-faster-time-to-insight-faster-time-to-act/) - - [Key Considerations to build an agile Subscription Management Solution](https://blogs.sap.com/2022/09/27/key-considerations-to-build-an-agile-subscription-management-solution/) - - [Sprint1 Hack4Green – Des apps innovantes pour un monde durable with French SAP user group USF](https://blogs.sap.com/2022/09/27/sprint1-hack4green-des-apps-innovantes-pour-un-monde-durable-with-french-sap-user-group-usf/) - - [SAP PaPM Cloud: What’s New as of 2022-09-26?](https://blogs.sap.com/2022/09/27/sap-papm-cloud-whats-new-as-of-2022-09-26/) - - [Get Ready for the 2022 Edition of the SAP Conference on Financial Close and Reporting!](https://blogs.sap.com/2022/09/27/get-ready-for-the-2022-edition-of-the-sap-conference-on-financial-close-and-reporting/) - - [User experience and application development sessions at SAP TechEd 2022](https://blogs.sap.com/2022/09/27/user-experience-and-application-development-sessions-at-sap-teched-2022/) - - [Smartform with Arabic and English Together in a single smartform](https://blogs.sap.com/2022/09/27/smartform-with-arabic-and-english-together-in-a-single-smartform/) -- Intigriti - - [6 reasons to join Intigriti’s product team](https://blog.intigriti.com/2022/09/27/six-reasons-join-intigritis-product-team/) -- Reverse Engineering - - [A technical analysis of Pegasus for Android – Part 2](https://www.reddit.com/r/ReverseEngineering/comments/xpg7lt/a_technical_analysis_of_pegasus_for_android_part_2/) - - [Tips and tricks for reversing foreign architecture games](https://www.reddit.com/r/ReverseEngineering/comments/xp7uu6/tips_and_tricks_for_reversing_foreign/) - - [What’s In A Bit – Designing, Using And Reverse-engineering Binary File Formats - Peter Bindels](https://www.reddit.com/r/ReverseEngineering/comments/xp3z8z/whats_in_a_bit_designing_using_and/) -- KitPloit - PenTest & Hacking Tools - - [pyFlipper - Unoffical Flipper Zero Cli Wrapper Written In Python](http://www.kitploit.com/2022/09/pyflipper-unoffical-flipper-zero-cli.html) -- Black Hills Information Security - - [Constrained Language Mode Bypass When __PSLockDownPolicy Is Used](https://www.blackhillsinfosec.com/constrained-language-mode-bypass-when-pslockdownpolicy-is-used/) -- text/plain - - [Badware Techniques: Notification Spam](https://textslashplain.com/2022/09/27/badware-techniques-notification-spam/) -- Twitter @hakivvi - - [RT Skay: CVE-2022-39197 Cobalt Strike < 4.7.1 RCE Analyze](https://twitter.com/Skay_00/status/1574659437054525442) -- Blog - Praetorian - - [Fingerprintx Tool: An Internship Project for the Real World](https://www.praetorian.com/blog/fingerprintx/) -- 安全牛 - - [保障Linux 系统应用安全的常用开源工具盘点](https://www.aqniu.com/hometop/89634.html) - - [专家观点 | 关键信息基础设施保护工作思考](https://www.aqniu.com/homenews/89583.html) - - [产业观察丨派拉软件研究发布《银行零信任安全白皮书》](https://www.aqniu.com/homenews/89584.html) - - [用统一微隔离做零信任可以多便宜](https://www.aqniu.com/vendor/89635.html) - - [唯一！Fortinet连续两年跻身Gartner SD-WAN最佳执行力榜首](https://www.aqniu.com/vendor/89582.html) - - [冰蝎4.0特征分析及流量检测思路](https://www.aqniu.com/industry/89580.html) - - [VNSTech 2022北京站|安博通安全可视化前沿产品，创造网络安全业务新体验](https://www.aqniu.com/vendor/89581.html) - - [【聚焦运维安全】全流程管控 还原真实运维场景](https://www.aqniu.com/industry/89571.html) - - [安华金和助力徽商银行完善数据安全风险评估能力建设](https://www.aqniu.com/industry/89572.html) -- webs3c - Latest posts - - [From None to AWS credentials read](https://webs3c.com/t/from-none-to-aws-credentials-read/220#post_1) -- 奇客Solidot–传递最新科技情报 - - [《自然》撤回备受争议的室温超导论文](https://www.solidot.org/story?sid=72899) - - [Windows 11 22H2 导致部分英特尔设备蓝屏死机](https://www.solidot.org/story?sid=72898) - - [苹果开始在印度组装 iPhone 14](https://www.solidot.org/story?sid=72897) - - [达斯·维德的声音未来将用 AI 合成](https://www.solidot.org/story?sid=72896) - - [iPhone 14 在华销量不及预期](https://www.solidot.org/story?sid=72895) - - [NSA 在美国时间对西北工业大学发动攻击](https://www.solidot.org/story?sid=72894) - - [开源古战争策略游戏 0 A.D 发布庄子版](https://www.solidot.org/story?sid=72893) - - [我国拥有大学文化程度的人口超过 2.18 亿](https://www.solidot.org/story?sid=72892) - - [细胞漫游者探索细胞内部世界](https://www.solidot.org/story?sid=72891) - - [中国电动汽车今年销量预计将超五分之一](https://www.solidot.org/story?sid=72890) - - [TikTok 准备与美国政府达成继续在美运营的协议](https://www.solidot.org/story?sid=72889) - - [NASA DART 飞船成功撞击小行星](https://www.solidot.org/story?sid=72888) - - [普京授予斯诺登俄罗斯公民身份](https://www.solidot.org/story?sid=72887) -- 杨龙 - - [笔记10：桥接模式](https://www.yanglong.pro/%e7%ac%94%e8%ae%b010/) - - [php+RabbitMQ 3.8.16+简单延时队列实现](https://www.yanglong.pro/rabbitmq-3-8-16%e7%ae%80%e5%8d%95%e5%bb%b6%e6%97%b6%e9%98%9f%e5%88%97%e5%ae%9e%e7%8e%b0/) - - [escript: exception error: undefined function rabbitmqctl_escript:main/1](https://www.yanglong.pro/escript-exception-error-undefined-function-rabbitmqctl_escriptmain-1/) -- 腾讯玄武实验室 - - [每日安全动态推送(09-27)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651958727&idx=1&sn=47241767b49e3fda4af73db79beddda3&chksm=8baecd58bcd9444ea752e21bb071d2092234aadf7bfcfab35408a7ad59e3ee7add36ebc415ae&scene=58&subscene=0#rd) -- HackerNews - - [鼠标悬停也能中招！带毒 PPT 正用来传播 Graphite 恶意软件](https://hackernews.cc/archives/41739) - - [匿名者向伊朗政府宣战，发起 OpIran 运动攻击政府网站](https://hackernews.cc/archives/41731) - - [俄罗斯宣布：将对乌克兰及其盟国的关键基础设施进行大规模网络攻击](https://hackernews.cc/archives/41725) - - [研究人员发现 3 个支持俄罗斯利益的黑客组织](https://hackernews.cc/archives/41719) - - [印度一医疗公司毫无责任心：新冠抗原检测数据公网暴露无人处理](https://hackernews.cc/archives/41715) - - [澳大利亚在发生大规模数据泄露后将全面修订隐私法](https://hackernews.cc/archives/41710) - - [以色列国防巨头埃尔比特系统的美国分公司遭黑客攻击](https://hackernews.cc/archives/41707) -- 代码卫士 - - [Java模板框架 Pebble易受命令注入攻击](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514082&idx=1&sn=e5f47cf95f861ab419805a85f2b77ddb&chksm=ea948688dde30f9e7dab3fe0e015db7f59b41f26ab34b0e762da365423999e608fd0d9a4e9f9&scene=58&subscene=0#rd) - - [CISA提醒修复Zoho ManageEngine RCE漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514082&idx=2&sn=a353a69d6d2c5a3f065ae133b67f4256&chksm=ea948688dde30f9e50183652d6391b23fd17af36c96c1ebcf3a7f40b0034288e9a22f16cbcd8&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】男子自学黑客技术，入侵企业网站植入色情服务信息，以此牟利！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018861&idx=1&sn=51e35a6d6ecf6c6c137300bcac3c80c3&chksm=f36fb4edc4183dfba4d51d029ccb134057e4ff948578de2e55e9e67c4c7f6eceb270b4a4c632&scene=58&subscene=0#rd) - - [【安全圈】美国渗透控制中国基础设施核心设备，窃取中国敏感用户隐私数据](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018861&idx=2&sn=75d8fb49c378114cf1c7d0685d652146&chksm=f36fb4edc4183dfbef68ce821785cf962410063237ff94bfe23f71c31f68816edbbb8a110836&scene=58&subscene=0#rd) - - [【安全圈】“匿名者”组织声称黑进了俄罗斯国防部网站!](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018861&idx=3&sn=2a6e9b8aa1029545f2ff4f46bd00c607&chksm=f36fb4edc4183dfb946b65cfe52d2518f8c73a15437fe8d759b3c5c38266b7710730f8826b5a&scene=58&subscene=0#rd) - - [【安全圈】黑客勒索不成竟然直接公开个人私密资料！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018861&idx=4&sn=5c7be981206f8265997e14e3d54b3d54&chksm=f36fb4edc4183dfb48bfb709e00668ab6da79311e879df3ec9fb85d1dee8dd35dbe09c7b3c20&scene=58&subscene=0#rd) - - [【安全圈】以色列国防巨头遭黑客攻击，员工个人信息遭泄露！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018861&idx=5&sn=2884f0519e875b7bf5c2d3a345132ebc&chksm=f36fb4edc4183dfb27bfb8666a5f8a0bbdb48a689e568867f220b0fbe1df53bacab85a34b0e6&scene=58&subscene=0#rd) - - [【安全圈】ASEC警告FARGO勒索软件再次盯上了脆弱的MS SQL服务器](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652018861&idx=6&sn=13004113a678d14cfa1484c918bdf106&chksm=f36fb4edc4183dfbad3e791459be067eda12da3395496ecc464daba46347179038db28d6a75e&scene=58&subscene=0#rd) -- SecPulse安全脉搏 - - [【文末福利】新书推荐｜国内首部身份安全专业书籍《身份攻击向量》正式发布](https://mp.weixin.qq.com/s?__biz=MzAxNDM3NTM0NQ==&mid=2657044817&idx=1&sn=ebe0aab49015cb424dab60c920fef138&chksm=803fa98fb74820999479b00c8a9830505a6735bf6d21e90dca7719e3438d3ffbfbd18981548b&scene=58&subscene=0#rd) -- FreeBuf网络安全行业门户 - - [WitAwards 2022中国网络安全行业年度评选正式启动！](https://www.freebuf.com/fevents/345774.html) - - [FreeBuf早报 | 澳大利亚将全面修订隐私法；欧盟 ENISA 发布网络安全技能框架](https://www.freebuf.com/news/345706.html) - - [匿名者向伊朗政府宣战，发起OpIran运动攻击政府网站](https://www.freebuf.com/news/345701.html) - - [普京正式授予斯诺登俄罗斯国籍](https://www.freebuf.com/news/345699.html) - - [乌克兰当局警告盟国，俄罗斯正在计划升级网络攻击](https://www.freebuf.com/news/345694.html) - - [鼠标悬停也能中招！带毒PPT正用来传播Graphite恶意软件](https://www.freebuf.com/news/345682.html) diff --git a/archive/2022/2022-09-29.md b/archive/2022/2022-09-29.md deleted file mode 100644 index 8dd85c1535..0000000000 --- a/archive/2022/2022-09-29.md +++ /dev/null @@ -1,212 +0,0 @@ -# 每日安全资讯（2022-09-29） - -- SecWiki News - - [SecWiki News 2022-09-28 Review](http://www.sec-wiki.com/?2022-09-28) -- Sploitus.com Exploits RSS Feed - - [COVESA 2.18.8 NULL Pointer Dereference / Heap Buffer Over-Read Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37997&utm_source=rss&utm_medium=rss) - - [Netfilter nft_set_elem_init Heap Overflow Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:168543&utm_source=rss&utm_medium=rss) - - [Mobile Mouse 3.6.0.4 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37995&utm_source=rss&utm_medium=rss) - - [Netfilter nft_set_elem_init Heap Overflow Privilege Escalation Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-37996&utm_source=rss&utm_medium=rss) - - [Mobile Mouse Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168547&utm_source=rss&utm_medium=rss) - - [WordPress Motopress Hotel Booking Lite 4.4.2 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168540&utm_source=rss&utm_medium=rss) - - [EShop Joomla Shopping-Cart 3.6.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168541&utm_source=rss&utm_medium=rss) - - [Exploit for Integer Overflow or Wraparound in Whatsapp exploit](https://sploitus.com/exploit?id=A1FF4B2F-E45A-5894-ABF1-A7485C01A922&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=AE11B0B4-2970-5388-807A-5E72B77B2B9A&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Sophos Firewall exploit](https://sploitus.com/exploit?id=B8E34E3E-3FE6-5DA6-935C-2A0517D15077&utm_source=rss&utm_medium=rss) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Veritas Backup Exec Agent Remote Code Execution](https://cxsecurity.com/issue/WLB-2022090085) - - [WordPress Sabai Discuss 1.4.13 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090084) - - [Backdoor.Win32.Augudor.b / Remote File Write Code Execution](https://cxsecurity.com/issue/WLB-2022090083) - - [Active eCommerce CMS 6.3.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090082) - - [Active eCommerce CMS 6.3.0 Arbitrary File Download](https://cxsecurity.com/issue/WLB-2022090081) - - [Netfilter nft_set_elem_init Heap Overflow Privilege Escalation](https://cxsecurity.com/issue/WLB-2022090080) - - [EShop Joomla Shopping-Cart 3.6.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090079) - - [WordPress Motopress Hotel Booking Lite 4.4.2 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090078) -- Der Flounder - - [Slides from the “Running Jamf Pro at Scale, from SAP with ❤️” session at Jamf Nation User Conference 2022](https://derflounder.wordpress.com/2022/09/28/slides-from-the-running-jamf-pro-at-scale-from-sap%ef%bf%bc-with-%e2%9d%a4%ef%b8%8f-session-at-jamf-nation-user-conference-2022/) -- Files ≈ Packet Storm - - [Suricata IDPE 6.0.8](https://packetstormsecurity.com/files/168546/suricata-6.0.8.tar.gz) - - [GNU Transport Layer Security Library 3.7.8](https://packetstormsecurity.com/files/168545/gnutls-3.7.8.tar.xz) - - [Mobile Mouse Remote Code Execution](https://packetstormsecurity.com/files/168547/mobile_mouse_rce.rb.txt) - - [nfstream 6.5.2](https://packetstormsecurity.com/files/168544/nfstream-6.5.2.tar.gz) - - [Netfilter nft_set_elem_init Heap Overflow Privilege Escalation](https://packetstormsecurity.com/files/168543/netfilter_nft_set_elem_init_privesc.rb.txt) - - [Ubuntu Security Notice USN-5644-1](https://packetstormsecurity.com/files/168542/USN-5644-1.txt) - - [EShop Joomla Shopping-Cart 3.6.0 Cross Site Scripting](https://packetstormsecurity.com/files/168541/joomlaeshopsc360-xss.txt) - - [WordPress Motopress Hotel Booking Lite 4.4.2 Cross Site Scripting](https://packetstormsecurity.com/files/168540/wpmotopresshbl442-xss.txt) -- Twitter @Nicolas Krassas - - [MEV Bot Earns $1M But Loses Everything To A Hacker An Hour Later](https://twitter.com/Dinosn/status/1575185570476630017) - - [Ethernet VLAN Stacking flaws let hackers launch DoS, MiTM attacks](https://twitter.com/Dinosn/status/1575185230838669317) - - [NFT Sales Have Lost Nearly All Their Allure](https://twitter.com/Dinosn/status/1575185072587935745) - - [HackTricks Cloud](https://twitter.com/Dinosn/status/1575171363920179200) - - [HTB: Noter - Alternative Root (First Blood)](https://twitter.com/Dinosn/status/1575135371708563457) - - [A Deep Dive Into the APT28’s stealer called CredoMap](https://twitter.com/Dinosn/status/1575132159379210240) - - [Another Tale of IBM i (AS/400) Hacking](https://twitter.com/Dinosn/status/1575132125690486786) - - [Cryptominers hijack $53 worth of system resources to earn $1](https://twitter.com/Dinosn/status/1575126146332725254) - - [Writing and Using Python Burp Extension — Adding a Custom Header Field](https://twitter.com/Dinosn/status/1575118307488833538) - - [Scan4All - Vuls Scan: 15000+PoCs; 21 Kinds Of Application Password Crack; 7000+Web Fingerprints; 146 Protocols And 90000+ Rules Port Scanning; Fuzz, H...](https://twitter.com/Dinosn/status/1575118158150639618) - - [CVE-2022–36934: An integer overflow in WhatsApp leading to remote code execution in an established…](https://twitter.com/Dinosn/status/1575097576327548928) - - [Bl00dy ransomware gang started using leaked LockBit 3.0 builder in attacks](https://twitter.com/Dinosn/status/1575095767811108864) - - [RT Ivan Kwiatkowski: Part II of my 🔥 series 🔥 on blockchains, cryptocurrencies and NFTs is now available! In it, I discuss (rant about) Ethereum...](https://twitter.com/JusticeRage/status/1575074066003742720) - - [EvilnoVNC: 2FA bypassing by using a real browser over a noVNC connection](https://twitter.com/Dinosn/status/1575067745133400066) - - [slicer: automate the boring process of APK recon](https://twitter.com/Dinosn/status/1575058171697467392) - - [Meta dismantled the largest Russian network since the war in Ukraine began](https://twitter.com/Dinosn/status/1575036227396378624) - - [Samsung sued for gobbling up too much personal info that miscreants then stole](https://twitter.com/Dinosn/status/1575015012850368512) - - [Attacking Encrypted HTTP Communications](https://twitter.com/Dinosn/status/1575014572645568512) - - [When Hypervisor Met Snapshot Fuzzing](https://twitter.com/Dinosn/status/1575011570354388993) -- 跳跳糖 - 安全与分享社区 - - [The End of AFR?](https://tttang.com/archive/1755/) -- 先知安全技术社区 - - [0ctf2022 hessian-only-jdk writeup jdk原生链](https://xz.aliyun.com/t/11732) - - [警惕破解软件！APS 窃密木马已感染万余台设备](https://xz.aliyun.com/t/11740) - - [API安全漏洞靶场crapi的基本介绍与解题思路](https://xz.aliyun.com/t/11734) -- Envato Tuts+ Code - Mobile Development - - [10 Best Android App Templates With Maps Integration](https://code.tutsplus.com/articles/best-android-app-templates-with-maps-integration--cms-30815) -- 先知安全技术社区 - - [0ctf2022 hessian-only-jdk writeup jdk原生链](https://xz.aliyun.com/t/11732) - - [警惕破解软件！APS 窃密木马已感染万余台设备](https://xz.aliyun.com/t/11740) - - [API安全漏洞靶场crapi的基本介绍与解题思路](https://xz.aliyun.com/t/11734) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Remediate Your Vulnerable Lenovo Systems with Qualys Custom Assessment and Remediation](https://blog.qualys.com/category/vulnerabilities-threat-research) -- 安全脉搏 - - [物联网终端安全入门与实践之了解物联网终端 （上篇）](https://www.secpulse.com/archives/188107.html) - - [「拯救大冤种」记一次服务器入侵事件的应急响应](https://www.secpulse.com/archives/188073.html) - - [校园网认证系统安全测试（绕过）](https://www.secpulse.com/archives/188045.html) - - [浅析蜜罐技术](https://www.secpulse.com/archives/187873.html) - - [E-office Server_v9.0 漏洞分析](https://www.secpulse.com/archives/187859.html) -- unSafe.sh - 不安全 - - [文件重定位简单实现和对抗 - luoyesiqiu](https://buaq.net/go-128544.html) - - [LABScon 2022 Event Highlights | Advancing Cybersecurity Research for Collective Digital Defense](https://buaq.net/go-128541.html) - - [Spyware disguises itself as Zoom downloads](https://buaq.net/go-128592.html) - - [How To Attack Admin Panels Successfully](https://buaq.net/go-128540.html) - - [New Report: 65% of Critical National Infrastructure was hit by a cyberattack in the last 12 months](https://buaq.net/go-128538.html) - - [timwhitez starred loader_process_hollow_copy_in_chunk](https://buaq.net/go-128525.html) - - [The first 300 setopts](https://buaq.net/go-128539.html) -- Security Boulevard - - [The Economics of Account Takeover](https://securityboulevard.com/2022/09/the-economics-of-account-takeover/) - - [How well do you know Department of Defense Acronyms?](https://securityboulevard.com/2022/09/how-well-do-you-know-department-of-defense-acronyms/) - - [Akamai Reports Massive Spike in Malicious Domain Activity](https://securityboulevard.com/2022/09/akamai-reports-massive-spike-in-malicious-domain-acitivity/) - - [A Roadmap for Achieving Comprehensive Identity Management](https://securityboulevard.com/2022/09/a-roadmap-for-achieving-comprehensive-identity-management/) - - [BSidesLV 2022 Lucky13 CommonGround – Josh Michaels’ And Lea Snyder’s ‘The Technical Trap’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-commonground-josh-michaels-and-lea-snyders-the-technical-trap/) - - [XKCD ‘Everyday Carry’](https://securityboulevard.com/2022/09/xkcd-everyday-carry/) - - [DevOps teams: BGP security is BAD. But you can fix it](https://securityboulevard.com/2022/09/devops-teams-bgp-security-is-bad-but-you-can-fix-it/) - - [External Attack Surface Management for APIs](https://securityboulevard.com/2022/09/external-attack-surface-management-for-apis/) - - [Mobile Application Penetration Testing](https://securityboulevard.com/2022/09/mobile-application-penetration-testing/) - - [BSidesLV 2022 Lucky13 CommonGround – Rodrigo Montoro’s ‘Understanding, Abusing And Monitoring AWS AppStream 2.0’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-commonground-rodrigo-montoros-understanding-abusing-and-monitoring-aws-appstream-2-0/) -- Recent Commits to cve:main - - [Update Wed Sep 28 10:03:07 UTC 2022](https://github.com/trickest/cve/commit/099fb9845a00bb691b7a95930f2b362a49706f15) -- 安全客-有思想的安全新媒体 - - [数字安全观察每周简报【技术趋势篇】2022.09.14-2022.09.20](https://www.anquanke.com/post/id/281056) - - [基于统一结构生成的网安信息抽取研究](https://www.anquanke.com/post/id/280784) - - [KCon 2022 演讲 PPT 新鲜出炉！](https://www.anquanke.com/post/id/280985) - - [基于动态信任的内生安全架构](https://www.anquanke.com/post/id/280780) - - [国家标准《信息安全技术 网络安全众测服务要求（征求意见稿）》公开征求意见](https://www.anquanke.com/post/id/280994) - - [美国国防公司Elbit Systems证实遭遇数据泄露事件](https://www.anquanke.com/post/id/280982) - - [Lazarus组织以热门工作为饵，投放Windows/macOS 恶意软件](https://www.anquanke.com/post/id/280979) - - [主机房遭攻击，永商期货客户竟1个月无法登录？](https://www.anquanke.com/post/id/280962) - - [上机考试，鼠标自己答题？“黑客”团伙落网](https://www.anquanke.com/post/id/280956) - - [美一黑客盗取投资平台信息炒股获利350万美元被捕](https://www.anquanke.com/post/id/280953) - - [API安全与可见性未得到妥善处理](https://www.anquanke.com/post/id/280778) - - [出乎意料！黑客向Optus道歉称数据已删除](https://www.anquanke.com/post/id/280948) - - [乌克兰宣称俄罗斯计划升级对乌网络攻击](https://www.anquanke.com/post/id/280924) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [漏洞预警|Spring Data REST 敏感信息泄露漏洞](https://www.4hou.com/posts/50rx) - - [一次老版本jboss反序列化漏洞的利用分析](https://www.4hou.com/posts/YXR0) - - [Cuba勒索软件（又名Tropical Scorpius）的最新攻击策略](https://www.4hou.com/posts/vJDX) - - [Windows App 运行控制机制 Smart App Control 的实现分析](https://www.4hou.com/posts/wgxR) - - [干货福利派送中||直面遗憾最好的方式，是“固执”的选择坚持！（附：XCon+XReward讲义下载链接）](https://www.4hou.com/posts/O9Rg) -- C99.sh - - [Ransomware: Detect & Respond](https://c99.sh/ransomware-detect-respond/) -- Forcepoint - - [New Report: 65% of Critical National Infrastructure was hit by a cyberattack in the last 12 months](https://www.forcepoint.com/blog/x-labs/panic-stations-critical-infrastucture-report) -- SAP Blogs - - [SAP Fiori APP for MRP master data issues](https://blogs.sap.com/2022/09/28/sap-fiori-app-for-mrp-master-data-issues/) - - [SAP Commerce – Synchronous Order Management(SOM) to Asynchronous Order Management(AOM)](https://blogs.sap.com/2022/09/28/sap-commerce-synchronous-order-managementsom-to-asynchronous-order-managementaom/) - - [SAP TM- Get the document flow of Freight Order/Freight Unit/ FSD in Code](https://blogs.sap.com/2022/09/28/sap-tm-get-the-document-flow-of-freight-order-freight-unit-fsd-in-code/) - - [Retrieving SAP Error message data after failed webservice call in SAP iRPA / Process Automation](https://blogs.sap.com/2022/09/28/retrieving-sap-error-message-data-after-failed-webservice-call-in-sap-irpa-process-automation/) - - [SAP Service Cloud: Satisfaction survey creation in Multiple Languages](https://blogs.sap.com/2022/09/28/sap-service-cloud-satisfaction-survey-creation-in-multiple-languages/) - - [Learnings from the Implementation of SAP S/4HANA BRIM Subscription Solution](https://blogs.sap.com/2022/09/28/learnings-from-the-implementation-of-sap-s-4hana-brim-subscription-solution/) - - [Generic Object Services (GOS) toolbar in CRM Billing](https://blogs.sap.com/2022/09/28/generic-object-services-gos-toolbar-in-crm-billing/) - - [Adopting country restriction on drugs manufacturing through Segmentation](https://blogs.sap.com/2022/09/28/adopting-country-restriction-on-drugs-manufacturing-through-segmentation/) - - [SAP Digital Manufacturing Cloud (DMC) 2208 – Release Highlights!](https://blogs.sap.com/2022/09/28/sap-digital-manufacturing-cloud-dmc-2208-release-highlights/) - - [Webinar: Future of integration with SAP BTP and SAP Integration Suite, Sept. 29th 2022](https://blogs.sap.com/2022/09/28/webinar-future-of-integration-with-sap-btp-and-sap-integration-suite-sept.-29th-2022/) -- Didier Stevens - - [Update: rtfdump.py Version 0.0.11](https://blog.didierstevens.com/2022/09/28/update-rtfdump-py-version-0-0-11/) -- Bug Bounty in InfoSec Write-ups on Medium - - [How To Attack Admin Panels Successfully](https://infosecwriteups.com/how-to-attack-admin-panels-successfully-72c90eeb818c?source=rss----7b722bfd1b8d--bug_bounty) -- Securelist - - [Prilex: the pricey prickle credit card complex](https://securelist.com/prilex-atm-pos-malware-evolution/107551/) -- Malwarebytes Labs - - [APT28 attack uses old PowerPoint trick to download malware](https://www.malwarebytes.com/blog/news/2022/09/powerpoint-mouseover-triggers-powershell-script-for-malware-delivery) - - [Spyware disguises itself as Zoom downloads](https://www.malwarebytes.com/blog/news/2022/09/threat-actors-want-you-to-download-their-zoom-spyware) - - [Erbium stealer on the hunt for data](https://www.malwarebytes.com/blog/news/2022/09/increasingly-popular-erbium-stealer-on-the-hunt-for-data) - - [4 times students compromised school cybersecurity](https://www.malwarebytes.com/blog/news/2022/09/when-students-hack-their-schools) -- 博客园 - luoyesiqiu - - [文件重定位简单实现和对抗 - luoyesiqiu](https://www.cnblogs.com/luoyesiqiu/p/file_redirect.html) -- SentinelOne - - [LABScon 2022 Event Highlights | Advancing Cybersecurity Research for Collective Digital Defense](https://www.sentinelone.com/blog/labscon-2022-event-highlights-advancing-cybersecurity-research-for-collective-digital-defense/) -- Reverse Engineering - - [Reconstructed source code of the game Duke Nukem II](https://www.reddit.com/r/ReverseEngineering/comments/xqi5e6/reconstructed_source_code_of_the_game_duke_nukem/) - - [IDA 2022 Plug-In Contest](https://www.reddit.com/r/ReverseEngineering/comments/xq40hq/ida_2022_plugin_contest/) -- The Daily Swig | Cybersecurity news and views - - [Vulnerability in Apache Pulsar allowed manipulator-in-the-middle attacks](https://portswigger.net/daily-swig/vulnerability-in-apache-pulsar-allowed-manipulator-in-the-middle-attacks) - - [Rancher stored secrets in plaintext, exposed Kubernetes clusters to takeover](https://portswigger.net/daily-swig/rancher-stored-secrets-in-plaintext-exposed-kubernetes-clusters-to-takeover) -- daniel.haxx.se - - [The first 300 setopts](https://daniel.haxx.se/blog/2022/09/28/the-first-300-setopts/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 美国网攻西工大另一图谋曝光；Meta大规模关闭俄罗斯欺诈新闻网站](https://www.freebuf.com/news/345879.html) - - [DVWA解题步骤](https://www.freebuf.com/articles/web/344098.html) - - [全国信安标委发布《信息安全技术 网络安全众测服务要求》（征求意见稿）](https://www.freebuf.com/news/345854.html) - - [以色列国防巨头埃尔比特系统美国分公司遭黑客攻击](https://www.freebuf.com/news/345820.html) - - [韩国数据合规重点解读](https://www.freebuf.com/articles/others-articles/345804.html) - - [美国网攻西工大另一图谋曝光：查询中国境内敏感身份人员信息](https://www.freebuf.com/news/345788.html) -- 安全牛 - - [盛邦安全入选IDC TechScape中国数据安全发展路线图推荐厂商，为API安全治理提供新思路](https://www.aqniu.com/vendor/89685.html) - - [国家标准《信息安全技术 网络安全众测服务要求》即日起公开征求意见](https://www.aqniu.com/homenews/89681.html) - - [一文简析渗透测试应用的类型、步骤与误区](https://www.aqniu.com/hometop/89680.html) - - [政企网络边界安全管理的思考与探索](https://www.aqniu.com/vendor/89660.html) - - [华清信安保险行业安全运营高峰论坛圆满落幕](https://www.aqniu.com/industry/89659.html) - - [长扬科技李庄：注重技术研发和科技创新，积极推动工业互联网安全发展](https://www.aqniu.com/vendor/89656.html) - - [成功签约！浪潮云正式收购思福迪](https://www.aqniu.com/vendor/89657.html) -- Black Hills Information Security - - [Why You Really Need to Stop Disabling UAC](https://www.blackhillsinfosec.com/why-you-really-need-to-stop-disabling-uac/) -- HackerNews - - [网络攻击扰乱酒店供应链 洲际酒店集团加盟商损失惨重](https://hackernews.cc/archives/41746) - - [前所未见的 APT 组织 Metador 已攻击电信、ISP 和大学约 2 年](https://hackernews.cc/archives/41744) -- KitPloit - PenTest & Hacking Tools - - [Psudohash - Password List Generator That Focuses On Keywords Mutated By Commonly Used Password Creation Patterns](http://www.kitploit.com/2022/09/psudohash-password-list-generator-that.html) -- 博客园 - nice_0e3 - - [Zoho ManageEngine ServiceDesk Plus (CVE-2021-44077) 漏洞分析 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16738291.html) -- r2c website - - [Software supply chain security is hard](https://r2c.dev/blog/2022/software-supply-chain-security-is-hard/) -- Checkmarx.com - - [How We Created an API Security CTF](https://checkmarx.com/blog/how-we-created-an-api-security-ctf/) -- 奇客Solidot–传递最新科技情报 - - [OpenAI 将允许任何人立即使用 DALL-E](https://www.solidot.org/story?sid=72912) - - [德国将保留剩余三个核电站中的两个至明年 4 月](https://www.solidot.org/story?sid=72911) - - [国际电联将宣布新秘书长](https://www.solidot.org/story?sid=72910) - - [Netflix 创办自己的游戏工作室](https://www.solidot.org/story?sid=72909) - - [AI 和机器人帮助设计最佳电池](https://www.solidot.org/story?sid=72908) - - [人民币兑美元汇率跌破 7.2](https://www.solidot.org/story?sid=72907) - - [乌干达爆发埃博拉疫情 23 人死亡](https://www.solidot.org/story?sid=72906) - - [Fast Company 遭黑客入侵网站关闭](https://www.solidot.org/story?sid=72905) - - [中国约会平台变为交友平台](https://www.solidot.org/story?sid=72904) - - [研究人员发现 Stable Diffusion 能压缩图像](https://www.solidot.org/story?sid=72903) - - [英特尔公布 XeSS 1.0 源代码](https://www.solidot.org/story?sid=72902) - - [英特尔发布 13 代 Raptor Lake 处理器](https://www.solidot.org/story?sid=72901) - - [英特尔发布起售价 329 美元的桌面显卡 Arc A770](https://www.solidot.org/story?sid=72900) -- 博客园 - 郑瀚Andrew - - [云山境 项目可行性分析 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16725925.html) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-09-28](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492841&idx=1&sn=5b1a7a1ef574752193efc08fec7757fa&chksm=c063ca30f71443266c234d4cf159bd006ef394602e16cc0fb55e427a9931b841c7534a213b49&scene=58&subscene=0#rd) -- Tide安全团队 - - [悟空crm漏洞新用](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247500554&idx=1&sn=d5d6e289e3e03f249f99d92fd62f9f74&chksm=ce5de16bf92a687da706dd32f2b317d52cb08348ad01e6dc080e66be429f8a70cb0713eddd12&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [GDB加载/卸载so时断下来](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486220&idx=1&sn=3a1fc5036e5d6d69e02248af655a2dc7&chksm=fab2c833cdc54125efb2d8cf50ac596e0c699bb2d8b1c1f33730501071beca3e65f63746117c&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [干货福利派送中||直面遗憾最好的方式，是“固执”的选择坚持！（附：XCon+XReward讲义下载链接）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551298&idx=1&sn=3a76ed7b83b3c556470b073e11dac196&chksm=e915d978de62506e8f5935212c623433d6320592ecb6572bca1fa7297b2ff8181f0a20ea89ff&scene=58&subscene=0#rd) - - [Cuba勒索软件的最新攻击策略](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551298&idx=2&sn=cf24cba6f3595a427e824705db7af519&chksm=e915d978de62506eec1cca9e07788a0e82e4deea004a286c0fc484e4027ae957a2610e6dcab3&scene=58&subscene=0#rd) - - [Windows App 运行控制机制 Smart App Control 的实现分析](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551298&idx=3&sn=01a569f446fc794a52dc066524de9581&chksm=e915d978de62506e9101b9e4a8932700bd29edd0d94facb2a1bb737e4f994ba212687252fbbc&scene=58&subscene=0#rd) -- 安全威胁情报 - - [重来五次之后，我终于修炼成CSO……](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650174374&idx=1&sn=2402552e5ac3f598208d6ea5ca978a74&chksm=f448881ac33f010c328f43017d9ad61e698809c7239e6234e6d49a19bb9e0295eff40eaf51ab&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Sep.28th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495865&idx=1&sn=452ca245940be3c9055a950682b45b3a&chksm=ce96bd87f9e134918217b97fedba3cd036e7567d892eda639ee4e34377537a96a884a35d748c&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-09-30.md b/archive/2022/2022-09-30.md deleted file mode 100644 index ac20eb958f..0000000000 --- a/archive/2022/2022-09-30.md +++ /dev/null @@ -1,218 +0,0 @@ -# 每日安全资讯（2022-09-30） - -- Recent Commits to cve:main - - [Update Thu Sep 29 10:12:55 UTC 2022](https://github.com/trickest/cve/commit/db3a173d3d8ddb1a50eb613ce0e60c7736025326) -- Twitter @Nicolas Krassas - - [RT abuse.ch: New Exchange #0day exploit in the wild 🔥🔥🔥 English version here 👇👇👇](https://twitter.com/abuse_ch/status/1575559280144498689) - - [Never-Before-Seen Malware Has Infected Hundreds Of Linux And Windows Devices](https://twitter.com/Dinosn/status/1575555446299295744) - - [Espionage Group Wields Steganographic Backdoor Against Govs, Stock Exchange](https://twitter.com/Dinosn/status/1575555089724481542) - - [Researcher details FFmpeg remote code execution (CVE-2022-2566) flaw](https://twitter.com/Dinosn/status/1575554917649223681) - - [XSS Flaw in Prevalent Media Imaging Tool Exposes Trove of Patient Data](https://twitter.com/Dinosn/status/1575554853371514881) - - [ZINC weaponizing open-source software](https://twitter.com/Dinosn/status/1575554042616741888) - - [Researchers Uncover Covert Attack Campaign Targeting Military Contractors](https://twitter.com/Dinosn/status/1575553899276439552) - - [Brave browser to start blocking annoying cookie consent banners](https://twitter.com/Dinosn/status/1575553804988284938) - - [Stealing data with CSS - CSS injection (Part 1)](https://twitter.com/Dinosn/status/1575553685236879360) - - [Capital One Phish Showcases Growing Bank-Brand Targeting Trend](https://twitter.com/Dinosn/status/1575553485109530624) - - [RT Tuan Anh Nguyen 🇻🇳 ⚡️: New 0day post-auth RCE on Exchange Server is being exploit in the wild and has been detected by team GTSC. They catc...](https://twitter.com/haxor31337/status/1575510329639174146) - - [aced: parse and resolve a single targeted Active Directory principal’s DACL](https://twitter.com/Dinosn/status/1575472454943866881) - - [GodGenesis: Python3 based C2 server to bypass all the known antiviruses and endpoints](https://twitter.com/Dinosn/status/1575472293190451207) - - [New malware backdoors VMware ESXi servers to hijack virtual machines](https://twitter.com/Dinosn/status/1575472242711994369) - - [SpyCast - A Crossplatform mDNS Enumeration Tool](https://twitter.com/Dinosn/status/1575471913748553731) - - [Swachh City Platform Suffers Data Breach Leaking 16 Million User Records](https://twitter.com/Dinosn/status/1575471785159655425) - - [Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs](https://twitter.com/Dinosn/status/1575385921356283904) - - [Reverse Engineer's Toolkit](https://twitter.com/Dinosn/status/1575385460557455360) - - [Re @elhaji_leon @SaveToNotion @gotomute](https://twitter.com/Dinosn/status/1575366612038963200) - - [Auth0 warns that some source code repos may have been stolen](https://twitter.com/Dinosn/status/1575365897576931328) -- Security Boulevard - - [Fake CISO Profiles on LinkedIn Target Fortune 500s](https://securityboulevard.com/2022/09/fake-ciso-profiles-on-linkedin-target-fortune-500s/) - - [FBI Arrests Pro-Russian “Patriot Hackers” from Colorado and Maryland](https://securityboulevard.com/2022/09/fbi-arrests-pro-russian-patriot-hackers-from-colorado-and-maryland/) - - [Reducing Insider Risk Through Employee Empathy](https://securityboulevard.com/2022/09/reducing-insider-risk-through-employee-empathy/) - - [RMISC is Back! A Look Inside 2022’s In-Person Conference](https://securityboulevard.com/2022/09/rmisc-is-back-a-look-inside-2022s-in-person-conference/) - - [BSidesLV 2022 Lucky13 CommonGround – Wendy Knox Everette’s ‘Weaponizing Your Fitness Tracker Against You: Health, Fitness & Location Tracking In A Post-Roe World’](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-commonground-wendy-knox-everettes-weaponizing-your-fitness-tracker-against-you-health-fitness-location-tracking-in-a-post-roe-world/) - - [Netography Integrates with CrowdStrike Making it Easier to Sync Context](https://securityboulevard.com/2022/09/netography-integrates-with-crowdstrike-making-it-easier-to-sync-context/) - - [Ukraine-Russia Conflict: Ukraine Alerts Energy Enterprises to Possible Cyberattack Escalation](https://securityboulevard.com/2022/09/ukraine-russia-conflict-ukraine-alerts-energy-enterprises-to-possible-cyberattack-escalation/) - - [XKCD ‘Pilot Priority List’](https://securityboulevard.com/2022/09/xkcd-pilot-priority-list/) - - [Zero Trust Is (also) About Protecting Machine Identities](https://securityboulevard.com/2022/09/zero-trust-is-also-about-protecting-machine-identities/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Joomla AdsManager 3.2.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022090090) - - [Bus Pass Management System 1.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090089) - - [qdPM 9.1 Authenticated Shell Upload](https://cxsecurity.com/issue/WLB-2022090088) - - [Joomla EDocman 1.23.3 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090087) - - [Online Examination System 1.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022090086) -- Sploitus.com Exploits RSS Feed - - [Online Examination System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168549&utm_source=rss&utm_medium=rss) - - [Bus Pass Management System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168555&utm_source=rss&utm_medium=rss) - - [Joomla EDocman 1.23.3 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38002&utm_source=rss&utm_medium=rss) - - [Joomla EDocman 1.23.3 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168550&utm_source=rss&utm_medium=rss) - - [qdPM 9.1 Authenticated Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168559&utm_source=rss&utm_medium=rss) - - [Online Examination System 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168551&utm_source=rss&utm_medium=rss) - - [Online Examination System 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38001&utm_source=rss&utm_medium=rss) - - [Online Examination System 1.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38000&utm_source=rss&utm_medium=rss) - - [Joomla AdsManager 3.2.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168556&utm_source=rss&utm_medium=rss) - - [Lavalite 9.0.0 XSRF TOKEN cookie File path traversal Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37998&utm_source=rss&utm_medium=rss) - - [Joomla AdsManager 3.2.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38003&utm_source=rss&utm_medium=rss) - - [Bus Pass Management System 1.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-37999&utm_source=rss&utm_medium=rss) - - [qdPM 9.1 Authenticated Shell Upload Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38004&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=B0643798-AA3E-5AF0-A9C0-85D3E7B20AEE&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Zohocorp Manageengine Servicedesk Plus exploit](https://sploitus.com/exploit?id=92200053-A0C9-5F1E-AA97-B445DF8E17A4&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5647-1](https://packetstormsecurity.com/files/168561/USN-5647-1.txt) - - [Ubuntu Security Notice USN-5615-2](https://packetstormsecurity.com/files/168560/USN-5615-2.txt) - - [Red Hat Security Advisory 2022-6741-01](https://packetstormsecurity.com/files/168558/RHSA-2022-6741-01.txt) - - [qdPM 9.1 Authenticated Shell Upload](https://packetstormsecurity.com/files/168559/qdpm_authenticated_rce.rb.txt) - - [TestSSL 3.0.8](https://packetstormsecurity.com/files/168557/testssl.sh-3.0.8.tar.gz) - - [Joomla AdsManager 3.2.0 SQL Injection](https://packetstormsecurity.com/files/168556/joomlaadsmanager320-sql.txt) - - [Bus Pass Management System 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/168555/buspms10-xss.txt) - - [Ubuntu Security Notice USN-5646-1](https://packetstormsecurity.com/files/168554/USN-5646-1.txt) - - [SIPPTS 3.2](https://packetstormsecurity.com/files/168553/sippts-3.2.tar.gz) - - [Ubuntu Security Notice USN-5645-1](https://packetstormsecurity.com/files/168552/USN-5645-1.txt) - - [Online Examination System 1.0 SQL Injection](https://packetstormsecurity.com/files/168551/oes10-sql.txt) - - [Joomla EDocman 1.23.3 Cross Site Scripting](https://packetstormsecurity.com/files/168550/joomlaedocman1233-xss.txt) - - [Online Examination System 1.0 Cross Site Scripting](https://packetstormsecurity.com/files/168549/oes10-xss.txt) - - [monomorph MD5-Monomorphic Shellcode Packer](https://packetstormsecurity.com/files/168548/monomorph-20220929.zip) -- SecWiki News - - [SecWiki News 2022-09-29 Review](http://www.sec-wiki.com/?2022-09-29) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Qualys Threat Research Thursday](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Sucuri Blog - - [WordPress Vulnerability & Patch Roundup September 2022](https://blog.sucuri.net/2022/09/wordpress-vulnerability-patch-roundup-september-2022.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [黑客从Wintermute加密货币做市商狂卷1.62亿美元](https://www.4hou.com/posts/QL27) - - [电商平台使用的物流API的安全风险](https://www.4hou.com/posts/PJ8z) -- 跳跳糖 - 安全与分享社区 - - [glibc2.35后门执行研究:tls_dtor_list攻击劫持exit执行流程](https://tttang.com/archive/1749/) -- Filippo Valsorda - - [age and Authenticated Encryption](https://words.filippo.io/dispatches/age-authentication/) -- bunnie's blog - - [Name that Ware, September 2022](https://www.bunniestudios.com/blog/?p=6575) - - [Winner, Name that Ware August 2022](https://www.bunniestudios.com/blog/?p=6573) -- 安全客-有思想的安全新媒体 - - [活动 | 惊喜警报，三倍积分，四重奖励](https://www.anquanke.com/post/id/281143) - - [高发类电信网络诈骗案件的侦查处置与对策](https://www.anquanke.com/post/id/280936) - - [第三届智能网联汽车网络安全渗透测试结果发布](https://www.anquanke.com/post/id/280915) - - [对关键信息基础设施保护的新思考](https://www.anquanke.com/post/id/280932) - - [黑客使用Quantum Builder投递Agent Tesla恶意软件](https://www.anquanke.com/post/id/281099) - - [Bl00dy勒索软件团伙使用LockBit 3.0构建器实施攻击活动](https://www.anquanke.com/post/id/281089) - - [《网络安全标准实践指南—健康码防伪技术指南》发布（附全文）](https://www.anquanke.com/post/id/281098) - - [Brute Ratel后利用工具包已被破解，黑客社区免费共享](https://www.anquanke.com/post/id/281084) - - [美军事武器承包商遭黑客攻击，涉F-35“闪电”II](https://www.anquanke.com/post/id/281077) - - [数字安全观察每周简报【安全事件篇】2022.09.14-2022.09.20](https://www.anquanke.com/post/id/280848) - - [美国国税局警告短信网络钓鱼攻击呈指数级增长](https://www.anquanke.com/post/id/281064) -- Chromium Blog - - [Chrome 107 Beta](http://blog.chromium.org/2022/09/chrome-107-beta.html) -- Trustwave Blog - - [Trustwave Secures Fourth Gold Competency in the Microsoft Partner Network](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwave-secures-fourth-gold-competency-in-the-microsoft-partner-network/) -- Blogs on STAR Labs - - [Apple CoreText - An Unexpected Journey to Learn about Failure](https://starlabs.sg/blog/2022/09-apple-coretext-an-unexpected-journey-to-learn-about-failure/) -- 安全脉搏 - - [物联网终端安全入门与实践之玩转物联网固件（中）](https://www.secpulse.com/archives/188250.html) - - [《物联网终端安全入门与实践之玩转物联网固件》上](https://www.secpulse.com/archives/188182.html) - - [《物联网终端安全入门与实践之了解物联网终端》下](https://www.secpulse.com/archives/188122.html) -- Insinuator.net - - [Some experiments with Process Hollowing](https://insinuator.net/2022/09/some-experiments-with-process-hollowing/) -- Microsoft Security Blog - - [How one product manager builds community at Microsoft Security](https://www.microsoft.com/security/blog/2022/09/29/how-one-product-manager-builds-community-at-microsoft-security/) - - [CSO perspective: Why a strong IAM strategy is key to an organization’s cybersecurity approach](https://www.microsoft.com/security/blog/2022/09/29/cso-perspective-why-a-strong-iam-strategy-is-key-to-an-organizations-cybersecurity-approach/) - - [ZINC weaponizing open-source software](https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/) -- Securelist - - [The secrets of Schneider Electric’s UMAS protocol](https://securelist.com/the-secrets-of-schneider-electrics-umas-protocol/107435/) -- Twitter @bytehx - - [RT Aman Rawat: Successfully created an exploit for CVE-2022-2633 and added template in @pdnuclei 😎 #bugbountytip #infosec #hacking](https://twitter.com/theamanrawat/status/1575459351992872961) - - [RT Akshat: Prototype Pollution!!!!!, a less talked about bug with a greater impact. Read my new blog "Prototype Pollution 101".](https://twitter.com/kyleakshat999/status/1575438127631515649) -- SpiderLabs Blog from Trustwave - - [CVE-2022-37461: Two Reflected XSS Vulnerabilities in Canon Medical’s Vitrea View](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-37461-two-reflected-xss-vulnerabilities-in-canon-medicals-vitrea-view/) -- GuidePoint Security - - [Cybersecurity Awareness Month 2022](https://www.guidepointsecurity.com/blog/cybersecurity-awareness-month-2022/) -- ly0n.me - - [A record – Why is it important?](https://ly0n.me/a-record-why-is-it-important/) -- Sucuri Blog - - [WordPress Vulnerability & Patch Roundup September 2022](https://blog.sucuri.net/2022/09/wordpress-vulnerability-patch-roundup-september-2022.html) -- Reverse Engineering - - [Found this obfuscated script on my website. Anyone can help me deobfuscate it?](https://www.reddit.com/r/ReverseEngineering/comments/xrh08s/found_this_obfuscated_script_on_my_website_anyone/) - - [A Deep Dive Into the APT28’s stealer called CredoMap](https://www.reddit.com/r/ReverseEngineering/comments/xr0tbs/a_deep_dive_into_the_apt28s_stealer_called/) - - [Ziion: Discovery of this New Kali Linux for Blockchain Security](https://www.reddit.com/r/ReverseEngineering/comments/xr77lm/ziion_discovery_of_this_new_kali_linux_for/) -- The Daily Swig | Cybersecurity news and views - - [Patching common vulnerabilities at scale: project promises bulk pull requests](https://portswigger.net/daily-swig/patching-common-vulnerabilities-at-scale-project-promises-bulk-pull-requests) -- SAP Blogs - - [Register for the SAP Essential Success Experience Day on October 27, 2022](https://blogs.sap.com/2022/09/29/register-for-the-sap-essential-success-experience-day-on-october-27-2022/) - - [Deleting / Re-organizing BOOKMARKS – SAP BW bookmarks deletion](https://blogs.sap.com/2022/09/29/deleting-re-organizing-bookmarks-sap-bw-bookmarks-deletion/) - - [[Blog Series] X.509 certificate-based authentication(mTLS) – Demystified](https://blogs.sap.com/2022/09/29/blog-series-x.509-certificate-based-authenticationmtls-demystified/) - - [Devtoberfest 2022 Week 1](https://blogs.sap.com/2022/09/29/devtoberfest-2022-week-1/) - - [Business and Digital Trends in the Chemical Industry](https://blogs.sap.com/2022/09/29/business-and-digital-trends-in-the-chemical-industry/) - - [Employee Central Service Center- An Overview](https://blogs.sap.com/2022/09/29/employee-central-service-center-an-overview/) - - [PILS Partner Meet-Up EMEA – Ideate, Co-innovate, Certify and Operate](https://blogs.sap.com/2022/09/29/pils-partner-meet-up-emea-ideate-co-innovate-certify-and-operate/) - - [Patrick Sims on What’s Coming Next in SAP BI 4.3, SP3 – and BI 2024](https://blogs.sap.com/2022/09/29/patrick-sims-on-whats-coming-next-in-sap-bi-4.3-sp3-and-bi-2024/) -- Malwarebytes Labs - - [Local government cybersecurity: 5 best practices](https://www.malwarebytes.com/blog/business/2022/09/local-government-cybersecurity-5-best-practices) - - [Optus data breach "attacker" says sorry, it was a mistake](https://www.malwarebytes.com/blog/news/2022/09/optus-data-breach-attacker-says-sorry-it-was-a-mistake) - - [Fast Company hacked to send obscene and racist messages](https://www.malwarebytes.com/blog/news/2022/09/fast-company-is-currently-investigating-how-it-got-hacked) -- KitPloit - PenTest & Hacking Tools - - [SpyCast - A Crossplatform mDNS Enumeration Tool](http://www.kitploit.com/2022/09/spycast-crossplatform-mdns-enumeration.html) -- 博客园 - nice_0e3 - - [Zoho ManageEngine ADAudit Plus (CVE-2022-28219 )漏洞分析 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16742215.html) -- FreeBuf网络安全行业门户 - - [一文了解智能汽车网安政策和法规](https://www.freebuf.com/articles/neopoints/345975.html) - - [FreeBuf早报 | 女子玩“羊了个羊”被骗9万元；中央网信办深入开展网络辟谣标签工作](https://www.freebuf.com/news/345971.html) - - [国家标准《信息安全技术 网络安全信息报送指南（征求意见稿）》发布](https://www.freebuf.com/news/345923.html) - - [《网络安全标准实践指南—健康码防伪技术指南》发布](https://www.freebuf.com/news/345921.html) - - [Meta 关闭大规模俄罗斯欺诈新闻“网络”](https://www.freebuf.com/news/345904.html) - - [记一次内网靶场渗透测试](https://www.freebuf.com/articles/network/345895.html) -- SentinelOne - - [Feature Spotlight | Combating Email Threats Through AI-Driven Defenses with Armorblox Integration](https://www.sentinelone.com/blog/feature-spotlight-combating-email-threats-through-ai-driven-defenses-with-armorblox-integration/) - - [S Ventures Invests in Armorblox to Combat Email Threats Using Natural Language Understanding and AI](https://www.sentinelone.com/blog/s-ventures-invests-in-armorblox-to-combat-email-threats-using-natural-language-understanding-and-ai/) -- 绿盟科技技术博客 - - [多方安全计算（4）MPC万能积木 秘密共享](http://blog.nsfocus.net/mpc4-0/) -- 安全牛 - - [工业控制器安全防护新方向](https://www.aqniu.com/vendor/89725.html) - - [中国开发区协会商业秘密保护专业委员会正式成立](https://www.aqniu.com/vendor/89713.html) - - [社区分享｜中南民族大学基于JumpServer构建规范、便利的运维安全体系](https://www.aqniu.com/vendor/89707.html) - - [自然资源部：维护国家地理信息数据安全，联合查处“问题地图”共享服务](https://www.aqniu.com/hometop/89695.html) - - [有奖调研丨2022企业数据安全建设状况与发展需求](https://www.aqniu.com/homenews/89694.html) - - [直播预告 | 网安大讲堂（46期）：软件安全开发模型解读](https://www.aqniu.com/homenews/89693.html) - - [vivo鲁京辉：数据安全与隐私保护是消费者的基本权利，是企业的“铁律”](https://www.aqniu.com/vendor/89692.html) - - [正见未来 | 筑量子时代信任体系 吉大正元多项抗量子研究成果首发](https://www.aqniu.com/vendor/89691.html) -- Twitter @hakivvi - - [RT Control_eXecute:](https://twitter.com/notzecoxao/status/1575306583222910976) -- Blog - Praetorian - - [“Always a New Challenge to Work On”: 2022 Summer Internship Program](https://www.praetorian.com/blog/summer-2022-intern-experience/) -- 奇客Solidot–传递最新科技情报 - - [动物研究显示精子组团前进](https://www.solidot.org/story?sid=72929) - - [Doreen Bogdan-Martin 当选为 ITU 秘书长](https://www.solidot.org/story?sid=72928) - - [《原神》两年产生 37 亿美元收入](https://www.solidot.org/story?sid=72927) - - [欧盟提出 AI 责任指令更容易就 AI 产品提起诉讼](https://www.solidot.org/story?sid=72926) - - [加州州长签署了薪酬透明法案](https://www.solidot.org/story?sid=72925) - - [华尔街银行为使用 WhatsApp 等加密应用缴纳逾 20 亿美元罚款](https://www.solidot.org/story?sid=72924) - - [Google疑似关闭了Google翻译的中国站点](https://www.solidot.org/story?sid=72923) - - [苹果据报道拒绝了台积电涨价 6% 的提议](https://www.solidot.org/story?sid=72922) - - [Cloudflare 推出 CAPTCHA 免费替代 Turnstile](https://www.solidot.org/story?sid=72921) - - [新恶意程序能感染 Windows、Linux 和 FreeBSD](https://www.solidot.org/story?sid=72920) - - [亚马逊发布 10.2 英寸电子书阅读器 Kindle Scribe](https://www.solidot.org/story?sid=72919) - - [中国科学家揭示埃博拉病毒聚合酶复合物的三维结构](https://www.solidot.org/story?sid=72918) - - [美国研究利用 AI 揭开匿名作者身份](https://www.solidot.org/story?sid=72917) - - [科学家发现了警告泰坦尼克号冰山的船只残骸](https://www.solidot.org/story?sid=72916) - - [Google 推迟 Manifest V2 扩展淘汰时间](https://www.solidot.org/story?sid=72915) - - [二维材料发现奇异的电子态费米弧](https://www.solidot.org/story?sid=72914) - - [朝鲜启动新冠疫苗接种](https://www.solidot.org/story?sid=72913) -- 杨龙 - - [RabbitMQ RPC使用](https://www.yanglong.pro/rabbitmq-rpc%e4%bd%bf%e7%94%a8/) -- Checkmarx.com - - [Maximize Your AppSec Return on Investment With Checkmarx One](https://checkmarx.com/blog/maximize-your-appsec-return-on-investment-with-checkmarx-one/) -- dotNet安全研究僧 - - [推荐 | 基于C#实现系统杀软对比排查工具](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486485&idx=1&sn=17104c2fa279796a70493f2808c9436f&chksm=fa5aa2f8cd2d2beedc7f8020ccea55f2d868946548e6a451be61e6446e9fb268a94d49765791&scene=58&subscene=0#rd) - - [优惠活动 | .NET矩阵星球亮点](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486485&idx=2&sn=2eb145c624be5d47d57c92aac40a3314&chksm=fa5aa2f8cd2d2beeaa3438d3c2ebba1b57a28f333cb9ee6b9628b7cd55e944b6c15b93f642a7&scene=58&subscene=0#rd) -- 虎符智库 - - [俄乌网络战背景下的城市网络安全建设](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247488167&idx=1&sn=83e5189d05bf86ef899e19b49ec0c653&chksm=971e7fa5a069f6b34e99c73c0a392ffa4a6f34897b0d9d28c869b6c8500a99c7f137cda9bf08&scene=58&subscene=0#rd) -- HackerNews - - [Meta 关闭大规模俄罗斯欺诈新闻“网络”](https://hackernews.cc/archives/41751) - - [俄罗斯监管机构要求苹果就将VK应用从 App Store 下架一事作出答复](https://hackernews.cc/archives/41749) -- 极客公园 - - [拉里·佩奇：创谷歌易，做飞行汽车难](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652968997&idx=1&sn=6e9b6ddf80012e92173227bf64b29dff&chksm=7e5465934923ec85c5da6756816a0eae66ce589117a8e91fa7ff32fe315ef5fb76425c2801bc&scene=58&subscene=0#rd) - - [进击的 Omniverse，英伟达的元宇宙新思考](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652968997&idx=2&sn=ef0232973a25b8919dcafb4a559fc734&chksm=7e5465934923ec853b0b4df878d8819960d49d7ddb7f623221a6083e5d41fcb43b50419df621&scene=58&subscene=0#rd) -- 星阑科技 - - [【技术干货】CVE-2022-34916 Apache Flume 远程代码执行漏洞分析](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495884&idx=1&sn=82c81cafe16e8158f9c32923e14fce50&chksm=c0075d50f770d446333878ac4b6e889ff44d1913228ac3c95b802f7ece1622432785fd12d156&scene=58&subscene=0#rd) -- 默安科技 - - [名列13位！默安科技荣膺“2022杭州市高成长性百强企业”称号](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247494344&idx=1&sn=13cbe9e2b37e927805ed7773643e0146&chksm=e93b1deade4c94fc3072afa0216c6a450e3226a1716323ec8ae1d7102c8ca166b0b5250c77c3&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.09.29）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491454&idx=1&sn=3dc77f96a11fa4e57eafa694c9a639db&chksm=fe251a7fc952936923d2ccd0b73b3e3ef2a1251be9d6f25a44fbbe1cd0c96dbdd4cfc2091392&scene=58&subscene=0#rd) -- 青藤技术服务 - - [强！高端电企这样避开安全“拦路虎”，效果翻倍](https://mp.weixin.qq.com/s?__biz=MzUyOTkwNTQ5Mg==&mid=2247486328&idx=1&sn=acdeee5b9a30d79ec130cfd27765f9ec&chksm=fa58a943cd2f2055329689b5c2fb458704ee8df194c1f879634a344860e932a0aafb74d58679&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-01.md b/archive/2022/2022-10-01.md deleted file mode 100644 index c2b1e6c6fe..0000000000 --- a/archive/2022/2022-10-01.md +++ /dev/null @@ -1,207 +0,0 @@ -# 每日安全资讯（2022-10-01） - -- NOSEC 安全讯息平台 - 漏洞预警 - - [【漏洞通报】微软Exchange服务SSRF&RCE漏洞（CVE-2022-4104...](https://nosec.org/home/detail/5037.html) -- Sploitus.com Exploits RSS Feed - - [Joomla DJ-Classifieds Ads 3.9 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168571&utm_source=rss&utm_medium=rss) - - [Joomla JoomRecipe 4.2.2 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168566&utm_source=rss&utm_medium=rss) - - [jCart For OpenCart 3.0.3.19 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168570&utm_source=rss&utm_medium=rss) - - [Exploit for Use After Free in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=5226B4B5-D53F-503C-8DD3-C3A316CA43FC&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=C2143FD5-3496-5264-8411-DE5008792F12&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-41082 exploit](https://sploitus.com/exploit?id=6E208382-5651-5649-B6C1-F9EF3A08EA81&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Zlib exploit](https://sploitus.com/exploit?id=63864FA7-D343-5F8E-8418-001077DB5B78&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Facade Ignition exploit](https://sploitus.com/exploit?id=0EF9F6DB-42EC-5183-B85C-571CD1B0D72B&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-41040 exploit](https://sploitus.com/exploit?id=58C7CDFB-F328-57B4-ACE6-CA3966DB0EEB&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [Gentoo Linux Security Advisory 202209-27](https://packetstormsecurity.com/files/168580/glsa-202209-27.txt) - - [Gentoo Linux Security Advisory 202209-20](https://packetstormsecurity.com/files/168579/glsa-202209-20.txt) - - [Gentoo Linux Security Advisory 202209-24](https://packetstormsecurity.com/files/168578/glsa-202209-24.txt) - - [Gentoo Linux Security Advisory 202209-22](https://packetstormsecurity.com/files/168577/glsa-202209-22.txt) - - [Gentoo Linux Security Advisory 202209-26](https://packetstormsecurity.com/files/168576/glsa-202209-26.txt) - - [Gentoo Linux Security Advisory 202209-23](https://packetstormsecurity.com/files/168575/glsa-202209-23.txt) - - [Gentoo Linux Security Advisory 202209-25](https://packetstormsecurity.com/files/168574/glsa-202209-25.txt) - - [Gentoo Linux Security Advisory 202209-21](https://packetstormsecurity.com/files/168573/glsa-202209-21.txt) - - [Gentoo Linux Security Advisory 202209-19](https://packetstormsecurity.com/files/168572/glsa-202209-19.txt) - - [Joomla DJ-Classifieds Ads 3.9 Cross Site Scripting](https://packetstormsecurity.com/files/168571/joomladjclassifiedsads39-xss.txt) - - [jCart For OpenCart 3.0.3.19 Cross Site Scripting](https://packetstormsecurity.com/files/168570/opencartjcart30319-xss.txt) - - [Gentoo Linux Security Advisory 202209-18](https://packetstormsecurity.com/files/168569/glsa-202209-18.txt) - - [Gentoo Linux Security Advisory 202209-17](https://packetstormsecurity.com/files/168568/glsa-202209-17.txt) - - [Gentoo Linux Security Advisory 202209-16](https://packetstormsecurity.com/files/168567/glsa-202209-16.txt) - - [Joomla JoomRecipe 4.2.2 Cross Site Scripting](https://packetstormsecurity.com/files/168566/joomlajoomrecipe422-xss.txt) - - [Red Hat Security Advisory 2022-6753-01](https://packetstormsecurity.com/files/168565/RHSA-2022-6753-01.txt) - - [Red Hat Security Advisory 2022-6750-01](https://packetstormsecurity.com/files/168564/RHSA-2022-6750-01.txt) - - [Red Hat Security Advisory 2022-6755-01](https://packetstormsecurity.com/files/168563/RHSA-2022-6755-01.txt) - - [Red Hat Security Advisory 2022-6756-01](https://packetstormsecurity.com/files/168562/RHSA-2022-6756-01.txt) -- 安全客-有思想的安全新媒体 - - [活动｜360SRC 隐私漏洞正式收录！](https://www.anquanke.com/post/id/281232) - - [活动｜360SRC 移动APP漏洞奖励升级！](https://www.anquanke.com/post/id/281231) - - [面向实战的漏洞运营实践](https://www.anquanke.com/post/id/280987) - - [工信部组织开展2022年工业互联网试点示范项目申报工作](https://www.anquanke.com/post/id/281225) - - [Serverless安全揭秘：架构、风险与防护措施](https://www.anquanke.com/post/id/281021) - - [中央网信办深入开展网络辟谣标签工作](https://www.anquanke.com/post/id/281182) - - [公安部：“百日行动”拦截诈骗电话2.8亿次、短信4亿条](https://www.anquanke.com/post/id/281158) - - [不可利用漏洞造成漏洞管理疲劳](https://www.anquanke.com/post/id/280998) - - [张狂黑客分享入侵Fast Company细节](https://www.anquanke.com/post/id/281155) - - [微软：Lazarus黑客组织“武器化”开源软件](https://www.anquanke.com/post/id/281169) - - [止损1个亿，“浪神”黑产组织覆灭记](https://www.anquanke.com/post/id/280984) - - [警惕！新恶意程序可感染Windows、Linux 和 FreeBSD](https://www.anquanke.com/post/id/281162) - - [欧盟法院推翻德国的电信数据采集规定](https://www.anquanke.com/post/id/281123) - - [美军事武器承包商遭黑客攻击，涉F-35“闪电”II](https://www.anquanke.com/post/id/281108) -- Trustwave Blog - - [APAC Webinar: Optimizing your Cyber Response with a Cyber Mesh Architecture](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/apac-webinar-optimizing-your-cyber-response-with-a-cyber-mesh-architecture/) -- 跳跳糖 - 安全与分享社区 - - [JBoss Remoting Connector 4446端口反序列化分析](https://tttang.com/archive/1751/) -- Envato Tuts+ Code - Mobile Development - - [Learn Java for Android Development: Introduction to Java](https://code.tutsplus.com/tutorials/learn-java-for-android-development-introduction-to-java--mobile-2604) -- Recent Commits to cve:main - - [Update Fri Sep 30 10:19:07 UTC 2022](https://github.com/trickest/cve/commit/eac7c8a1d62e40287cce2fc73fc02d4c08f9f343) -- SecWiki News - - [SecWiki News 2022-09-30 Review](http://www.sec-wiki.com/?2022-09-30) -- unSafe.sh - 不安全 - - [The Good, the Bad and the Ugly in Cybersecurity – Week 40](https://buaq.net/go-128860.html) - - [Two new Exchange Server zero-days in the wild](https://buaq.net/go-128904.html) - - [Forcepoint at GITEX Global 2022 in Dubai Beginning 10 October](https://buaq.net/go-128858.html) - - [M3U8 视频解析下载与自动合并](https://buaq.net/go-128873.html) - - [Pmanager - Store And Retrieve Your Passwords From A Secure Offline Database. Check If Your Passwords Has Leaked Previously To Prevent Targeted Password Reuse Attacks](https://buaq.net/go-128857.html) - - [猫爪 Cat Catch – 抓取网页视频，M3U8 解析下载合并工具[Chrome/Firefox]](https://buaq.net/go-128852.html) - - [PoC CVE's Updated List](https://buaq.net/go-128850.html) - - [7000多人好评度100%的免费课程，你不来看看吗？](https://buaq.net/go-128874.html) - - [@你，招人！本周岗位更新](https://buaq.net/go-128875.html) - - [本周看什么 | 最近值得一看的 9 部作品](https://buaq.net/go-128854.html) - - [派周报：搜索的边界](https://buaq.net/go-128855.html) - - [timwhitez starred PetitPotato](https://buaq.net/go-128838.html) - - [timwhitez starred Freeze-Common](https://buaq.net/go-128839.html) - - [New Zero-Day Exploit Targets Microsoft Exchange Servers](https://buaq.net/go-128840.html) -- Twitter @Nicolas Krassas - - [Re @capdegarde_ @_codeh4ck3r @XssPayloads @Sagar__Sajeev This ! ^^ de-escalation of the RCE to show XSS ...](https://twitter.com/Dinosn/status/1575932101987569664) - - [Giving JuicyPotato a second chance: JuicyPotatoNG](https://twitter.com/Dinosn/status/1575928895202795522) - - [RT 7h3h4ckv157: Re 13. TCM Security — Interactive Learning. 14. HackXpert — Written Content and Labs. 15. Try Hack Me — Written Content and Labs. 1...](https://twitter.com/7h3h4ckv157/status/1575875809482416128) - - [RT 7h3h4ckv157: Here are 27 ways to learn ethical hacking for free: Credit: @danielmakelley Thread 🧵 ⬇ #infosec #bugbountytips #ctf #hacking 1. Ro...](https://twitter.com/7h3h4ckv157/status/1575875803744591872) - - [FBI Arrests Former NSA Employee For Trying To Sell Top Secret Documents](https://twitter.com/Dinosn/status/1575866278878752768) - - [What I learnt from reading 220 IDOR bug reports.](https://twitter.com/Dinosn/status/1575865409357479937) - - [Germany arrests hacker for stealing €4 million via phishing attacks](https://twitter.com/Dinosn/status/1575864189171949568) - - [Hunting for C2 Traffic](https://twitter.com/Dinosn/status/1575856116634112000) - - [RT Orange Cyberdefense's SensePost Team: Struggling to proxy your offensive tools (*cough, Windows, cough*)? See how @_cablethief uses WireGuard and t...](https://twitter.com/sensepost/status/1575820003978493952) - - [Detecting Mimikatz with Busylight](https://twitter.com/Dinosn/status/1575795192304631809) - - [Arbitrary cache poisoning on all Akamai websites via 'Connection: Content-Length'](https://twitter.com/Dinosn/status/1575795111061258240) - - [A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion](https://twitter.com/Dinosn/status/1575790924025630720) - - [Microsoft warns of North Korean crew posing as LinkedIn recruiters](https://twitter.com/Dinosn/status/1575731085903745024) - - [Fired admin cripples former employer's network using old credentials](https://twitter.com/Dinosn/status/1575724669403111424) - - [Some experiments with Process Hollowing](https://twitter.com/Dinosn/status/1575724473465982976) - - [Hacking group hides backdoor malware inside Windows logo image](https://twitter.com/Dinosn/status/1575724432198434816) - - [How CIA betrayed informants with shoddy front websites built for covert comms](https://twitter.com/Dinosn/status/1575724006564515846) - - [Re @SaumyajeetDas21 Looking forward to it !](https://twitter.com/Dinosn/status/1575723818802245632) - - [WARNING: New Unpatched Microsoft Exchange Zero-Day Under Active Exploitation](https://twitter.com/Dinosn/status/1575721771344371712) -- 安全脉搏 - - [【漏洞预警】Apache Tomcat信息泄露漏洞](https://www.secpulse.com/archives/188410.html) - - [从0开始两小时手撕VM逆向题](https://www.secpulse.com/archives/188404.html) -- Tenable Blog - - [CVE-2022-41040 and CVE-2022-41082: ProxyShell Variant Exploited in the Wild](https://www.tenable.com/blog/cve-2022-41040-and-cve-2022-41082-proxyshell-variant-exploited-in-the-wild) - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-sept-30) -- Security Boulevard - - [Get Ready for Cybersecurity Awareness Month](https://securityboulevard.com/2022/09/get-ready-for-cybersecurity-awareness-month/) - - [Hackers Use Telegram, Signal, Dark Web to Help Iranian Protesters](https://securityboulevard.com/2022/09/hackers-use-telegram-signal-dark-web-to-help-iranian-protesters/) - - [Preparing for Cyber Insurance? 6 Questions to Ask Your IT Team Today](https://securityboulevard.com/2022/09/preparing-for-cyber-insurance-6-questions-to-ask-your-it-team-today/) - - [This Week in Malware – 135 Packages Target npm and PyPI Registries](https://securityboulevard.com/2022/09/this-week-in-malware-135-packages-target-npm-and-pypi-registries/) - - [New DHS Cybersecurity Grant Program – Seceon Offers Expertise in Developing Your Cyber Plan](https://securityboulevard.com/2022/09/new-dhs-cybersecurity-grant-program-seceon-offers-expertise-in-developing-your-cyber-plan/) - - [Identity Attack Watch: September 2022](https://securityboulevard.com/2022/09/identity-attack-watch-september-2022/) - - [BSidesLV 2022 Lucky13 CommonGround – Robert “TProphet” Walker’s ‘The Exclave Experience: Relocating To ‘Almost Canada”](https://securityboulevard.com/2022/09/bsideslv-2022-lucky13-commonground-robert-tprophet-walkers-the-exclave-experience-relocating-to-almost-canada/) - - [Poisoning the source – How and why attackers are targeting developer accounts](https://securityboulevard.com/2022/09/poisoning-the-source-how-and-why-attackers-are-targeting-developer-accounts/) - - [Warning: N. Korean Job Scams Push Trojans via LinkedIn](https://securityboulevard.com/2022/09/north-korea-job-scam-trojan-linkedin-richixbw/) - - [Defend from within | Intrusion suppression with runtime protection, continuous monitoring & application security | Contrast SecurityDefend from within](https://securityboulevard.com/2022/09/defend-from-within-intrusion-suppression-with-runtime-protection-continuous-monitoring-application-security-contrast-securitydefend-from-within/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [重保专题 | 论重保期间如何“守城作战、防守反击”？](https://www.4hou.com/posts/gXPl) - - [Replicant：在Trezor One硬件钱包上重现故障注入攻击](https://www.4hou.com/posts/ZXD6) - - [推特前员工投诉公司存在安全问题](https://www.4hou.com/posts/gXDY) - - [​网络攻击中常见掩盖真实IP的攻击方式及虚假IP地址追踪溯源方法](https://www.4hou.com/posts/xjBJ) -- Orange Cyberdefense - - [WireSocks for Easy Proxied Routing](https://sensepost.com/blog/2022/wiresocks-for-easy-proxied-routing/) -- SAP Blogs - - [X.509 certificate-based authentication(mTLS) – Generating X.509 certificates of BTP managed services](https://blogs.sap.com/2022/09/30/x.509-certificate-based-authenticationmtls-generating-x.509-certificates-of-btp-managed-services/) - - [Forecast Volatility Measurement with SAP IBP](https://blogs.sap.com/2022/09/30/forecast-volatility-kpi-measurement-with-sap-ibp/) - - [SAP HANA Cloud to Support ARM-based AWS Graviton Processors](https://blogs.sap.com/2022/09/30/sap-hana-cloud-to-support-arm-based-aws-graviton-processors/) - - [Unable to Delete a Component from a Maintenance or Service Order](https://blogs.sap.com/2022/09/30/unable-to-delete-a-component-from-a-maintenance-or-service-order/) - - [Spotlight: SAP HANA Cloud supports the SAP Open Documentation Initiative](https://blogs.sap.com/2022/09/30/spotlight-sap-hana-cloud-supports-the-sap-open-documentation-initiative/) - - [Goals and Accelerators in Variable Pay](https://blogs.sap.com/2022/09/30/goals-and-accelerators-in-variable-pay/) - - [CONNECT 2022: SAP Partner Summit – first highlights](https://blogs.sap.com/2022/09/30/connect-2022-sap-partner-summit-first-highlights/) - - [Exploring SAP’s Integration Strategy: Free eBook Available Now](https://blogs.sap.com/2022/09/30/exploring-saps-integration-strategy-free-ebook-available-now/) - - [Developing SAP Concur Extension Solutions | Hands-on Video Tutorials](https://blogs.sap.com/2022/09/30/developing-sap-concur-extension-solutions-hands-on-video-tutorials/) - - [How to find Customer/User Exists in SAP ABAP? Exit for Batch Management](https://blogs.sap.com/2022/09/30/how-to-find-customer-user-exists-in-sap-abap-exit-for-batch-management/) -- Forcepoint - - [Forcepoint at GITEX Global 2022 in Dubai Beginning 10 October](https://www.forcepoint.com/blog/insights/meet-at-gitex-2022-dubai) -- Real-time communications security on Communication Breakdown - Real-Time Communications Security - - [DDoS workshop at TADSummit, toll fraud via MS Teams Direct Routing and WebRTC news](https://www.rtcsec.com/newsletter/2022-09-rtcsec-news/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 40](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-40-4/) -- Malwarebytes Labs - - [Two new Exchange Server zero-days in the wild](https://www.malwarebytes.com/blog/news/2022/09/two-new-exchange-zero-days-that-look-and-feel-like-proxyshell-part-2) -- Reverse Engineering - - [PoC CVE's Updated List](https://www.reddit.com/r/ReverseEngineering/comments/xryae2/poc_cves_updated_list/) -- The Daily Swig | Cybersecurity news and views - - [Bug Bounty Radar // The latest bug bounty programs for October 2022](https://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-october-2022) -- Microsoft Security Response Center - - [Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server](https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/) -- KitPloit - PenTest & Hacking Tools - - [Pmanager - Store And Retrieve Your Passwords From A Secure Offline Database. Check If Your Passwords Has Leaked Previously To Prevent Targeted Password Reuse Attacks](http://www.kitploit.com/2022/09/pmanager-store-and-retrieve-your.html) -- FreeBuf网络安全行业门户 - - [“要命”的广告弹窗](https://www.freebuf.com/articles/346101.html) - - [反转？美国国家安全局雇员向外国特工泄密，对方实为FBI卧底](https://www.freebuf.com/news/346079.html) - - [CyberBattleSim-（内网自动化渗透）研究分析](https://www.freebuf.com/articles/network/336371.html) - - [为了被重新聘用，被解雇员工竟黑了公司网络](https://www.freebuf.com/news/346062.html) - - [65% 的公司正在考虑采用 VPN 替代方案](https://www.freebuf.com/news/346058.html) - - [微软：勒索组织正在将开源软件武器化](https://www.freebuf.com/news/346057.html) -- Hex Rays - - [Igor’s tip of the week #108: Raw memory accesses in pseudocode](https://hex-rays.com/blog/igors-tip-of-the-week-108-raw-memory-accesses-in-pseudocode/) -- rtl-sdr.com - - [Quick Demo of our KrakenSDR Network Mapping Direction Finding Software (Alpha)](https://www.rtl-sdr.com/quick-demos-of-our-krakensdr-network-mapping-direction-finding-software-alpha/) - - [A WebUSB Based RTL-SDR Aircraft ADS-B Decoder](https://www.rtl-sdr.com/a-webusb-based-rtl-sdr-aircraft-ads-b-decoder/) - - [A Broad Overview About HF on the RTL-SDR Blog V3](https://www.rtl-sdr.com/a-broad-overview-about-hf-on-the-rtl-sdr-blog-v3/) - - [Radio Jove Spectrograph Hardware and Software](https://www.rtl-sdr.com/radio-jove-spectrograph-hardware-and-software/) -- 安全牛 - - [安全牛课堂丨一种被低估的企业网络安全风险](https://www.aqniu.com/homenews/89769.html) - - [高效开展网络安全风险评估的六要素](https://www.aqniu.com/hometop/89768.html) - - [国标来啦！ | 全国信安标委发布《信息安全技术 网络数据分类分级要求》（征求意见稿）](https://www.aqniu.com/vendor/89760.html) - - [传递“生命火种” | 捐献造血干细胞的你，最帅！](https://www.aqniu.com/vendor/89755.html) - - [立足用户需求 聚焦行业应用 | 慧盾安全亮相内蒙古数据安全盛会](https://www.aqniu.com/vendor/89735.html) - - [《网络安全法》将迎来修改 | 相关主体如何应对?](https://www.aqniu.com/vendor/89734.html) - - [八万台海康威视摄像机网上裸奔丨 “安全刺客”怎么防？](https://www.aqniu.com/vendor/89732.html) - - [共话数字安全产业现状与未来丨数世咨询创始人李少鹏一行莅临慧盾安全交流](https://www.aqniu.com/vendor/89733.html) -- 奇客Solidot–传递最新科技情报 - - [Matrix 修复端对端加密高危漏洞](https://www.solidot.org/story?sid=72940) - - [眼睛如何在一生中改变颜色](https://www.solidot.org/story?sid=72939) - - [丰田社长为无纯电战略辩护](https://www.solidot.org/story?sid=72938) - - [Google 简化论坛类信息搜索](https://www.solidot.org/story?sid=72937) - - [Meta 宣布文本视频生成器 Make-A-Video](https://www.solidot.org/story?sid=72936) - - [NASA 和 SpaceX 研究为哈勃望远镜延寿](https://www.solidot.org/story?sid=72935) - - [NASA Juno 飞船近距离飞越木星卫星欧罗巴](https://www.solidot.org/story?sid=72934) - - [沙特准备在游戏领域投资 378 亿美元](https://www.solidot.org/story?sid=72933) - - [比特币挖矿的气候影响相当于牛肉生产](https://www.solidot.org/story?sid=72932) - - [Meta 冻结招聘](https://www.solidot.org/story?sid=72931) - - [Google 将关闭 Stadia](https://www.solidot.org/story?sid=72930) -- 黑海洋 - WIKI - - [3D图片制作大师(3D Image Commander)](https://blog.upx8.com/3004) -- Checkmarx.com - - [Checkmarx Recognized as a Top Security Organization in 2022 Stratus Awards](https://checkmarx.com/press-releases/checkmarx-recognized-as-a-top-security-organization-in-2022-stratus-awards/) -- text/plain - - [HTTPS Goofs: Forgetting the Bare Domain](https://textslashplain.com/2022/09/30/https-goofs-forgetting-the-bare-domain/) - - [Best Practice: Post-Mortems](https://textslashplain.com/2022/09/29/best-practice-post-mortems/) -- 互联网安全内参 - - [美国网络安全监管机构首个综合战略规划解析](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506195&idx=1&sn=ab8b96ff80f233324ef4637994d49a6f&chksm=ebfa9e33dc8d17252521894efb50ecf965e7ef0be51a88f774ec79122203569bc7ae1e3e9278&scene=58&subscene=0#rd) - - [美国政府问责局：24个机构的隐私项目审查及关键发现](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506195&idx=2&sn=146f8cda787e470e527713fefd069650&chksm=ebfa9e33dc8d1725a10d9e0aec4abbac6f590c0b59cdd72c038c24bd3173dc12cb4ab08da8e8&scene=58&subscene=0#rd) -- 锦行信息安全 - - [【战略合作】锦行科技携手广东警官学院共建产学研合作基地，共促网安实战技术及人才发展](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247490555&idx=1&sn=3b89472f50368d1632fc4c55755c5f4b&chksm=9799e05ea0ee6948c6ae133486e79d0d5422c98f20f89caa49277995249dfa3d0f7ced8321b2&scene=58&subscene=0#rd) - - [锦行荣获广州“越盾-2022”越秀区数字政府网络安全攻防演练第二名](https://mp.weixin.qq.com/s?__biz=MzIxNTQxMjQyNg==&mid=2247490555&idx=2&sn=d07b3e595bb29cfa8ecf375e30c3b444&chksm=9799e05ea0ee6948a5240afbc77f351fdf8c0cff537b50fd12094de08ae297257ce8214bf98a&scene=58&subscene=0#rd) -- 绿盟科技技术博客 - - [绿盟威胁情报月报-2022年9月](http://blog.nsfocus.net/monthlyreport202209/) -- 情报分析师 - - [【情报分析】北溪天然气管道泄露，谁干的？](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517728&idx=1&sn=472177e9903356c9912b7c054620404b&chksm=87169eabb06117bd8bc84d5048437a9116094dfe2c75baf54e8cc4ec2779ace99b8b738cd148&scene=58&subscene=0#rd) - - [【情报课堂】如何基于太阳阴影位置计算时间](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517728&idx=2&sn=089a774675e27532c127ab32685301ff&chksm=87169eabb06117bd7c62f835bbb1a4c70e3124693569872ebf27d6f48988428c5913721b533c&scene=58&subscene=0#rd) - - [【情报动态】寻找北溪破坏者的竞赛](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517728&idx=3&sn=50dad9a228bdd40947cf30491d74318a&chksm=87169eabb06117bd84e2a2fbf3dde3e48166f0fa2afbcf4335fef8a9545814f35f3956e86663&scene=58&subscene=0#rd) -- 京东安全应急响应中心 - - [【公告】JSRC八月英雄榜单揭晓](https://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=2727835119&idx=1&sn=e87edd2baf1db7c261065d47292d2416&chksm=8050a267b7272b7179745ee6c45d7759930735c03948531c8f042e222eb061d6a11d9187d23d&scene=58&subscene=0#rd) -- VLabTeam - - [基于SBERT孪生网络的漏洞描述归一化](https://mp.weixin.qq.com/s?__biz=MzkwNzIxMDUyNg==&mid=2247484915&idx=1&sn=82f13aaded590b6134c85928adb82888&chksm=c0ddff82f7aa769489b6d69baa3a2b26bf659e36e0df7191226e029165b5824409e6c916c25c&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [网络关键设备安全检测结果（第7批）](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531747&idx=1&sn=8f17acc0ba6cf31763da5d24b4eca8c1&chksm=fa93ca22cde44334b0c0e36de01b73a16a6db6449c444e9cad1c62175551c52b3c9b09641040&scene=58&subscene=0#rd) - - [评估安全运营中心能力的七大关键指标](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531747&idx=2&sn=9c8225ca650be3f4ef94bfffc561044f&chksm=fa93ca22cde443345363d04cc329dd02e9c9ad156de1954d76fb8529919139fd6b4843142467&scene=58&subscene=0#rd) - - [PoS机恶意软件全新升级！秒杀磁条卡-芯片卡交易安全措施！](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531747&idx=3&sn=32d190999cbdd30c0edea31873e5d087&chksm=fa93ca22cde44334aa37b257f8467f6c6a7a01a4c2755d9b1f214fe0a1103effbb456d0c6ba5&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-02.md b/archive/2022/2022-10-02.md deleted file mode 100644 index ce4a4a0660..0000000000 --- a/archive/2022/2022-10-02.md +++ /dev/null @@ -1,105 +0,0 @@ -# 每日安全资讯（2022-10-02） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [WooCommerce BRW Booking Rental 1.3.1 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100006) - - [Backdoor.Win32.Bingle.b / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022100005) - - [ZKSecurity BIO 4.1.2 SQL Injection / Code Execution](https://cxsecurity.com/issue/WLB-2022100004) - - [GuppY CMS 6.00.10 Shell Upload](https://cxsecurity.com/issue/WLB-2022100003) - - [Joomla jMarket 5.15 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100002) - - [Joomla JS Jobs Pro 1.3.6 SQL Injection](https://cxsecurity.com/issue/WLB-2022100001) -- Security Boulevard - - [BSidesLV 2022 Lucky13 GroundFloor – Remi Escourrou’s, Xavier Gerondeau’s And Gauthier Sebaux’s ‘CICD Security: A New Eldorado (Talk)’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundfloor-remi-escourrous-xavier-gerondeaus-and-gauthier-sebauxs-cicd-security-a-new-eldorado-talk/) - - [Cybersecurity Awareness Month Champion | See Yourself in Cyber | Contrast Security](https://securityboulevard.com/2022/10/cybersecurity-awareness-month-champion-see-yourself-in-cyber-contrast-security/) -- Recent Commits to cve:main - - [Update Sat Oct 1 10:15:56 UTC 2022](https://github.com/trickest/cve/commit/316e40e416c7dff55adb9305f52813d2bd1190b2) -- Sploitus.com Exploits RSS Feed - - [Joomla JS Jobs Pro 1.3.6 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168582&utm_source=rss&utm_medium=rss) - - [Joomla jMarket 5.15 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168581&utm_source=rss&utm_medium=rss) - - [ZKSecurity BIO 4.1.2 SQL Injection / Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168586&utm_source=rss&utm_medium=rss) - - [ZKSecurity BIO 3.0.5.0_R Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:168587&utm_source=rss&utm_medium=rss) - - [GuppY CMS 6.00.10 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168584&utm_source=rss&utm_medium=rss) - - [Joomla MyMuse 4.3.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168583&utm_source=rss&utm_medium=rss) - - [Centreon 22.04.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168585&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-41082 exploit](https://sploitus.com/exploit?id=87179042-CF32-5495-87D0-B916B42259D2&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Zimbra Collaboration exploit](https://sploitus.com/exploit?id=549DF2E5-96E4-5204-9F2F-303AABC189EE&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Sophos Firewall exploit](https://sploitus.com/exploit?id=CDC28FA3-9C62-5164-A646-234AC30C0DA0&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [HTB: Scrambled [From Linux]](https://twitter.com/Dinosn/status/1576283528035151874) - - [HTB: Scrambled - Alternative Roots](https://twitter.com/Dinosn/status/1576283449039945728) - - [Luxury hotel chain Shangri-La suffered a security breach](https://twitter.com/Dinosn/status/1576258151870963712) - - [Deadfinder - Find Dead-Links (Broken Links)](https://twitter.com/Dinosn/status/1576251924675932160) - - [LA School District Ransomware Attackers Now Threaten to Leak Stolen Data](https://twitter.com/Dinosn/status/1576113253541097473) - - [Two new Exchange Server zero-days in the wild](https://twitter.com/Dinosn/status/1576113078994771968) -- unSafe.sh - 不安全 - - [Security vs Compliance-Cloudflare Password Policy Restriction Bypass](https://buaq.net/go-128948.html) - - [FileLessRemoteShellcode](https://buaq.net/go-128950.html) - - [Deadfinder - Find Dead-Links (Broken Links)](https://buaq.net/go-128947.html) - - [秋招难，就业难，加裁员|华盟信安网络安全就业班课程全新升级，来，做一名渗透测试工程师吧！](https://buaq.net/go-128941.html) - - [Poseidon’s Offspring: Charybdis and Scylla](https://buaq.net/go-128936.html) - - [一日一技｜Obsidian Command 进阶用法三则](https://buaq.net/go-128940.html) - - [Cruising Alaska](https://buaq.net/go-128932.html) - - [NullMixer：迄今为止投放最多恶意软件的投放程序](https://buaq.net/go-128924.html) - - [GPS干扰器被用来劫持卡车和击落无人机：该如何应对？](https://buaq.net/go-128925.html) - - [城市漫步指南 | 为我踟蹰停酒盏，与君约略说杭州](https://buaq.net/go-128930.html) - - [FFmpeg 编码和编辑入门 | Asimov](https://buaq.net/go-128906.html) -- Files ≈ Packet Storm - - [Packet Storm New Exploits For September, 2022](https://packetstormsecurity.com/files/168590/202209-exploits.tgz) - - [Ubuntu Security Notice USN-5650-1](https://packetstormsecurity.com/files/168589/USN-5650-1.txt) - - [Ubuntu Security Notice USN-5648-1](https://packetstormsecurity.com/files/168588/USN-5648-1.txt) - - [ZKSecurity BIO 3.0.5.0_R Privilege Escalation](https://packetstormsecurity.com/files/168587/zksecuritybio3050r-escalate.txt) - - [ZKSecurity BIO 4.1.2 SQL Injection / Code Execution](https://packetstormsecurity.com/files/168586/zksecuritybio412-sql.txt) - - [Centreon 22.04.0 Cross Site Scripting](https://packetstormsecurity.com/files/168585/centreon22040sa-xss.txt) - - [GuppY CMS 6.00.10 Shell Upload](https://packetstormsecurity.com/files/168584/guppy60010-shell.txt) - - [Joomla MyMuse 4.3.0 SQL Injection](https://packetstormsecurity.com/files/168583/joomlamymuse430-sql.txt) - - [Joomla JS Jobs Pro 1.3.6 SQL Injection](https://packetstormsecurity.com/files/168582/joomlajsjobspro136-sql.txt) - - [Joomla jMarket 5.15 Cross Site Scripting](https://packetstormsecurity.com/files/168581/joomlajmarket515-xss.txt) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [NullMixer：迄今为止投放最多恶意软件的投放程序](https://www.4hou.com/posts/JXRD) - - [GPS干扰器被用来劫持卡车和击落无人机：该如何应对？](https://www.4hou.com/posts/oJ9z) -- SecWiki News - - [SecWiki News 2022-10-01 Review](http://www.sec-wiki.com/?2022-10-01) -- Microsoft Security Blog - - [Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082](https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/) -- Security Research - - [Phishing With Chromium's Application Mode](https://mrd0x.com/phishing-with-chromium-application-mode/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Security vs Compliance-Cloudflare Password Policy Restriction Bypass](https://infosecwriteups.com/security-vs-compliance-cloudflare-password-policy-restriction-bypass-da07ca7df4f2?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [SAP Inventory Management – Everything you must know](https://blogs.sap.com/2022/10/01/sap-inventory-management-everything-you-must-know/) - - [Event Management with Process Automation: Automation of Alert Reaction in IT Event Management](https://blogs.sap.com/2022/10/01/event-management-with-process-automation-automation-of-alert-reaction-in-it-event-management/) - - [Simplify EDI with SAP S/4HANA Cloud with SAP Trading Partner Management and Cloud Integration](https://blogs.sap.com/2022/10/01/simplify-edi-with-sap-s-4hana-cloud-with-sap-trading-partner-management-and-cloud-integration/) - - [X.509 certificate-based authentication(mTLS) – Communicating with services using VCAP environment variables(Java)](https://blogs.sap.com/2022/10/01/x.509-certificate-based-authenticationmtls-communicating-with-services-using-vcap-environment-variablesjava/) - - [X.509 certificate-based authentication(mTLS) – Communicating with services using SAP destination service(Java)](https://blogs.sap.com/2022/10/01/x.509-certificate-based-authenticationmtls-communicating-with-services-using-sap-destination-servicejava/) -- Hexacorn - - [Dealing with alert fatigue, Part 1](https://www.hexacorn.com/blog/2022/10/01/dealing-with-alert-fatigue-part-1/) -- Reverse Engineering - - [Poseidon’s Offspring: Charybdis and Scylla](https://www.reddit.com/r/ReverseEngineering/comments/xsp07i/poseidons_offspring_charybdis_and_scylla/) -- - - [Captain’s Log: September 2022](https://cornerpirate.com/2022/10/01/captains-log-september-2022/) -- KitPloit - PenTest & Hacking Tools - - [Deadfinder - Find Dead-Links (Broken Links)](http://www.kitploit.com/2022/10/deadfinder-find-dead-links-broken-links.html) -- Twitter @hakivvi - - [RT Anders Hejlsberg: Amazing it is 10 years today since @TSteveLuc, @lukehoban and I unveiled @TypeScript at @GOTOcon in Aarhus, Denmark. Would've nev...](https://twitter.com/ahejlsberg/status/1576301011568033792) -- text/plain - - [Cruising Alaska](https://textslashplain.com/2022/10/01/cruising-alaska/) -- 信息时代的犯罪侦查 - - [“重点人员”社会行为预警之聚集模型探究](https://mp.weixin.qq.com/s?__biz=MzAxNTA4NDAwOQ==&mid=2650736600&idx=1&sn=0ff70b2a96192cea7dca133ecc327b88&chksm=8382d75eb4f55e484dc9a68263d552dd31a511ff660e3e0c7b082a7aaf51dc21bb1b78d35197&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [分享图片](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247493438&idx=1&sn=448f017d8d58483622db41187d888119&chksm=e84c41e1df3bc8f78bdb0fc8f4dca3c12f1a36a0a57185cb97a878dbaa1cb39dfdb610f05c66&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [国庆福利 | 盛世华诞，锦绣中国](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486511&idx=1&sn=05ab7bb2d3229a89bfb5a1c2b9ac3052&chksm=fa5aa2c2cd2d2bd48d1cdb08e68e53d92213ca6b26fd1753549649dc9c2d750c3ee884d2d805&scene=58&subscene=0#rd) -- 中国信息安全 - - [热烈庆祝中华人民共和国成立73周年！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166200&idx=1&sn=67261df7e3ef646cdba5463279a5aa5a&chksm=8b5ef1c1bc2978d7c9488c8ac24109771e2acbdc99f5f163b27af99bb9d3463ddf1929292476&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [深度伪造技术让布鲁斯威利斯重返大银幕](https://www.solidot.org/story?sid=72946) - - [Fedora 项目仍然是社区驱动](https://www.solidot.org/story?sid=72945) - - [Stadia 员工是在最后一刻才知道服务关闭](https://www.solidot.org/story?sid=72944) - - [微软开始启用 Edge 内置的 VPN 服务](https://www.solidot.org/story?sid=72943) - - [埃塞俄比亚 Tigray 地区断网两年](https://www.solidot.org/story?sid=72942) -- 安全圈 - - [【安全圈】澳大利亚史上最大数据泄露,半数国民信息遭泄露](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652019240&idx=1&sn=21e363fb259d680506b57a14c56046f2&chksm=f36fb668c4183f7e89eea6bc754b8d7362d2618328d3e78a67da1da6d22d64b13cd47501e89d&scene=58&subscene=0#rd) - - [【安全圈】英国军情五处网站遭黑客攻击 被迫暂时关闭](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652019240&idx=2&sn=1b199496600aa2ef1f3864b0d4bec875&chksm=f36fb668c4183f7ec12ee93ca69c1bb995738bcd9c6bd667c84641f74ff48a8d0ffb9c70b178&scene=58&subscene=0#rd) - - [【安全圈】微软称两个新的Exchange零日漏洞已受到主动攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652019240&idx=3&sn=6c1dd642eb051751f5d6a042205f1f26&chksm=f36fb668c4183f7e982b5c294ce06c789d467f25200814a0f123e730987b11f11c9f74cb7a52&scene=58&subscene=0#rd) - - [【安全圈】Backdoor.Stegmap：一种隐藏在微软Windows标志中的恶意软件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652019240&idx=4&sn=b5ec58936edec458d9a763f1f5893ff7&chksm=f36fb668c4183f7e5c1cac81ffea2cfc9640a61c4b1e2e150893713cd8fa3893b65ca1655021&scene=58&subscene=0#rd) -- 青衣十三楼飞花堂 - - [cby的日常(before 2022.8.29)](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486232&idx=1&sn=8a8d54ff331eac7bc68f998b4097c5f5&chksm=fab2c827cdc541310af656f78d379c896216164a649063f27280ffa7c939cc67934386d851bf&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-03.md b/archive/2022/2022-10-03.md deleted file mode 100644 index aeecba996b..0000000000 --- a/archive/2022/2022-10-03.md +++ /dev/null @@ -1,92 +0,0 @@ -# 每日安全资讯（2022-10-03） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [jCart For OpenCart 3.0.3.19 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100010) - - [Backdoor.Win32.NTRC / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022100009) - - [Backdoor.Win32.Delf.eg / Unauthenticated Remote Command Execution](https://cxsecurity.com/issue/WLB-2022100008) - - [Authenticated Remote Code Execution in Composr-CMS Version < =10.0.39](https://cxsecurity.com/issue/WLB-2022100007) -- Sploitus.com Exploits RSS Feed - - [Exploit for Incorrect Calculation in Moodle exploit](https://sploitus.com/exploit?id=CFCAFCA9-26CA-5B4D-B6B1-6C7FBCE7151D&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-41082 exploit](https://sploitus.com/exploit?id=9945D2DB-9314-5400-8C2B-94D4BD603DD9&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Polkit Project Polkit exploit](https://sploitus.com/exploit?id=93997679-C259-5867-98F3-BE24C5A27450&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Privilege Management in Canonical Ubuntu Linux exploit](https://sploitus.com/exploit?id=78F7E4FE-65A6-5F2E-89CC-FD468018CA49&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [BSidesLV 2022 Lucky13 GroundFloor – Omer Gil’s And Asaf Greenholts’ ‘Climbing The Production Mountain: Practical CI/CD Attacks Using CI/CD Goat’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundfloor-omer-gils-and-asaf-greenholts-climbing-the-production-mountain-practical-ci-cd-attacks-using-ci-cd-goat/) - - [Dr. GRC: How You Can Learn to Stop Worrying and Love User Access Reviews (or Maybe Worry Less and Not Hate Them So Much)](https://securityboulevard.com/2022/10/dr-grc-how-you-can-learn-to-stop-worrying-and-love-user-access-reviews-or-maybe-worry-less-and-not-hate-them-so-much/) - - [Why We Should Make Time to Brainstorm New, Innovative Ideas](https://securityboulevard.com/2022/10/why-we-should-make-time-to-brainstorm-new-innovative-ideas/) - - [Zero-Day Microsoft Exchange Server Vulnerabilities Exposed Early Due to Limited Targeted Attacks](https://securityboulevard.com/2022/10/zero-day-microsoft-exchange-server-vulnerabilities-exposed-early-due-to-limited-targeted-attacks/) - - [Hiring Data Recycling Security Engineers Smart?](https://securityboulevard.com/2022/10/hiring-data-recycling-security-engineers-smart/) -- SecWiki News - - [SecWiki News 2022-10-02 Review](http://www.sec-wiki.com/?2022-10-02) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [驱动强制签名(DSE)是否还能起到安全防护的作用？](https://www.4hou.com/posts/pVBN) - - [攻击者通过水坑攻击传递ScanBox键盘记录器](https://www.4hou.com/posts/jJBR) -- Twitter @Nicolas Krassas - - [RT Rio: After an unhealthy amount of hours put into this, I finally managed to get RCE on Cobalt Strike. I would recommend avoiding it for a while as ...](https://twitter.com/0x09AL/status/1576509338738634752) - - [BlackCat malware lashes out at US defense IT contractor](https://twitter.com/Dinosn/status/1576502857297059841) - - [RT Germán Fernández: I wrote a quick Nmap script to scan for servers potentially vulnerable to #ProxyNotShell (based on Microsoft's recommended URL ...](https://twitter.com/1ZRR4H/status/1576471006373613569) - - [Common Security Exploits and Protections on Solana](https://twitter.com/Dinosn/status/1576448267508150273) - - [Real-world infosec wordlists, updated regularly](https://twitter.com/Dinosn/status/1576448180325036034) -- unSafe.sh - 不安全 - - [Flare-On 9 Challenge Started This Weekend](https://buaq.net/go-129023.html) - - [awesome-rat](https://buaq.net/go-129019.html) - - [pupy安装与使用](https://buaq.net/go-129018.html) - - [Bayanay - Python Wardriving Tool](https://buaq.net/go-129013.html) - - [cvemon](https://buaq.net/go-129014.html) - - [没人用应用推荐 第五集](https://buaq.net/go-129065.html) - - [质感文件 – 开源、轻量、简洁的 Material Design 文件管理器[Android]](https://buaq.net/go-129011.html) - - [招生！2022年《安卓高级研修班》秋季班](https://buaq.net/go-129012.html) - - [box](https://buaq.net/go-129005.html) - - [alist](https://buaq.net/go-129006.html) - - [scan4all](https://buaq.net/go-129007.html) - - [CasaOS](https://buaq.net/go-129008.html) - - [趁着换季，给衣柜来一次断舍离](https://buaq.net/go-129004.html) - - [docker-flare](https://buaq.net/go-129003.html) - - [驱动强制签名(DSE)是否还能起到安全防护的作用？](https://buaq.net/go-128994.html) - - [6 个视频，3 万粉丝，少数派作者是怎么运营 B 站的？](https://buaq.net/go-128998.html) - - [Evernote2Onenote – 将笔记从 Evenote 迁移至 OneNote[2022 年可用，第三方工具]](https://buaq.net/go-128996.html) - - [攻击者通过水坑攻击传递ScanBox键盘记录器](https://buaq.net/go-128995.html) - - [Remote_ShellcodeLoader](https://buaq.net/go-128988.html) -- SpiderLabs Blog from Trustwave - - [Trustwave Action Response: Zero Day Vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trustwave-action-response-zero-day-vulnerabilities-in-microsoft-exchange-server-2013-2016-and-2019/) -- Malwarebytes Labs - - [Why (almost) everything we told you about passwords was wrong](https://www.malwarebytes.com/blog/news/2022/10/why-almost-everything-we-told-you-about-passwords-was-wrong) -- SAP Blogs - - [Migration of CRM one order transactions from SAP CRM 7.0 to SAP S/4 Hana Customer Engagement](https://blogs.sap.com/2022/10/02/migration-of-crm-one-order-transactions-from-sap-crm-7.0-to-sap-s-4-hana-customer-engagement/) - - [Pre-Migration Check Tool SMIGR_CHECK_DB6: Be Better Prepared for the Migration of Your Db2 LUW Database](https://blogs.sap.com/2022/10/02/pre-migration-check-tool-smigr_check_db6-be-better-prepared-for-the-migration-of-your-db2-luw-database/) - - [A Carrousel for your Learning Home Page](https://blogs.sap.com/2022/10/02/a-carrousel-for-your-learning-home-page/) - - [SAP Integration Suite: Resilient APIs using API Management, Event Mesh, and Cloud Integration](https://blogs.sap.com/2022/10/02/sap-integration-suite-resilient-apis-using-api-management-event-mesh-and-cloud-integration/) - - [Auto-Tracking with MLflow on SAP AI Core](https://blogs.sap.com/2022/10/02/auto-tracking-with-mlflow-on-sap-ai-core/) - - [SAP Data Services (SAP BODS) – Snapshot](https://blogs.sap.com/2022/10/02/sap-data-services-sap-bods-snapshot/) - - [TCS CPG SAP Innovation Hub now ready to inspire!](https://blogs.sap.com/2022/10/02/tcs-cpg-sap-innovation-hub-now-ready-to-inspire/) - - [H4S4 Vs SAP HCM Compatibility packs – High-level overview](https://blogs.sap.com/2022/10/02/h4s4-vs-sap-hcm-compatibility-packs-high-level-overview/) -- KitPloit - PenTest & Hacking Tools - - [Bayanay - Python Wardriving Tool](http://www.kitploit.com/2022/10/bayanay-python-wardriving-tool.html) -- Reverse Engineering - - [Flare-On 9 Challenge Started This Weekend](https://www.reddit.com/r/ReverseEngineering/comments/xtpcpd/flareon_9_challenge_started_this_weekend/) -- 杨龙 - - [分布式锁](https://www.yanglong.pro/%e5%88%86%e5%b8%83%e5%bc%8f%e9%94%81/) -- 关注安全技术 - - [网络安全未来启示录—云安全](https://mp.weixin.qq.com/s?__biz=MzA4MDMwMjQ3Mg==&mid=2651868384&idx=1&sn=791aee660a59e68b993a5e4737c20c03&chksm=8442b407b3353d114618de4c75dc84acf6d26715090d95f63de7af3011c02c3615dc26f8e60a&scene=58&subscene=0#rd) -- 黑海洋 - WIKI - - [小米运动刷步数支持微信支付宝](https://blog.upx8.com/3006) - - [千帆搜索（网盘综合）+来搜一下（夸克云盘）](https://blog.upx8.com/3005) -- 看雪学院 - - [定制bcc/ebpf在android平台上实现基于dwarf的用户态栈回溯](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473840&idx=1&sn=a823afd14e7381f3ab44880ac65beb00&chksm=b18e65fa86f9ecec0112aefe5871d63a976873fe9847e1d48dc3c17452871c67fac7f742372a&scene=58&subscene=0#rd) - - [招生！2022年《安卓高级研修班》秋季班](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473840&idx=2&sn=5e02aab9f2ae482e10a9f51e7a33b6a6&chksm=b18e65fa86f9ececd94eb48ad82958842e516a6b635dd3972904b8d893915f3724bb36b4514b&scene=58&subscene=0#rd) -- 博客园 - 郑瀚Andrew - - [旅游经济学 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16746036.html) -- 奇客Solidot–传递最新科技情报 - - [商飞 C919 飞机获颁型号合格证](https://www.solidot.org/story?sid=72950) - - [Jingyao Liu 诉刘强东案达成庭外和解](https://www.solidot.org/story?sid=72949) - - [印尼足球场发生踩踏事故逾百人死亡](https://www.solidot.org/story?sid=72948) -- 极客公园 - - [失血、裁员、股价暴跌：Meta 正在成为硅谷的泰坦尼克](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969188&idx=1&sn=df2152e82a51560a86fdb1114e26cff2&chksm=7e5465524923ec446f921339842cf86b1e4743ff3480696fb35e240829dbfd048b1a5e51ad45&scene=58&subscene=0#rd) - - [库克：普通人很难理解元宇宙；马斯克：特斯拉机器人卖 2 万美元以下；传腾讯大举收购海外游戏公司 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969174&idx=1&sn=71aa0eb2656e3a819518fd8dd28f8fe4&chksm=7e5465604923ec76788ea38e1d78598a15562f07f761d219294ea59ef399548c5dc5ea38b582&scene=58&subscene=0#rd) -- 情报分析师 - - [“末日情景”：如果俄罗斯与北约爆发核战争会怎么样？](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517808&idx=1&sn=3929cd1d8b8c3680066efe754db8111e&chksm=87169f7bb061166df8a280fb6eb42792ed2daf9bd0a8675b7b8939b3cd288947391f8d5cfe62&scene=58&subscene=0#rd) - - [洛杉矶警长办公室启动实时监控中心以改善犯罪应对](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517808&idx=3&sn=0e5a8c918378703bb5bb2aa94a43f175&chksm=87169f7bb061166dd810d75bae32e2fcb71e96fcdfae0bf607a3cb558785174a070a45d98bd6&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [信安标委发布《网络安全标准实践指南—健康码防伪技术指南》](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496719&idx=1&sn=c359ce97550a43a67a21a30e5a6efb69&chksm=fa5221b1cd25a8a78e9461eaf0000b0018fbb649c8d8880efc237161d4858290a43776c29e52&scene=58&subscene=0#rd) -- 吴鲁加 - - [简单与长期](https://mp.weixin.qq.com/s?__biz=Mzg5NDY4ODM1MA==&mid=2247484209&idx=1&sn=25a661271a903d468e8fd0fd653a9139&chksm=c01a8e00f76d0716458df9ee5940def2ef45b7d03302e2024fea4754124f138ec749833c17c9&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-04.md b/archive/2022/2022-10-04.md deleted file mode 100644 index edce5eb9f6..0000000000 --- a/archive/2022/2022-10-04.md +++ /dev/null @@ -1,159 +0,0 @@ -# 每日安全资讯（2022-10-04） - -- Trustwave Blog - - [2022 Cybersecurity Awareness Month is Here](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/2022-cybersecurity-awareness-month-is-here/) -- Recent Commits to cve:main - - [Update Mon Oct 3 10:18:16 UTC 2022](https://github.com/trickest/cve/commit/8e0d43ee09e874467199b9ec79ed0d2969506e25) -- Twitter @Nicolas Krassas - - [Russian retail chain 'DNS' confirms hack after data leaked online](https://twitter.com/Dinosn/status/1577015106793152512) - - [Shining New Light on an Old ROM Vulnerability: Secure Boot Bypass via DCD and CSF Tampering on NXP](https://twitter.com/Dinosn/status/1577009401273102337) - - [A python3 remake of the classic "tree" command with the additional feature of searching for user provided keywords/regex in files, highlighting those ...](https://twitter.com/Dinosn/status/1576997605879357440) - - [Re @ant0inet Will there be a recorded version?](https://twitter.com/Dinosn/status/1576991989609865216) - - [spk aka spritzgebaeck: A small OSINT/Recon tool to find CIDRs that belong to a specific organization.](https://twitter.com/Dinosn/status/1576991064614805505) - - [RansomEXX gang claims to have hacked Ferrari and leaked online internal documents](https://twitter.com/Dinosn/status/1576990979516641280) - - [RT Panagiotis Chartas: A standalone python3 remake of the classic "tree" command with the additional feature of searching for user provided keywords/r...](https://twitter.com/t3l3machus/status/1576989875756072961) - - [Kim Kardashian Pays $1.26m Over Crypto Pump And Dump](https://twitter.com/Dinosn/status/1576952244716843008) - - [Microsoft Exchange server zero-day mitigation can be bypassed](https://twitter.com/Dinosn/status/1576944894223863808) - - [I've heard a lot of good things about the company.](https://twitter.com/Dinosn/status/1576938202044059648) - - [Curated list of open-source & paid Attack Surface Monitoring (ASM) tools.](https://twitter.com/Dinosn/status/1576937848875274240) - - [The PS5 Has Been Jailbroken – Custom Packages Can Now Be Installed](https://twitter.com/Dinosn/status/1576933780828192768) - - [RT Ozgur Alp: My latest blog post about auth bypasses is mentioned in InfoSec Community’s IWWeekly newsletter. Check it out if not already! :)](https://twitter.com/ozgur_bbh/status/1576931341009944579) - - [Secure your machine learning with Semgrep](https://twitter.com/Dinosn/status/1576925428173795329) - - [Detecting Deepfake Audio by Modeling the Human Acoustic Tract](https://twitter.com/Dinosn/status/1576915707266101248) - - [Wordlists handcrafted with love,](https://twitter.com/Dinosn/status/1576908591139020800) - - [FUD-UUID-Shellcode: bypass Windows Defender](https://twitter.com/Dinosn/status/1576895792685928448) - - [monkey365: conduct Microsoft 365, Azure subscriptions and Azure Active Directory security configuration reviews](https://twitter.com/Dinosn/status/1576851882097549312) - - [Bayanay - Python Wardriving Tool](https://twitter.com/Dinosn/status/1576832563729293313) - - [GitHub - jafarlihi/rconn: rconn is a multiplatform program for creating generic reverse connections. Lets you consume services that are behind firewal...](https://twitter.com/Dinosn/status/1576832514726842368) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [WhatsApp Fixed Critical Vulnerabilities that Could Let an Attacker Hack Devices Remotely – Automatically Discover and Remediate Using VMDR Mobile](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Sploitus.com Exploits RSS Feed - - [Joomla DJ-Classifieds Ads 3.9 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38008&utm_source=rss&utm_medium=rss) - - [Google Chrome 103.0.5060.53 Autofill Assistant Universal Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168595&utm_source=rss&utm_medium=rss) - - [Joomla JUX Charity Hub 1.0.4 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168591&utm_source=rss&utm_medium=rss) - - [Password Manager For IIS 2.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168599&utm_source=rss&utm_medium=rss) - - [GuppY CMS 6.00.10 Shell Upload Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38006&utm_source=rss&utm_medium=rss) - - [Joomla jMarket 5.15 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38009&utm_source=rss&utm_medium=rss) - - [Joomla Easy Shop 1.4.1 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168592&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.NTRC MVID-2022-0646 Hardcoded Credential exploit](https://sploitus.com/exploit?id=PACKETSTORM:168600&utm_source=rss&utm_medium=rss) - - [Joomla JoomRecipe 4.2.2 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38007&utm_source=rss&utm_medium=rss) - - [ZKSecurity BIO 3.0.5.0_R Privilege Escalation Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38012&utm_source=rss&utm_medium=rss) - - [Joomla JKassa ShoppingCart 2.0.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168593&utm_source=rss&utm_medium=rss) - - [Centreon 22.04.0 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38005&utm_source=rss&utm_medium=rss) - - [Joomla Rentalot Plus 19.05 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168601&utm_source=rss&utm_medium=rss) - - [Joomla JS Jobs Pro 1.3.6 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38010&utm_source=rss&utm_medium=rss) - - [Joomla MarvikShop ShoppingCart 3.4 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168597&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.Delf.eg MVID-2022-0647 Remote Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168602&utm_source=rss&utm_medium=rss) - - [Joomla MarvikShop ShoppingCart 3.4 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168598&utm_source=rss&utm_medium=rss) - - [ZKSecurity BIO 4.1.2 SQL Injection / Code Execution Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-38013&utm_source=rss&utm_medium=rss) - - [Joomla MyMuse 4.3.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38011&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-41082 exploit](https://sploitus.com/exploit?id=6776EABD-28C1-5A42-8AB2-27BD7F492078&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-41040 exploit](https://sploitus.com/exploit?id=D58D53CD-D047-5570-B473-DEFF8E3B0225&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-10-03 Review](http://www.sec-wiki.com/?2022-10-03) -- unSafe.sh - 不安全 - - [SEO poisoning: Beware of suspicious links to avoid malware infections](https://buaq.net/go-129136.html) - - [Our favourite community contributions to the XSS cheat sheet](https://buaq.net/go-129137.html) - - [The PS5 Has Been Jailbroken – Custom Packages Can Now Be Installed](https://buaq.net/go-129129.html) - - [S Ventures Invests in Noetic Cyber for Complete Visibility and Control of Your Security Posture](https://buaq.net/go-129132.html) - - [Secure your machine learning with Semgrep](https://buaq.net/go-129130.html) - - [Orange Arbitrary Command Execution](https://buaq.net/go-129131.html) - - [我与一名网格员的战争](https://buaq.net/go-129123.html) - - [Actively exploited vulnerability in Bitbucket Server and Data Center](https://buaq.net/go-129160.html) - - [Java-Remote-Class-Loader - Tool to send Java bytecode to your victims to load and execute using Java ClassLoader together with Reflect API](https://buaq.net/go-129125.html) - - [Romance scammer deepfakes Mark Ruffalo to con elderly artist](https://buaq.net/go-129161.html) - - [vercel_xss_platform](https://buaq.net/go-129112.html) - - [WhatsApp Fixed Critical Vulnerabilities That Could Let an Attacker Hack Devices Remotely – Automatically Discover and Remediate Using VMDR Mobile](https://buaq.net/go-129104.html) - - [派评 | 近期值得关注的 App](https://buaq.net/go-129110.html) - - [C2-detection-manjusaka](https://buaq.net/go-129101.html) -- Security Boulevard - - [Optus Data Breach – Why Vulnerable APIs are to Blame](https://securityboulevard.com/2022/10/optus-data-breach-why-vulnerable-apis-are-to-blame/) - - [AWS Permission Boundaries for Dummies](https://securityboulevard.com/2022/10/aws-permission-boundaries-for-dummies/) - - [OpenText Report Identifies Nastiest Malware for 2022](https://securityboulevard.com/2022/10/opentext-report-identifies-nastiest-malware-for-2022/) - - [BSidesLV 2022 Lucky13 GroundFloor – Tanya Janca’s ‘When DevSecOps Fails’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundfloor-tanya-jancas-when-devsecops-fails/) - - [Facebook Stole U.S. Veteran Ideas and Tried to Kill Their Business](https://securityboulevard.com/2022/10/facebook-stole-u-s-veteran-ideas-and-tried-to-kill-their-business/) - - [Weaponizing Open Source Through Job Recruiting](https://securityboulevard.com/2022/10/weaponizing-open-source-through-job-recruiting/) - - [Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 401’](https://securityboulevard.com/2022/10/robert-m-lees-jeff-haas-little-bobby-comic-week-401/) - - [Using Facebook Pixel](https://securityboulevard.com/2022/10/using-facebook-pixel/) - - [Canada’s Largest Retail Pizza Chain Moves from Reactive to Proactive API Protection with Cequence](https://securityboulevard.com/2022/10/canadas-largest-retail-pizza-chain-moves-from-reactive-to-proactive-api-protection-with-cequence/) - - [Email Security News Round-Up [September 2022]](https://securityboulevard.com/2022/10/email-security-news-round-up-september-2022/) -- Files ≈ Packet Storm - - [Backdoor.Win32.Delf.eg MVID-2022-0647 Remote Command Execution](https://packetstormsecurity.com/files/168602/MVID-2022-0647.txt) - - [Joomla Rentalot Plus 19.05 Cross Site Scripting](https://packetstormsecurity.com/files/168601/joomlarentalotplus1905-xss.txt) - - [Backdoor.Win32.NTRC MVID-2022-0646 Hardcoded Credential](https://packetstormsecurity.com/files/168600/MVID-2022-0646.txt) - - [Password Manager For IIS 2.0 Cross Site Scripting](https://packetstormsecurity.com/files/168599/pmforiis20-xss.txt) - - [Joomla MarvikShop ShoppingCart 3.4 Cross Site Scripting](https://packetstormsecurity.com/files/168598/joomlamarviksc34-xss.txt) - - [Joomla MarvikShop ShoppingCart 3.4 SQL Injection](https://packetstormsecurity.com/files/168597/joomlamarviksc34-sql.txt) - - [Google Chrome 103.0.5060.53 network::URLLoader::NotifyCompleted Heap Use-After-Free](https://packetstormsecurity.com/files/168596/GS20221003145930.tgz) - - [Google Chrome 103.0.5060.53 Autofill Assistant Universal Cross Site Scripting](https://packetstormsecurity.com/files/168595/GS20221003145618.txt) - - [Windows Kerberos RC4 MD4 Encryption Downgrade Privilege Escalation](https://packetstormsecurity.com/files/168594/GS20221003145132.txt) - - [Joomla JKassa ShoppingCart 2.0.0 SQL Injection](https://packetstormsecurity.com/files/168593/joomlajkassashoppingcart200-sql.txt) - - [Joomla Easy Shop 1.4.1 Cross Site Scripting](https://packetstormsecurity.com/files/168592/joomlaeasyshop141-xss.txt) - - [Joomla JUX Charity Hub 1.0.4 SQL Injection](https://packetstormsecurity.com/files/168591/joomlajuxcharityhub104-sql.txt) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [本机函数和汇编代码调用](https://www.4hou.com/posts/ZXRv) - - [新的 Golang 勒索软件Agenda自定义攻击](https://www.4hou.com/posts/mX0O) - - [细思极恐！眼镜镜片反射会泄露Zoom会话信息](https://www.4hou.com/posts/pVq1) -- Bug Bounty in InfoSec Write-ups on Medium - - [Orange Arbitrary Command Execution](https://infosecwriteups.com/orange-arbitrary-command-execution-75ba7f283d53?source=rss----7b722bfd1b8d--bug_bounty) -- Trail of Bits Blog - - [Secure your machine learning with Semgrep](https://blog.trailofbits.com/2022/10/03/semgrep-maching-learning-static-analysis/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/xuc5u9/rreverseengineerings_weekly_questions_thread/) - - [The PS5 Has Been Jailbroken – Custom Packages Can Now Be Installed](https://www.reddit.com/r/ReverseEngineering/comments/xujbpi/the_ps5_has_been_jailbroken_custom_packages_can/) - - [The Yaralyzer is a new tool for visualizing and force decoding YARA and regular expression matches in binary and text data of any kind](https://www.reddit.com/r/ReverseEngineering/comments/xusc1b/the_yaralyzer_is_a_new_tool_for_visualizing_and/) -- SentinelOne - - [S Ventures Invests in Noetic Cyber for Complete Visibility and Control of Your Security Posture](https://www.sentinelone.com/blog/s-ventures-invests-in-noetic-cyber-for-complete-visibility-and-control-of-your-security-posture/) -- Malwarebytes Labs - - [Actively exploited vulnerability in Bitbucket Server and Data Center](https://www.malwarebytes.com/blog/news/2022/10/warnings-about-actively-exploited-vulnerability-in-bitbucket-server-and-data-center) - - [Romance scammer deepfakes Mark Ruffalo to con elderly artist](https://www.malwarebytes.com/blog/news/2022/10/romance-scammer-makes-bank-with-deepfake-mark-ruffalo) - - [A week in security (September 26 – October 2)](https://www.malwarebytes.com/blog/news/2022/10/a-week-in-security-september-26-october-2) -- blog.avast.com EN - - [SEO poisoning: Beware of suspicious links to avoid malware infections](https://blog.avast.com/seo-poisoning) -- SAP Blogs - - [SAP Activate for SAP S/4HANA Cloud, 3-system landscape](https://blogs.sap.com/2022/10/03/sap-activate-for-sap-s-4hana-cloud-3-system-landscape/) - - [How to Create the Perfect SAP Innovation Awards Entry [and Improve Your Chances of Winning]](https://blogs.sap.com/2022/10/03/how-to-create-the-perfect-sap-innovation-awards-entry-and-improve-your-chances-of-winning/) - - [SAP Integration Suite, advanced event mesh vis-à-vis SAP Event Mesh and SAP Integration Suite.](https://blogs.sap.com/2022/10/03/sap-integration-suite-advanced-event-mesh-vis-a-vis-sap-event-mesh-and-sap-integration-suite./) - - [Using Data Quality Management, microservices for location data in SAP Data Intelligence Pipeline](https://blogs.sap.com/2022/10/03/using-data-quality-management-microservices-for-location-data-in-sap-data-intelligence-pipeline/) - - [How to kick start with SAP Standard Content for Billing and Revenue Innovation Management?](https://blogs.sap.com/2022/10/03/how-to-kick-start-with-sap-standard-content-for-billing-and-revenue-innovation-management/) - - [How to Restrict to Create Duplicate ERS Invoice for the same Reference# for a Vendor by using Transaction Code-MRRL](https://blogs.sap.com/2022/10/03/how-to-restrict-to-create-duplicate-ers-invoice-for-the-same-reference-for-a-vendor-by-using-transaction-code-mrrl/) - - [What’s New in SAP Analytics Cloud Release 2022.20](https://blogs.sap.com/2022/10/03/whats-new-in-sap-analytics-cloud-release-2022.20/) - - [Collaborate with us on SAP BTP, Neo Environment Documentation](https://blogs.sap.com/2022/10/03/collaborate-with-us-on-sap-btp-neo-environment-documentation/) - - [SAP Cybersecurity Month 2022](https://blogs.sap.com/2022/10/03/sap-cybersecurity-month-2022/) - - [SAP Community Spotlight: SAP Analytics Cloud](https://blogs.sap.com/2022/10/03/sap-community-spotlight-sap-analytics-cloud/) -- PortSwigger Research - - [Our favourite community contributions to the XSS cheat sheet](https://portswigger.net/research/our-favourite-community-contributions-to-the-xss-cheat-sheet) -- Securelist - - [DeftTorero: tactics, techniques and procedures of intrusions revealed](https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/) -- Twitter @bytehx - - [RT Nicolas Krassas: Wordlists handcrafted with love,](https://twitter.com/Dinosn/status/1576908591139020800) -- The Daily Swig | Cybersecurity news and views - - [Microsoft confirms zero-day exploits against Exchange Server in ‘limited’ attacks](https://portswigger.net/daily-swig/microsoft-confirms-zero-day-exploits-against-exchange-server-in-limited-attacks) - - [Nepxion Discovery software with Spring Cloud functionality fails to patch RCE, info leak bugs](https://portswigger.net/daily-swig/nepxion-discovery-software-with-spring-cloud-functionality-fails-to-patch-rce-info-leak-bugs) -- KitPloit - PenTest & Hacking Tools - - [Java-Remote-Class-Loader - Tool to send Java bytecode to your victims to load and execute using Java ClassLoader together with Reflect API](http://www.kitploit.com/2022/10/java-remote-class-loader-tool-to-send.html) -- 奇客Solidot–传递最新科技情报 - - [Linux 6.0 释出](https://www.solidot.org/story?sid=72955) - - [瑞典科学家 Svante Pääbo 获 2022 年度诺贝尔生理学或医学奖](https://www.solidot.org/story?sid=72954) - - [Tumblr 永远不会再允许色情](https://www.solidot.org/story?sid=72953) - - [Debian 社区投票允许安装非自由固件](https://www.solidot.org/story?sid=72952) - - [Google 以低使用量关闭中国版翻译服务](https://www.solidot.org/story?sid=72951) -- 黑海洋 - WIKI - - [Google GSON 基础教程](https://blog.upx8.com/3007) -- 看雪学院 - - [2022 SDC 议题 | 基于硬件虚拟化技术的新一代二进制分析利器](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473846&idx=1&sn=27b4c964223b41a130cecb2c3360d4f0&chksm=b18e65fc86f9eceaf6e8f622be1404345a7ae5c311346c16b24260759f54a5334e126bb49fe1&scene=58&subscene=0#rd) - - [PE加载过程 FileBuffer-ImageBuffer](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473846&idx=2&sn=0258ae8d48a044dda44652e214c6c2b7&chksm=b18e65fc86f9ecea2bf2e6afa9ab5e0199da90be9f63e4c645ae8bd3628506b20907ec8fcaf7&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [分享 | VMP加壳工具 3.6.0 ultimate破解版](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486520&idx=1&sn=7b47eeb4ab7a146aa460d7846c34cb8b&chksm=fa5aa2d5cd2d2bc313cfed3ffe06a1842acd3cf005ebda3f2503d7c6db153e9211e21974fd0f&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [StrongBox-为Arm终端设备的GPU构建TEE](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492866&idx=1&sn=22fc5355c695f8711c883a030b8c602c&chksm=c063cbdbf71442cd12c0b772621f703047421d7de4333428ec06f573e97dcae89bab645afa93&scene=58&subscene=0#rd) -- 网安杂谈 - - [电信诈骗|虚拟货币领域电信网络诈骗犯罪的立体化审查](https://mp.weixin.qq.com/s?__biz=MzAwMTMzMDUwNg==&mid=2650887003&idx=1&sn=920e781ea740978e15922cf56cef371b&chksm=812eaf7eb65926681381664753b55f2e463b1fcbef5b994b76a080860ab720c736624ec846a0&scene=58&subscene=0#rd) -- 情报分析师 - - [操纵：如何识别战胜情感操纵和精神控制的关系](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517852&idx=1&sn=06793a41f659162b0abe27f22ba22184&chksm=87169f17b0611601144cbb7753212e28d9e143a296b4963320626058e99cad0f1a4bc0101943&scene=58&subscene=0#rd) - - [【情报课堂】如何找到某个插图的作者](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517852&idx=2&sn=ba1606fbe1913087889823177463a4b9&chksm=87169f17b06116017952b715d2e543bb1972acc50b8da2163c825fe9d82481a0f05b3a0999df&scene=58&subscene=0#rd) -- 极客公园 - - [华为距离「造车」，只差一层窗户纸](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969490&idx=1&sn=0e3c4d34e0e051c1b12c6871a0ef6478&chksm=7e5467a44923eeb20c9b50f90a94c5ffa96ddca5cbb8e972bae08a1dda5e6e1c553d372731c6&scene=58&subscene=0#rd) - - [华为 P60 将搭载高通 4nm 芯片；Mobileye 申请 300 亿美元 IPO；NASA 拍下火星神秘碎片| 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969415&idx=1&sn=935fe9aaa037e2bc9c60286099105497&chksm=7e5464714923ed6711854a21337612483264a084c753d30948b8919ea5bea8a22b70382b14c4&scene=58&subscene=0#rd) -- 朴实无华lake2 - - [国庆在家喜提红码 —— 外省赋红码处理流程详解及原因追溯](https://mp.weixin.qq.com/s?__biz=Mzg4NTc0MjAwMg==&mid=2247484184&idx=1&sn=1a91ce0308dfeac5df912fdefc44e8b2&chksm=cfa503c5f8d28ad3355770c9088cf33d7eb73eb3cb738bf32f3794e1002f57fc9feaee72b78a&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-05.md b/archive/2022/2022-10-05.md deleted file mode 100644 index 7c1c483838..0000000000 --- a/archive/2022/2022-10-05.md +++ /dev/null @@ -1,192 +0,0 @@ -# 每日安全资讯（2022-10-05） - -- Sploitus.com Exploits RSS Feed - - [Joomla JUX Charity Hub 1.0.4 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38018&utm_source=rss&utm_medium=rss) - - [Joomla Rentalot Plus 19.05 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38014&utm_source=rss&utm_medium=rss) - - [Windows Kerberos RC4 MD4 Encryption Downgrade Privilege Escalation Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38021&utm_source=rss&utm_medium=rss) - - [Google Chrome 103.0.5060.53 Autofill Assistant Universal Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38022&utm_source=rss&utm_medium=rss) - - [Password Manager For IIS 2.0 Cross Site Scripting Vulneraility exploit](https://sploitus.com/exploit?id=1337DAY-ID-38015&utm_source=rss&utm_medium=rss) - - [WordPress WPvivid Backup Path Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:168616&utm_source=rss&utm_medium=rss) - - [Joomla Easy Shop 1.4.1 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38016&utm_source=rss&utm_medium=rss) - - [WordPress Elementor 3.6.2 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168615&utm_source=rss&utm_medium=rss) - - [Joomla Solidres 2.12.9 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168606&utm_source=rss&utm_medium=rss) - - [Joomla MarvikShop ShoppingCart 3.4 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38017&utm_source=rss&utm_medium=rss) - - [Joomla JKassa ShoppingCart 2.0.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38019&utm_source=rss&utm_medium=rss) - - [Joomla RAXO All-Mode PRO 2.01 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168611&utm_source=rss&utm_medium=rss) - - [Canteen Management 1.0-2022 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168608&utm_source=rss&utm_medium=rss) - - [Joomla MarvikShop ShoppingCart 3.4 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38020&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Privilege Management in Microsoft exploit](https://sploitus.com/exploit?id=FE6D7F99-F6AF-559F-93A5-786367B77158&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=031A1BA5-EA1C-586D-8614-7558CCA5FCCB&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Glpi-Project Glpi exploit](https://sploitus.com/exploit?id=B8C3E5D6-A25D-59B8-9A0D-CADCEF69BB3D&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [Cyber Risk Quantification Drives Cyber Risk Awareness for Security AND Business Leaders](https://securityboulevard.com/2022/10/cyber-risk-quantification-drives-cyber-risk-awareness-for-security-and-business-leaders/) - - [Safe Security Adds Cybersecurity ROI Tool to Portfolio](https://securityboulevard.com/2022/10/safe-security-adds-cybersecurity-roi-tool-to-portfolio/) - - [BSidesLV 2022 Lucky13 GroundFloor – Karan Dwivedi’s ‘Clean Forensics: Analyzing Network Traffic Of Vacuum Bots’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundfloor-karan-dwivedis-clean-forensics-analyzing-network-traffic-of-vacuum-bots/) - - [Reflections on Swiss Cyber Institute’s Global Cyber Conference by Paul Kelly](https://securityboulevard.com/2022/10/reflections-on-swiss-cyber-institutes-global-cyber-conference-by-paul-kelly/) - - [Client-Side Security: You Can Delegate Authority But Not Responsibility](https://securityboulevard.com/2022/10/client-side-security-you-can-delegate-authority-but-not-responsibility/) - - [Participate in Cybersecurity Awareness Month!](https://securityboulevard.com/2022/10/participate-in-cybersecurity-awareness-month/) - - [Securing Istio Workloads with mTLS Using cert-manager](https://securityboulevard.com/2022/10/securing-istio-workloads-with-mtls-using-cert-manager/) - - [Daniel Stori’s ‘Introducing The OOM Killer’](https://securityboulevard.com/2022/10/daniel-storis-introducing-the-oom-killer/) - - [FAIL: Los Angeles School District Loses 500GB of PII](https://securityboulevard.com/2022/10/lausd-leaks-500gb-pii-richixbw/) - - [How DMARC Can Improve Email Deliverability?](https://securityboulevard.com/2022/10/how-dmarc-can-improve-email-deliverability/) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5614-2](https://packetstormsecurity.com/files/168617/USN-5614-2.txt) - - [WordPress WPvivid Backup Path Traversal](https://packetstormsecurity.com/files/168616/TSI-ADV152022.txt) - - [WordPress Elementor 3.6.2 Shell Upload](https://packetstormsecurity.com/files/168615/wp_plugin_elementor_auth_upload_rce.rb.txt) - - [Ubuntu Security Notice USN-5651-2](https://packetstormsecurity.com/files/168614/USN-5651-2.txt) - - [Red Hat Security Advisory 2022-6763-01](https://packetstormsecurity.com/files/168613/RHSA-2022-6763-01.txt) - - [Ubuntu Security Notice USN-5651-1](https://packetstormsecurity.com/files/168612/USN-5651-1.txt) - - [Joomla RAXO All-Mode PRO 2.01 Cross Site Scripting](https://packetstormsecurity.com/files/168611/joomlaraxoalmodepro201-xss.txt) - - [Red Hat Security Advisory 2022-6764-01](https://packetstormsecurity.com/files/168610/RHSA-2022-6764-01.txt) - - [Ubuntu Security Notice USN-5653-1](https://packetstormsecurity.com/files/168609/USN-5653-1.txt) - - [Canteen Management 1.0-2022 SQL Injection](https://packetstormsecurity.com/files/168608/canteenmgmt102022-sql.txt) - - [Ubuntu Security Notice USN-5652-1](https://packetstormsecurity.com/files/168607/USN-5652-1.txt) - - [Joomla Solidres 2.12.9 Cross Site Scripting](https://packetstormsecurity.com/files/168606/joomlasolidres2129-xss.txt) - - [Red Hat Security Advisory 2022-6765-01](https://packetstormsecurity.com/files/168605/RHSA-2022-6765-01.txt) - - [Red Hat Security Advisory 2022-6766-01](https://packetstormsecurity.com/files/168604/RHSA-2022-6766-01.txt) - - [OpenSSH 9.1p1](https://packetstormsecurity.com/files/168603/openssh-9.1p1.tar.gz) -- Der Flounder - - [Slides from the “Leveling Up – Managing admin rights in the enterprise” session at MacSysAdmin 2022](https://derflounder.wordpress.com/2022/10/04/slides-from-the-leveling-up-managing-admin-rights-in-the-enterprise-session-at-macsysadmin-2022/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [ZKSecurity BIO 3.0.5.0_R Privilege Escalation](https://cxsecurity.com/issue/WLB-2022100017) - - [Centreon 22.04.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100016) - - [Joomla MarvikShop ShoppingCart 3.4 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100015) - - [Joomla JKassa ShoppingCart 2.0.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022100014) - - [Joomla RAXO All-Mode PRO 2.01 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100013) - - [Canteen Management 1.0-2022 SQL Injection](https://cxsecurity.com/issue/WLB-2022100012) - - [Joomla Solidres 2.12.9 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100011) -- Microsoft Security Blog - - [Cybersecurity awareness tips from Microsoft to empower your team to #BeCyberSmart](https://www.microsoft.com/security/blog/2022/10/04/cybersecurity-awareness-tips-from-microsoft-to-empower-your-team-to-becybersmart/) -- Recent Commits to cve:main - - [Update Tue Oct 4 10:18:18 UTC 2022](https://github.com/trickest/cve/commit/d6cc9b8f29eb40d9eeef2af8128eb4160cb5c5e9) -- Tenable Blog - - [Introducing the Tenable One Exposure Management Platform](https://www.tenable.com/blog/introducing-the-tenable-one-exposure-management-platform) - - [Exposure Management: Reducing Risk in the Modern Attack Surface](https://www.tenable.com/blog/exposure-management-reducing-risk-in-the-modern-attack-surface) -- unSafe.sh - 不安全 - - [TikTok's "secret operation" tracks you even if you don't use it](https://buaq.net/go-129261.html) - - [Prioritize vulnerability assessment more easily with these simple steps— and intelligence—from Secunia Research](https://buaq.net/go-129254.html) - - [IDE-based application security for developers in IntelliJ](https://buaq.net/go-129234.html) - - [Slides from the “Leveling Up – Managing admin rights in the enterprise” session at MacSysAdmin 2022](https://buaq.net/go-129233.html) - - [Huge increase in smishing scams, warns IRS](https://buaq.net/go-129262.html) - - [Utkuici - Nessus Automation](https://buaq.net/go-129225.html) - - [OnionPoison: infected Tor Browser installer distributed through popular YouTube channel](https://buaq.net/go-129224.html) - - [Zimbra漏洞调试环境搭建](https://buaq.net/go-129212.html) - - [Lsassy二次开发——添加dump方法](https://buaq.net/go-129211.html) - - [DLL劫持漏洞自动化识别工具Rattler测试](https://buaq.net/go-129210.html) - - [如何使用DLLHijackingScanner检测DLL劫持漏洞和受信目录利用 - 腾讯云开发者社区-腾讯云](https://buaq.net/go-129209.html) - - [ImpulsiveDLLHijack：一款基于C#实现的DLL劫持技术研究工具 - 腾讯云开发者社区-腾讯云](https://buaq.net/go-129208.html) - - [锁屏小组件、专注模式过滤、状态标签……文本效率工具 Drafts 5 更新详解](https://buaq.net/go-129213.html) - - [Practical Network Penetration Tester (PNPT): Real-life Penetration Testing exam – Tips & Tricks to pass the exam](https://buaq.net/go-129191.html) - - [【reverse】虚假控制流入门：Ubuntu20.04安装ollvm4.0踩坑记+用IDApython去除BCF - 『脱壳破解区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn](https://buaq.net/go-129181.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [通过第三方软件收集用户凭据](https://www.4hou.com/posts/zlNr) - - [黑客采用Sliver工具箱作为Cobalt Strike的替代品](https://www.4hou.com/posts/vJxm) - - [攻击者滥用《原神》（游戏名）反作弊驱动程序来阻止杀毒软件](https://www.4hou.com/posts/500B) -- SecWiki News - - [SecWiki News 2022-10-04 Review](http://www.sec-wiki.com/?2022-10-04) -- Twitter @Nicolas Krassas - - [pirebok - an adversarial fuzzer](https://twitter.com/Dinosn/status/1577361454461763592) - - [FBI warns of "Pig Butchering" cryptocurrency investment schemes](https://twitter.com/Dinosn/status/1577361417245757441) - - [Cybercriminals Leak LA School Data After It Refuses To Ransom](https://twitter.com/Dinosn/status/1577361293543096332) - - [Researchers Report Supply Chain Vulnerability in Packagist PHP Repository](https://twitter.com/Dinosn/status/1577360973647724545) - - [Optus confirms 2.1 million ID numbers exposed in data breach](https://twitter.com/Dinosn/status/1577360878369767424) - - [Aussie Telco Telstra Breached, Reportedly Exposing 30,000 Employees' Data](https://twitter.com/Dinosn/status/1577360779686330375) - - [Popular YouTube Channel Caught Distributing Malicious Tor Browser Installer](https://twitter.com/Dinosn/status/1577360580515610642) - - [Re @haxor31337 Congratulations and all the best !](https://twitter.com/Dinosn/status/1577339908888346626) - - [From today, America and UK follow new rules on how they can demand your data from each other](https://twitter.com/Dinosn/status/1577248771028963329) - - [The Yaralyzer is a new tool for visualizing and force decoding YARA and regular expression matches in binary and text data of any kind](https://twitter.com/Dinosn/status/1577248687742652422) - - [Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub](https://twitter.com/Dinosn/status/1577248624521592833) - - [CVE-2022-41850: Linux kernel code execution vulnerability](https://twitter.com/Dinosn/status/1577248507865419776) - - [GooFuzz: enumerate directories, files, subdomains or parameters](https://twitter.com/Dinosn/status/1577248459958398977) - - [Comm100 Chat Provider Hijacked to Spread Malware in Supply Chain Attack](https://twitter.com/Dinosn/status/1577248390546477062) - - [TD Bank discloses data breach after employee leaks customer info](https://twitter.com/Dinosn/status/1577227260737699840) - - [Actively exploited vulnerability in Bitbucket Server and Data Center](https://twitter.com/Dinosn/status/1577226792959881216) - - [Hackers Exploiting Dell Driver Vulnerability to Deploy Rootkit on Targeted Computers](https://twitter.com/Dinosn/status/1577226504940855297) -- Blog & What's New | Offensive Security - - [See Yourself in Cyber with OffSec: Penetration Testing](https://www.offensive-security.com/penetration-testing/see-yourself-as-a-pentester/) -- Flexera Blog - Feed - - [Prioritize vulnerability assessment more easily with these simple steps— and intelligence—from Secunia Research](https://www.flexera.com/blog/vulnerability-management/prioritize-vulnerability-assessment-more-easily-with-these-simple-steps-and-intelligence-from-secunia-research/) -- Twitter @bytehx - - [Re @haxor31337 Congrats mate!](https://twitter.com/bytehx343/status/1577308495585873921) -- Securelist - - [OnionPoison: infected Tor Browser installer distributed through popular YouTube channel](https://securelist.com/onionpoison-infected-tor-browser-installer-youtube/107627/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-10-01 thru 10-03 - 3 days of traffic from scans/probes hitting a web server](https://www.malware-traffic-analysis.net/2022/10/03/index.html) - - [2022-09-16 thru 09-30 - 15 days of traffic from scans/probes hitting a web server](https://www.malware-traffic-analysis.net/2022/09/30/index.html) - - [2022-09-29 - Qakbot (Qbot) with Cobalt Strike](https://www.malware-traffic-analysis.net/2022/09/29/index.html) - - [2022-09-03 thru 09-15 - 13 days of traffic from scans/probes hitting a web server](https://www.malware-traffic-analysis.net/2022/09/15/index.html) -- Malwarebytes Labs - - [TikTok's "secret operation" tracks you even if you don't use it](https://www.malwarebytes.com/blog/news/2022/10/tiktoks-secret-operation-tracks-you-even-if-you-dont-use-it) - - [Huge increase in smishing scams, warns IRS](https://www.malwarebytes.com/blog/news/2022/09/huge-increase-in-smishing-scams-warns-irs) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Attending Sofia Cyber Sec and Cyber Security Talks in Bulgaria! - Come and Join Me!](https://ddanchev.blogspot.com/2022/10/attending-sofia-cyber-sec-and-cyber.html) -- Reverse Engineering - - [Identifying Class hierarchy from RTTI](https://www.reddit.com/r/ReverseEngineering/comments/xvossf/identifying_class_hierarchy_from_rtti/) -- Intigriti - - [What does it mean to become an Intigriti partner?](https://blog.intigriti.com/2022/10/04/become-intigriti-partner/) -- Application Security Blog - - [IDE-based application security for developers in IntelliJ](https://www.synopsys.com/blogs/software-security/ide-based-appsec-code-sight-intellij/) -- SAP Blogs - - [SAP AppGyver で簡単な「BP一覧」アプリを作ってみた](https://blogs.sap.com/2022/10/04/sap-appgyver-%e3%81%a7%e7%b0%a1%e5%8d%98%e3%81%aa%e3%80%8cbp%e4%b8%80%e8%a6%a7%e3%80%8d%e3%82%a2%e3%83%97%e3%83%aa%e3%82%92%e4%bd%9c%e3%81%a3%e3%81%a6%e3%81%bf%e3%81%9f/) - - [Part 3 – Perform OCR on a .PDF using microservice hosted on SAP BTP, Kyma Runtime](https://blogs.sap.com/2022/10/04/part-3-perform-ocr-on-a-.pfd-using-microservice-hosted-on-sap-btp-kyma-runtime/) - - [Learn How to Create an Incentive Outcome Dashboard in Report Stories](https://blogs.sap.com/2022/10/04/learn-how-to-create-an-incentive-outcome-dashboard-in-report-stories/) - - [The ABAP Detective Copies A Client](https://blogs.sap.com/2022/10/04/the-abap-detective-copies-a-client/) - - [Enablement of Correction Invoices for Customer Invoices](https://blogs.sap.com/2022/10/04/enablement-of-correction-invoices-for-customer-invoices/) - - [HCM Brasil eSocial: Informações importantes sobre a troca do layout](https://blogs.sap.com/2022/10/04/hcm-brasil-esocial-informacoes-importantes-sobre-a-troca-do-layout/) - - [SAP Commissions – Build your own App with SAP AppGyver](https://blogs.sap.com/2022/10/04/sap-commissions-build-your-own-app-with-sap-appgyver/) - - [A Network Approach to Quality Management](https://blogs.sap.com/2022/10/04/a-network-approach-to-quality-management/) - - [SAP Sales and Service Cloud – 2211 Release Briefing Webcast](https://blogs.sap.com/2022/10/04/sap-sales-and-service-cloud-2211-release-briefing-webcast/) - - [Predictive accounting for incoming sales orders in SAP S/4HANA Cloud](https://blogs.sap.com/2022/10/04/predictive-accounting-for-incoming-sales-orders-in-sap-s-4hana-cloud/) -- The Daily Swig | Cybersecurity news and views - - [Matrix address flaws that break message encryption assurances](https://portswigger.net/daily-swig/matrix-address-flaws-that-break-message-encryption-assurances) - - [JavaScript sandbox vm2 remediates remote code execution risk](https://portswigger.net/daily-swig/javascript-sandbox-vm2-remediates-remote-code-execution-risk) - - [Researchers net $46k for Akamai misconfiguration vulnerability](https://portswigger.net/daily-swig/researchers-net-46k-for-akamai-misconfiguration-vulnerability) -- r2c website - - [It's time to ignore 98% of dependency alerts. Introducing Semgrep Supply Chain.](https://r2c.dev/blog/2022/introducing-semgrep-supply-chain/) -- Security Café - - [Practical Network Penetration Tester (PNPT): Real-life Penetration Testing exam – Tips & Tricks to pass the exam](https://securitycafe.ro/2022/10/04/practical-network-penetration-tester-pnpt-real-life-penetration-testing-exam-tips-tricks-to-pass-the-exam/) -- Twitter @Keiran Smith (Affix) - - [Re @Morrisons staff using the password 2222 on the self checkout to enter staff modes #security #observation #infosec #usefultoknow. Since I know the ...](https://twitter.com/cli/status/1577400370619420705) -- KitPloit - PenTest & Hacking Tools - - [Utkuici - Nessus Automation](http://www.kitploit.com/2022/10/utkuici-nessus-automation.html) -- 博客园 - 郑瀚Andrew - - [中国特色小镇规划理论与实践 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16749545.html) -- 黑海洋 - WIKI - - [卸载Oracle甲骨文云服务器 后台监控程序](https://blog.upx8.com/3042) - - [freenom 免费域名搭建魔法上网](https://blog.upx8.com/3041) - - [甲骨文云Oracle Cloud搭建科学上网](https://blog.upx8.com/3040) - - [甲骨文服务器（Oracle Cloud）开启root用户登录](https://blog.upx8.com/3038) - - [全自动一键网络重装脚本（DD脚本）](https://blog.upx8.com/3035) - - [使用ipset设置防火墙端口白名单，只让指定国家访问](https://blog.upx8.com/3033) - - [宝塔面板LNMP开启Brotli压缩，可提高网站加载速度](https://blog.upx8.com/3032) - - [GoIndex：一个无需服务器的Google Drive目录索引程序](https://blog.upx8.com/3031) - - [宝塔面板“反向代理”：悄悄把网站变成自己的](https://blog.upx8.com/3030) - - [VPS常用脚本合集(BBR、测速、回程、性能）](https://blog.upx8.com/3027) -- 看雪学院 - - [针对某会议软件，简单研究其CEF框架](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473847&idx=1&sn=ad73bc3a39d01fbdc0ef69f51e1f7606&chksm=b18e65fd86f9ecebedc7b8244af1252aebc923f97c01338211dc7a9ae52c5f212cab4ab1f467&scene=58&subscene=0#rd) - - [雪花创作激励计划，快来参与！](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473847&idx=2&sn=3112b36fca81b3e1287e6cc870adcd3f&chksm=b18e65fd86f9eceb520167620f97c91ae34ad7a8445ddcc0cc76e5ede22738de2a57afe58d58&scene=58&subscene=0#rd) - - [Unicorn 高级逆向与反混淆](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473847&idx=3&sn=018a6f9c34f96207837443d4c3484887&chksm=b18e65fd86f9eceb5c278f4d249b323dd9f51550b3009feff7446e06034954e25f6d26ef24c5&scene=58&subscene=0#rd) -- Blog - Praetorian - - [Assessment of an Ecosystem: The importance of end to end, holistic testing](https://www.praetorian.com/blog/the-importance-of-end-to-end-holistic-testing/) -- 奇客Solidot–传递最新科技情报 - - [天文学家发现银河系死亡恒星墓场](https://www.solidot.org/story?sid=72962) - - [气候变化让树木变“胖”了](https://www.solidot.org/story?sid=72961) - - [Steam Deck 掌机出货量逾一百万部](https://www.solidot.org/story?sid=72960) - - [诺贝尔物理学奖授予了三名研究纠缠量子态的科学家](https://www.solidot.org/story?sid=72959) - - [美最高法院同意审理挑战科技公司免责的案件](https://www.solidot.org/story?sid=72958) - - [印度火星探测器 Mangalyaan 停止工作](https://www.solidot.org/story?sid=72957) - - [俄罗斯人试图购买不适合服兵役的证明躲避动员令](https://www.solidot.org/story?sid=72956) -- Light Cube - - [这下云原生了 · Light Cube 七周年](https://github.red/lightcube-7th/) -- dotNet安全研究僧 - - [九九重阳，九九相伴！](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486532&idx=1&sn=f992b53f104c29f7deaf36033f7a6911&chksm=fa5aa2a9cd2d2bbf965919edda48da90a25e0fd43c12d9cc3e639ff9f50e27d64e2e05523bf9&scene=58&subscene=0#rd) - - [优惠活动 | .NET矩阵星球亮点](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486532&idx=2&sn=7e1b51ab21aa2d8d9b68380d755c1636&chksm=fa5aa2a9cd2d2bbf88f3d6ffabe659cabaa89c4ff7bd3593556a68725a82076febc76483e61c&scene=58&subscene=0#rd) -- RASP安全技术 - - [线程注入与JRASP实践](https://mp.weixin.qq.com/s?__biz=Mzg5MjQ1OTkwMg==&mid=2247484499&idx=1&sn=a5808d12ba14f17afab4b73c79f4dd37&chksm=c03c8a42f74b03547e33a6cb3cab563bbc4dbb03858cd754545feeedb1107b394ce683532921&scene=58&subscene=0#rd) -- 情报分析师 - - [技术获取和军备控制：通过高超音速武器辩论进行思考](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517853&idx=1&sn=86f8edbb1bda7637e719567fb243fe52&chksm=87169f16b061160006e804a337c3404e8af7ee3227538835ff8d2200dc26aa74241f165b3d50&scene=58&subscene=0#rd) - - [【情报课堂】无人机和操作系统](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517853&idx=2&sn=47d89bbade84e487842ff1aa8cfb2f1e&chksm=87169f16b0611600597b74a8473b714ba199a1d15ff2cf7568578bc56dad8d3de44050cb51c5&scene=58&subscene=0#rd) -- 极客公园 - - [特斯拉三季度交付量不及预期；任天堂成立影业公司；天文学家称银河系有数百亿颗「超级地球」 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969506&idx=1&sn=991f2e1dbbc87a99de0cc0c4f5d37de9&chksm=7e5467944923ee826f1a5978d2da4169585fcedc35d73eb1ead7207ffe54b810a71d3d4df868&scene=58&subscene=0#rd) -- 丁爸情报分析师的工具箱 - - [【工具】自动化的开源情报（OSINT）工具-蜘蛛脚（SpiderFoot）](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651132623&idx=1&sn=dcd91c4056c8bcb52bb170797a4b3fcc&chksm=f1af65f5c6d8ece33f8e13cbe2327bedff54fde74b036d6a4ff846d1f3785576e1c4ab3f27c8&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-06.md b/archive/2022/2022-10-06.md deleted file mode 100644 index addce51bd9..0000000000 --- a/archive/2022/2022-10-06.md +++ /dev/null @@ -1,164 +0,0 @@ -# 每日安全资讯（2022-10-06） - -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Joomla JUX Charity Hub 1.0.4 SQL Injection](https://cxsecurity.com/issue/WLB-2022100021) - - [Ubuntu 22.04.1 X64 Desktop Enlightenment 0.25.3-1 Privilege Escalation](https://cxsecurity.com/issue/WLB-2022100020) - - [Remote Mouse 4.110 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022100019) - - [Canteen Management 1.0-2022 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100018) -- Sploitus.com Exploits RSS Feed - - [Remote Mouse 4.110 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168635&utm_source=rss&utm_medium=rss) - - [Joomla Solidres 2.12.9 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38025&utm_source=rss&utm_medium=rss) - - [Canteen Management 1.0 2022 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38023&utm_source=rss&utm_medium=rss) - - [Ubuntu 22.04.1 X64 Desktop Enlightenment 0.25.3-1 Privilege Escalation exploit](https://sploitus.com/exploit?id=PACKETSTORM:168634&utm_source=rss&utm_medium=rss) - - [WordPress WPvivid Backup Path Traversal Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38026&utm_source=rss&utm_medium=rss) - - [Remote Mouse 4.110 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38028&utm_source=rss&utm_medium=rss) - - [Joomla RAXO All-Mode PRO 2.01 Cross Site Scripting Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38024&utm_source=rss&utm_medium=rss) - - [WordPress Elementor 3.6.2 Shell Upload Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38027&utm_source=rss&utm_medium=rss) - - [Canteen Management 1.0-2022 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168618&utm_source=rss&utm_medium=rss) - - [Exploit for Command Injection in Atlassian Bitbucket exploit](https://sploitus.com/exploit?id=B875D929-E22E-55B9-B81B-D82D9EE19A68&utm_source=rss&utm_medium=rss) -- Microsoft Security Blog - - [Detecting and preventing LSASS credential dumping attacks](https://www.microsoft.com/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/) -- Files ≈ Packet Storm - - [Remote Mouse 4.110 Remote Code Execution](https://packetstormsecurity.com/files/168635/remote_mouse_rce.rb.txt) - - [Ubuntu 22.04.1 X64 Desktop Enlightenment 0.25.3-1 Privilege Escalation](https://packetstormsecurity.com/files/168634/ubuntu_enlightenment_mount_priv_esc.rb.txt) - - [Wireshark Analyzer 4.0.0](https://packetstormsecurity.com/files/168633/wireshark-4.0.0.tar.xz) - - [Ubuntu Security Notice USN-5656-1](https://packetstormsecurity.com/files/168632/USN-5656-1.txt) - - [Red Hat Security Advisory 2022-6782-01](https://packetstormsecurity.com/files/168631/RHSA-2022-6782-01.txt) - - [Red Hat Security Advisory 2022-6777-01](https://packetstormsecurity.com/files/168630/RHSA-2022-6777-01.txt) - - [Red Hat Security Advisory 2022-6780-01](https://packetstormsecurity.com/files/168629/RHSA-2022-6780-01.txt) - - [Red Hat Security Advisory 2022-6779-01](https://packetstormsecurity.com/files/168628/RHSA-2022-6779-01.txt) - - [Red Hat Security Advisory 2022-6778-01](https://packetstormsecurity.com/files/168627/RHSA-2022-6778-01.txt) - - [Red Hat Security Advisory 2022-6776-01](https://packetstormsecurity.com/files/168626/RHSA-2022-6776-01.txt) - - [Red Hat Security Advisory 2022-6774-01](https://packetstormsecurity.com/files/168625/RHSA-2022-6774-01.txt) - - [Red Hat Security Advisory 2022-6775-01](https://packetstormsecurity.com/files/168624/RHSA-2022-6775-01.txt) - - [Red Hat Security Advisory 2022-6781-01](https://packetstormsecurity.com/files/168623/RHSA-2022-6781-01.txt) - - [Red Hat Security Advisory 2022-6787-01](https://packetstormsecurity.com/files/168622/RHSA-2022-6787-01.txt) - - [Red Hat Security Advisory 2022-6783-01](https://packetstormsecurity.com/files/168621/RHSA-2022-6783-01.txt) - - [Ubuntu Security Notice USN-5655-1](https://packetstormsecurity.com/files/168620/USN-5655-1.txt) - - [Ubuntu Security Notice USN-5654-1](https://packetstormsecurity.com/files/168619/USN-5654-1.txt) - - [Canteen Management 1.0-2022 Cross Site Scripting](https://packetstormsecurity.com/files/168618/canteenmgmt102022-xss.txt) -- Twitter @Nicolas Krassas - - [New TrollStore Tool Permanently Installs Apps on Non-Jailbroken iOS Devices](https://twitter.com/Dinosn/status/1577747250293489682) - - [Modified Version Of Tor Browser Spies On Chinese Users](https://twitter.com/Dinosn/status/1577747084559761432) - - [Russian Hacker Arrested In India For Helping Students Cheat In Exam](https://twitter.com/Dinosn/status/1577746077683433472) - - [Fuzzing Trackmania Nations Forever for RCE](https://twitter.com/Dinosn/status/1577743864290590720) - - [Hundreds of Microsoft SQL servers backdoored with new malware](https://twitter.com/Dinosn/status/1577743645817688064) - - [Detecting and preventing LSASS credential dumping attacks](https://twitter.com/Dinosn/status/1577743283572424715) - - [City of Tucson discloses data breach affecting over 125,000 people](https://twitter.com/Dinosn/status/1577743240069103624) - - [Chase UK's app-only bank hit with 24-hour ongoing outage](https://twitter.com/Dinosn/status/1577743188181368832) - - [Telstra Telecom discloses data breach impacting former and current employees](https://twitter.com/Dinosn/status/1577743055330983954) - - [RT CantHide: We are Live! 🦊 CantHide finds previous locations by looking at a given social media account. #OSINT #CyberSecurity #geolocation #infos...](https://twitter.com/canthideme/status/1577724748926259209) - - [RT ap: We have just released a new version of our #JuicyPotatoNG tool to help red teamers/pentesters. Now you can bruteforce clsid's, find open ports ...](https://twitter.com/decoder_it/status/1577715436682100738) - - [SteaLinG: open-source penetration testing framework designed for social engineering](https://twitter.com/Dinosn/status/1577612642998693888) - - [Pixel 6 bootloader: Emulation, ROP](https://twitter.com/Dinosn/status/1577586561780252672) - - [Dissect: An incident response game-changer](https://twitter.com/Dinosn/status/1577540185465802753) - - [US Govt: Hackers stole data from US defense org using new malware](https://twitter.com/Dinosn/status/1577540118956724225) - - [No Shangri-La for you: Top hotel chain confirms data leak](https://twitter.com/Dinosn/status/1577540089084870664) - - [TikTok's "secret operation" tracks you even if you don't use it](https://twitter.com/Dinosn/status/1577539903092572160) - - [On this page you’ll find tools which you can help do your OSINT research.](https://twitter.com/Dinosn/status/1577517408708861953) -- SecWiki News - - [SecWiki News 2022-10-05 Review](http://www.sec-wiki.com/?2022-10-05) -- Security Boulevard - - [Glut of Fake LinkedIn Profiles Pits HR Against the Bots](https://securityboulevard.com/2022/10/glut-of-fake-linkedin-profiles-pits-hr-against-the-bots/) - - [SlashNext Extends Award-Winning Enterprise Mobile for Home and Personal Use](https://securityboulevard.com/2022/10/slashnext-extends-award-winning-enterprise-mobile-for-home-and-personal-use/) - - [Frontline VM Datasheet](https://securityboulevard.com/2022/10/frontline-vm-datasheet/) - - [SafeBreach Coverage for US-CERT Alert (AA22-277A) – Use of Impacket and CovalentStealer to Steal Sensitive Data](https://securityboulevard.com/2022/10/safebreach-coverage-for-us-cert-alert-aa22-277a-use-of-impacket-and-covalentstealer-to-steal-sensitive-data/) - - [BSidesLV 2022 Lucky13 GroundFloor – Uriel Kosayev’s ‘Malware Analysis – Red Team Edition’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundfloor-uriel-kosayevs-malware-analysis-red-team-edition/) - - [Memory-safe #RustLang shines with its day in the sun](https://securityboulevard.com/2022/10/memory-safe-rustlang-shines-with-its-day-in-the-sun/) - - [The latest update to the ReversingLabs Malware Analysis Workbench](https://securityboulevard.com/2022/10/the-latest-update-to-the-reversinglabs-malware-analysis-workbench/) - - [Frontline Cyber Threat Monitoring™ Datasheet](https://securityboulevard.com/2022/10/frontline-cyber-threat-monitoring-datasheet/) - - [XKCD ‘Wing Lift’](https://securityboulevard.com/2022/10/xkcd-wing-lift/) - - [Do You Know What to Look for in a Cloud Security Platform?](https://securityboulevard.com/2022/10/do-you-know-what-to-look-for-in-a-cloud-security-platform/) -- Recent Commits to cve:main - - [Update Wed Oct 5 10:18:55 UTC 2022](https://github.com/trickest/cve/commit/0595db4f1c0cbf894a4cf1666bdd3805eab613df) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [谷歌和微软可通过Web浏览器的拼写检查功能获取你的密码](https://www.4hou.com/posts/q8X3) -- C0reFast记事本 - - [在移动硬盘盒上启用SSD的Trim功能](https://www.ichenfu.com/2022/10/05/enable-trim-on-usb-attached-scsi-ssds/) -- Sucuri Blog - - [How to Secure & Harden Your Joomla! Website in 12 Steps](https://blog.sucuri.net/2022/10/how-to-secure-harden-your-joomla-website-in-12-steps.html) -- unSafe.sh - 不安全 - - [Bogus job offers hide trojanised open-source software](https://buaq.net/go-129380.html) - - [MobaXterm密码获取 - Yangsir34 - 博客园](https://buaq.net/go-129357.html) - - [HyperSine/how-does-MobaXterm-encrypt-password: This repo offers a tool to reveal password encrypted by MobaXterm.](https://buaq.net/go-129356.html) - - [批量下载公众号文章内容/音频/视频，还支持公众号话题](https://buaq.net/go-129406.html) - - [API Monitor32 - Detecting Windows API hooking and modification for analysis purposes](https://buaq.net/go-129355.html) - - [Top 8 Defenses MSPs Can Take Against Cyberattacks](https://buaq.net/go-129359.html) - - [Defending digital freedom in times of cyberwar](https://buaq.net/go-129358.html) - - [Working on blockchains as a Trail of Bits intern](https://buaq.net/go-129341.html) - - [Public Report – IOV Labs powHSM Security Assessment](https://buaq.net/go-129339.html) - - [Ghauri – advanced cross-platform tool](https://buaq.net/go-129347.html) - - [SekaiCTF 2022 - safelist writeup](https://buaq.net/go-129350.html) - - [CyRC Vulnerability Advisory: CVE-2022-39064 IKEA TRÅDFRI smart lighting](https://buaq.net/go-129342.html) - - [CyRC Vulnerability Advisory: CVE-2022-39065 IKEA TRÅDFRI smart lighting gateway](https://buaq.net/go-129343.html) - - [phra's blog ~ Technical posts about InfoSec](https://buaq.net/go-129331.html) - - [Deliver a Strike by Reversing a Badger: Brute Ratel Detection and Analysis](https://buaq.net/go-129340.html) - - [Kim Kardashian gets huge fine for crypto ad](https://buaq.net/go-129381.html) - - [Erlik 2 - Vulnerable-Flask-App](https://buaq.net/go-129346.html) - - [完美解码PureCodec20221001官方版&绿色版](https://buaq.net/go-129408.html) -- Trail of Bits Blog - - [Working on blockchains as a Trail of Bits intern](https://blog.trailofbits.com/2022/10/05/trail-of-bits-internship-blockchain-tealer/) -- SpiderLabs Blog from Trustwave - - [Post-Exploitation Persistent Email Forwarder in Outlook Desktop](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/post-exploitation-persistent-email-forwarder-in-outlook-desktop/) -- SAP Blogs - - [Printer Resident Fonts using SAP Adobe Forms](https://blogs.sap.com/2022/10/05/printer-resident-fonts-using-sap-adobe-forms/) - - [SAP Integration Suite Sessions auf dem DSAG Jahreskongress 2022 (German)](https://blogs.sap.com/2022/10/05/sap-integration-suite-sessions-auf-dem-dsag-jahreskongress-2022-german/) - - [Deloitte strengthens offerings to help customers achieve their ESG goals with SAP technology](https://blogs.sap.com/2022/10/05/deloitte-strengthens-offerings-to-help-customers-achieve-their-esg-goals-with-sap-technology./) - - [Creator Spotlight: Bringing teachers’ activities straight to families with Zuzmó](https://blogs.sap.com/2022/10/05/creator-spotlight-bringing-teachers-activities-straight-to-families-with-zuzmo/) - - [Timesheet Accounting and Billing on S/4HANA Cloud for Professional Services](https://blogs.sap.com/2022/10/05/timesheet-accounting-and-billing-on-s-4hana-cloud-for-professional-services/) - - [Engineering in the Cloud – Why SAP is the Best Choice](https://blogs.sap.com/2022/10/05/engineering-in-the-cloud-why-sap-is-the-best-choice/) - - [How to comply with embargo, sanctioned party lists and export control in SAP](https://blogs.sap.com/2022/10/05/how-to-comply-with-embargo-sanctioned-party-lists-and-export-control-in-sap/) - - [Event-Based Revenue Recognition for Universal Parallel Accounting in SAP S/4HANA 2022](https://blogs.sap.com/2022/10/05/event-based-revenue-recognition-for-universal-parallel-accounting-in-sap-s-4hana-2022/) - - [How to Learn Through Teaching | Johann Fößleitner SAP Champion Spotlight](https://blogs.sap.com/2022/10/05/how-to-learn-through-teaching-johann-fosleitner-sap-champion-spotlight/) - - [HCM Nómina España: Cómo ejecutar el Mensaje FIE para un empleado](https://blogs.sap.com/2022/10/05/hcm-nomina-espana-como-ejecutar-el-mensaje-fie-para-un-empleado/) -- 博客园 - luoyesiqiu - - [Android类加载流程 - luoyesiqiu](https://www.cnblogs.com/luoyesiqiu/p/classload.html) -- Securelist - - [Uncommon infection and malware propagation methods](https://securelist.com/uncommon-infection-and-malware-propagation-methods/107640/) -- Sucuri Blog - - [How to Secure & Harden Your Joomla! Website in 12 Steps](https://blog.sucuri.net/2022/10/how-to-secure-harden-your-joomla-website-in-12-steps.html) -- SentinelOne - - [Top 8 Defenses MSPs Can Take Against Cyberattacks](https://www.sentinelone.com/blog/top-8-defenses-msps-can-take-against-cyberattacks/) -- Reverse Engineering - - [API Monitor32 - Detecting Windows API hooking and modification for analysis purposes](https://www.reddit.com/r/ReverseEngineering/comments/xwbrr3/api_monitor32_detecting_windows_api_hooking_and/) - - [Deliver a Strike by Reversing a Badger: Brute Ratel Detection and Analysis](https://www.reddit.com/r/ReverseEngineering/comments/xw89a5/deliver_a_strike_by_reversing_a_badger_brute/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-10-04 - HTML smuggling --> IcedID (Bokbot) --> Cobalt Strike](https://www.malware-traffic-analysis.net/2022/10/04/index.html) -- blog.avast.com EN - - [Defending digital freedom in times of cyberwar](https://blog.avast.com/digital-freedom-cyberwar) -- Application Security Blog - - [CyRC Vulnerability Advisory: CVE-2022-39064 IKEA TRÅDFRI smart lighting](https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting/) - - [CyRC Vulnerability Advisory: CVE-2022-39065 IKEA TRÅDFRI smart lighting gateway](https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting-gateway/) -- The Daily Swig | Cybersecurity news and views - - [PHP package manager component Packagist vulnerable to compromise](https://portswigger.net/daily-swig/php-package-manager-component-packagist-vulnerable-to-compromise) -- Malwarebytes Labs - - [Admin from hell facing 10 years for sabotaging ex-employer's network](https://www.malwarebytes.com/blog/news/2022/10/ex-employee-faces-10-years-in-prison-for-misusing-login-details) - - [Bogus job offers hide trojanised open-source software](https://www.malwarebytes.com/blog/news/2022/10/bogus-job-offers-lead-to-weaponised-open-source-software) - - [Kim Kardashian gets huge fine for crypto ad](https://www.malwarebytes.com/blog/news/2022/10/kim-kardashian-violates-1933-law-after-posting-emex-crypto-security-ad) -- KitPloit - PenTest & Hacking Tools - - [Erlik 2 - Vulnerable-Flask-App](http://www.kitploit.com/2022/10/erlik-2-vulnerable-flask-app.html) -- rtl-sdr.com - - [TechMinds: A Look at the TRX DUO Red Pitaya Clone](https://www.rtl-sdr.com/techminds-a-look-at-the-trx-duo-red-pitaya-clone/) - - [HackRF Opera Cake Released: A Rapid RF Switching Board](https://www.rtl-sdr.com/hackrf-opera-cake-released-a-rapid-rf-switching-board/) -- Black Hills Information Security - - [Talkin’ About Infosec News – 10/5/2022](https://www.blackhillsinfosec.com/talkin-about-infosec-news-10-5-2022/) -- Intigriti - - [Bug Bytes #176 – Deepfake dangers, @rhynorater’s SSRF magic, recon techniques everyone misses & more!](https://blog.intigriti.com/2022/10/05/bug-bytes-176/) -- 奇客Solidot–传递最新科技情报 - - [卡巴斯基发现通过 YouTube 频道传播的恶意 Tor 浏览器](https://www.solidot.org/story?sid=72968) - - [美国政府发布 AI 指导方针](https://www.solidot.org/story?sid=72966) - - [VideoLAN 威胁起诉印度政府](https://www.solidot.org/story?sid=72965) - - [三位化学家获诺贝尔化学奖，其中一位第二次获奖](https://www.solidot.org/story?sid=72964) - - [马斯克提议按原提议收购 Twitter](https://www.solidot.org/story?sid=72963) -- Checkmarx.com - - [API Security: Exposed API Endpoint Leaks Over 11 Million Telco Customers’ Data](https://checkmarx.com/blog/api-security-exposed-api-endpoint-leaks-over-11-million-telco-customers-data/) -- PeiQi文库 - - [GLPI htmLawedTest.php 远程命令执行漏洞 CVE-2022-35914](https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247493588&idx=1&sn=99c7a429bb57cb121f8c871814cea3d5&chksm=cecc4f8df9bbc69b5f5234417c06e2379a38490660699f9c5e6b9eabec241d3f8ec711b64556&scene=58&subscene=0#rd) -- 极客公园 - - [马斯克提议按原价收购推特；欧盟批准强制苹果使用 USB-C 接口；AI 激光灭蟑设备问世 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969521&idx=1&sn=9dadeef31dc3059f43698d18233efd02&chksm=7e5467874923ee91c76bb76153a9668ddec2c3cb1c7d8f75b7b9f64a0547c20b0615c67b3471&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [谷歌和微软可通过Web浏览器的拼写检查功能获取你的密码](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551721&idx=1&sn=e355eb542764eed56ff6db3dfad30ca9&chksm=e915dad3de6253c5e63f2f5f63980f4bd4a01bb29fe8220704a309c9f7a3e15ef76c7dcd78e8&scene=58&subscene=0#rd) - - [通过第三方软件收集用户凭据](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551721&idx=2&sn=214eef1a9aaa7318715e01c6c1af1059&chksm=e915dad3de6253c5c0f506ceaadea65e886fdda04a7c4a4439683977c6460b4d35a9ced9413a&scene=58&subscene=0#rd) -- 情报分析师 - - [国土安全部2022-2026年参与和信息共享战略](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517864&idx=1&sn=dea8c650d654465af35123333cae6103&chksm=87169f23b0611635dd3de06814927a523292ec8bfaf89e8ca5f9e061422d9af51657339456da&scene=58&subscene=0#rd) - - [【情报课堂】乌克兰马里乌波尔的士兵地理定位](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650517864&idx=2&sn=ac6ae85d87fe89ad58ea2c7a5dccac73&chksm=87169f23b0611635f2bd25a9860ca3b970267f947d9b9bea4e3c19fdce0f715a6197bb4da3e6&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-07.md b/archive/2022/2022-10-07.md deleted file mode 100644 index 9be657268a..0000000000 --- a/archive/2022/2022-10-07.md +++ /dev/null @@ -1,136 +0,0 @@ -# 每日安全资讯（2022-10-07） - -- Jiajun的编程随想 - - [ElasticSearch 学习笔记](https://jiajunhuang.com/articles/2022_10_06-elasticsearch.md.html) -- Security Boulevard - - [What Is Container Security, and How Can You Boost Yours?](https://securityboulevard.com/2022/10/what-is-container-security-and-how-can-you-boost-yours/) - - [The Black Market to Avoid Putin’s Mobilization Order Is Booming](https://securityboulevard.com/2022/10/the-black-market-to-avoid-putins-mobilization-order-is-booming/) - - [Automating Supply Chain Integrity](https://securityboulevard.com/2022/10/automating-supply-chain-integrity/) - - [Frontline Pen Test Datasheet](https://securityboulevard.com/2022/10/frontline-pen-test-datasheet/) - - [The FBI, CISA and MS-ISAC on Ransomware in School Districts: What’s Happening and How to Respond](https://securityboulevard.com/2022/10/the-fbi-cisa-and-ms-isac-on-ransomware-in-school-districts-whats-happening-and-how-to-respond/) - - [BSidesLV 2022 Lucky13 GroundFloor – Blue Hephaestus’ ‘Automating Data Recovery And Digital Forensics’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundfloor-blue-hephaestus-automating-data-recovery-and-digital-forensics/) - - [How Dynamic Authorization Enables a Zero Trust Architecture](https://securityboulevard.com/2022/10/how-dynamic-authorization-enables-a-zero-trust-architecture/) - - [Higher Education is a Growing Target for Threat Actors](https://securityboulevard.com/2022/10/higher-education-is-a-growing-target-for-threat-actors/) - - [Visa Sees Digital Payment Threats Evolving Post-Pandemic](https://securityboulevard.com/2022/10/visa-sees-digital-payment-threats-evolving-post-pandemic/) - - [XKCD ‘Quantified Self’](https://securityboulevard.com/2022/10/xkcd-quantified-self/) -- Microsoft Security Blog - - [Microsoft publishes new report on holistic insider risk management](https://www.microsoft.com/security/blog/2022/10/06/microsoft-publishes-new-report-on-holistic-insider-risk-management/) -- Sploitus.com Exploits RSS Feed - - [Joomla JoomBri Careers 3.3.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168641&utm_source=rss&utm_medium=rss) - - [Ubuntu 22.04.1 X64 Desktop Enlightenment 0.25.3-1 Privilege Escalation Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38031&utm_source=rss&utm_medium=rss) - - [Canteen Management 1.0 2022 - XSS Reflected Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38030&utm_source=rss&utm_medium=rss) - - [Joomla JoomBri Freelance 4.5.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168636&utm_source=rss&utm_medium=rss) - - [Wordpress Zephyr Project Manager 3.2.42 Plugin - Multiple SQL injection Vulnerabilities exploit](https://sploitus.com/exploit?id=1337DAY-ID-38029&utm_source=rss&utm_medium=rss) - - [Joomla KSAdvertiser 2.5.37 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168648&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Privilege Management in Microsoft exploit](https://sploitus.com/exploit?id=CF3485E1-2E99-580B-BC50-D61EA587BA40&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=553EF29F-6CB4-5F8F-91AD-85FC945A94E0&utm_source=rss&utm_medium=rss) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-6820-01](https://packetstormsecurity.com/files/168651/RHSA-2022-6820-01.txt) - - [Ubuntu Security Notice USN-5659-1](https://packetstormsecurity.com/files/168650/USN-5659-1.txt) - - [Ubuntu Security Notice USN-5660-1](https://packetstormsecurity.com/files/168649/USN-5660-1.txt) - - [Joomla KSAdvertiser 2.5.37 Cross Site Scripting](https://packetstormsecurity.com/files/168648/joomlaksadvertiser2537-xss.txt) - - [Red Hat Security Advisory 2022-6757-01](https://packetstormsecurity.com/files/168647/RHSA-2022-6757-01.txt) - - [Red Hat Security Advisory 2022-6819-01](https://packetstormsecurity.com/files/168646/RHSA-2022-6819-01.txt) - - [Linux 3.19 anon_vma Use-After-Free](https://packetstormsecurity.com/files/168645/GS20221006124106.tgz) - - [Ubuntu Security Notice USN-5658-1](https://packetstormsecurity.com/files/168644/USN-5658-1.txt) - - [Red Hat Security Advisory 2022-6821-01](https://packetstormsecurity.com/files/168643/RHSA-2022-6821-01.txt) - - [Red Hat Security Advisory 2022-6823-01](https://packetstormsecurity.com/files/168642/RHSA-2022-6823-01.txt) - - [Joomla JoomBri Careers 3.3.0 Cross Site Scripting](https://packetstormsecurity.com/files/168641/joomlajoombricareers330-xss.txt) - - [Red Hat Security Advisory 2022-6822-01](https://packetstormsecurity.com/files/168640/RHSA-2022-6822-01.txt) - - [Red Hat Security Advisory 2022-6825-01](https://packetstormsecurity.com/files/168639/RHSA-2022-6825-01.txt) - - [Red Hat Security Advisory 2022-6813-01](https://packetstormsecurity.com/files/168638/RHSA-2022-6813-01.txt) - - [Red Hat Security Advisory 2022-6815-01](https://packetstormsecurity.com/files/168637/RHSA-2022-6815-01.txt) - - [Joomla JoomBri Freelance 4.5.0 Cross Site Scripting](https://packetstormsecurity.com/files/168636/joomlajoombrifreelance450-xss.txt) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [恶意的攻击对旅行者带来了很多问题](https://www.4hou.com/posts/r77E) - - [Google Play和Apple Store惊现下载量达1300万人次的广告软件](https://www.4hou.com/posts/GK2y) -- unSafe.sh - 不安全 - - [Hundreds of Microsoft SQL servers found to be backdoored](https://buaq.net/go-129491.html) - - [Data Access Agreement offers a new path for UK - US data requests](https://buaq.net/go-129492.html) - - [Gambaru To Run](https://buaq.net/go-129464.html) - - [IT工具知识-04：如何在VS中用ILMerge真正一键自动合并exe和dll，不需要每次敲击命令行，也不需要用鼠标操作GUI！！！ - ErgoCogito - 博客园](https://buaq.net/go-129463.html) - - [C＃ 将dll打包到程序中](https://buaq.net/go-129462.html) - - [WordPress Security](https://buaq.net/go-129466.html) - - [Bugcrowd — Tale of multiple misconfigurations!! ❌](https://buaq.net/go-129467.html) - - [Building Blocks For Your XDR Journey, Part 1 | Extending Beyond the Endpoint](https://buaq.net/go-129469.html) - - [Penetration Testing – What’s New in the PCI DSS v4.0](https://buaq.net/go-129468.html) - - [Cyberstalking, pig masks, and cockroaches: Former eBay execs are sentenced](https://buaq.net/go-129493.html) - - [Inside the James Webb Attack Image](https://buaq.net/go-129465.html) -- 微风的网络日志 - - [Gambaru To Run](http://leybreeze.com/blog/?p=219849) -- Sucuri Blog - - [What is a Malware Attack?](https://blog.sucuri.net/2022/10/what-is-a-malware-attack.html) -- Recent Commits to cve:main - - [Update Thu Oct 6 10:20:18 UTC 2022](https://github.com/trickest/cve/commit/87cf637954409523b845c99316fffb30c344e335) -- Forcepoint - - [Inside the James Webb Attack Image](https://www.forcepoint.com/blog/x-labs/inside-james-webb-attack-image) -- Securelist - - [A look at the 2020–2022 ATM/PoS malware landscape](https://securelist.com/atm-pos-malware-landscape-2020-2022/107656/) -- Bug Bounty in InfoSec Write-ups on Medium - - [WordPress Security](https://infosecwriteups.com/wordpress-security-c8ea1891bd51?source=rss----7b722bfd1b8d--bug_bounty) - - [Bugcrowd — Tale of multiple misconfigurations!! ❌](https://infosecwriteups.com/bugcrowd-tale-of-multiple-misconfigurations-cb5b98f09302?source=rss----7b722bfd1b8d--bug_bounty) - - [Hacking the WordPress sites for fun and profit | Part-1 [ Water ]](https://infosecwriteups.com/hacking-the-wordpress-sites-for-fun-and-profit-part-1-water-7ba474ced0f8?source=rss----7b722bfd1b8d--bug_bounty) - - [How to properly enforce authorization](https://infosecwriteups.com/how-to-properly-enforce-authorization-65dc62d21745?source=rss----7b722bfd1b8d--bug_bounty) - - [The Day I End-Up finding that Critical Database Info leaking on CM Cell(TN) Application](https://infosecwriteups.com/the-day-i-end-up-finding-that-critical-database-info-leaking-on-cm-cell-tn-application-b6c126687f13?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [Fiori Design System](https://blogs.sap.com/2022/10/06/fiori-design-system/) - - [Export the Analytic Application to PDF](https://blogs.sap.com/2022/10/06/export-the-analytic-application-to-pdf/) - - [How to check available migration objects based on version and migration approach?](https://blogs.sap.com/2022/10/06/how-to-check-available-migration-objects-based-on-version-and-migration-approach/) - - [PILS Partner Meet-Up EMEA – SAP Industry Cloud – Program benefits and pre-requisites](https://blogs.sap.com/2022/10/06/pils-partner-meet-up-emea-sap-industry-cloud-program-benefits-and-pre-requisites/) - - [SAP HANA Cloud, Data Lake Relational Engine on Object Storage](https://blogs.sap.com/2022/10/06/sap-hana-cloud-data-lake-relational-engine-on-object-storage/) - - [Territory Management in SAP Sales and Service Cloud (C4C)](https://blogs.sap.com/2022/10/06/territory-management-in-sap-sales-and-service-cloud-c4c/) - - [New Release: SAP Advanced Data Migration and Management by Syniti](https://blogs.sap.com/2022/10/06/new-release-sap-advanced-data-migration-and-management-by-syniti/) - - [SAP MDG for Retail](https://blogs.sap.com/2022/10/06/sap-mdg-for-retail/) - - [Auditing Solution Update for SAP BusinessObjects BI Platform 4.3 +](https://blogs.sap.com/2022/10/06/auditing-solution-update-for-sap-businessobjects-bi-platform-4.3/) - - [“SAP Portal & New-Generation Products” Trivia Summer Quiz 2022: and the winners are…](https://blogs.sap.com/2022/10/06/sap-portal-new-generation-products-trivia-summer-quiz-2022-and-the-winners-are.../) -- GuidePoint Security - - [Penetration Testing – What’s New in the PCI DSS v4.0](https://www.guidepointsecurity.com/blog/penetration-testing-whats-new-in-the-pci-dss-v4-0/) -- SpiderLabs Blog from Trustwave - - [HTML File Attachments: Still A Threat](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/html-file-attachments-still-a-threat/) -- Twitter @Nicolas Krassas - - [US govt shares top flaws exploited by Chinese hackers since 2020](https://twitter.com/Dinosn/status/1578100559797592064) - - [Re @PinkDraconian Always at the bottom, there is no other place other options are wrong!](https://twitter.com/Dinosn/status/1578095439127134208) - - [Iranian Hackers Spreading RatMilad Android Spyware Disguised as VPN App](https://twitter.com/Dinosn/status/1578091049465020416) - - [Piercing The Veil](https://twitter.com/Dinosn/status/1578087656847994880) - - [Meta sues app dev for stealing over 1 million WhatsApp accounts](https://twitter.com/Dinosn/status/1578087564451389440) - - [Zelle Fraud Is On The Rise And Many Victims Are Denied Refunds](https://twitter.com/Dinosn/status/1578086863792898059) - - [Microsoft publishes new report on holistic insider risk management](https://twitter.com/Dinosn/status/1578086787553034286) - - [RT EvilPenguin:](https://twitter.com/EvilPenguin_/status/1578086421348249602) - - [Bhinneka - 1,274,340 breached accounts](https://twitter.com/Dinosn/status/1578084377635995652) - - [Eternity Group Hackers Offering New LilithBot Malware as a Service to Cybercriminals](https://twitter.com/Dinosn/status/1578084094788997123) - - [Linux Kernel 5.19.12 bug could damage Intel laptop displays](https://twitter.com/Dinosn/status/1578084074824077312) - - [RT reverseame: Process injection: breaking all macOS security layers with a single vulnerability](https://twitter.com/reverseame/status/1577996442794336256) - - [wodat: Windows Oracle Database Attack Toolkit](https://twitter.com/Dinosn/status/1577983228631142400) - - [Releasing GitFive - Track down GitHub users by doing advanced investigation (usernames history, names variations, links between multiple identities, a...](https://twitter.com/Dinosn/status/1577983049924493313) - - [CVE-2022-41343 - RCE via Phar Deserialisation (Dompdf)](https://twitter.com/Dinosn/status/1577982824036147209) - - [CVE-2022-25748: Critical Vulnerability in Qualcomm Chips Affects Billions of Devices](https://twitter.com/Dinosn/status/1577982718641594370) - - [Police arrest teen for using leaked Optus data to extort victims](https://twitter.com/Dinosn/status/1577982570918289410) - - [CVE Collection of jQuery UI XSS Payloads](https://twitter.com/Dinosn/status/1577895131847458819) - - [goverview - Get an overview of the list of URLs](https://twitter.com/Dinosn/status/1577894794176733187) -- blog.avast.com EN - - [10 blind spots in your SMB’s cyber defense](https://blog.avast.com/blind-spots-cyber-defense) - - [BeReal has some major privacy issues](https://blog.avast.com/bereal-safety) -- Sucuri Blog - - [What is a Malware Attack?](https://blog.sucuri.net/2022/10/what-is-a-malware-attack.html) -- Malwarebytes Labs - - [Hundreds of Microsoft SQL servers found to be backdoored](https://www.malwarebytes.com/blog/news/2022/10/hundreds-of-microsoft-sql-servers-found-to-be-backdoored) - - [Data Access Agreement offers a new path for UK - US data requests](https://www.malwarebytes.com/blog/news/2022/10/data-access-agreement-offers-a-new-path-for-uk-us-data-requests) - - [Cyberstalking, pig masks, and cockroaches: Former eBay execs are sentenced](https://www.malwarebytes.com/blog/news/2022/10/cyberstalking-pig-masks-and-cockroaches-former-ebay-execs-are-sentenced) - - [BOD 23-01: Improving asset visibility and vulnerability detection on federal networks](https://www.malwarebytes.com/blog/news/2022/10/improving-asset-visibility-and-vulnerability-detection-on-federal-networks) -- SentinelOne - - [Building Blocks For Your XDR Journey, Part 1 | Extending Beyond the Endpoint](https://www.sentinelone.com/blog/building-blocks-for-your-xdr-journey-part-1-extending-beyond-the-endpoint/) -- The Daily Swig | Cybersecurity news and views - - [Dex patches authentication bug that enabled unauthorized access to client applications](https://portswigger.net/daily-swig/dex-patches-authentication-bug-that-enabled-unauthorized-access-to-client-applications) - - [The exploitability advisory: CISA’s VEX offers fresh take on tackling known vulnerabilities](https://portswigger.net/daily-swig/the-exploitability-advisory-cisas-vex-offers-fresh-take-on-tackling-known-vulnerabilities) -- KitPloit - PenTest & Hacking Tools - - [Arsenal - Recon Tool installer](http://www.kitploit.com/2022/10/arsenal-recon-tool-installer.html) -- r2c website - - [Fully loaded: testing vulnerable PyYAML versions](https://r2c.dev/blog/2022/testing-vulnerable-pyyaml-versions/) -- 奇客Solidot–传递最新科技情报 - - [运行在 Linux 5.19.12 之上的英特尔集显可能会破坏显示器](https://www.solidot.org/story?sid=72973) - - [Linux 6.1 合并补丁加入对 Rust 的初步支持](https://www.solidot.org/story?sid=72972) - - [马斯克 和 Twitter 在收购条款上存在分歧](https://www.solidot.org/story?sid=72971) - - [苹果据报同意台积电的芯片价格上涨](https://www.solidot.org/story?sid=72970) - - [点击化学是个糟糕的翻译](https://www.solidot.org/story?sid=72969) -- 杨龙 - - [RabbitMQ的消息未确认和多次确认问题](https://www.yanglong.pro/rabbitmq%e7%9a%84%e6%b6%88%e6%81%af%e6%9c%aa%e7%a1%ae%e8%ae%a4%e5%92%8c%e5%a4%9a%e6%ac%a1%e7%a1%ae%e8%ae%a4%e9%97%ae%e9%a2%98/) diff --git a/archive/2022/2022-10-08.md b/archive/2022/2022-10-08.md deleted file mode 100644 index 650a2ccf51..0000000000 --- a/archive/2022/2022-10-08.md +++ /dev/null @@ -1,145 +0,0 @@ -# 每日安全资讯（2022-10-08） - -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-6838-01](https://packetstormsecurity.com/files/168663/RHSA-2022-6838-01.txt) - - [Red Hat Security Advisory 2022-6839-01](https://packetstormsecurity.com/files/168662/RHSA-2022-6839-01.txt) - - [Red Hat Security Advisory 2022-6850-01](https://packetstormsecurity.com/files/168661/RHSA-2022-6850-01.txt) - - [Red Hat Security Advisory 2022-6831-01](https://packetstormsecurity.com/files/168660/RHSA-2022-6831-01.txt) - - [Red Hat Security Advisory 2022-6832-01](https://packetstormsecurity.com/files/168659/RHSA-2022-6832-01.txt) - - [Red Hat Security Advisory 2022-6834-01](https://packetstormsecurity.com/files/168658/RHSA-2022-6834-01.txt) - - [Red Hat Security Advisory 2022-6835-01](https://packetstormsecurity.com/files/168657/RHSA-2022-6835-01.txt) - - [Red Hat Security Advisory 2022-6833-01](https://packetstormsecurity.com/files/168656/RHSA-2022-6833-01.txt) - - [Ubuntu Security Notice USN-5661-1](https://packetstormsecurity.com/files/168655/USN-5661-1.txt) - - [Hashicorp Boundary Clickjacking](https://packetstormsecurity.com/files/168654/hashicorpboundary-clickjack.txt) - - [Joomla Vik Booking 1.15.0 Cross Site Scripting](https://packetstormsecurity.com/files/168653/joomlavikbooking1150-xss.txt) - - [WordPress Zephyr Project Manager 3.2.42 SQL Injection](https://packetstormsecurity.com/files/168652/wpzephyrpm3242-sql.txt) -- Security Boulevard - - [Analysis of CISA releases Advisory on Top CVEs Exploited Chinese State-Sponsored Groups](https://securityboulevard.com/2022/10/analysis-of-cisa-releases-advisory-on-top-cves-exploited-chinese-state-sponsored-groups/) - - [Data ASaaSsins: Threats That Can Cause Data Loss and Hurt Your Business](https://securityboulevard.com/2022/10/data-asaassins-threats-that-can-cause-data-loss-and-hurt-your-business/) - - [This Week in Malware – Over 100 Packages Discovered](https://securityboulevard.com/2022/10/this-week-in-malware-over-100-packages-discovered/) - - [How to Improve Okta Security](https://securityboulevard.com/2022/10/how-to-improve-okta-security/) - - [BSidesLV 2022 Lucky13 GroundFloor – Cheryl Biswas’ ‘Code Dependency: Chinese APTs In Software Supply Chain Attacks’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundfloor-cheryl-biswas-code-dependency-chinese-apts-in-software-supply-chain-attacks/) - - [Report: Big U.S. Banks Are Stiffing Account Takeover Victims](https://securityboulevard.com/2022/10/report-big-u-s-banks-are-stiffing-account-takeover-victims/) - - [What We Know About the Zero-Day Vulnerability Affecting Zimbra Collaboration and cpio](https://securityboulevard.com/2022/10/what-we-know-about-the-zero-day-vulnerability-affecting-zimbra-collaboration-and-cpio/) - - [XKCD ‘Battery Life’](https://securityboulevard.com/2022/10/xkcd-battery-life/) - - [NSA announces new Post-Quantum resistant algorithm Suite 2.0 and Transition Timetable](https://securityboulevard.com/2022/10/nsa-announces-new-post-quantum-resistant-algorithm-suite-2-0-and-transition-timetable/) - - [Hacker Paige Thompson is FREE (‘Because Transgender Status and Mental Health Issues’)](https://securityboulevard.com/2022/10/paige-thompson-free-transgender-mental-health-richixbw/) -- Sploitus.com Exploits RSS Feed - - [WordPress Zephyr Project Manager 3.2.42 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168652&utm_source=rss&utm_medium=rss) - - [Joomla Vik Booking 1.15.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168653&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Forgerock Openam exploit](https://sploitus.com/exploit?id=247D8848-0864-5E40-BB19-1B04B408E896&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=940BBB90-C055-5DBF-9C23-3CC67D2D239E&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-10-07 Review](http://www.sec-wiki.com/?2022-10-07) -- Tenable Blog - - [Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)](https://www.tenable.com/blog/cisa-top-20-cves-exploited-peoples-republic-of-china-state-sponsored-actors-aa22-279a) - - [CVE-2022-40684: Critical Authentication Bypass in FortiOS and FortiProxy](https://www.tenable.com/blog/cve-2022-40684-critical-authentication-bypass-in-fortios-and-fortiproxy) - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-oct-7) -- Recent Commits to cve:main - - [Update Fri Oct 7 10:11:05 UTC 2022](https://github.com/trickest/cve/commit/08ec09de09a68d252c0d39f9214e5e614d7a765f) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors](https://blog.qualys.com/category/vulnerabilities-threat-research) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [互联网的可怕未来：创新技术构成更大的网络安全威胁](https://www.4hou.com/posts/JX2D) -- ArthurChiao's Blog - - [[译] 流量控制（TC）五十年：从基于缓冲队列（Queue）到基于时间戳（EDT）的演进（Google, 2018）](https://arthurchiao.github.io/blog/traffic-control-from-queue-to-edt-zh/) -- Twitter @Nicolas Krassas - - [Arsenal - Recon Tool installer](https://twitter.com/Dinosn/status/1578436925543034880) - - [Cloudfox - Automating Situational Awareness For Cloud Penetration Tests](https://twitter.com/Dinosn/status/1578429293784227847) - - [LofyGang Uses 100s of Malicious NPM Packages to Poison Open Source Software](https://twitter.com/Dinosn/status/1578423205311963136) - - [Fortinet urges customers to immediately fix a critical authentication bypass flaw in FortiGate and FortiProxy](https://twitter.com/Dinosn/status/1578399342032977921) - - [Hackers exploiting unpatched RCE bug in Zimbra Collaboration Suite](https://twitter.com/Dinosn/status/1578399315642425346) - - [Feds Ink $26 Million Contract For Deception Platform For Defense](https://twitter.com/Dinosn/status/1578399260512583680) - - [Biden Signs Order For EU - U.S. Data Privacy Framework](https://twitter.com/Dinosn/status/1578399196658425863) - - [Fortinet warns admins to patch critical auth bypass bug immediately](https://twitter.com/Dinosn/status/1578377124871815172) - - [LofyGang hackers built a credential-stealing enterprise on Discord, NPM](https://twitter.com/Dinosn/status/1578376991107153920) - - [Spyware Maker Intellexa Sued by Journalist](https://twitter.com/Dinosn/status/1578350946492436482) - - [RT Panagiotis Chartas: Using the newly published tool "eviltree" against a (retired) @hackthebox_eu machine during priv esc to instantly discover cred...](https://twitter.com/t3l3machus/status/1578338978738020352) - - [Hackers Can Use 'App Mode' in Chromium Browsers' for Stealth Phishing Attacks](https://twitter.com/Dinosn/status/1578336995226841089) - - [popeye: Kubernetes cluster resource sanitizer](https://twitter.com/Dinosn/status/1578302529326448640) - - [South Korea cancels passport of Terraform Lab's Do Kwon](https://twitter.com/Dinosn/status/1578302487097810944) - - [RT cts (we are hiring!): An easy-to-understand breakdown of today's Binance Bridge hack.](https://twitter.com/gf_256/status/1578258553357275136) - - [Russian Hackers Shut Down US State Government Websites](https://twitter.com/Dinosn/status/1578253324549124096) - - [Papa John's sued for 'wiretap' spying on website mouse clicks, keystrokes](https://twitter.com/Dinosn/status/1578253278168551424) - - [Huge nonprofit hospital network suffers IT meltdown after 'security incident'](https://twitter.com/Dinosn/status/1578252783760936962) - - [Uncovering a Fake Recruiter Scam with OSINT techniques](https://twitter.com/Dinosn/status/1578252736302264326) -- unSafe.sh - 不安全 - - [[原创]shellccode注入c#DLL到非托管程序-编程技术-看雪论坛-安全社区|安全招聘|bbs.pediy.com](https://buaq.net/go-129554.html) - - [Robocalls: FCC cracks the whip](https://buaq.net/go-129555.html) - - [FreeBuf早报 | 英国首相个人手机号遭曝光；丰田道歉：约296000条客户信息被泄露](https://buaq.net/go-129599.html) - - [态势感知的前世今生（之一）](https://buaq.net/go-129544.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 41](https://buaq.net/go-129545.html) - - [ETH-Account-Cracking-2.0](https://buaq.net/go-129552.html) - - [collision-webshell](https://buaq.net/go-129553.html) - - [Cloudfox - Automating Situational Awareness For Cloud Penetration Tests](https://buaq.net/go-129546.html) - - [Malwarebytes' modernized bug bounty program—here's all you need to know](https://buaq.net/go-129602.html) - - [TOP 10 unattributed APT mysteries](https://buaq.net/go-129541.html) - - [没人敢用这个吧，但是挺酷的](https://buaq.net/go-129571.html) -- 安全小飞侠的窝 - - [态势感知的前世今生（之一）](http://avfisher.win/archives/1355) -- Securelist - - [TOP 10 unattributed APT mysteries](https://securelist.com/top-10-unattributed-apt-mysteries/107676/) -- blog.avast.com EN - - [Robocalls: FCC cracks the whip](https://blog.avast.com/fcc-carriers-robocalls) -- SAP Blogs - - [QR-Bill Data in Create Supplier Invoice](https://blogs.sap.com/2022/10/07/qr-bill-data-in-create-supplier-invoice/) - - [QR-bill for non-Swiss and non-Lichtenstein Company Codes](https://blogs.sap.com/2022/10/07/qr-bill-for-non-swiss-and-non-lichtenstein-company-codes/) - - [Disclosure Management – ESEF and embedded images](https://blogs.sap.com/2022/10/07/disclosure-management-esef-and-embedded-images/) - - [Data migration from SAP S/4HANA Cloud and SAP HANA Smart Data Integration](https://blogs.sap.com/2022/10/07/data-migration-from-sap-s-4hana-cloud-and-sap-hana-smart-data-integration/) - - [HA/DR Architecture on SAP Shared File system on Windows in Azure Cloud](https://blogs.sap.com/2022/10/07/ha-dr-architecture-on-sap-shared-file-system-on-windows-in-azure-cloud/) - - [Log Analysis for the Standard Framework of Situation Handling](https://blogs.sap.com/2022/10/07/log-analysis-for-the-standard-framework-of-situation-handling/) - - [Create a CDS view with joins using eclipse](https://blogs.sap.com/2022/10/07/create-a-cds-view-with-joins-using-eclipse/) - - [Google Ads Integration with SAP Marketing Cloud or SAP Marketing – Integration package update to version 3.1.0](https://blogs.sap.com/2022/10/07/google-ads-integration-with-sap-marketing-cloud-or-sap-marketing-integration-package-update-to-version-3.1.0/) - - [Faith at Work: How Top Performing Companies Measure Up](https://blogs.sap.com/2022/10/07/faith-at-work-how-top-performing-companies-measure-up/) - - [Ingredients of Good Design](https://blogs.sap.com/2022/10/07/ingredients-of-good-design/) -- Didier Stevens - - [Overview of Content Published in September](https://blog.didierstevens.com/2022/10/07/overview-of-content-published-in-september-6/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 41](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-41-4/) -- Hex Rays - - [Igor’s tip of the week #109: Hex view text encoding](https://hex-rays.com/blog/igors-tip-of-the-week-109-hex-view-text-encoding/) - - [IDA 8.1 released](https://hex-rays.com/blog/ida-8-1-released/) -- Malwarebytes Labs - - [Romance scammer given 25 years of alone time](https://www.malwarebytes.com/blog/news/2022/10/romance-and-business-email-compromise-scammer-given-25-years-of-alone-time) - - [Malwarebytes' modernized bug bounty program—here's all you need to know](https://www.malwarebytes.com/blog/business/2022/10/malwarebytes-bugbounty-modernized-why-how-where) - - [Android vulnerabilities could allow arbitrary code execution](https://www.malwarebytes.com/blog/news/2022/10/vulnerabilities-in-google-android-could-allow-for-arbitrary-code-execution) -- 学习路 - - [详细谈谈CVE的申请过程](https://4ra1n.love/post/kW122qsMs/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-10-06 - HTML smuggling --> IcedID (Bokbot) --> Cobalt Strike](https://www.malware-traffic-analysis.net/2022/10/06/index.html) -- The Daily Swig | Cybersecurity news and views - - [Policy-as-code approach counters ‘cloud native’ security risks](https://portswigger.net/daily-swig/policy-as-code-approach-counters-cloud-native-security-risks) - - [Critical flaw in open source WebPageTest remains unpatched](https://portswigger.net/daily-swig/critical-flaw-in-open-source-webpagetest-remains-unpatched) -- KitPloit - PenTest & Hacking Tools - - [Cloudfox - Automating Situational Awareness For Cloud Penetration Tests](http://www.kitploit.com/2022/10/cloudfox-automating-situational.html) - - [Parrot 5.1 - Security GNU/Linux Distribution Designed with Cloud Pentesting and IoT Security in Mind](http://www.kitploit.com/2022/10/parrot-51-security-gnulinux.html) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 英国首相个人手机号遭曝光；丰田道歉：约296000条客户信息被泄露](https://www.freebuf.com/news/346189.html) -- 杨龙 - - [性能优化之批量处理数据](https://www.yanglong.pro/%e6%80%a7%e8%83%bd%e4%bc%98%e5%8c%96%e4%b9%8b%e6%89%b9%e9%87%8f%e5%a4%84%e7%90%86%e6%95%b0%e6%8d%ae/) - - [分布式ID生成](https://www.yanglong.pro/%e5%88%86%e5%b8%83%e5%bc%8fid%e7%94%9f%e6%88%90/) - - [ddns](https://www.yanglong.pro/ddns/) - - [wget: not an http or ftp url:](https://www.yanglong.pro/wget-not-an-http-or-ftp-url/) - - [redo log 和 bin log](https://www.yanglong.pro/2735-2/) -- 奇客Solidot–传递最新科技情报 - - [英伟达开源内核驱动是否带来了改变？](https://www.solidot.org/story?sid=72977) - - [政治立场如何影响新冠死亡率](https://www.solidot.org/story?sid=72976) - - [记者卢宇光被指发布虚假信息](https://www.solidot.org/story?sid=72974) -- 看雪学院 - - [2022 SDC 议题 | 国产智能网联汽车漏洞挖掘中的几个突破点](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473853&idx=1&sn=cc6c0e7d75f02b4b34edad2bd0525349&chksm=b18e65f786f9ece19e09b9e261ff88f235ba67ffb4045b5e66669bcdc70a6ca550edd5e96ba9&scene=58&subscene=0#rd) - - [进程 Dump & PE unpacking & IAT 修复 - Windows 篇](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473853&idx=2&sn=8fd4d2448cc087a58348422ec5c8e04b&chksm=b18e65f786f9ece1d9240bff1ebf9bc5bb25edabf0237ccfabe07642e94ea288b10c5f73b10d&scene=58&subscene=0#rd) - - [LLVM与代码混淆技术，详解3种经典代码混淆方式+2种变体](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458473853&idx=3&sn=1536601278788f3efd02ebffbae46098&chksm=b18e65f786f9ece1cf051db536f70c45e6782d4d8019008c529b6ae25fc62849f688c5eac603&scene=58&subscene=0#rd) -- Checkmarx.com - - [LofyGang – Software Supply Chain Attackers; Organized, Persistent, and Operating for over a Year](https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organized-persistent-and-operating-for-over-a-year/) -- 我的安全梦 - - [关于漏洞是如何被攻击者利用的话题](https://mp.weixin.qq.com/s?__biz=MzU3NDY1NTYyOQ==&mid=2247485384&idx=1&sn=4980e406a1a4af62d67dfc46bccbd70a&chksm=fd2e5a2aca59d33c98fe0836d9c17cae12f728ef127472bc560107292a82223d9a2f6905f778&scene=58&subscene=0#rd) -- 君哥的体历 - - [疑似4000W短信数据泄露、多家等保测评机构被处理事情的探讨，关于美国NSA攻击西工大事件最新进展的深度讨论 | 总第167周](https://mp.weixin.qq.com/s?__biz=MzI2MjQ1NTA4MA==&mid=2247488923&idx=1&sn=6a6aeca4a8203e2f7929d606ebbb226f&chksm=ea4bbfdcdd3c36cae179f806768b49c4c28c7867b5b14d165d99d6a4d615d483519e06957e30&scene=58&subscene=0#rd) -- 情报分析师 - - [【情报资料】联合出版物《英国空间力量》104页](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518120&idx=1&sn=cb92f6694c83bcb2b9c270f683e8da43&chksm=87169c23b061153534a0f5cd06aa2b606b35890cb4d11d00eea51a03c0c1c351277ea5b6b96e&scene=58&subscene=0#rd) - - [【情报技巧】警方使用的10种审讯技巧](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518120&idx=2&sn=a5806969493989eb77f3e4576fc8d17e&chksm=87169c23b0611535f2e393c9b445ebfc2d0e9b1e1c663014dcdd9ed68a7f70f1a048a6a027e0&scene=58&subscene=0#rd) - - [【情报课堂】使用NASA火灾数据监测战区](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518120&idx=3&sn=25b291c2ac9d694dca76d9bc43a6515e&chksm=87169c23b0611535c979e5dbd48d752918a2a75e2a2ee27ff840c1280e2fe8ebc84c0cd593e1&scene=58&subscene=0#rd) -- 数世咨询 - - [什么是 SBOM（软件物料清单）](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247495608&idx=1&sn=98bde2942729a0bf93fb3da828ae8eb9&chksm=c1449d05f633141305c9dab89b0bfea72116e3cb2170e9b97a5cca5261fe08b6694b27b58cc7&scene=58&subscene=0#rd) -- 极客公园 - - [法国女作家安妮·埃尔诺获诺贝尔文学奖；苹果 App Store 欧元区涨价；三星 Q3 营业利润下降 32% | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969577&idx=1&sn=cdcfa98b57870df5a203e3fbe5c7939d&chksm=7e5467df4923eec93ee9c2e83cafc22147cab07b50a78466b71efe27ef8f31830bddf10c7cf6&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-09.md b/archive/2022/2022-10-09.md deleted file mode 100644 index 4391e9e1b1..0000000000 --- a/archive/2022/2022-10-09.md +++ /dev/null @@ -1,167 +0,0 @@ -# 每日安全资讯（2022-10-09） - -- Verne in GitHub - - [MP3 ID3 结构](https://einverne.github.io/post/2022/10/mp3-id3.html) -- Security Boulevard - - [BSidesLV 2022 Lucky13 GroundTruth – Joshua D Saxe’s ‘Security AI In The Real World: Lessons Learned From Building Practical Machine Learning Systems Deployed To Hundreds Of Thousands Of Networks’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundtruth-joshua-d-saxes-security-ai-in-the-real-world-lessons-learned-from-building-practical-machine-learning-systems-deployed-to-hundreds-of-thousands-of-networks/) -- Twitter @Nicolas Krassas - - [List of ngrok alternatives and other ngrok-like tunneling software and services. Focus on self-hosting.](https://twitter.com/Dinosn/status/1578829354448359424) - - [Re @chukwuemekaoa @SaveToNotion and you are muted](https://twitter.com/Dinosn/status/1578611826031726597) -- Recent Commits to cve:main - - [Update Sat Oct 8 10:13:22 UTC 2022](https://github.com/trickest/cve/commit/41c441ab29f081a0bb4ad009f21b58e950dd0ae9) -- NOSEC 安全讯息平台 - 漏洞预警 - - [【漏洞通报】FortiGate 和 FortiProxy 存在身份验证绕过漏...](https://nosec.org/home/detail/5038.html) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Student Grading System 1.0 - SQLi Authentication Bypass](https://cxsecurity.com/issue/WLB-2022100025) - - [Joomla JoomBri Careers 3.3.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100024) - - [Joomla Vik Booking 1.15.0 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100023) - - [Wordpress Plugin Zephyr Project Manager 3.2.42 Multiple SQLi](https://cxsecurity.com/issue/WLB-2022100022) -- Jiajun的编程随想 - - [OAuth 2 详解（一）：简介及 Authorization Code 模式](https://jiajunhuang.com/articles/2022_10_08-oauth2_explained.md.html) -- unSafe.sh - 不安全 - - [IDA Pro 8.1 released.](https://buaq.net/go-129694.html) - - [timwhitez starred maigret](https://buaq.net/go-129689.html) - - [Quickpost: Standby Power Consumption Of An Old Linear Power Supply](https://buaq.net/go-129685.html) - - [AoratosWin - A Tool That Removes Traces Of Executed Applications On Windows OS](https://buaq.net/go-129686.html) - - [泄露约30万用户信息，丰田公开道歉](https://buaq.net/go-129736.html) - - [城市漫步指南：濑户内海的夏天](https://buaq.net/go-129671.html) - - [LiveHosts – 在浏览器中实时添加 主机/IP 映射，无需修改 hosts 文件[Chrome/Firefox]](https://buaq.net/go-129674.html) - - [2022年第六届工业信息安全技能大赛](https://buaq.net/go-129673.html) - - [顺便问问，威联通用户多么？](https://buaq.net/go-129739.html) - - [绿盟科技威胁周报（2022.09.26-2022.10.02）](https://buaq.net/go-129649.html) - - [如何理解摄影：浅议摄影的创造性](https://buaq.net/go-129672.html) - - [安全牛课堂丨OSCP和OSEP有哪些区别？](https://buaq.net/go-129650.html) -- 安全客-有思想的安全新媒体 - - [活动 | PSRC双11闯关挑战开启！翻倍奖励+闯关奖励High翻全场！](https://www.anquanke.com/post/id/281343) - - [分类分级后应如何有效利用数据安全技术持续进行数据安全治理](https://www.anquanke.com/post/id/281109) - - [“数字沧州”安全保障体系建设的探索与实践](https://www.anquanke.com/post/id/281090) - - [浅谈硬编码密码及其扫描工具](https://www.anquanke.com/post/id/281052) - - [国家标准《信息安全技术 软件供应链安全要求》公开征求意见](https://www.anquanke.com/post/id/281312) - - [弱密码测试工具blaster使用演示](https://www.anquanke.com/post/id/272802) - - [“埃及泄密”—黑客团伙盯上埃及金融机构](https://www.anquanke.com/post/id/281299) - - [BXH攻击事件分析](https://www.anquanke.com/post/id/281172) - - [澳男子因滥用Optus Breach泄露数据被捕](https://www.anquanke.com/post/id/281273) - - [Meta起诉应用程序开发者窃取超百万WhatsApp帐户](https://www.anquanke.com/post/id/281266) -- Sploitus.com Exploits RSS Feed - - [Exploit for Command Injection in Tp-Link Tapo C200 Firmware exploit](https://sploitus.com/exploit?id=BD48C942-D48E-5B9B-9F1F-D7D97DA08700&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Privilege Management in Microsoft exploit](https://sploitus.com/exploit?id=480AA36A-BFDC-54DD-AE13-43A3FE97ADCE&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=B8464218-31FA-569A-AC74-26B347DEC285&utm_source=rss&utm_medium=rss) - - [Exploit for Classic Buffer Overflow in Draytek Vigor3910 Firmware exploit](https://sploitus.com/exploit?id=AC1E0ECD-C313-5E8A-AF3C-465634468809&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2021-42321 exploit](https://sploitus.com/exploit?id=4A657558-ABE9-5708-B292-B836048EF1AD&utm_source=rss&utm_medium=rss) - - [Exploit for Path Traversal in Grafana exploit](https://sploitus.com/exploit?id=FE3C17CE-4B3B-5955-92AF-F2A330AFAFA6&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Privilege Management in Openwebanalytics Open Web Analytics exploit](https://sploitus.com/exploit?id=4B1750D9-C959-5CFC-B566-F957C83C9950&utm_source=rss&utm_medium=rss) -- SecWiki News - - [SecWiki News 2022-10-08 Review](http://www.sec-wiki.com/?2022-10-08) -- 跳跳糖 - 安全与分享社区 - - [Linux新版内核下内存取证分析附CTF题](https://tttang.com/archive/1762/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [2022 SDC议题首次曝光，共建安全新生态](https://www.4hou.com/posts/EQmK) - - [新的攻击活动利用了MICROSOFT EXCHANGE服务器上新的0 day RCE漏洞](https://www.4hou.com/posts/nJPD) - - [币安Binance Bridge被窃价值5.66亿美元的加密货币](https://www.4hou.com/posts/zly7) - - [网络空间中的秘密行动、Say活动和情报竞赛](https://www.4hou.com/posts/pVP1) -- Innost的专栏 - - [边缘设备、系统及计算杂谈(19)——Ubuntu Server了解一下](https://blog.csdn.net/Innost/article/details/127218977) -- 安全脉搏 - - [【安全热点】西工大网络攻击事件的“饮茶”嗅探木马（Suctionchar_Agent）分析](https://www.secpulse.com/archives/188417.html) - - [WebLogic 反序列化漏洞深入分析](https://www.secpulse.com/archives/188492.html) -- Didier Stevens - - [Quickpost: Standby Power Consumption Of An Old Linear Power Supply](https://blog.didierstevens.com/2022/10/08/quickpost-standby-power-consumption-of-an-old-linear-power-supply/) -- Twitter @bytehx - - [RT siri@fu4k1: CVE-2022-35914 POC GLPI <10.0.2 - PHP code injection #CVE](https://twitter.com/sirifu4k1/status/1578770303567921152) - - [RT Md Ismail Sojal: Xss Sucuri WAF Payload : 1/4script3/4alert(¢xss¢)1/4/script3/4 #xSs #bugbountytips #cybersec #infosec](https://twitter.com/0x0SojalSec/status/1578656189592006656) - - [RT siri@fu4k1: Java-Deserialization-Cheat-Sheet: The cheat sheet about Java Deserialization vulnerabilities #cheatsheet #bugbounty #infosec #hacktools...](https://twitter.com/sirifu4k1/status/1578582259074240512) -- Hexacorn - - [Dealing with alert fatigue, Part 2](https://www.hexacorn.com/blog/2022/10/08/dealing-with-alert-fatigue-part-2/) -- Reverse Engineering - - [IDA Pro 8.1 released.](https://www.reddit.com/r/ReverseEngineering/comments/xyujui/ida_pro_81_released/) - - [The Input Lag and Attack Animation Delay of Teenage Mutant Ninja Turtles (NES) - Behind the Code [YouTube]](https://www.reddit.com/r/ReverseEngineering/comments/xyxzzp/the_input_lag_and_attack_animation_delay_of/) -- CCC Event Blog - - [Night of open Knowledge (NooK) am 11. und 12.11.2022](https://events.ccc.de/2022/10/08/nook/) -- SAP Blogs - - [Schedule Production Fiori App-1- Dispatch multiple order operations](https://blogs.sap.com/2022/10/08/schedule-production-fiori-app-1-dispatch-multiple-order-operations/) - - [My First In-Person SAP Community Event Post Pandemic #sitBLR](https://blogs.sap.com/2022/10/08/sitblr-my-first-in-person-sap-community-event-post-pandemic/) -- KitPloit - PenTest & Hacking Tools - - [AoratosWin - A Tool That Removes Traces Of Executed Applications On Windows OS](http://www.kitploit.com/2022/10/aoratoswin-tool-that-removes-traces-of.html) -- FreeBuf网络安全行业门户 - - [泄露约30万用户信息，丰田公开道歉](https://www.freebuf.com/news/346273.html) - - [FreeBuf早报 | LofyGang向开源软件大量投毒；黑客从Binance窃取超过5.7亿美元](https://www.freebuf.com/news/346237.html) - - [因滥用 Optus 泄露的数据信息敲诈受害者，19岁少年被捕](https://www.freebuf.com/news/346232.html) -- 安全牛 - - [2022年第六届工业信息安全技能大赛](https://www.aqniu.com/vendor/89820.html) - - [安全牛课堂丨OSCP和OSEP有哪些区别？](https://www.aqniu.com/homenews/89816.html) - - [网络安全领域最常用的十大开发语言](https://www.aqniu.com/vendor/89777.html) - - [水利行业工控系统网络安全防护方案](https://www.aqniu.com/vendor/89776.html) - - [ChainAegis：BTC和ETH第三季度链上数据解读](https://www.aqniu.com/vendor/89775.html) - - [批准+校验漏洞-TransitSwap安全事件分析](https://www.aqniu.com/vendor/89774.html) -- 奇客Solidot–传递最新科技情报 - - [维护 NTP 协议的人](https://www.solidot.org/story?sid=72988) - - [杀死恐龙的小行星也引发了全球海啸](https://www.solidot.org/story?sid=72987) - - [普林斯顿大学富有到不需要任何外部资金了](https://www.solidot.org/story?sid=72986) - - [Google 准备在日本建数据中心](https://www.solidot.org/story?sid=72985) - - [中国加大量子计算投资](https://www.solidot.org/story?sid=72984) - - [波士顿动力等公司承诺不会武器化机器人](https://www.solidot.org/story?sid=72983) - - [币安 BNB Chain 被盗 5.7 亿美元](https://www.solidot.org/story?sid=72982) - - [英特尔和 SiFive 演示用 Intel 4 工艺制造的 RISC-V 开发板](https://www.solidot.org/story?sid=72981) - - [法官推迟 Twitter 与马斯克案庭审时间](https://www.solidot.org/story?sid=72980) - - [科学家在实验中发现一维外尔费米子](https://www.solidot.org/story?sid=72979) -- HackerNews - - [科技公司因担心泄密 每年物理销毁数百万个可运行的服务器和硬盘](https://hackernews.cc/archives/41767) - - [丰田汽车约 29 万条客户信息泄露 2017 年后新注册用户受影响](https://hackernews.cc/archives/41764) - - [Meta 警告 100 万 Facebook 用户可能被安装了密码窃取应用](https://hackernews.cc/archives/41759) - - [黑客从 Binance 的 BNB 链中窃取 5.7 亿美元的加密代币](https://hackernews.cc/archives/41756) -- 安全客 - - [【技术分享】物联网协议—MQTT与ROS](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649778431&idx=1&sn=457a0352e9f09a0a8d45c061958637d7&chksm=88935890bfe4d186821b78a964673a38a2f79ee60c7bfeb0710dbc7bc400ab44be926e6ade97&scene=58&subscene=0#rd) - - [【安全头条】警惕！新恶意程序可感染Windows、Linux 和 FreeBSD](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649778431&idx=2&sn=31e75141b66b045866873e6f604da848&chksm=88935890bfe4d186b60890c5d72bb82dc9ae2575e9f73cd6c8f09ac83d784dbb2f0cc351b80f&scene=58&subscene=0#rd) -- 互联网安全内参 - - [乌克兰反攻俄军重要时刻，星链卫星网频繁中断](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506237&idx=1&sn=1f738b7a46761fe6bf9c751f5a15a375&chksm=ebfa9e1ddc8d170bd138b353b53695ba8f919dadd780f01577821deb228a81d5ab36a4d34c00&scene=58&subscene=0#rd) - - [白宫发布《关于加强美国信号情报活动保障措施的行政命令》](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506237&idx=2&sn=2de182db663048e6cbbe2fb07c3c2e23&chksm=ebfa9e1ddc8d170b8c8bd1ae5b277a9e6e1c5a593c09ea7ab57d450f46764475d540ba536de0&scene=58&subscene=0#rd) - - [仅售“50元”：英国首相个人手机号遭曝光](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506237&idx=3&sn=8d12a310eca0aaaafb00cd069a786a8c&chksm=ebfa9e1ddc8d170bf25cc28474a6fb8dce73bf84a6bfd7a53f98ef79943a098b7505ac61cc7d&scene=58&subscene=0#rd) - - [“中毒”的洋葱浏览器专门收集中国用户的上网历史和位置信息](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506237&idx=4&sn=856f772f77c73f3e8c2ad8fed541c83d&chksm=ebfa9e1ddc8d170be13499ae960cc87e6abeb822f4049210f00fb44e0f3e6727908c60430551&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [分享工具 | ScanId一款.NET混淆识别器](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486563&idx=1&sn=92ba808a27b1c5e0be471571ae53c520&chksm=fa5aa28ecd2d2b9868bef29e6c98a904d5041af64addd1340a8ca4f08d2ef78b1a9a8016019b&scene=58&subscene=0#rd) - - [优惠活动 | .NET矩阵星球亮点](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486563&idx=2&sn=26875a2dffaef9515b116b925c24c80d&chksm=fa5aa28ecd2d2b9850c4399d609e892da29d9525ee778a2abe5d46cbdf902cbf54fb32376295&scene=58&subscene=0#rd) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（2022.09.26-2022.10.02）](http://blog.nsfocus.net/weeklyreport40/) -- 威努特工控安全 - - [威努特2022年Q3业绩快报](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651089795&idx=1&sn=1497324c2bc6cf5decc44931fb0ca78b&chksm=80e67133b791f825adddfb45f2fec086d97c7067c89182414a2c03652380922ac8b703b57f33&scene=58&subscene=0#rd) -- 安全牛 - - [网络安全领域最常用的十大开发语言](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119028&idx=1&sn=f4b46cb5a99c75e2a5a84e1c2ad9a43d&chksm=bd146d678a63e4716a4c06f75040351fb05e880848cd076cd1ffb4f753abb1cef95d7e399781&scene=58&subscene=0#rd) - - [安全牛课堂丨OSCP和OSEP有哪些区别？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119028&idx=3&sn=51dca200b9d8bcd4d73f4270aa884b96&chksm=bd146d678a63e47189bc46d4b2de6a5ff982d949b8fd46d2f53cc2289bfa64c1bb901248dd88&scene=58&subscene=0#rd) -- 中国信息安全 - - [征订 | 2023年《中国信息安全》杂志征订开始啦！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166328&idx=1&sn=b84acf51617ae27298f679148384d11d&chksm=8b5ef141bc297857ed4bdfa3f6f8175fb11a5e6e7f496abe7e4a81a0b09c2f20fc3e08dc3fa9&scene=58&subscene=0#rd) - - [评论 | 互相尊重网络主权 坚决反对网络霸权](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166328&idx=2&sn=da1df9ecd536e3797dd8c885f7a082ec&chksm=8b5ef141bc2978570d1970a7a8ddce694323bd9a7a0fc2564ec34652cd5197bc7373968ecba5&scene=58&subscene=0#rd) - - [专题·医疗数据安全 | 现代医院网络安全管理面临的挑战和对策](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166328&idx=3&sn=fc236a2ad0666499bb26ac0cef654e91&chksm=8b5ef141bc297857d7bf6f60d457a9b74e559bfdc5d2b7939636907dc91b973579c81f95e642&scene=58&subscene=0#rd) - - [注意 | 收发快递，个人信息这样保护](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166328&idx=4&sn=305f46b3fb981596ad9873530318e4b6&chksm=8b5ef141bc2978579a5c2a35867374bfb711b7f6b4db9f462ed187f08f7507060dcf390335de&scene=58&subscene=0#rd) -- 情报分析师 - - [【珍贵资料】涉朝资料大集合（9-10月上新）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518511&idx=1&sn=5057ab1df9a7dcc4b0af2e23ecf0e4ff&chksm=87169da4b06114b282faa127414e2788f25a1f7d2253bb2c48372ccc419eb9fd4c6a40812714&scene=58&subscene=0#rd) - - [警察采访录音中使用的不同类型的摄像机](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518511&idx=2&sn=4656ad10a731ffc973f0ed380d7f2023&chksm=87169da4b06114b2fa3c123b7ed94d6d54ef657641780872346500519287ceb3d508560672d4&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [绿盟科技云安全纲领（上）](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247493450&idx=1&sn=207233ce8645881310bdebd62316c7a9&chksm=e84c4195df3bc883ef61d995c169c5a181a97166c41ec6c6e13586a7dc1ad1bf1fe6464589af&scene=58&subscene=0#rd) -- 三六零CERT - - [安全日报（2022.10.08）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491468&idx=1&sn=9817ae0e54bec81f9396b9c6cfb34902&chksm=fe251a8dc952939b6e8440c1e8a2743f66e09c13688bc9966e76faea9adb22f0f35a617a9d64&scene=58&subscene=0#rd) -- 极客公园 - - [风口背后：第一批 00 后 Web3 创业者，和他们的「人间清醒」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969628&idx=1&sn=588da9db4bf3b387d3509dd6b14b0857&chksm=7e54672a4923ee3c35c2c50986678f2bd51646b0e535aafc4daf65f08d849d81d3f10f4ee0ca&scene=58&subscene=0#rd) - - [国庆档总票房15亿；特斯拉12月交付首辆Semi电动卡车；Meta高管称Horizon问题太多员工都不用 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969594&idx=1&sn=4864ce80a30ca2aebc541b9ae9b350ea&chksm=7e5467cc4923eedabe93de661c9fd2cfb427e0f3724ecaa994c77b63c0ae39b6e3b544a3e9fe&scene=58&subscene=0#rd) -- 火线Zone - - [使用 Kubescape 和 kube-bench 保护 Kubernetes 集群](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247496783&idx=1&sn=f1f9aaccf8516bf6d1afaecaaf69a549&chksm=eaa97c6fdddef5790667df6831bae9d365710d9acb49bf7179248d450546c99b72187b721fb1&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [SideWinder Uncoils to Strike](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496780&idx=1&sn=afe6da2b6c00a6352b846899c6c194e5&chksm=fa5221f2cd25a8e4adce2b6d1052b004aa4af205887662dca76ea81466b9a9c4be1f31d23295&scene=58&subscene=0#rd) -- 网安寻路人 - - [白宫《关于加强美国信号情报活动保障措施的行政命令》全文翻译](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247496147&idx=1&sn=d00a8675a91be4a3491491c33196424c&chksm=97e94c39a09ec52fcbad3bfc35755977ea3fb8119628d233b3048dff885d900f09697f200dd4&scene=58&subscene=0#rd) -- Viola后花园 - - [退潮后的科技行业发展](https://mp.weixin.qq.com/s?__biz=MzI2Njg1OTA3OA==&mid=2247483974&idx=1&sn=b1e462eebdea903e0008ae2b6b3c0e3f&chksm=ea86e56fddf16c79d9449a1759873f54cff38db4842f4b029ca2d9e791a0af0ec66fb340aec2&scene=58&subscene=0#rd) -- 安全学术圈 - - [2022年先进密码技术与系统安全四川省重点实验室开放课题](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247488200&idx=1&sn=cf145b28d11f688cfb802617b9b483d6&chksm=fe2eed43c9596455bc655aef2b7e101f1cfdaf33f95c0dd8ea362612097c7b2c1124594d9054&scene=58&subscene=0#rd) -- 杨龙 - - [zookeeper](https://www.yanglong.pro/zookeeper/) - - [红锁（Redlock）和联锁](https://www.yanglong.pro/%e7%ba%a2%e9%94%81%ef%bc%88redlock%ef%bc%89%e5%92%8c%e8%81%94%e9%94%81/) - - [Redis Lua 里 KEYS 和 ARGV 区别](https://www.yanglong.pro/redis-keys-%e5%92%8c-argv-%e5%8c%ba%e5%88%ab/) - - [程序开多少个线程合适？](https://www.yanglong.pro/%e7%a8%8b%e5%ba%8f%e5%bc%80%e5%a4%9a%e5%b0%91%e4%b8%aa%e7%ba%bf%e7%a8%8b%e5%90%88%e9%80%82%ef%bc%9f/) -- 代码卫士 - - [微软证实称两个Exchange 0day 正遭在野利用](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514120&idx=1&sn=875f2a8038dd18f4393f68e4958721d8&chksm=ea948962dde3007476979db37549927911d0a40f66cd92734aac2576932e65c02e814b4d2292&scene=58&subscene=0#rd) - - [Fortinet：立即修复这个严重的认证绕过漏洞！](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514120&idx=2&sn=e9b6c1a8e128a9eee70880b0fc3cce94&chksm=ea948962dde300745ee1435a5b05de3016d29440d127c2f0dad65ea6b5b80bc83b6a301afaec&scene=58&subscene=0#rd) - - [JavaScript 沙箱 vm2修复远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514120&idx=3&sn=70433e477638c9c6b3ed925cbdb9cb76&chksm=ea948962dde300745c90d6d6c46d60584f699d5afcb625367d464f79bbbb7bf930be487ee4b9&scene=58&subscene=0#rd) - - [研究员发现 Akamai配置不当漏洞，获得4.6万美元奖励](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514120&idx=4&sn=2326059ddf5ddf3a36ed6009c070e3fa&chksm=ea948962dde300745ca4da0f4fd5f0139c312973295e9d112ead5f8df77010a6fd05ed83ebd7&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [币安Binance Bridge被窃价值5.66亿美元的加密货币](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551853&idx=1&sn=d3390f14fe08f384344b9fd953c7e5e5&chksm=e915db57de6252410cc6db85e94d6611f955432792069177f9c5d2af44f4953cc27534abab5a&scene=58&subscene=0#rd) - - [新的攻击活动利用了MICROSOFT EXCHANGE服务器上新的0 day RCE漏洞](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551853&idx=2&sn=2d846fc97f966aa40945a159c1f271e8&chksm=e915db57de6252412a01a8e5d5cf42923de37f8a819c10ee3f09fd02228f71c5b64055dd4072&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-10.md b/archive/2022/2022-10-10.md deleted file mode 100644 index 23c91c99df..0000000000 --- a/archive/2022/2022-10-10.md +++ /dev/null @@ -1,162 +0,0 @@ -# 每日安全资讯（2022-10-10） - -- Sploitus.com Exploits RSS Feed - - [Exploit for Cross-site Scripting in Helpsystems Cobalt Strike exploit](https://sploitus.com/exploit?id=F5B2F5B6-5329-5166-9F29-040EEC38588C&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Glpi-Project Glpi exploit](https://sploitus.com/exploit?id=9EBE9514-9A58-573D-8521-BE7788457807&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=D6B062D5-F610-54D9-8FD2-EFE6E9D2F8BD&utm_source=rss&utm_medium=rss) -- Verne in GitHub - - [.info 域名涨价应对策略](https://einverne.github.io/post/2022/10/domain-renewal-price-increase-solution.html) -- Security Boulevard - - [Browsing history: Many UK adults don’t know it’s visible to third parties](https://securityboulevard.com/2022/10/browsing-history-many-uk-adults-dont-know-its-visible-to-third-parties/) - - [IBM Survey Finds Security, Compliance Concerns Major Barriers to Cloud Adoption](https://securityboulevard.com/2022/10/ibm-survey-finds-security-compliance-concerns-major-barriers-to-cloud-adoption/) - - [Der Einsame Posten](https://securityboulevard.com/2022/10/der-einsame-posten/) - - [BSidesLV 2022 Lucky13 GroundTruth – Ben U. Gelman’s ‘That Escalated Quickly: A System For Alert Prioritization’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundtruth-ben-u-gelmans-that-escalated-quickly-a-system-for-alert-prioritization/) - - [To ‘See Yourself in Cyber,’ Ask: What’s Your Cyber Story?](https://securityboulevard.com/2022/10/to-see-yourself-in-cyber-ask-whats-your-cyber-story/) - - [Russia Wants to Cancel Christmas](https://securityboulevard.com/2022/10/russia-wants-to-cancel-christmas/) - - [Intel Outlines Focus on Innovative Security Technologies](https://securityboulevard.com/2022/10/intel-outlines-focus-on-innovative-security-technologies/) -- Der Flounder - - [Running Jamf Pro inventory updates at startup time using a Jamf Pro policy](https://derflounder.wordpress.com/2022/10/09/running-jamf-pro-inventory-updates-at-startup-time-using-a-jamf-pro-policy/) - - [Running Jamf Pro inventory updates at startup time](https://derflounder.wordpress.com/2022/10/09/running-jamf-pro-inventory-updates-at-startup-time/) -- Recent Commits to cve:main - - [Update Sun Oct 9 10:15:00 UTC 2022](https://github.com/trickest/cve/commit/1f1326c57bf9e62399eb2a421b8a24b82a79a3c7) -- Twitter @Nicolas Krassas - - [Re @bibelo_info website screenshots :)](https://twitter.com/Dinosn/status/1579058995540955136) - - [Linux Malware Detection (LMD)](https://twitter.com/Dinosn/status/1579058101294370816) - - [Lloyd’s of London investigates alleged cyber attack](https://twitter.com/Dinosn/status/1579035510005456896) - - [Intel Alder Lake source code leaked](https://twitter.com/Dinosn/status/1579035455856574464) - - [HTB: OpenSource](https://twitter.com/Dinosn/status/1578987612945416192) - - [ADATA denies RansomHouse cyberattack, says leaked data from 2021 breach](https://twitter.com/Dinosn/status/1578987477364187139) - - [CVE-2022-39222: Authentication bypass bug in openID connect provider Dex](https://twitter.com/Dinosn/status/1578987404199104513) - - [Android vulnerabilities could allow arbitrary code execution](https://twitter.com/Dinosn/status/1578987329452183553) -- obaby@mars - - [聊一聊最近在看的剧](http://h4ck.org.cn/2022/10/%e8%81%8a%e4%b8%80%e8%81%8a%e6%9c%80%e8%bf%91%e5%9c%a8%e7%9c%8b%e7%9a%84%e5%89%a7/) -- unSafe.sh - 不安全 - - [Everything About Path Traversal Vulnerability](https://buaq.net/go-129858.html) - - [Full Company Building Takeover](https://buaq.net/go-129840.html) - - [EXPLOITING OS COMMAND INJECTION VULNERABILITIES](https://buaq.net/go-129841.html) - - [EvilnoVNC - Ready To Go Phishing Platform](https://buaq.net/go-129829.html) - - [Zerotier1.10.1 内网穿透神器,远程办公时代的生产力工具](https://buaq.net/go-129873.html) - - [招生！2022年《安卓高级研修班》秋季班](https://buaq.net/go-129827.html) -- Jiajun的编程随想 - - [OAuth 2 详解（二）：Implict Grant Flow](https://jiajunhuang.com/articles/2022_10_09-oauth2_explained_implict_grant.md.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [漏洞预警|Apache Commons JXPath 存在代码执行漏洞](https://www.4hou.com/posts/ZXNE) - - [专家解读｜企业供应链安全的思考与实践（一）软件供应链风险来源与供应商管理](https://www.4hou.com/posts/WBXX) - - [chaos恶意软件使用了全新的DDoS和加密模块重新出现在人们面前](https://www.4hou.com/posts/l6Pl) - - [研究人员在宜家智能照明系统中发现漏洞](https://www.4hou.com/posts/DElY) -- SecWiki News - - [SecWiki News 2022-10-09 Review](http://www.sec-wiki.com/?2022-10-09) -- 安全客-有思想的安全新媒体 - - [webshell免杀中符号的妙用](https://www.anquanke.com/post/id/281115) - - [LofyGang分发约200个恶意NPM包窃取信用卡数据](https://www.anquanke.com/post/id/281403) - - [关于bypassuac的探究](https://www.anquanke.com/post/id/272975) - - [研究发现近19%的网络钓鱼邮件绕过微软Defender安全系统](https://www.anquanke.com/post/id/281399) - - [英国军情五处网站遭黑客攻击，被迫暂时关闭](https://www.anquanke.com/post/id/281361) - - [Telegram创始人称WhatsApp是被植入了后门的“监视工具”](https://www.anquanke.com/post/id/281366) - - [Facebook检测400+应用程序窃取用户登录凭据](https://www.anquanke.com/post/id/281357) - - [DPC攻击复现](https://www.anquanke.com/post/id/281186) - - [前Uber安全主管因隐瞒黑客行为被判有罪](https://www.anquanke.com/post/id/281352) - - [《反电信网络诈骗法》的治理要旨与合规启示](https://www.anquanke.com/post/id/281116) - - [英特尔第12代Alder Lake CPU源代码据称在黑客攻击中被泄露](https://www.anquanke.com/post/id/281348) -- 跳跳糖 - 安全与分享社区 - - [Edge浏览器-通过XSS获取高权限从而RCE](https://tttang.com/archive/1766/) -- 安全脉搏 - - [新型钓鱼诈骗：贪小便宜吃大亏！！](https://www.secpulse.com/archives/188641.html) - - [MCMS 审计之路](https://www.secpulse.com/archives/188600.html) - - [欺骗的艺术——你被社工了吗？](https://www.secpulse.com/archives/188453.html) -- WeiyiGeek Blog - - [资源分享|免费注册申请永久的eu.org顶级域名创建属于自己的域名,再也不用给博客域名续费了!](https://blog.weiyigeek.top/2022/10-9-688.html) - - [自媒体文章/网络资源分享/test](https://blog.weiyigeek.top/2022/10-9-index.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [Everything About Path Traversal Vulnerability](https://infosecwriteups.com/everything-about-path-traversal-vulnerability-c40ba5465bc4?source=rss----7b722bfd1b8d--bug_bounty) - - [Full Company Building Takeover](https://infosecwriteups.com/company-building-takeover-10a422385390?source=rss----7b722bfd1b8d--bug_bounty) - - [EXPLOITING OS COMMAND INJECTION VULNERABILITIES](https://infosecwriteups.com/exploiting-os-command-injection-vulnerabilities-14195c9a410b?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [ABAP Trace to PlantUML Sequence Diagram](https://blogs.sap.com/2022/10/09/abap-trace-to-plantuml-sequence-diagram/) - - [SAP BTP – Compare energy efficiency languages for deployment](https://blogs.sap.com/2022/10/09/sap-btp-compare-energy-efficiency-languages-for-deployment/) - - [Integrate S4 Service Order & FSM appointment offering in Appgyver-SAP Intelligent Service Cloud V2](https://blogs.sap.com/2022/10/09/integrate-s4-service-order-fsm-appointment-offering-in-appgyver-sap-intelligent-service-cloud-v2/) - - [SAP BTP – Sustainable/Carbon Emission and energy efficiency languages](https://blogs.sap.com/2022/10/09/sap-btp-sustainable-carbon-emission-and-energy-efficiency-languages/) - - [SAP Signavio Process Intelligence: On-Premise SAP S/4HANA data](https://blogs.sap.com/2022/10/09/sap-signavio-process-intelligence-on-premise-sap-s-4hana-data/) - - [如何开始SAP BTP无代码服务 – 构建一个端到端的BP展示页面](https://blogs.sap.com/2022/10/09/%e5%a6%82%e4%bd%95%e5%bc%80%e5%a7%8bsap-btp%e6%97%a0%e4%bb%a3%e7%a0%81%e6%9c%8d%e5%8a%a1-%e6%9e%84%e5%bb%ba%e4%b8%80%e4%b8%aa%e7%ab%af%e5%88%b0%e7%ab%af%e7%9a%84bp%e5%b1%95%e7%a4%ba%e9%a1%b5/) - - [Case Management in SAP Intelligent Service Cloud V2 -Qualtrics Integration(Customer feedback)](https://blogs.sap.com/2022/10/09/case-management-in-sap-intelligent-service-cloud-v2-qualtrics-integrationcustomer-feedback/) - - [Case Management in SAP Intelligent Service Cloud V2 -Overview](https://blogs.sap.com/2022/10/09/case-management-in-sap-intelligent-service-cloud-v2-overview/) -- blog.avast.com EN - - [Browsing history: Many UK adults don’t know it's visible to third parties](https://blog.avast.com/browsing-history-research) -- Reverse Engineering - - [Decompiling x86 Deep Neural Network Executables](https://www.reddit.com/r/ReverseEngineering/comments/xzscgy/decompiling_x86_deep_neural_network_executables/) - - [Messing with CVE-2022-30190 by Understanding Compound File Binary Format and OLE Structures](https://www.reddit.com/r/ReverseEngineering/comments/xzek6z/messing_with_cve202230190_by_understanding/) -- 学习路 - - [随笔-1](https://4ra1n.love/post/T_-hRwbQ2/) -- KitPloit - PenTest & Hacking Tools - - [EvilnoVNC - Ready To Go Phishing Platform](http://www.kitploit.com/2022/10/evilnovnc-ready-to-go-phishing-platform.html) -- 安全牛 - - [如何应对网络安全中的配置漂移问题？](https://www.aqniu.com/homenews/89826.html) - - [破解密码的8种典型手段与防护建议](https://www.aqniu.com/hometop/89825.html) - - [海云安荣登“2022深圳行业领袖企业100强”榜单、首席技术官齐博士荣膺“2022深圳行业领袖新青年”称号](https://www.aqniu.com/vendor/89824.html) -- 奇客Solidot–传递最新科技情报 - - [美国第四大医院系统遭勒索软件攻击](https://www.solidot.org/story?sid=73000) - - [月壤玻璃微球揭秘地月系统小行星撞击事件](https://www.solidot.org/story?sid=72999) - - [天河新超算速度提高到 200 PFlops](https://www.solidot.org/story?sid=72998) - - [伊朗抗议者劫持国有电视台直播](https://www.solidot.org/story?sid=72997) - - [美国公司因解雇拒绝打开摄像头的员工被罚 7.5 万欧元](https://www.solidot.org/story?sid=72996) - - [Windows 95 有专门的补丁去兼容《模拟城市》](https://www.solidot.org/story?sid=72995) - - [伊朗网民的 VPN 和 Tor 使用量增加](https://www.solidot.org/story?sid=72994) - - [DeepMind 的 AlphaTensor 找到更快的矩阵乘法算法](https://www.solidot.org/story?sid=72993) - - [地球系统模拟的水平分辨率首次达到 1.2 公里](https://www.solidot.org/story?sid=72992) - - [Valve 最新的 Steam Deck 视频含有任天堂 Switch 模拟器](https://www.solidot.org/story?sid=72991) - - [Twitter 称马斯克无法被信任](https://www.solidot.org/story?sid=72990) - - [Intel Alder Lake固件整体方案泄漏分析](https://www.solidot.org/story?sid=72989) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 宜家智能照明系统存缺陷；英特尔第12代处理器源码遭泄露](https://www.freebuf.com/news/346341.html) - - [RSAC2022议题分享：OT逆向工程](https://www.freebuf.com/articles/web/346306.html) - - [芯片制造商 ADATA（威刚）否认遭到 RansomHouse 组织攻击](https://www.freebuf.com/news/346304.html) - - [《信息安全技术 软件供应链安全要求》（征求意见稿）发布](https://www.freebuf.com/news/346297.html) - - [400万条2K Games用户数据正在暗网上出售](https://www.freebuf.com/news/346294.html) -- 丁爸情报分析师的工具箱 - - [【企业介绍】北京银景科技有限公司](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651132680&idx=1&sn=b65da78d917e778ec074436a64a0e4b3&chksm=f1af6432c6d8ed246bf2d13a0978a64592517e4c20b4c36d3d569797da876bf14ba87ca28f08&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [安全威胁情报周报（10.1~10.9）](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247496495&idx=1&sn=1e9649713f5692af0386fc685f303fa6&chksm=cfca903bf8bd192dc71d7a7d044878d276cdbab100b1bb9dd4f4c782fd9cb1a8150f16ab310c&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [现代医院网络安全管理面临的挑战和对策](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531643&idx=1&sn=85d7629d0a5765403a3cb686d99505e5&chksm=c1e9f02af69e793c773140f90fabb675ea2d6143eadb2fe5188e98c677eccc296da42d42898e&scene=58&subscene=0#rd) - - [币安Binance Bridge被窃价值5.66亿美元的加密货币](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531643&idx=2&sn=7934c95548270163fc12964c718702a6&chksm=c1e9f02af69e793c9fa0b1776baf19e6907785654194715abb30c80a3725a087f8405354b323&scene=58&subscene=0#rd) - - [乌克兰反攻俄军重要时刻，星链卫星网频繁中断](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531643&idx=3&sn=0e8d90a9a167a25483b30f984087d4dc&chksm=c1e9f02af69e793c8bcce365f0c9d8af4cf8c833000dabc748587ed920089e3e983dbac7a074&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】美国加码全面限制中国芯片](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020010&idx=1&sn=eaa59aceef3bb47f8e96fb4705d8df79&chksm=f36fb16ac418387c7b31395410d805ce992df88e7d4fbcee0077eeadcb5b6bb0ab3bfb0621b6&scene=58&subscene=0#rd) - - [【安全圈】借道境外对网站实施“流量攻击”，两名“黑客”落网！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020010&idx=2&sn=dc2c6a783f94920104cdc90ffddd8645&chksm=f36fb16ac418387c93c35a9863c271bcd7dafb356f9a3e16d30009118bd57d70e023cb954d2f&scene=58&subscene=0#rd) - - [【安全圈】英特尔 Alder Lake 源码泄露，英伟达、AMD 遭黑客攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020010&idx=3&sn=370e48eeb92e51547c635b97e84dc343&chksm=f36fb16ac418387ccbd3c2320c740e718b633fa0f7963c3223aeb7d10ca47ee6648293b160f6&scene=58&subscene=0#rd) - - [【安全圈】首例支付网络安全赎金案宣判，前Uber高管面临牢狱之灾](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020010&idx=4&sn=97bf9203fbe892b94a1ec5a1c7465959&chksm=f36fb16ac418387c9396edcf3c0151fd01df78242852cc8a34e0d54ecfbe17a7e69de676432a&scene=58&subscene=0#rd) - - [【安全圈】Meta 警告 100 万 Facebook 用户账户信息遭泄露](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020010&idx=5&sn=62857f0cde96b9d5fe6ca959a2a1d200&chksm=f36fb16ac418387c19a656654de4c84f2bbe9dd0515c9218dd26d800cec9b1033a96cbb8d9b0&scene=58&subscene=0#rd) -- 黑海洋 - WIKI - - [Windows WireGuard 节点分流方案](https://blog.upx8.com/3046) - - [Linux VPS脚本工具箱](https://blog.upx8.com/3045) - - [在Freenom申请免费域名](https://blog.upx8.com/3044) - - [在eu.org申请免费域名](https://blog.upx8.com/3043) -- HackerNews - - [前 Uber 安全主管 Joe Sullivan 因向当局隐瞒黑客行为而被判有罪](https://hackernews.cc/archives/41784) - - [研究发现近 19% 的网络钓鱼邮件绕过微软 Defender 安全系统](https://hackernews.cc/archives/41779) - - [2022 年上半年，影子 API 遭遇多达 50 亿次的恶意请求](https://hackernews.cc/archives/41777) - - [新的 Maggie 恶意软件已感染包括我国在内的超 250 台微软 SQL 服务器](https://hackernews.cc/archives/41775) - - [因滥用 Optus 泄露的数据信息敲诈受害者，19岁少年被捕](https://hackernews.cc/archives/41773) - - [泄露的英特尔酷睿 Alder Lake BIOS 的 5.9GB 源代码被发布到 GitHub 上](https://hackernews.cc/archives/41769) -- 网络安全应急技术国家工程实验室 - - [高效开展网络安全风险评估的六要素](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531815&idx=1&sn=4fe5672f45140a63cbc8d4fce6d36ae5&chksm=fa93cbe6cde442f02857bb38bb7b8c7706508192c9c91e4adee496668d614011558981cf1cd9&scene=58&subscene=0#rd) - - [揭秘多重人格的伊朗黑客组织—TA453](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531815&idx=2&sn=6797dcc8e9ad98a51c6e3e1f1758624a&chksm=fa93cbe6cde442f04baba4f42007201428966030b13d5f51e03bced6405b86af0171d94ab767&scene=58&subscene=0#rd) - - [恶意移动APP的套路防不胜防！影响100万个脸书用户的中毒APP是如何对抗安全检测的？](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531815&idx=3&sn=c914451da4eb62b28121ceffc9fe6d61&chksm=fa93cbe6cde442f0f9670bf80ce201f3139cf2bce961af51e9691fe37629376b7748002e4fa0&scene=58&subscene=0#rd) -- 看雪学院 - - [基于PMI实现对读写行为检测](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458475098&idx=1&sn=09ac26802aa9938c1e6e8b258f6a8d16&chksm=b18e6ad086f9e3c687d1435ee657a1aa54a7e70952eaf4a38fde246b22871a4189efc97edc0b&scene=58&subscene=0#rd) - - [一个密码学漏洞导致一亿美元损失！某虚拟货币交易平台遭黑客攻击](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458475098&idx=2&sn=a70d164c39ff37d3b983f97d4a94a61c&chksm=b18e6ad086f9e3c65c1fbb5cc0f1946976397406f7193f8d6e58f47e4867829294012ab75648&scene=58&subscene=0#rd) - - [招生！2022年《安卓高级研修班》秋季班](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458475098&idx=3&sn=ab4ab5b1afa3311629a50d30245ff232&chksm=b18e6ad086f9e3c6eaf9848adc5eb8b4c2456d171d033e53e0a84590649bd617e24100edde39&scene=58&subscene=0#rd) -- 小米安全中心 - - [报名开启｜小米SRC邀您参与白帽成长营](https://mp.weixin.qq.com/s?__biz=MzI2NzI2OTExNA==&mid=2247514230&idx=1&sn=fb9f663ba338c6de0d810d1e5f3d1e96&chksm=ea839ee3ddf417f5bd02cc842e1c1052d803b56c8b3aea9b37665dfd0094523666169b514a04&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [RSAC2022议题分享：OT逆向工程](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496810&idx=1&sn=24f8a2294ea4fb223b6fde571306a550&chksm=fa5221d4cd25a8c27b56b7a4ac817362e75dd87098f4126a3a20a46fc1addd0d075393e0e853&scene=58&subscene=0#rd) -- 情报分析师 - - [普京的保镖如何运作](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518536&idx=1&sn=6af1c7af4c71af71b5282459af39acc4&chksm=87169a43b061135565884d323e2b019611ab062b06443decc271822827ccdaf8b2aa1c9ffe04&scene=58&subscene=0#rd) - - [俄罗斯男子在克里米亚大桥爆炸中被确认为卡车的所有者，52岁的亲属马希尔·尤苏博夫可能正在驾驶卡车](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518536&idx=2&sn=5123dc8a3a0bcd54c19633ed8c1ad265&chksm=87169a43b0611355359bc1afd74d8e6c67d133d621a784f7da1ecb3ed4f9ffbea0fe65202620&scene=58&subscene=0#rd) - - [爱尔兰警察署专员关于管理和使用秘密人力情报来源的公开声明](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518536&idx=3&sn=c73b77609a6d2d1afddc06c863bfa339&chksm=87169a43b0611355f1829fa2c7e19977767ffe0281dc4e08b613e776db90386feb189d1a8203&scene=58&subscene=0#rd) -- 极客公园 - - [股价暴跌八成、高管离职，人造肉的故事不香了？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969674&idx=1&sn=aa71ab21595f6dff995f0398d8f6339d&chksm=7e54677c4923ee6a87d9ed4054609d4367e2050fe49bf65b6ea76d23e3dcfe23b3265a4ad49e&scene=58&subscene=0#rd) - - [华为 53 岁高管丁耘去世；传美国将对华出台芯片技术管制新规；波士顿动力承诺不造战争机器人｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969669&idx=1&sn=6c525a9a90db8cf10610f62a4618ce26&chksm=7e5467734923ee65b84a66f9a305f0a52f4938a923c82a4681b3e13dafcfcbc127b0a7516c9c&scene=58&subscene=0#rd) -- 嘶吼专业版 - - [研究人员在宜家智能照明系统中发现漏洞](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551871&idx=1&sn=bd2a46a697628ef293d7b08dcd57ec5a&chksm=e915db45de625253c2e8df5bb617dfcaf97bcd79854f13adea280e6248da04ebdc780a89c860&scene=58&subscene=0#rd) - - [chaos恶意软件使用了全新的DDoS和加密模块重新出现在人们面前](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247551871&idx=2&sn=167ad9ccf337df0f5cca1d63e2e91b2f&chksm=e915db45de625253e881f2505a8bcc26cdb9d284ca87844b16c0339c0a8d573ee5d23bdf725a&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-11.md b/archive/2022/2022-10-11.md deleted file mode 100644 index e854064fef..0000000000 --- a/archive/2022/2022-10-11.md +++ /dev/null @@ -1,182 +0,0 @@ -# 每日安全资讯（2022-10-11） - -- Sploitus.com Exploits RSS Feed - - [Webile v1.0.1 - Directory Traversal Web Vulnerability exploit](https://sploitus.com/exploit?id=VULNERABLE:2320&utm_source=rss&utm_medium=rss) - - [Joomla Vik Rent Car 1.14 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168668&utm_source=rss&utm_medium=rss) - - [Online Shopping System Advanced 1.0 SQL Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168671&utm_source=rss&utm_medium=rss) - - [Web Based Student Clearance 1.0 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168667&utm_source=rss&utm_medium=rss) - - [Knap (APL) v3.1.3 - Persistent Cross Site Vulnerability exploit](https://sploitus.com/exploit?id=VULNERABLE:2307&utm_source=rss&utm_medium=rss) - - [WordPress / Joomla JReviews 4.1.5 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168669&utm_source=rss&utm_medium=rss) - - [Zentao Project Management System 17.0 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168665&utm_source=rss&utm_medium=rss) - - [WordPress eCommerce Product Catalog 3.0.70 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168670&utm_source=rss&utm_medium=rss) - - [MapTool v1.11.5 - Denial of Service Vulnerability exploit](https://sploitus.com/exploit?id=VULNERABLE:2318&utm_source=rss&utm_medium=rss) - - [Exploit for Unrestricted Upload of File with Dangerous Type in Zimbra Collaboration exploit](https://sploitus.com/exploit?id=EBFC1543-13D3-549C-A3B9-A6E4B17E7555&utm_source=rss&utm_medium=rss) - - [Exploit for Out-of-bounds Write in Polkit Project Polkit exploit](https://sploitus.com/exploit?id=08C0F3E4-FA70-595A-92E5-ADD81215F25D&utm_source=rss&utm_medium=rss) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Joomla Vik Rent Car 1.14 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100030) - - [Web Based Student Clearance 1.0 Shell Upload](https://cxsecurity.com/issue/WLB-2022100029) - - [WordPress eCommerce Product Catalog 3.0.70 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100028) - - [WordPress / Joomla JReviews 4.1.5 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100027) - - [Zentao Project Management System 17.0 Remote Code Execution](https://cxsecurity.com/issue/WLB-2022100026) -- Security Boulevard - - [How social environments impact student mental health and self-harm](https://securityboulevard.com/2022/10/how-social-environments-impact-student-mental-health-and-self-harm/) - - [Uber CISO Verdict: It’s the Cover-Up](https://securityboulevard.com/2022/10/uber-ciso-verdict-its-the-cover-up/) - - [API Spyder: Doing the (Seemingly) Impossible](https://securityboulevard.com/2022/10/api-spyder-doing-the-seemingly-impossible/) - - [Introducing the Control Plane for Machine Identity Management](https://securityboulevard.com/2022/10/introducing-the-control-plane-for-machine-identity-management/) - - [Cybersecurity is a Successfully Failure](https://securityboulevard.com/2022/10/cybersecurity-is-a-successfully-failure/) - - [Laying the Foundations for Growth](https://securityboulevard.com/2022/10/laying-the-foundations-for-growth/) - - [Human-Centric No-Code Automation is the Future of Cybersecurity](https://securityboulevard.com/2022/10/human-centric-no-code-automation-is-the-future-of-cybersecurity/) -- 跳跳糖 - 安全与分享社区 - - [Microsoft Windows Shift F10 Bypass and Autopilot privilge escalation(译文)](https://tttang.com/archive/1767/) -- Verne in GitHub - - [Git 对文件权限的控制](https://einverne.github.io/post/2022/10/git-file-permission.html) -- Jiajun的编程随想 - - [OAuth 2 详解（四）：Client Credentials Flow](https://jiajunhuang.com/articles/2022_10_10-oauth2_explained_client_credentials.md.html) - - [OAuth 2 详解（三）：Resource Owner Password Credentials Grant](https://jiajunhuang.com/articles/2022_10_10-oauth2_explained_password.md.html) -- Twitter @Nicolas Krassas - - [DFShell: The Best Forwarded Shell](https://twitter.com/Dinosn/status/1579512970283216896) - - [Iran State-Run TV’s Live Transmission Hacked by Edalate Ali Hackers](https://twitter.com/Dinosn/status/1579493739227385858) - - [US airports taken down in DDoS attacks by pro-Russian hackers](https://twitter.com/Dinosn/status/1579484603244752896) - - [The head of the Federal Cyber Security Authority (BSI) faces dismissal](https://twitter.com/Dinosn/status/1579476270425202689) - - [This is a repo which documents real bugs in real software to illustrate trends, learn how to prevent or find them more quickly.](https://twitter.com/Dinosn/status/1579444074108833793) - - [Best CTF Platforms](https://twitter.com/Dinosn/status/1579440830351568897) - - [Everest gang demands $200K for data stolen from South Africa state-owned electricity company ESKOM](https://twitter.com/Dinosn/status/1579440615947132933) - - [Learning Linux kernel exploitation - Part 2 - CVE-2022-0847](https://twitter.com/Dinosn/status/1579440441094987778) - - [Dark web carding site BidenCash gives 1.2M payment cards for free](https://twitter.com/Dinosn/status/1579439849811369984) - - [Persistent PHP payloads in PNGs: How to inject PHP code in an image – and keep it there !](https://twitter.com/Dinosn/status/1579439666776117248) - - [Intel confirms leaked Alder Lake BIOS Source Code is authentic](https://twitter.com/Dinosn/status/1579439526753488897) - - [RT yvvdwf: My pleasure to share the details of my first #RCE:](https://twitter.com/yvvdwf/status/1579388374582177792) - - [njRAT Malware Analysis](https://twitter.com/Dinosn/status/1579369286472437762) - - [RT Horizon3 Attack Team: Another appliance vuln down... CVE-2022-40684, affecting multiple #Fortinet solutions, is an auth bypass that allows remote a...](https://twitter.com/Horizon3Attack/status/1579285863108087810) -- SecWiki News - - [SecWiki News 2022-10-10 Review](http://www.sec-wiki.com/?2022-10-10) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [Chinoxy和PivNoxy攻击的幕后组织调查](https://www.4hou.com/posts/vJJm) - - [macOS Archive工具漏洞](https://www.4hou.com/posts/AOg1) -- Recent Commits to cve:main - - [Update Mon Oct 10 17:21:51 UTC 2022](https://github.com/trickest/cve/commit/c463a24d452fb870212d409fc98083d7e060a611) -- 安全客-有思想的安全新媒体 - - [“清朗·打击网络谣言和虚假信息”专项行动曝光第二批网络谣言溯源及处置典型案例](https://www.anquanke.com/post/id/281326) - - [CVE-2022-24112 Apache APISIX 远程代码执行漏洞](https://www.anquanke.com/post/id/281092) - - [永安在线完成新一轮4000万元融资，国科投资独家投资](https://www.anquanke.com/post/id/281465) - - [数字安全观察每周简报【政策消息篇】2022.09.21-2022.09.27](https://www.anquanke.com/post/id/281466) - - [Optus数据泄露事件后，澳大利亚修改隐私法](https://www.anquanke.com/post/id/281461) - - [美国第四大医院系统遭勒索软件攻击](https://www.anquanke.com/post/id/281453) -- Tenable Blog - - [Tenable.io: To control or not to control, that is the question](https://www.tenable.com/blog/tenable-io-to-control-or-not-to-control-that-is-the-question) -- Files ≈ Packet Storm - - [Verbatim Store 'n' Go Secure Portable SSD Behavior Violation](https://packetstormsecurity.com/files/168679/SYSS-2022-046.txt) - - [Verbatim Store 'n' Go Secure Portable SSD Missing Trust](https://packetstormsecurity.com/files/168678/SYSS-2022-045.txt) - - [Verbatim Store 'n' Go Secure Portable SSD Weak Cryptography](https://packetstormsecurity.com/files/168675/SYSS-2022-043.txt) - - [cryptmount Filesystem Manager 6.1.0](https://packetstormsecurity.com/files/168676/cryptmount-6.1.0.tar.gz) - - [Linux munmap() Race Condition / Use-After-Free](https://packetstormsecurity.com/files/168674/GS20221010161432.tgz) - - [Ubuntu Security Notice USN-5663-1](https://packetstormsecurity.com/files/168673/USN-5663-1.txt) - - [Ubuntu Security Notice USN-5371-3](https://packetstormsecurity.com/files/168672/USN-5371-3.txt) - - [Online Shopping System Advanced 1.0 SQL Injection](https://packetstormsecurity.com/files/168671/ossa10-sql.txt) - - [WordPress eCommerce Product Catalog 3.0.70 Cross Site Scripting](https://packetstormsecurity.com/files/168670/wpepc3070-xss.txt) - - [WordPress / Joomla JReviews 4.1.5 Cross Site Scripting](https://packetstormsecurity.com/files/168669/wpjreviews415-xss.txt) - - [Joomla Vik Rent Car 1.14 Cross Site Scripting](https://packetstormsecurity.com/files/168668/joomlavikrentcar114-xss.txt) - - [Web Based Student Clearance 1.0 Shell Upload](https://packetstormsecurity.com/files/168667/wbsc10-shell.txt) - - [Crealogix EBICS Cross Site Scripting](https://packetstormsecurity.com/files/168666/crealogix-xss.pdf) - - [Zentao Project Management System 17.0 Remote Code Execution](https://packetstormsecurity.com/files/168665/zentaopms170-exec.txt) - - [macOS 12.3.1 Local Root](https://packetstormsecurity.com/files/168664/macOS1231-root.tgz) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [In-Depth Look Into Data-Driven Science Behind Qualys TruRisk](https://blog.qualys.com/category/vulnerabilities-threat-research) -- CTFするぞ - - [【検証小ネタ】プログラムとヒープの間の心の溝](https://ptr-yudai.hatenablog.com/entry/2022/10/10/165046) -- 博客园 - 挖洞的土拨鼠 - - [关于账号注销中的合规注意点 - 挖洞的土拨鼠](https://www.cnblogs.com/KevinGeorge/p/16776957.html) -- Bug Bounty in InfoSec Write-ups on Medium - - [Accidental Account takeover](https://infosecwriteups.com/accidental-account-takeover-4301b56f4fb2?source=rss----7b722bfd1b8d--bug_bounty) -- Forcepoint - - [CISA Directive: Federal Agencies Must Improve Cybersecurity Asset Visibility and Vulnerability Detection](https://www.forcepoint.com/blog/insights/cisa-federal-agencies-must-improve-cybersecurity-asset-visibility) -- Twitter @bytehx - - [RT Nicolas Krassas: Best CTF Platforms](https://twitter.com/Dinosn/status/1579440830351568897) - - [RT yvvdwf: My pleasure to share the details of my first #RCE:](https://twitter.com/yvvdwf/status/1579388374582177792) -- 安全脉搏 - - [Java反序列化之CC1链分析 | 技术精选0142](https://www.secpulse.com/archives/188750.html) - - [比赛中遇到的一些简单的逆向题目](https://www.secpulse.com/archives/188701.html) - - [ThinkPHP6.0.13反序列化漏洞分析](https://www.secpulse.com/archives/188663.html) -- Malwarebytes Labs - - [Teen talk: What it's like to grow up online, and the role of parents: Lock and Code S03E21](https://www.malwarebytes.com/blog/podcast/2022/10/forever-connected-lock-and-code-s03e21) - - [White House unveils Blueprint for an AI Bill of Rights](https://www.malwarebytes.com/blog/news/2022/10/the-white-houses-new-bill-of-rights-holds-big-tech-companies-accountable-for-their-ai) - - [A week in security (October 3 – 9)](https://www.malwarebytes.com/blog/news/2022/10/a-week-in-security-october-3-9) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/y07zw0/rreverseengineerings_weekly_questions_thread/) -- SentinelOne - - [CISO Wins | Reducing Risk Across Endpoint, Identity and Cloud Surfaces](https://www.sentinelone.com/blog/ciso-wins-reducing-risk-across-endpoint-identity-and-cloud-surfaces/) -- The Daily Swig | Cybersecurity news and views - - [Zimbra remote code execution vulnerability actively exploited in the wild](https://portswigger.net/daily-swig/zimbra-remote-code-execution-vulnerability-actively-exploited-in-the-wild) -- Rhynorater's InfoSec Blog - - [postMessage Braindump](https://rhynorater.github.io/postMessage-Braindump) -- Twitter @Keiran Smith (Affix) - - [Evade the ps command on Linux with Function hooking in C](https://twitter.com/cli/status/1579399933765251072) -- 安全牛 - - [让安全专家也头疼的7种物联网设备](https://www.aqniu.com/hometop/89838.html) - - [产业观察丨永安在线宣布完成新一轮4000万元融资](https://www.aqniu.com/homenews/89839.html) - - [安全头条 |《网络安全标准实践指南—健康码防伪技术指南》发布；国内首个车联网安全自动驾驶开放测试道路项目建成](https://www.aqniu.com/homenews/89840.html) - - [默克尔树漏洞成因和链上资金追踪-BNBChain跨链桥攻击事件分析](https://www.aqniu.com/vendor/89837.html) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 伊朗抗议者劫持国有电视台直播；日本IPA发布2022《信息安全白皮书》](https://www.freebuf.com/news/346484.html) - - [宜家智能照明系统发现漏洞，可能导致灯泡闪烁恢复出厂设置](https://www.freebuf.com/articles/network/346423.html) - - [英特尔确认Alder Lake BIOS源代码已泄露](https://www.freebuf.com/news/346409.html) - - [三城联动，四大特色 | CIS 2022大会各地观众限量报名开启](https://www.freebuf.com/fevents/346377.html) -- 奇客Solidot–传递最新科技情报 - - [Linus Torvalds 的内存问题导致 Linux 6.1 补丁合并推迟](https://www.solidot.org/story?sid=73011) - - [五角大楼将奇虎和深圳大疆列入黑名单](https://www.solidot.org/story?sid=73010) - - [伯南克等三人获诺贝尔经济学家](https://www.solidot.org/story?sid=73009) - - [机器学习撼动粒子物理学](https://www.solidot.org/story?sid=73008) - - [中国 8 月尝试 90 次人工降雨](https://www.solidot.org/story?sid=73007) - - [模拟显示月球可能是在短时间内形成的](https://www.solidot.org/story?sid=73006) - - [需求不振内存厂商面临困境](https://www.solidot.org/story?sid=73005) - - [研究显示高研发成本不能解释高药品价格](https://www.solidot.org/story?sid=73004) - - [Google 演示文本视频 AI 模型 Imagen Video](https://www.solidot.org/story?sid=73003) - - [研究显示推荐系统能使用 AI 操纵人的偏好](https://www.solidot.org/story?sid=73002) -- 博客园 - 渗透测试中心 - - [《你安全吗》涉及到的技术解读 - 渗透测试中心](https://www.cnblogs.com/backlion/p/16774946.html) -- KitPloit - PenTest & Hacking Tools - - [HSTP - Simple Hyper Service Transfer Protocol On Networks](http://www.kitploit.com/2022/10/hstp-simple-hyper-service-transfer.html) -- 90Sec - 最新话题 - - [SeaCms 代码审计](https://forum.90sec.com/t/topic/2191) -- 绿盟科技金融事业部 - - [绿盟科技安全运营重保方案系列（三）：网站云防护服务](https://mp.weixin.qq.com/s?__biz=MzI2NDI5MTg4MA==&mid=2247492342&idx=1&sn=8e135f8773cce274de10636218600953&chksm=eaac71b1dddbf8a738b4e229b0bfec901b7ad3257359b14e2ae7dedafa2eb93844b0e70b42dc&scene=58&subscene=0#rd) -- 代码卫士 - - [软件和应用安全的六大金科玉律](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514145&idx=1&sn=639a349a140d429c996a51949fec0a92&chksm=ea94894bdde3005d6eeb0e37e7a3f81c6518bdce555fd5d9fff4418c5b305e17c5fb7916cb58&scene=58&subscene=0#rd) - - [黑客正在利用Zimbra ZCS中的未修复RCE漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514145&idx=2&sn=de026e7969cb14c915002400434f0be1&chksm=ea94894bdde3005d4a094cd8e5125835831ac95a26d5e5666cca5c1b0300b99ce4e581210d69&scene=58&subscene=0#rd) -- 绿盟科技研究通讯 - - [绿盟科技云安全纲领（中）](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247493485&idx=1&sn=b23094071581dfe656d74dff5634147e&chksm=e84c41b2df3bc8a4da07cf6a74e6e49054445b6f2a44ceea19f673537d76cea2a8480fa4a42a&scene=58&subscene=0#rd) -- HackerNews - - [宜家智能照明系统发现漏洞，可能导致灯泡闪烁恢复出厂设置](https://hackernews.cc/archives/41808) - - [英特尔确认 Alder Lake BIOS 源代码已泄露](https://hackernews.cc/archives/41805) -- 中国信息安全 - - [专题·医疗数据安全 | 互联互通背景下对医疗数据安全保护的思考](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166464&idx=1&sn=0fb3bed792e42289b3d47cbaf948e567&chksm=8b5ef6b9bc297faf40fb6ad209d64543dd7c31306be3dee2a72f4e497e29fb79b16c445c6dde&scene=58&subscene=0#rd) - - [CNNVD | 关于 Fortinet FortiOS 安全漏洞情况的通报](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166464&idx=2&sn=93e2bfb417b13ada678a761154bf88f5&chksm=8b5ef6b9bc297faf58a268b89dadd8385971a3d54f832c0c94573ff70f3fcfaaf838a549085a&scene=58&subscene=0#rd) - - [通知 | 国家标准《信息安全技术 智能手机预装应用程序基本安全要求（征求意见稿）》公开征求意见](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166464&idx=3&sn=3b69d588d2a14dbba6ae7e70ec5c058d&chksm=8b5ef6b9bc297faf690ba34ad02f9e90f3c177e98af71fb9dac5a6b722c25cf547b6f8e5b808&scene=58&subscene=0#rd) - - [关注 | 人社部关停一批仿冒技能类评价证书查询官网 持续推进“山寨证书”治理](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166464&idx=4&sn=1e9c32e0b67a13a33f1d605e4b3c25c9&chksm=8b5ef6b9bc297fafc48f7013ce71b91f0ecb201abd242f256c1fb8c757beac919f5db88700cf&scene=58&subscene=0#rd) - - [发布 | 《陕西省大数据条例》（全文）](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166464&idx=5&sn=2d8709ad5cc78927be56e632f2299def&chksm=8b5ef6b9bc297faf550094b01f2679d0f356dcbb4978b0c3a34f15594a5cbd705b8027472b10&scene=58&subscene=0#rd) - - [关注 | 2022年9月全国受理网络违法和不良信息举报1518.8万件](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166464&idx=6&sn=39287001a1c7781714a5fe1b848274d6&chksm=8b5ef6b9bc297fafea4f1a9f5dd9635fb3eb25eb262a06a0b42a747323aeda0645aa4eee5970&scene=58&subscene=0#rd) -- 星阑科技 - - [API NEWS | ​API是Optus数据泄露的根源](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495943&idx=1&sn=f0bb0ae6a841391a0199638a14b6dd24&chksm=c0075c9bf770d58d20e021f478bbde5ef59462fbd2eb4668caec6550edfc0bc59fbe6e78e2c1&scene=58&subscene=0#rd) -- CNVD漏洞平台 - - [CNVD漏洞周报2022年第39、40期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492467&idx=1&sn=f12e02fcac59e3c95c92deed26ce1ab6&chksm=fd74d3baca035aac03adeaa0309943c3ceabc73567f128ec8972a5ba7f35143f99b640fc482c&scene=58&subscene=0#rd) - - [上周关注度较高的产品安全漏洞(20220926-20221009)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247492467&idx=2&sn=0a7b41047158fc6df5edcdc8f65b0222&chksm=fd74d3baca035aac8b5aecbb7b79b12e2484f59a7a22cf3147df90912c61ed7dce075d7c603d&scene=58&subscene=0#rd) -- 信息时代的犯罪侦查 - - [获得镜像9、镜像14的幸运网友名单！](https://mp.weixin.qq.com/s?__biz=MzAxNTA4NDAwOQ==&mid=2650736614&idx=1&sn=021abdd7812b427def65daa22fd30b0b&chksm=8382d760b4f55e76b19a5c5a3677be5e2487f37a000efab5909b1ed1c12a5ea37d10909aa877&scene=58&subscene=0#rd) -- 三六零CERT - - [安全事件周报 (09.26-10.09)](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491475&idx=1&sn=d7ffb2144c2602b50d3c39e01887106d&chksm=fe251a92c95293847e0a9c9c975fb459873c6e94cdf7233a3ab153b7f2ca1760877a66a07dd3&scene=58&subscene=0#rd) - - [安全日报（2022.10.10）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491475&idx=2&sn=f845d4d08fef759c45dbc72bcb5e80e3&chksm=fe251a92c95293846fb5985665fbd81a8b7c51b7af5390fd106ade79f8ea89f17423dfd284b4&scene=58&subscene=0#rd) -- 默安科技 - - [他们走进了你身边的网安故事，为的是……](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247494404&idx=1&sn=d8c87fa06f26d2ad92b8a1a46836122e&chksm=e93b1c26de4c95305204ca4c14273e1fbdb6370dbc02e07e389a405a09d5164422502abc78a8&scene=58&subscene=0#rd) -- 安全牛 - - [让安全专家也头疼的7种物联网设备](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119058&idx=1&sn=7dd444633b9533aedb70ea90bd001335&chksm=bd146d018a63e41740e20d4b06d6be59f9d5dec12df95ce051a0db02549c2fd4de5f24916b22&scene=58&subscene=0#rd) - - [产业观察丨永安在线宣布完成新一轮4000万元融资](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119058&idx=2&sn=b853131f905ea72b530854e90739c1d0&chksm=bd146d018a63e41793d728148e02234e3b625b1be7f24bb71ae911ac4c8fcc1702bbc6a67531&scene=58&subscene=0#rd) - - [安全头条 |《网络安全标准实践指南—健康码防伪技术指南》发布；国内首个车联网安全自动驾驶开放测试道路项目建成](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119058&idx=3&sn=4766bd52c9d3917991e6c9585873a3ab&chksm=bd146d018a63e417f011cde6dcacc4bd67af879129bb4aa53b99286795f34af710ed69720282&scene=58&subscene=0#rd) -- 火绒安全实验室 - - [激活工具带毒，静默安装360、2345系列软件](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247510022&idx=1&sn=138508f0557e04d69e8e6f843a09aa4b&chksm=eb707639dc07ff2fd71323c5cffe6147134b045b896fc178e7887ab3ee41eb1b7b44986c0b6d&scene=58&subscene=0#rd) -- 吴鲁加 - - [食堂的故事](https://mp.weixin.qq.com/s?__biz=Mzg5NDY4ODM1MA==&mid=2247484217&idx=1&sn=c2ad3405a60a328981f82256103126fc&chksm=c01a8e08f76d071ec249b3d224b78cba31000045812ac718cd8fc3a4bd803b7df0a65eb0b41b&scene=58&subscene=0#rd) -- 杨龙 - - [error: ‘RSA_SSLV23_PADDING’ undeclared](https://www.yanglong.pro/error-rsa_sslv23_padding-undeclared/) - - [bash: ps: command not found](https://www.yanglong.pro/bash-ps-command-not-found/) - - [100万个TCP空链接，要多少内存？](https://www.yanglong.pro/100%e4%b8%87%e4%b8%aatcp%e7%a9%ba%e9%93%be%e6%8e%a5%ef%bc%8c%e8%a6%81%e5%a4%9a%e5%b0%91%e5%86%85%e5%ad%98%ef%bc%9f/) - - [关于RabbitMQ消费者手动ack](https://www.yanglong.pro/%e5%85%b3%e4%ba%8erabbitmq%e6%b6%88%e8%b4%b9%e8%80%85%e6%89%8b%e5%8a%a8ack/) diff --git a/archive/2022/2022-10-12.md b/archive/2022/2022-10-12.md deleted file mode 100644 index 2e0f1ef5d0..0000000000 --- a/archive/2022/2022-10-12.md +++ /dev/null @@ -1,184 +0,0 @@ -# 每日安全资讯（2022-10-12） - -- Sploitus.com Exploits RSS Feed - - [MapTool v1.11.5 - Cross Site Scripting Vulnerabilities exploit](https://sploitus.com/exploit?id=VULNERABLE:2319&utm_source=rss&utm_medium=rss) - - [RRX IOB LP v1.0 - DNS Cache Snooping Vulnerability exploit](https://sploitus.com/exploit?id=VULNERABLE:2261&utm_source=rss&utm_medium=rss) - - [Vicidial v2.14-783a - Multiple XSS Web Vulnerabilities exploit](https://sploitus.com/exploit?id=VULNERABLE:2311&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Facade Ignition exploit](https://sploitus.com/exploit?id=02C11241-781D-5142-A562-1315AFB6C819&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Microsoft exploit](https://sploitus.com/exploit?id=5C16D945-0879-5E51-B2AF-B106F633656A&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Initialization in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=5B6399A2-4BE1-55C2-B52E-714DB41A498A&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=D7FAABC0-C6C7-55D7-B5DB-C0585EB16921&utm_source=rss&utm_medium=rss) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [JSON Web Token (JWT) Weaknesses](https://blog.qualys.com/category/vulnerabilities-threat-research) - - [October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities with 13 Critical, plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities with 17 Critical.](https://blog.qualys.com/category/vulnerabilities-threat-research) -- SecWiki News - - [SecWiki News 2022-10-11 Review](http://www.sec-wiki.com/?2022-10-11) -- Tenable Blog - - [Microsoft’s October 2022 Patch Tuesday Addresses 84 CVEs (CVE-2022-41033)](https://www.tenable.com/blog/microsofts-october-2022-patch-tuesday-addresses-84-cves-cve-2022-41033) - - [CISOs Tell All: Everything You’ve Ever Wanted To Know About CISOs in 2022](https://www.tenable.com/blog/cisos-tell-all-everything-youve-ever-wanted-to-know-about-cisos-in-2022) -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-6875-01](https://packetstormsecurity.com/files/168695/RHSA-2022-6875-01.txt) - - [Red Hat Security Advisory 2022-6872-01](https://packetstormsecurity.com/files/168694/RHSA-2022-6872-01.txt) - - [Red Hat Security Advisory 2022-6878-01](https://packetstormsecurity.com/files/168693/RHSA-2022-6878-01.txt) - - [Red Hat Security Advisory 2022-6855-01](https://packetstormsecurity.com/files/168692/RHSA-2022-6855-01.txt) - - [Red Hat Security Advisory 2022-6856-01](https://packetstormsecurity.com/files/168691/RHSA-2022-6856-01.txt) - - [Red Hat Security Advisory 2022-6854-01](https://packetstormsecurity.com/files/168690/RHSA-2022-6854-01.txt) - - [Ubuntu Security Notice USN-5669-1](https://packetstormsecurity.com/files/168689/USN-5669-1.txt) - - [Ubuntu Security Notice USN-5667-1](https://packetstormsecurity.com/files/168688/USN-5667-1.txt) - - [Ubuntu Security Notice USN-5668-1](https://packetstormsecurity.com/files/168687/USN-5668-1.txt) - - [Ubuntu Security Notice USN-5669-2](https://packetstormsecurity.com/files/168686/USN-5669-2.txt) - - [Ubuntu Security Notice USN-5657-1](https://packetstormsecurity.com/files/168685/USN-5657-1.txt) - - [Ubuntu Security Notice USN-5665-1](https://packetstormsecurity.com/files/168684/USN-5665-1.txt) - - [Ubuntu Security Notice USN-5666-1](https://packetstormsecurity.com/files/168683/USN-5666-1.txt) - - [American Fuzzy Lop plus plus 4.04c](https://packetstormsecurity.com/files/168680/AFLplusplus-4.04c.tar.gz) - - [OpenSSL Toolkit 3.0.6](https://packetstormsecurity.com/files/168681/openssl-3.0.6.tar.gz) - - [OpenSSL Toolkit 1.1.1r](https://packetstormsecurity.com/files/168682/openssl-1.1.1r.tar.gz) -- 跳跳糖 - 安全与分享社区 - - [Weblogic Analysis Attacked by T3 Protocol From CVE (part 1)](https://tttang.com/archive/1768/) -- 安全客-有思想的安全新媒体 - - [反诈态势情报 | 远控技术的应用趋势，以及窝点黑产设备的监控和打击对策](https://www.anquanke.com/post/id/281496) - - [网络安全主管难以维护公司安全](https://www.anquanke.com/post/id/281418) - - [现代医院网络安全管理面临的挑战和对策](https://www.anquanke.com/post/id/281413) - - [学习笔记 | Spring Security RegexRequestMatcher 认证绕过及转发流程](https://www.anquanke.com/post/id/281421) - - [“致命”Caffeine允许任何人发起Microsoft 365网络钓鱼攻击](https://www.anquanke.com/post/id/281526) - - [暗网市场BidenCash免费送出120万张“信用卡”](https://www.anquanke.com/post/id/281513) - - [数字安全观察每周简报【行业动态篇】2022.09.21-2022.09.27](https://www.anquanke.com/post/id/281482) - - [ITI发布人工智能系统透明度建议](https://www.anquanke.com/post/id/281408) - - [违反数据保护和营销法，英零售商Easylife被罚170万美元](https://www.anquanke.com/post/id/281515) - - [针对U盘文件的盗与防攻略](https://www.anquanke.com/post/id/281144) - - [俄罗斯黑客曝猛料，称美国参与研制新冠病毒](https://www.anquanke.com/post/id/281503) - - [美媒：美国14家机场遭俄黑客攻击 网站无法打开](https://www.anquanke.com/post/id/281499) - - [新西兰一网络公司遭黑客攻击！45万人医疗数据流入暗网](https://www.anquanke.com/post/id/281501) -- 安全脉搏 - - [Java 反序列化之 C3P0 链学习](https://www.secpulse.com/archives/188871.html) - - [浅析 Linux Dirty Cred 新型漏洞利用方式](https://www.secpulse.com/archives/188840.html) -- Security Boulevard - - [Web Automation with NodeJS](https://securityboulevard.com/2022/10/web-automation-with-nodejs/) - - [SafeBreach Coverage for #ProxyNotShell Vulnerabilities CVE-2022-41040 and CVE-2022-41082](https://securityboulevard.com/2022/10/safebreach-coverage-for-proxynotshell-vulnerabilities-cve-2022-41040-and-cve-2022-41082/) - - [Microsoft Patch Tuesday, October 2022 Edition](https://securityboulevard.com/2022/10/microsoft-patch-tuesday-october-2022-edition/) - - [KuppingerCole Evaluated 22 Vendors to Help You Make the Right Choice in Customer Identity](https://securityboulevard.com/2022/10/kuppingercole-evaluated-22-vendors-to-help-you-make-the-right-choice-in-customer-identity/) - - [VERT Threat Alert: October 2022 Patch Tuesday Analysis](https://securityboulevard.com/2022/10/vert-threat-alert-october-2022-patch-tuesday-analysis/) - - [Contrast Security expands its GitHub coverage with new SCA GitHub Action](https://securityboulevard.com/2022/10/contrast-security-expands-its-github-coverage-with-new-sca-github-action/) - - [Why SMBs Should Explore MDR](https://securityboulevard.com/2022/10/why-smbs-should-explore-mdr/) - - [Uber Breach and the Need for Data Visibility](https://securityboulevard.com/2022/10/uber-breach-and-the-need-for-data-visibility/) - - [BSidesLV 2022 Lucky13 GroundTruth – Emily Austin’s ‘Back To Basics: Using Descriptive Statistics To Study The Shape Of The Internet’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundtruth-emily-austins-back-to-basics-using-descriptive-statistics-to-study-the-shape-of-the-internet/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [“扫码免费领空气炸锅”可信吗？我帮你试过了，没错，领到了空气…](https://www.4hou.com/posts/oJ9K) - - [反诈态势情报 | 远控技术的应用趋势，以及窝点黑产设备的监控和打击对策](https://www.4hou.com/posts/9XP4) - - [新品发布 | 春秋云境.com重磅上线，网络安全实战“元宇宙”等你来体验](https://www.4hou.com/posts/mXgA) - - [通过 HTTP 请求走私窃取活动目录凭据](https://www.4hou.com/posts/r7p6) - - [游戏机黑客披露了“实际上无法修补”的PS4/PS5 漏洞](https://www.4hou.com/posts/mXVp) - - [匿名网络追踪溯源机制及方法](https://www.4hou.com/posts/50XZ) - - [11月2日-4日，2022年第四届国际工业信息安全应急大会重新启动！](https://www.4hou.com/posts/jJNz) -- Twitter @Nicolas Krassas - - [RT Mustafa Can İPEKÇİ: It appears that Microsoft Azure made some changes for](https://twitter.com/mcipekci/status/1579981331072966656) - - [Uncovering Siemens SIMATIC S7-1200/1500 Hardcoded Cryptographic Keys in PLCs](https://twitter.com/Dinosn/status/1579893810355896321) - - [iPhones Calling 911 From Owners' Pockets On Rollercoasters](https://twitter.com/Dinosn/status/1579893697126494208) - - [A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the ...](https://twitter.com/Dinosn/status/1579824884796239873) - - [This project was built by pentesters for pentesters. Redeye is a tool intended to help you manage your data during a pentest operation in the most eff...](https://twitter.com/Dinosn/status/1579824485217501184) - - [monomorph: MD5-Monomorphic Shellcode Packer](https://twitter.com/Dinosn/status/1579823972753244160) - - [If you're wondering why Google blew $5b on Mandiant, this may shed some light](https://twitter.com/Dinosn/status/1579823849956573184) - - [Inserting a Backdoor into a Machine-Learning System](https://twitter.com/Dinosn/status/1579816744876937216) - - [Researchers Detail Critical RCE Flaw Reported in Popular vm2 JavaScript Sandbox](https://twitter.com/Dinosn/status/1579816692796248066) - - [Researchers Warn of New Phishing-as-a-Service Being Used by Cyber Criminals](https://twitter.com/Dinosn/status/1579816647430635520) - - [Understanding Kerberoasting](https://twitter.com/Dinosn/status/1579778110077431808) - - [Fake Solana Phantom security updates push crypto-stealing malware](https://twitter.com/Dinosn/status/1579778058374221825) - - [EvilnoVNC - Ready To Go Phishing Platform](https://twitter.com/Dinosn/status/1579777943483867136) - - [Researchers have developed CVE-2022-40684 PoC exploit code](https://twitter.com/Dinosn/status/1579777806569209856) - - [Harley Malware: New Attack on Android Devices](https://twitter.com/Dinosn/status/1579777711866015744) - - [sandfly-entropyscan: detect packed or encrypted binaries related to malware](https://twitter.com/Dinosn/status/1579777632627200000) - - [Toyota dev left key to customer info on public GitHub page for five years](https://twitter.com/Dinosn/status/1579777559218520064) - - [Fortinet Warns of Active Exploitation of Newly Discovered Critical Auth Bypass Bug](https://twitter.com/Dinosn/status/1579777532458856449) - - [RT Dare Obasanjo: So many body blows in the EU crypto regulation • NFTs to be treated as securities • stablecoin companies will have capital require...](https://twitter.com/Carnage4Life/status/1579674730290118656) -- Recent Commits to cve:main - - [Update Tue Oct 11 10:15:51 UTC 2022](https://github.com/trickest/cve/commit/bf4752e2d67f85748c93f388b32d7b6bdbc6bcc4) -- paper - Last paper - - [HTML 附件成为恶意邮件的常用手段](https://paper.seebug.org/1983/) - - [MiraclePtr UAF 漏洞利用缓解技术介绍](https://paper.seebug.org/1982/) -- gynvael.coldwind//vx.log (en) - - [Hello World under the microscope](https://gynvael.coldwind.pl/?id=754) -- Jiajun的编程随想 - - [OAuth 2 详解（五）：Device Authorization Flow](https://jiajunhuang.com/articles/2022_10_11-oauth2_explained_device_code.md.html) -- SAP Blogs - - [SAP BW/4HANA extraction for SAP S/4HANA On-premise for Group Reporting](https://blogs.sap.com/2022/10/11/sap-bw-4hana-extraction-for-sap-s-4hana-on-premise-for-group-reporting/) - - [SAP Data Warehouse Cloud SAP HANA Cloud HDI Automation CI/CD Pipelines Details](https://blogs.sap.com/2022/10/11/sap-data-warehouse-cloud-sap-hana-cloud-hdi-automation-ci-cd-pipelines-details/) - - [SAP Document and Reporting Compliance: Withholding Tax Reports Implementation Leading Note](https://blogs.sap.com/2022/10/11/sap-document-and-reporting-compliance-withholding-tax-reports-implementation-leading-note/) - - [SAP Document and Reporting Compliance: Nota Principal para los Reportes de Retenciones](https://blogs.sap.com/2022/10/11/sap-document-and-reporting-compliance-nota-principal-para-los-reportes-de-retenciones/) - - [2022 SAP for Utilities Recap](https://blogs.sap.com/2022/10/11/2022-sap-for-utilities-recap/) - - [System Replacement – Analysis for Microsoft Office](https://blogs.sap.com/2022/10/11/system-replacement-analysis-for-microsoft-office/) -- Malwarebytes Labs - - [An 18 year scam odyssey of stranded astronauts](https://www.malwarebytes.com/blog/news/2022/10/an-18-year-scam-odyssey-of-stranded-astronauts) - - [Security awareness campaign highlights things your bank will never say](https://www.malwarebytes.com/blog/news/2022/10/security-awareness-campaign-highlights-things-your-bank-will-never-say) - - [Smart lights vulnerable to "blink and you'll miss it" attack](https://www.malwarebytes.com/blog/news/2022/10/smart-lighting-system-suffers-a-blink-and-youll-miss-it-attack) -- Horizon3.ai - - [FortiOS, FortiProxy, and FortiProxySwitchManager Authentication Bypass IOCs (CVE-2022-40684)](https://www.horizon3.ai/fortinet-iocs-cve-2022-40684/) -- SentinelOne - - [S Ventures Invests in Laminar, a Cloud Data Security Pioneer](https://www.sentinelone.com/blog/s-ventures-invests-in-laminar-a-cloud-data-security-pioneer/) -- 博客园 - admin-神风 - - [RASP的安全攻防研究实践 - admin-神风](https://www.cnblogs.com/wh4am1/p/16780056.html) -- Intigriti - - [Intigriti’s Trust Center: An open view into how we keep you safe](https://blog.intigriti.com/2022/10/11/intigriti-trust-center/) -- Reverse Engineering - - [How classical attacks reverse engineering apply to Flutter apps, a game cheating case study](https://www.reddit.com/r/ReverseEngineering/comments/y17gas/how_classical_attacks_reverse_engineering_apply/) - - [How classical attacks apply to Flutter apps](https://www.reddit.com/r/ReverseEngineering/comments/y19izp/how_classical_attacks_apply_to_flutter_apps/) -- Bug Bounty in InfoSec Write-ups on Medium - - [Why do Deserialization Vulnerabilities occur?](https://infosecwriteups.com/why-do-deserialization-vulnerabilities-occur-577aafd39785?source=rss----7b722bfd1b8d--bug_bounty) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-10-10 - Qakbot (Qbot) with Cobalt Strike](https://www.malware-traffic-analysis.net/2022/10/10/index.html) -- The Daily Swig | Cybersecurity news and views - - [Hidden DNS resolver insecurity creates widespread website hijack risk](https://portswigger.net/daily-swig/hidden-dns-resolver-insecurity-creates-widespread-website-hijack-risk) -- 绿盟科技技术博客 - - [【顶会论文分析】模型劫持攻击](http://blog.nsfocus.net/model-hijacking-attack/) -- FreeBuf网络安全行业门户 - - [Canary保护机制及绕过](https://www.freebuf.com/articles/system/346608.html) - - [FreeBuf早报 | 奇虎和大疆被美方列入黑名单；英国建立“国防网络学院”](https://www.freebuf.com/news/346601.html) - - [《信息安全技术 智能手机预装应用程序基本安全要求（征求意见稿）》发布](https://www.freebuf.com/news/346595.html) - - [定制CIS 2022冰阔落，就送周边大礼包](https://www.freebuf.com/fevents/346555.html) - - [美国多个机场因网络攻击发生故障，和俄罗斯有关？](https://www.freebuf.com/news/346538.html) -- KitPloit - PenTest & Hacking Tools - - [Monkey365 - Tool For Security Consultants To Easily Conduct Not Only Microsoft 365, But Also Azure Subscriptions And Azure Active Directory Security Configuration Reviews](http://www.kitploit.com/2022/10/monkey365-tool-for-security-consultants.html) -- Twitter @Keiran Smith (Affix) - - [RT ITNEXT: Evasion Techniques — Hiding your process from `ps` by @cli at #ITNEXT. #cprogramming #redteaming #evasion #hooking #pentesting](https://twitter.com/ITNEXT_io/status/1579773835238199299) -- Blog - Praetorian - - [Six Months of Finding Secrets with Nosey Parker](https://www.praetorian.com/blog/six-months-of-finding-secrets-with-nosey-parker/) -- 博客园 - 郑瀚Andrew - - [村镇特色旅游资源开发与保护 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16778777.html) -- HackerNews - - [暗网市场 BidenCash 公开超 120 万信用卡用户信息](https://hackernews.cc/archives/41837) - - [美国多个机场因网络攻击发生故障，和俄罗斯有关？](https://hackernews.cc/archives/41831) - - [研究人员详细介绍了网络间谍组织 Earth Aughisky 使用的恶意工具](https://hackernews.cc/archives/41825) - - [Fortinet 产品中的 CVE-2022-40684 漏洞正被在野利用](https://hackernews.cc/archives/41823) - - [伊朗社会抗议引发信息战：国家电视台又遭篡改 播放“杀死最高领袖”](https://hackernews.cc/archives/41821) - - [2K 确认一些用户数据被窃和用于出售](https://hackernews.cc/archives/41818) -- 我的安全梦 - - [红队方向产品研究分析报告](https://mp.weixin.qq.com/s?__biz=MzU3NDY1NTYyOQ==&mid=2247485386&idx=1&sn=f7a5bc139464fcaa6ffd97a90f039334&chksm=fd2e5a28ca59d33ea7ca66e3ee6a6f523bafe9dd5510da68d0561e9e8a5b1266a3086971c8d9&scene=58&subscene=0#rd) -- Checkmarx.com - - [Customers Have Spoken: Checkmarx is a 2022 Gartner® Peer Insights™ Customers’ Choice for Application Security Testing for Fourth Consecutive Year](https://checkmarx.com/press-releases/customers-have-spoken-checkmarx-is-a-2022-gartner-peer-insights-customers-choice-for-application-security-testing-for-fourth-consecutive-year/) - - [The Votes Are In: Checkmarx Named a 2022 Gartner® Peer Insights™ Customers’ Choice for AST](https://checkmarx.com/blog/the-votes-are-in-checkmarx-named-a-2022-gartner-peer-insights-customers-choice-for-ast/) -- 雷神众测 - - [雷神众测助力｜第六届安全开发者峰会，10月23日上海见！](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652500014&idx=1&sn=f3189fed8a614bd90043c50d30777123&chksm=f258539dc52fda8b0b71de280d9f7b1ccd2b46b385b8aa7fba607605936d219e15ff0352e172&scene=58&subscene=0#rd) -- 火线Zone - - [使用自定义云容器在 Azure Functions 中增强云安全性](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247496839&idx=1&sn=28d7201c58dda9c62bf73d8c3f0ec6ce&chksm=eaa97ca7dddef5b173891e0a7f1b94a6acfb28bcebb9e8963989f6c7d11995f36e57f6c049f0&scene=58&subscene=0#rd) -- 安全圈 - - [【安全圈】每条个人信息卖五毛，团伙被抓后发现1500万资产！](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020254&idx=1&sn=b3e9ef3dc066b70b23b8b5192a4e8728&chksm=f36fb25ec4183b48da91c4e0d3d8e52a9f372b3c48abb34197419a92e3441ea97b121eb38220&scene=58&subscene=0#rd) - - [【安全圈】美国14家机场遭俄黑客攻击 网站无法打开](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020254&idx=2&sn=de6027cc9cac7ebc45a1756923396872&chksm=f36fb25ec4183b48a09da53169ada71d15d9ed312f15acc41e3eb2fe49957806eef9c749e164&scene=58&subscene=0#rd) - - [【安全圈】macOS Archive 工具漏洞](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020254&idx=3&sn=ce1a2a77f4185c5fd8b146e3b3cd790d&chksm=f36fb25ec4183b4830c7a78a61ce39ec4333a9dde92466c334547374640ede9f58283c218f67&scene=58&subscene=0#rd) - - [【安全圈】美国第四大医疗系统疑似遭勒索软件攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020254&idx=4&sn=a261d5f065088f217fd04d82a984c409&chksm=f36fb25ec4183b48d12f6f3c82e7714e16e25471afbc5e07b94765b7610136213d1d05acfa97&scene=58&subscene=0#rd) -- 天融信阿尔法实验室 - - [每日攻防资讯简报[Oct.11th]](https://mp.weixin.qq.com/s?__biz=Mzg3MDAzMDQxNw==&mid=2247495878&idx=1&sn=7c72c89b4992222d6910570488399fc6&chksm=ce96bdf8f9e134ee89460b6428d017ea6fb5be014d8e2309a498989a626865a93da00e5dff79&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [Blender 加入对 Wayland 的支持](https://www.solidot.org/story?sid=73026) - - [特斯拉和比亚迪电动车交付量破记录](https://www.solidot.org/story?sid=73025) - - [科学家发现女性更容易患阿尔茨海默氏症的机制](https://www.solidot.org/story?sid=73024) - - [Firefox 如何改进 macOS 版本的响应](https://www.solidot.org/story?sid=73023) - - [访问密钥在 GitHub 暴露五年后丰田警告数据泄露](https://www.solidot.org/story?sid=73022) - - [调查显示逾四成 Windows PC 无法升级到 Windows 11](https://www.solidot.org/story?sid=73021) - - [ISC DHCP Server 寿命终止](https://www.solidot.org/story?sid=73020) - - [PC 出货量三季度同比下降近 20%](https://www.solidot.org/story?sid=73019) - - [统计显示大规模抗议活动的成功率越来越低](https://www.solidot.org/story?sid=73018) - - [科学家在癌症肿瘤中发现真菌](https://www.solidot.org/story?sid=73017) - - [Stoke Space 试图设计出完全可重复使用的火箭](https://www.solidot.org/story?sid=73016) - - [Google Pixel 再次遭遇无法拨打急救电话的问题](https://www.solidot.org/story?sid=73015) - - [美国陆军将使用 Google Workspace 服务](https://www.solidot.org/story?sid=73014) - - [VirtualBox 7.0.0 释出支持完全加密](https://www.solidot.org/story?sid=73013) - - [Yuri Milner 放弃俄罗斯国籍](https://www.solidot.org/story?sid=73012) diff --git a/archive/2022/2022-10-13.md b/archive/2022/2022-10-13.md deleted file mode 100644 index f7750d274d..0000000000 --- a/archive/2022/2022-10-13.md +++ /dev/null @@ -1,201 +0,0 @@ -# 每日安全资讯（2022-10-13） - -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=33F59131-F1BD-56AB-8BB7-C960EFF9223C&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Initialization in Linux Linux Kernel exploit](https://sploitus.com/exploit?id=18A0ECF1-D699-5318-9A70-6E1902FB2119&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-40471 exploit](https://sploitus.com/exploit?id=AFF2402E-57B2-57D9-A94F-8E088095B4BB&utm_source=rss&utm_medium=rss) -- Der Flounder - - [Building Jamf Pro smart groups for Ventura-compatible and Ventura-incompatible Mac models](https://derflounder.wordpress.com/2022/10/12/building-jamf-pro-smart-groups-for-ventura-compatible-and-ventura-incompatible-mac-models/) -- Vulnerabilities and Threat Research – Qualys Security Blog - - [Creating Awareness of External JavaScript Libraries in Web Applications](https://blog.qualys.com/category/vulnerabilities-threat-research) -- Security Boulevard - - [Spanning Backup Earns Top 10 Ranking for SaaS Backup Solutions in G2’s Fall 2022 Report](https://securityboulevard.com/2022/10/spanning-backup-earns-top-10-ranking-for-saas-backup-solutions-in-g2s-fall-2022-report/) - - [Voices from Validate – Preparing to Prevent Disruption](https://securityboulevard.com/2022/10/voices-from-validate-preparing-to-prevent-disruption/) - - [BSidesLV 2022 Lucky13 GroundFloor – Russell Thomas’ And Christopher Vos’ ‘Lessons Learned While Modeling Rare Catastrophic Cyber Loss Events’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundfloor-russell-thomas-and-christopher-vos-lessons-learned-while-modeling-rare-catastrophic-cyber-loss-events/) - - [Secrets in code combined with code leaks exposed data for 300,000 Toyota customers](https://securityboulevard.com/2022/10/secrets-in-code-combined-with-code-leaks-exposed-data-for-300000-toyota-customers/) - - [Breakwater Revolutionizes Data Privacy Market with an Efficient, Cost-Effective Solution for Companies Who Need to Manage Unstructured Data](https://securityboulevard.com/2022/10/breakwater-revolutionizes-data-privacy-market-with-an-efficient-cost-effective-solution-for-companies-who-need-to-manage-unstructured-data/) - - [DevOps lesson from Toyota FAIL: Crash test secrets](https://securityboulevard.com/2022/10/devops-lesson-from-toyota-fail-crash-test-secrets/) - - [Threat Hunting Workshop: Hunting for Execution](https://securityboulevard.com/2022/10/threat-hunting-workshop-hunting-for-execution/) - - [Google Cybersecurity Action Team Threat Horizons Report #4 Is Out!](https://securityboulevard.com/2022/10/google-cybersecurity-action-team-threat-horizons-report-4-is-out/) - - [The Four Horsemen of Network Security](https://securityboulevard.com/2022/10/the-four-horsemen-of-network-security/) - - [XKCD ‘Archimedes Principle’](https://securityboulevard.com/2022/10/xkcd-archimedes-principle/) -- Files ≈ Packet Storm - - [Ubuntu Security Notice USN-5671-1](https://packetstormsecurity.com/files/168698/USN-5671-1.txt) - - [Ubuntu Security Notice USN-5670-1](https://packetstormsecurity.com/files/168697/USN-5670-1.txt) - - [Red Hat Security Advisory 2022-6890-01](https://packetstormsecurity.com/files/168696/RHSA-2022-6890-01.txt) -- Microsoft Security Blog - - [5 cybersecurity capabilities announced at Microsoft Ignite 2022 to help you secure more with less](https://www.microsoft.com/security/blog/2022/10/12/5-cybersecurity-capabilities-announced-at-microsoft-ignite-2022-to-help-you-secure-more-with-less/) - - [Introducing new Microsoft Defender for Cloud innovations to strengthen cloud-native protections](https://www.microsoft.com/security/blog/2022/10/12/introducing-new-microsoft-defender-for-cloud-innovations-to-strengthen-cloud-native-protections/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Authenticated Sql Injection in ImpressCMS v1.4.3](https://cxsecurity.com/issue/WLB-2022100033) - - [Online Shopping System Advanced 1.0 SQL Injection](https://cxsecurity.com/issue/WLB-2022100032) - - [Indonesia Web Master Driver 1.0 - Shell Upload](https://cxsecurity.com/issue/WLB-2022100031) -- Jiajun的编程随想 - - [OAuth 2 详解（六）：Authorization Code Flow with PKCE](https://jiajunhuang.com/articles/2022_10_12-oauth2_explained_authorization_code_pkce.md.html) -- Twitter @Nicolas Krassas - - [RT Ahsan Khan: IDOR Checklist](https://twitter.com/hunter0x7/status/1580211248037126145) - - [Monkey365 - Tool For Security Consultants To Easily Conduct Not Only Microsoft 365, But Also Azure Subscriptions And Azure Active Directory Security C...](https://twitter.com/Dinosn/status/1580206734253391872) - - [A deep dive into CVE-2021–42847 - arbitrary file write and XXE in ManageEngine ADAudit Plus before 7006](https://twitter.com/Dinosn/status/1580206617840484352) - - [[CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution](https://twitter.com/Dinosn/status/1580199669774553088) - - [Cerberus Stress Testing Tool](https://twitter.com/Dinosn/status/1580199577780559873) - - [RT Erik Wynter: I published another exploit writeup! It's a deep dive into CVE-2021-42847, a critical ManageEngine ADAudit Plus vuln that had no avail...](https://twitter.com/WynterErik/status/1580196044398157824) - - [Custom scan profiles for use with Burp Suite Pro](https://twitter.com/Dinosn/status/1580173019166621698) - - [This repository includes code and IoCs that are the product of research done in Akamai's various security research teams.](https://twitter.com/Dinosn/status/1580172669185511429) - - [A Highly capable Pe Packer](https://twitter.com/Dinosn/status/1580172381708234753) - - [Recovering Passwords by Measuring Residual Heat](https://twitter.com/Dinosn/status/1580167759270678528) - - [Google Forms abused in new COVID-19 phishing wave in the U.S.](https://twitter.com/Dinosn/status/1580167693906640896) - - [Critical Bug in Siemens SIMATIC PLCs Could Let Attackers Steal Cryptographic Keys](https://twitter.com/Dinosn/status/1580167644056952832) - - [Android leaks some traffic even when 'Always-on VPN' is enabled](https://twitter.com/Dinosn/status/1580147990500560896) - - [On Bypassing eBPF Security Monitoring](https://twitter.com/Dinosn/status/1580147936431788033) - - [CVE-2022-24697: Apache Kylin Command Injection Vulnerability](https://twitter.com/Dinosn/status/1580147634513522690) - - [Analysing LastPass, Part 1](https://twitter.com/Dinosn/status/1580147591014100994) - - [Userland Execution of Binaries Directly from Python](https://twitter.com/Dinosn/status/1580147488341708800) - - [RT Blaklis: It's Magento patch time. Critical vulnerability (CVSS 10) I reported patched in the last version - please patch your version as soon as po...](https://twitter.com/Blaklis_/status/1580134439778414593) -- paper - Last paper - - [CVE-2022-24112 Apache APISIX 远程代码执行漏洞](https://paper.seebug.org/1984/) -- 安全客-有思想的安全新媒体 - - [互联网基础资源治理的十点认知](https://www.anquanke.com/post/id/281620) - - [以色列网络安全人才培养理念、实践及特点剖析](https://www.anquanke.com/post/id/281667) - - [迈向量子安全时代，万事达卡推出抗量子非接触式支付卡](https://www.anquanke.com/post/id/281607) - - [思科发布处理黑客入侵思科设备事件响应人员指南](https://www.anquanke.com/post/id/281649) - - [浅谈Web源码泄漏](https://www.anquanke.com/post/id/281545) - - [消息称PC需求放缓英特尔计划裁员数千人](https://www.anquanke.com/post/id/281628) - - [十大未归因APT攻击之谜](https://www.anquanke.com/post/id/281615) - - [加快推进我国数字法治政府建设的建议](https://www.anquanke.com/post/id/281610) - - [数字安全观察每周简报【技术趋势篇】2022.09.21-2022.09.27](https://www.anquanke.com/post/id/281487) - - [哈佛商业出版社土耳其分公司遭勒索攻击](https://www.anquanke.com/post/id/281555) -- 安全脉搏 - - [蓝队【研判专题】莽就对了，三板斧！](https://www.secpulse.com/archives/188961.html) - - [【漏洞预警】Fortinet多个产品身份验证绕过漏洞](https://www.secpulse.com/archives/188957.html) - - [浅谈Web源码泄漏](https://www.secpulse.com/archives/188924.html) - - [新型蜜罐有哪些？未来方向如何？](https://www.secpulse.com/archives/188915.html) -- Trustwave Blog - - [Trustwave's David Broggy Receives Microsoft's Most Valuable Professional Award](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/trustwaves-david-broggy-receives-microsofts-most-valuable-professional-award/) -- 跳跳糖 - 安全与分享社区 - - [浅析Apache Commons Jxpath命令执行分析(CVE-2022-41852)](https://tttang.com/archive/1771/) -- Blog & What's New | Offensive Security - - [See Yourself in Cyber with OffSec: Security Operations](https://www.offensive-security.com/offsec/see-yourself-in-security-operations/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [三大黑产组织情报！邮件钓鱼背后操控的缅北魔方G组织](https://www.4hou.com/posts/nJll) - - [【技术原创】Sophos XG漏洞调试环境搭建](https://www.4hou.com/posts/VZZM) - - [Intel确认Alder Lake BIOS的源代码泄露](https://www.4hou.com/posts/4KP0) -- NowSecure - - [5 Surefire Ways to Reduce Mobile AppSec Testing Costs](https://www.nowsecure.com/blog/2022/10/12/5-surefire-ways-to-reduce-mobile-appsec-testing-costs/) -- SecWiki News - - [SecWiki News 2022-10-12 Review](http://www.sec-wiki.com/?2022-10-12) -- Sucuri Blog - - [SiteCheck Malware Trends Report – Q3 2022](https://blog.sucuri.net/2022/10/sitecheck-malware-trends-report-2022-q3.html) -- Recent Commits to cve:main - - [Update Wed Oct 12 10:14:49 UTC 2022](https://github.com/trickest/cve/commit/9afe5ebe835fb95db65011c015a756921687d998) -- Forcepoint - - [The Increasingly Complex Threat Landscape Must be Fought with Simplicity](https://www.forcepoint.com/blog/x-labs/fight-complex-threat-landscape-with-simplicity) -- Bug Bounty in InfoSec Write-ups on Medium - - [Critical IDOR Vulnerability on Medium?](https://infosecwriteups.com/critical-idor-vulnerability-on-medium-f78346edbcb1?source=rss----7b722bfd1b8d--bug_bounty) -- SAP Blogs - - [SAP BTP ABAP Environment – Pre-Upgrade Option for Release 2211](https://blogs.sap.com/2022/10/12/sap-btp-abap-environment-pre-upgrade-option-for-release-2211/) - - [SAP Ariba Early Release Series](https://blogs.sap.com/2022/10/12/sap-ariba-early-release-series-6/) - - [UX & Fiori at SAP – is it the same thing?](https://blogs.sap.com/2022/10/12/ux-fiori-at-sap-is-it-the-same-thing/) - - [Stories from SuccessConnect: Why Extensibility Matters to HR](https://blogs.sap.com/2022/10/12/stories-from-successconnect-why-extensibility-matters-to-hr/) - - [ADS configuration](https://blogs.sap.com/2022/10/12/ads-configuration-2/) - - [Process Statuses for eDocuments in Saudi Arabia](https://blogs.sap.com/2022/10/12/process-statuses-for-edocuments-in-saudi-arabia/) - - [ONB-EC Integration: Sending data from Custom Data Collection to the Employee Profile](https://blogs.sap.com/2022/10/12/onb-ec-integration-sending-data-from-custom-data-collection-to-the-employee-profile/) - - [A 1-2 Combination for Knock-Out Supplier Collaboration Success](https://blogs.sap.com/2022/10/12/a-1-2-combination-for-knock-out-supplier-collaboration-success/) - - [Videos from first month of SAP Activate Minute](https://blogs.sap.com/2022/10/12/videos-from-first-month-of-sap-activate-minute/) - - [How to efficiently manage your chart of accounts with help of Expert Worklist and spreadsheet template in SAP S/4HANA Cloud](https://blogs.sap.com/2022/10/12/how-to-efficiently-manage-your-chart-of-accounts-with-help-of-expert-worklist-and-spreadsheet-template-in-sap-s-4hana-cloud/) -- hn security - - [Semgrep rules for Kotlin security assessment](https://security.humanativaspa.it/semgrep-rules-for-kotlin-security-assessment/) -- Securelist - - [Malicious WhatsApp mod distributed through legitimate apps](https://securelist.com/malicious-whatsapp-mod-distributed-through-legitimate-apps/107690/) -- Trail of Bits Blog - - [Porting the Solana eBPF JIT compiler to ARM64](https://blog.trailofbits.com/2022/10/12/solana-jit-compiler-ebpf-arm64/) -- Application Security Blog - - [Open source dependency best practices for developers](https://www.synopsys.com/blogs/software-security/open-source-dependency-best-practices/) -- Sucuri Blog - - [SiteCheck Malware Trends Report – Q3 2022](https://blog.sucuri.net/2022/10/sitecheck-malware-trends-report-2022-q3.html) -- Intigriti - - [Bug Bytes #177 – Hackers descend on Ahmedabad, the hardest CTF and tales of easy P1s](https://blog.intigriti.com/2022/10/12/bug-bytes-177/) - - [Intigriti continues to innovate security testing with a redefined penetration testing offering](https://blog.intigriti.com/2022/10/12/intigriti-continues-innovate-security-testing-redefined-penetration-testing-offering/) -- Twitter @bytehx - - [RT Nicolas Krassas: postMessage Braindump - a brief postMessage testing methodology](https://twitter.com/Dinosn/status/1580116391532720128) - - [RT Dhamu: #bugbountytips #bugbounty CVE-2022–41040 Microsoft Exchange vulnerable to server-side request forgery by @Dhamu_offi](https://twitter.com/Dhamu_offi/status/1580053379744571392) -- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge - - [Dancho Danchev's 2010 Disappearance - Official Complaint Against Harassment Courtesy of Republic of Bulgaria - An OSINT Analysis](https://ddanchev.blogspot.com/2022/10/dancho-danchevs-2010-disappearance.html) -- Malwarebytes Labs - - [UK government sounds alarm on tax scams](https://www.malwarebytes.com/blog/news/2022/10/ukgov-sounds-alarm-on-hmrc-tax-scams) - - [Update now! October patch Tuesday fixes actively used zero-day...but not the one you expected](https://www.malwarebytes.com/blog/news/2022/10/update-now-october-patch-tuesday-fixes-actively-used-zero-day) - - [Top 5 ransomware detection techniques: Pros and cons of each](https://www.malwarebytes.com/blog/business/2022/10/top-5-ransomware-detection-techniques-pros-and-cons-of-each) -- KitPloit - PenTest & Hacking Tools - - [SteaLinG - Open-Source Penetration Testing Framework Designed For Social Engineering](http://www.kitploit.com/2022/10/stealing-open-source-penetration.html) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 八种让人意想不到的数据泄露方式；VMware某漏洞一年仍未修补](https://www.freebuf.com/news/346650.html) - - [近一年时间过去了，VMware的这一漏洞仍悬而未决](https://www.freebuf.com/news/346632.html) - - [键盘残余热量可能泄露密码，20秒内拍下键盘热像图，密码泄露86%](https://www.freebuf.com/articles/database/346627.html) -- 安全牛 - - [安全牛课堂丨一位甲方学员的CISM认证备考经验分享](https://www.aqniu.com/homenews/89876.html) - - [简析纵深防御与零信任的应用对比与发展融合](https://www.aqniu.com/hometop/89875.html) - - [直播预告 | 网安大讲堂（47期）：数据出境安全评估要点解读](https://www.aqniu.com/homenews/89874.html) - - [八种让人“意想不到”的数据泄露方式](https://www.aqniu.com/homenews/89873.html) - - [指掌易丁俊一：保障数字化工作空间安全需要4种关键能力](https://www.aqniu.com/hometop/89872.html) -- HackerNews - - [近一年时间过去了，VMware 的这一漏洞仍悬而未决](https://hackernews.cc/archives/41863) - - [BazarCall 回调网络钓鱼攻击不断更新其社会工程策略](https://hackernews.cc/archives/41854) - - [DeepFakes 成为网络经济犯罪的帮凶](https://hackernews.cc/archives/41847) - - [3000 万元采购威胁检测产品，美国农业部向主动安全转型](https://hackernews.cc/archives/41844) - - [丰田披露 30 万客户个人信息意外泄露事件](https://hackernews.cc/archives/41842) -- Black Hills Information Security - - [POGS at Wild West Hackin’ Fest!](https://www.blackhillsinfosec.com/pogs-at-wild-west-hackin-fest/) -- 博客园 - 郑瀚Andrew - - [关于不同层次消费者的文化产品市场策略 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16782726.html) -- 奇客Solidot–传递最新科技情报 - - [新加坡成为亚洲加密货币金融中心](https://www.solidot.org/story?sid=73039) - - [美国供应商暂停在中国内存厂商的业务](https://www.solidot.org/story?sid=73038) - - [TikTok 从难民的乞求捐款中抽取七成](https://www.solidot.org/story?sid=73037) - - [Firefox OS 复活](https://www.solidot.org/story?sid=73036) - - [NASA 宣布 DART 成功偏转小行星轨道](https://www.solidot.org/story?sid=73035) - - [LHAASO观测到迄今为止最高能伽马射线暴](https://www.solidot.org/story?sid=73034) - - [印度面临抗生素耐药超级病菌的爆发](https://www.solidot.org/story?sid=73033) - - [欧洲人权法庭认为瑞士养老金对男性构成歧视](https://www.solidot.org/story?sid=73032) - - [作者名字对审稿人有巨大影响](https://www.solidot.org/story?sid=73031) - - [晚进食可能增加肥胖风险](https://www.solidot.org/story?sid=73030) - - [编译器/VM项目Animula正式加入HardenedLinux社区](https://www.solidot.org/story?sid=73029) - - [因 PC 需求放缓英特尔计划裁员数千人](https://www.solidot.org/story?sid=73028) - - [Meta 发布 1500 美元的 VR 头显](https://www.solidot.org/story?sid=73027) -- 杨龙 - - [关于update by = count 自己](https://www.yanglong.pro/%e5%85%b3%e4%ba%8eupdate-by-count-%e8%87%aa%e5%b7%b1/) - - [共享锁和排他锁](https://www.yanglong.pro/2842-2/) - - [](https://www.yanglong.pro/2830-2/) -- Microsoft Security Response Center - - [](https://msrc-blog.microsoft.com/2022/10/12/14921/) -- 看雪学院 - - [2022 SDC 议题 | 从后门到漏洞——智能设备私有协议中的安全问题](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458475529&idx=1&sn=e671849b648ae1495d898f2f6d2ce96a&chksm=b18e6c8386f9e5950a273cd6d31bda88a81e428b8a93489476c57810e5c4f0a5262d0d989c48&scene=58&subscene=0#rd) - - [VMProtect3.5模拟x86分支指令je、jne、jge和jl的分析](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458475529&idx=2&sn=d59d371c83e45fa4787d5e2baea980cb&chksm=b18e6c8386f9e59573e5b57d8ea75388f4f71f22b21f469781a8c56aca5f694199a6a1b32d27&scene=58&subscene=0#rd) - - [丰田部分源代码被公开，近30万客户信息泄露](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458475529&idx=3&sn=98da65e74a4e9be3b1b75c684e18f65a&chksm=b18e6c8386f9e595bcc21529b5525684c23cb7de48aebc8860a6b38dc4b2e0877bc19ca4cd07&scene=58&subscene=0#rd) - - [《安卓逆向入门》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458475529&idx=4&sn=2e5ccc62fd726dbeb4cb6691c8f34547&chksm=b18e6c8386f9e595bfc2958c318b980ca409330ca033434d9aee1e94217a7c745fb109063ddc&scene=58&subscene=0#rd) -- 微步在线研究响应中心 - - [东欧黑产频繁攻击金融&制造业的态势分析](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247496497&idx=1&sn=f5ca3b36f2a75ff76292438ebc0781f6&chksm=cfca9025f8bd193330380bdf2ce2f10f864cfd499db0d350cefe7823100ddc11c00bf122dfe0&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [推荐 | 基于C#实现数据库连接字符解密工具](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486611&idx=1&sn=5d5fdb2d3f4b7fe0afcbcd009b821ab9&chksm=fa5aa27ecd2d2b68428fb818e218fb96542e673fbc1b1390c639b74f54eebc8d6d500bc85326&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [加快推进我国数字法治政府建设的建议](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531714&idx=1&sn=70093fb5f134f53cbbc8a799eb02adaf&chksm=c1e9f093f69e7985379fd5e4344676754e19a2c9d6f51060efde703422a7089e6f889b508392&scene=58&subscene=0#rd) - - [八种让人“意想不到”的数据泄露方式](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531714&idx=2&sn=c76450d53b37adcff2779d252391942f&chksm=c1e9f093f69e7985029590dd2b9e060ae05f0da181b15449bd2515e642f9fe77325a16ad2f1a&scene=58&subscene=0#rd) - - [亲俄黑客组织对美国关键基础设施发起大规模攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531714&idx=3&sn=507d7c2983ea7402e9e620c100164eb0&chksm=c1e9f093f69e79856ebdb8da85191539949f7650adb5e6df55d2ebaaba573da13335b6a3509c&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [消费者IoT安全新进展！白宫将推出以能源之星为蓝本的网络安全标签计划](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531881&idx=1&sn=9552b3d7b0f5af3e7ccae2f65bf58d7a&chksm=fa93cba8cde442be35758aacca7ad72e04a223cc02908838af2283a08690e3df842699ffd871&scene=58&subscene=0#rd) - - [美国多个机场因网络攻击发生故障，和俄罗斯有关？](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531881&idx=2&sn=726a341d2ce14df57149d9850fe496ee&chksm=fa93cba8cde442be7f2a3b05195f0f56d0c04852da17930ccf059ce2e8e2360a4ac514d409ca&scene=58&subscene=0#rd) - - [游戏机黑客披露了“实际上无法修补”的PS4/PS5 漏洞](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531881&idx=3&sn=431fbbfdd6d4289044979c28af52d62a&chksm=fa93cba8cde442bee88d05d015a39bcc32594e774108ceff530298c9ebcf698d371be8636943&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [2022第五空间决赛WriteUp｜pwn、reverse、crypto方向合集](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496906&idx=1&sn=779e156280e474fdc4161b184663520e&chksm=fa522174cd25a8628d29f572c076020e46ea9e8be05c35a6a5648033b5469ce4dea54ea91e24&scene=58&subscene=0#rd) -- 青藤技术服务 - - [视频丨老板竟然用方言骂我，IT打工人我该怎么办？](https://mp.weixin.qq.com/s?__biz=MzUyOTkwNTQ5Mg==&mid=2247486343&idx=1&sn=7d9f8931f98e2f3a5919f410ea3975a2&chksm=fa58a9bccd2f20aae1c58b7a95a8d2544977fa644d95ce9dcd1da5da907190a1102ef802e52a&scene=58&subscene=0#rd) -- 极客公园 - - [Meta 推 Quest Pro 头显1499美元；谷歌云接受加密币支付；iPhone 换接口苹果每年丢百亿美元 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652969830&idx=1&sn=7236d526fa864614e3766db5c2b8e422&chksm=7e5466d04923efc66e98b925636c29b24ccf83994cd74b534c63f1734ac03115faf6b7932302&scene=58&subscene=0#rd) -- text/plain - - [Capturing Logs for Debugging SmartScreen](https://textslashplain.com/2022/10/12/capturing-logs-for-debugging-smartscreen/) -- 嘶吼专业版 - - [【技术原创】Sophos XG漏洞调试环境搭建](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247552045&idx=1&sn=97beaa36cf2d426426e8f71be82014ee&chksm=e915dc17de6255012ef33cb9f2dd96090317f048d4650f6f009322c007a6100f330393939bd4&scene=58&subscene=0#rd) - - [Intel确认Alder Lake BIOS的源代码泄露](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247552045&idx=2&sn=d226141639aebbdffb128515464b3f23&chksm=e915dc17de625501bfc28074abbde2017668f6c47cc6bd5d000bbf9589082de2162dd665ca74&scene=58&subscene=0#rd) -- Tide安全团队 - - [安全人必备书《Web安全攻防从入门到精通》正式预售](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247500777&idx=1&sn=6a21bd74a3ebdc7337e4d50db4dcde77&chksm=ce5de188f92a689ea3cdccaeedce1ed8e894288a933ef7d3b30a8ef5a2f2644333693e6a283f&scene=58&subscene=0#rd) -- 情报分析师 - - [【警务情报】欧安组织情报主导警务指南|108页](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518761&idx=1&sn=1a6285be6b989de369527a4e605c2636&chksm=87169aa2b06113b4390033d2b65240d9624d3d49c234ccbb9d56dae06f10fa1e1b72f5b262ca&scene=58&subscene=0#rd) - - [【科技情报】欧洲越来越接近禁止面部识别](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518761&idx=2&sn=744a0b6f8a4db6fac1502beade4b7a7b&chksm=87169aa2b06113b41896f4d7d108764ca709f18ce25d7f9f3efa3214cd0da01af33fa461a3c1&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-14.md b/archive/2022/2022-10-14.md deleted file mode 100644 index 2a2c29b461..0000000000 --- a/archive/2022/2022-10-14.md +++ /dev/null @@ -1,214 +0,0 @@ -# 每日安全资讯（2022-10-14） - -- Files ≈ Packet Storm - - [Red Hat Security Advisory 2022-6941-01](https://packetstormsecurity.com/files/168705/RHSA-2022-6941-01.txt) - - [Ubuntu Security Notice USN-5673-1](https://packetstormsecurity.com/files/168704/USN-5673-1.txt) - - [Red Hat Security Advisory 2022-6801-01](https://packetstormsecurity.com/files/168703/RHSA-2022-6801-01.txt) - - [Ubuntu Security Notice USN-5672-1](https://packetstormsecurity.com/files/168702/USN-5672-1.txt) - - [Red Hat Security Advisory 2022-6921-01](https://packetstormsecurity.com/files/168701/RHSA-2022-6921-01.txt) - - [Red Hat Security Advisory 2022-6916-01](https://packetstormsecurity.com/files/168700/RHSA-2022-6916-01.txt) - - [Red Hat Security Advisory 2022-6805-01](https://packetstormsecurity.com/files/168699/RHSA-2022-6805-01.txt) -- Microsoft Security Blog - - [Microsoft named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Information and Event Management](https://www.microsoft.com/security/blog/2022/10/13/microsoft-named-a-leader-in-the-2022-gartner-magic-quadrant-for-security-information-and-event-management/) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Backdoor.Win32.Bingle.b / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022100036) - - [Joomla KSAdvertiser 2.5.37 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100035) - - [blesta 5.4.1 Backdoor Account Vulnerability](https://cxsecurity.com/issue/WLB-2022100034) -- Recent Commits to cve:main - - [Update Thu Oct 13 10:20:43 UTC 2022](https://github.com/trickest/cve/commit/de7b66133ed00a8ff3b9e87f0b88bc2bb15c22bb) -- Security Boulevard - - [Overheard at The Machine Identity Management Summit 2022](https://securityboulevard.com/2022/10/overheard-at-the-machine-identity-management-summit-2022/) - - [State and Local Governments: Get the Most from Federal Grants for Cybersecurity with CRQ](https://securityboulevard.com/2022/10/state-and-local-governments-get-the-most-from-federal-grants-for-cybersecurity-with-crq/) - - [Here’s How a Well-Protected Site Can Effectively Deter Fraud](https://securityboulevard.com/2022/10/heres-how-a-well-protected-site-can-effectively-deter-fraud/) - - [Cybersecurity Issues in Healthcare: Recent Trends and Solution](https://securityboulevard.com/2022/10/cybersecurity-issues-in-healthcare-recent-trends-and-solution/) - - [BSidesLV 2022 Lucky13 GroundTruth – Adarsh D. Kyadige’s And Konstantin Berlin’s ‘Weeding Out Living-Off-The-Land Attacks At Scale’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundtruth-adarsh-d-kyadiges-and-konstantin-berlins-weeding-out-living-off-the-land-attacks-at-scale/) - - [The Week in Security: Google takes next step on supply chain risk, UK issues software security guidance](https://securityboulevard.com/2022/10/the-week-in-security-google-takes-next-step-on-supply-chain-risk-uk-issues-software-security-guidance/) - - [XKCD ‘Easy or Hard’](https://securityboulevard.com/2022/10/xkcd-easy-or-hard/) - - [New PHP Variant of Ducktail Infostealer Targeting Facebook Business Accounts](https://securityboulevard.com/2022/10/new-php-variant-of-ducktail-infostealer-targeting-facebook-business-accounts/) - - [PHP Variant of Ducktail Targets Facebook Business Accounts](https://securityboulevard.com/2022/10/php-variant-of-ducktail-targets-facebook-business-accounts/) - - [IT Risk Management: How to Get Started with Risk Frameworks](https://securityboulevard.com/2022/10/it-risk-management-how-to-get-started-with-risk-frameworks/) -- Twitter @Nicolas Krassas - - [A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365](https://twitter.com/Dinosn/status/1580645499773722625) - - [FortiOS Authentication Bypass PoC](https://twitter.com/Dinosn/status/1580642911267749888) - - [Mediabank Private latest Aussie business to confirm cyber break-in](https://twitter.com/Dinosn/status/1580567235130978304) - - [Magniber Ransomware Adopts JavaScript, Targeting Home Users with Fake Software Updates](https://twitter.com/Dinosn/status/1580557633001443332) - - [YoWhatsApp, unofficial WhatsApp Android app spreads the Triada Trojan](https://twitter.com/Dinosn/status/1580557484963823616) - - [RT Panagiotis Chartas: HoaxShell can now run on systems with PowerShell Constraint Language mode enabled (use -cm option with any of the available pay...](https://twitter.com/t3l3machus/status/1580555806415917056) - - [Researchers Uncover Custom Backdoors and Spying Tools Used by Polonium Hackers](https://twitter.com/Dinosn/status/1580554516016943104) - - [POLONIUM APT targets Israel with a new custom backdoor dubbed PapaCreep](https://twitter.com/Dinosn/status/1580554264677535745) - - [Budworm Hackers Resurface with New Espionage Attacks Aimed at U.S. Organization](https://twitter.com/Dinosn/status/1580554161283686400) - - [New Chinese Malware Attack Framework Targets Windows, macOS, and Linux Systems](https://twitter.com/Dinosn/status/1580553944572387328) - - [A spreadsheet designed to automatically generate Key Performance Indicators (charts) for Cyber Security Services based on documented data, powered by ...](https://twitter.com/Dinosn/status/1580463635385589760) - - [RT Jas502n: Apache Commons Text < 1.10.0 RCE StringSubstitutor.createInterpolator().replace("${script:js:new java.lang.ProcessBuilder(\"calc\").start(...](https://twitter.com/jas502n/status/1580461835068719104) - - [RT reverseame: Linux Kernel Exploit (CVE-2022-32250) with mqueue](https://twitter.com/reverseame/status/1580449772259151873) - - [Toyota discloses data leak after access key exposed on GitHub](https://twitter.com/Dinosn/status/1580420777450516480) - - [Google Rolling Out Passkey Passwordless Login Support to Android and Chrome](https://twitter.com/Dinosn/status/1580420332879421443) - - [aftermath: Swift-based, open-source macOS incident response framework](https://twitter.com/Dinosn/status/1580420221860728832) - - [Prison inmate accused of orchestrating $11M fraud using cell cellphone](https://twitter.com/Dinosn/status/1580420158136274944) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [《至人无己 正复为奇：网络安全服务市场洞察报告 2022》报告调研召集令| 嘶吼安全产业研究院](https://www.4hou.com/posts/pVlr) - - [研究人员绕过了微软更新的"ProxyNotShell "漏洞修复指导方案](https://www.4hou.com/posts/q8nR) - - [美国多个机场遭到亲俄罗斯威胁团伙Killnet的网络攻击](https://www.4hou.com/posts/03PG) -- 安全客-有思想的安全新媒体 - - [欧盟出台新《欧洲创新议程》，大力支持深科技创新](https://www.anquanke.com/post/id/281640) - - [美海军发布《信息优势拱顶石设计概念》 推动数字现代化发展](https://www.anquanke.com/post/id/281636) - - [《2022中国网络安全十大创新方向》报告发布](https://www.anquanke.com/post/id/281627) - - [Claroty利用RCE在西门子PLC中发现硬编码的加密密钥](https://www.anquanke.com/post/id/281714) - - [ISC×数说安全联合发布《ISC 2022十年网安行业代表性案例》](https://www.anquanke.com/post/id/281707) - - [NIST 牵头推进混合卫星网络安全指南研制](https://www.anquanke.com/post/id/281701) - - [数字安全观察每周简报【安全事件篇】2022.09.21-2022.09.27](https://www.anquanke.com/post/id/281492) - - [白宫公布消费者设备网络安全标签计划：参考能源之星](https://www.anquanke.com/post/id/281697) - - [澳大利亚加速推动关键基础设施改革的风险管理计划](https://www.anquanke.com/post/id/281693) - - [韩政府提交加入《网络犯罪公约》意向书](https://www.anquanke.com/post/id/281675) - - [Cymru发布恶意软件IcedID近期攻击活动的分析报告](https://www.anquanke.com/post/id/281690) - - [美国陆军将使用Google Workspace云计算服务](https://www.anquanke.com/post/id/281679) - - [NIST牵头组建商用卫星利益共同体 推进混合卫星网络安全指南研制](https://www.anquanke.com/post/id/281623) -- paper - Last paper - - [CVE-2022-25237 Bonitasoft Platform RCE 漏洞分析](https://paper.seebug.org/1985/) -- Sucuri Blog - - [How to Securely Debug WordPress Errors on Your Website](https://blog.sucuri.net/2022/10/how-to-securely-debug-wordpress-errors-on-your-website.html) -- Sploitus.com Exploits RSS Feed - - [Web Based Student Clearance 1.0 Shell Upload Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38033&utm_source=rss&utm_medium=rss) - - [Zentao Project Management System 17.0 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38034&utm_source=rss&utm_medium=rss) - - [Online Shopping System Advanced 1.0 SQL Injection Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38032&utm_source=rss&utm_medium=rss) - - [pfSense plugin pfBlockerNG unauthenticated RCE as root exploit](https://sploitus.com/exploit?id=MSF:EXPLOIT-UNIX-HTTP-PFSENSE_PFBLOCKERNG_WEBSHELL-&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=567E25A0-124E-58B5-BAF5-B7651C9D74AA&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-2992 exploit](https://sploitus.com/exploit?id=90EDD019-8412-5551-81E4-C0EEE579487C&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Adobe Acrobat Dc exploit](https://sploitus.com/exploit?id=6A5A58AE-38FC-5D0C-8009-59012478F29E&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-37298 exploit](https://sploitus.com/exploit?id=2ACDC990-52B7-5958-857B-A840D33A2BE2&utm_source=rss&utm_medium=rss) -- 跳跳糖 - 安全与分享社区 - - [域内用户Hash获取方式总结](https://tttang.com/archive/1758/) -- 安全脉搏 - - [干货 | 最全的CTF练习网站和在线攻防网站总结](https://www.secpulse.com/archives/189011.html) - - [火热报名中｜OSCS 软件供应链安全技术论坛议程抢先看](https://www.secpulse.com/archives/188999.html) - - [干货 | 红队渗透系列之获取入口打点总结](https://www.secpulse.com/archives/188994.html) -- unSafe.sh - 不安全 - - [I have my Black Duck audit reports; What’s next?](https://buaq.net/go-130735.html) - - [8220 Gang Cloud Botnet Targets Misconfigured Cloud Workloads](https://buaq.net/go-130734.html) - - [BlueHat 2023 Call for Papers is Now Open!](https://buaq.net/go-130733.html) - - [Only half of teens agree they "feel supported online" by parents](https://buaq.net/go-130773.html) -- SecWiki News - - [SecWiki News 2022-10-13 Review](http://www.sec-wiki.com/?2022-10-13) -- Tenable Blog - - [Consolidate and Unify to Accelerate Your Security Efforts](https://www.tenable.com/blog/consolidate-and-unify-to-accelerate-your-security-efforts) -- Securelist - - [Ongoing exploitation of CVE-2022-41352 (Zimbra 0-day)](https://securelist.com/ongoing-exploitation-of-cve-2022-41352-zimbra-0-day/107703/) -- Horizon3.ai - - [FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684)](https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/) - - [Horizon3.ai Named Finalist for Cloud Security Innovation of the Year in 2022 SDC Awards](https://www.businesswire.com/news/home/20221013005346/en/Horizon3.ai-Named-Finalist-for-Cloud-Security-Innovation-of-the-Year-in-2022-SDC-Awards#new_tab) - - [What is Zero Trust – and How NodeZero Can Help](https://www.horizon3.ai/what-is-zero-trust-and-how-can-nodezero-help/) -- SpiderLabs Blog from Trustwave - - [ModSecurity Request Body Parsing: Recent Bypass Issues](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-request-body-parsing-recent-bypass-issues/) -- GuidePoint Security - - [GRIT Ransomware Report – Q3 2022](https://www.guidepointsecurity.com/blog/grit-ransomware-report-q3-2022/) -- Malwarebytes Labs - - [Introducing Malwarebytes Managed Detection and Response (MDR)](https://www.malwarebytes.com/blog/business/2022/10/introducing-malwarebytes-managed-detection-and-response-mdr) - - [Android and Chrome start showing passwords the door](https://www.malwarebytes.com/blog/news/2022/10/google-is-bringing-passkey-support-to-both-android-and-chrome) - - [Chinese APT's favorite vulnerabilities revealed](https://www.malwarebytes.com/blog/news/2022/10/psa-chinese-apts-target-flaws-that-take-full-control-of-systems) - - [Only half of teens agree they "feel supported online" by parents](https://www.malwarebytes.com/blog/news/2022/10/only-half-of-teens-agree-they-feel-supported-online-by-parents) -- SentinelOne - - [8220 Gang Cloud Botnet Targets Misconfigured Cloud Workloads](https://www.sentinelone.com/blog/8220-gang-cloud-botnet-targets-misconfigured-cloud-workloads/) -- Sucuri Blog - - [How to Securely Debug WordPress Errors on Your Website](https://blog.sucuri.net/2022/10/how-to-securely-debug-wordpress-errors-on-your-website.html) -- Application Security Blog - - [I have my Black Duck audit reports; What’s next?](https://www.synopsys.com/blogs/software-security/next-steps-black-duck-audit-report/) -- Didier Stevens - - [Update: base64dump.py Version 0.0.24](https://blog.didierstevens.com/2022/10/13/update-base64dump-py-version-0-0-24/) -- SAP Blogs - - [Creating a predictive analytic application using R in SAP Analytics Cloud](https://blogs.sap.com/2022/10/13/creating-a-predictive-analytic-application-using-r-in-sap-analytics-cloud/) - - [Real estate as an essential part of future mobility](https://blogs.sap.com/2022/10/13/real-estate-as-an-essential-part-of-future-mobility/) - - [Fantastic Ghosts and How to Engage Them](https://blogs.sap.com/2022/10/13/fantastic-ghosts-and-how-to-engage-them/) - - [3 things to do when starting an S/4 program – Part 2](https://blogs.sap.com/2022/10/13/3-things-to-do-when-starting-an-s-4-program-part-2/) - - [Revenue Recognition Key Documentation: The Key to Understanding the Posting Logic of Event-Based Revenue Recognition](https://blogs.sap.com/2022/10/13/revenue-recognition-key-documentation-the-key-to-understanding-the-posting-logic-of-event-based-revenue-recognition/) - - [Export product catalog from SAP Commerce Cloud to procurement system for Punchout level 2](https://blogs.sap.com/2022/10/13/export-product-catalog-from-sap-commerce-cloud-to-procurement-system-for-punchout-level-2/) - - [Getting started with Domain-Driven Design](https://blogs.sap.com/2022/10/13/getting-started-with-domain-driven-design/) - - [How to Enable Generic Country/Region Version in Expense and Reimbursement Management](https://blogs.sap.com/2022/10/13/how-to-enable-generic-country-region-version-in-expense-and-reimbursement-management/) - - [Create Business Partner via API class CL_MD_BP_MAINTAIN](https://blogs.sap.com/2022/10/13/create-business-partner-via-api-class-cl_md_bp_maintain/) -- Microsoft Security Response Center - - [Hunting for Cobalt Strike: Mining and plotting for fun and profit](https://msrc-blog.microsoft.com/2022/10/13/hunting-for-cobalt-strike-mining-and-plotting-for-fun-and-profit/) - - [BlueHat 2023 Call for Papers is Now Open!](https://msrc-blog.microsoft.com/2022/10/13/bluehat-2023-call-for-papers-is-now-open/) -- Reverse Engineering - - [Have you ever asked yourself how breakpoints work?](https://www.reddit.com/r/ReverseEngineering/comments/y36479/have_you_ever_asked_yourself_how_breakpoints_work/) -- The Daily Swig | Cybersecurity news and views - - [GitLab patches RCE bug in GitHub import function](https://portswigger.net/daily-swig/gitlab-patches-rce-bug-in-github-import-function) -- KitPloit - PenTest & Hacking Tools - - [FUD-UUID-Shellcode - Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness](http://www.kitploit.com/2022/10/fud-uuid-shellcode-another-shellcode.html) -- r2c website - - [A deep dive into Semgrep Supply Chain](https://r2c.dev/blog/2022/a-deep-dive-into-semgrep-supply-chain/) -- 安全牛 - - [等你来战！阿里云Webshell文本检测算法大赛火热报名中](https://www.aqniu.com/activity-meeting/89925.html) - - [2022 ASRC Q3季度邮件安全报告](https://www.aqniu.com/vendor/89924.html) - - [SharkTeam：Move合约开发与合约安全](https://www.aqniu.com/vendor/89921.html) - - [Moonbeam的多链架构 by：amos.berlin & RARA from SharkTeam](https://www.aqniu.com/vendor/89920.html) - - [2022年度全球高薪IT认证榜单发布，4项网络安全认证入选Top15！](https://www.aqniu.com/industry/89911.html) - - [揭秘三种新型恶意软件的感染方式与传播路径](https://www.aqniu.com/homenews/89903.html) -- text/plain - - [Q: Why do tabs sometimes show an orange dot?](https://textslashplain.com/2022/10/13/q-why-do-tabs-sometimes-show-an-orange-dot/) -- Sandfly Security Blog RSS Feed - - [Sandfly 4.2 - Automatic Host Discovery and Faster Than Ever](https://www.sandflysecurity.com/blog/sandfly-4-2-automatic-host-discovery-and-faster-than-ever) -- Twitter @Octagon Networks - - [🔥💾 Multiple vulnerabilities leading to RCE in Juniper SSLVPNs / JunOS devices were recently reported by us. Kudos to @PaulosYibelo for discoveri...](https://twitter.com/OctagonNetworks/status/1580568062079574016) -- 博客园 - 郑瀚Andrew - - [中国房地产演进的三个阶段 - 郑瀚Andrew](https://www.cnblogs.com/LittleHann/p/16782822.html) -- HackerNews - - [印度启动 5G 网络引发网络诈骗，孟买警方发出警告](https://hackernews.cc/archives/41887) - - [西门子 SIMATIC PLC 中的关键漏洞可能让攻击者窃取加密密钥](https://hackernews.cc/archives/41879) - - [Aruba 修复了 EdgeConnect Enterprise Orchestrator 中的关键漏洞](https://hackernews.cc/archives/41876) - - [研究表明指尖的热量可用于破解密码](https://hackernews.cc/archives/41873) - - [Shein 母公司将因数据泄露向纽约州支付 190 万美元](https://hackernews.cc/archives/41869) - - [LockBit 公司的附属机构破坏了微软的 Exchange 服务器以部署勒索软件](https://hackernews.cc/archives/41866) -- Checkmarx.com - - [Some Vulnerabilities Don’t Have a Name](https://checkmarx.com/blog/some-vulnerabilities-dont-have-a-name/) -- 三六零CERT - - [安全日报（2022.10.13）](https://mp.weixin.qq.com/s?__biz=MzU5MjEzOTM3NA==&mid=2247491487&idx=1&sn=c61a8851a8dba60f298b6171b50f7e28&chksm=fe251a9ec95293884864402043436a6dbfe1e9a16d47e9ce4fa445d60cdf6f21b7f69054c757&scene=58&subscene=0#rd) -- FreeBuf网络安全行业门户 - - [Canary保护机制及绕过](https://www.freebuf.com/articles/system/346608.html) - - [”三哥“，核酸信息泄露该管管了！](https://www.freebuf.com/news/346742.html) - - [FreeBuf早报 | 工信部通报38款侵害用户权益 App；印度5G网络引发各种网络诈骗](https://www.freebuf.com/news/346739.html) - - [听说网安人压力贼大？](https://www.freebuf.com/news/346733.html) - - [十大 CICD 安全风险（四）](https://www.freebuf.com/articles/web/346723.html) - - [企业内部钓鱼邮件演练指南](https://www.freebuf.com/articles/es/336273.html) - - [当我们谈论小程序安全时，我们在谈论什么](https://www.freebuf.com/articles/web/339661.html) -- 代码卫士 - - [新型NPM计时攻击可导致供应链攻击，GitHub 不打算修复](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514198&idx=1&sn=896500007d3b6e8878a313e75f4f0440&chksm=ea94893cdde3002ab918f2937fefc42dece54a931457ca7274fbea4258224d4cc93342f08b7d&scene=58&subscene=0#rd) - - [Aruba 修复EdgeConnect 中的严重RCE和认证绕过漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514198&idx=2&sn=7355930428f40ec6edfaaa22d7aee746&chksm=ea94893cdde3002ae09057a6941995beea58bffa9829737ad255d7b107096c28655b9bb0dfb1&scene=58&subscene=0#rd) -- 杨龙 - - [for循环解决兔子问题](https://www.yanglong.pro/for%e5%be%aa%e7%8e%af%e8%a7%a3%e5%86%b3%e5%85%94%e5%ad%90%e9%97%ae%e9%a2%98/) - - [MySQL索引失效](https://www.yanglong.pro/mysql%e7%b4%a2%e5%bc%95%e5%a4%b1%e6%95%88/) -- 安全牛 - - [2022年度全球高薪IT认证榜单发布，4项网络安全认证入选Top15！](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119135&idx=1&sn=4a98d5975b9ae8b46a8d1b989833940a&chksm=bd146ecc8a63e7da7f4cf04a7d9818315389aaa2c0e8183784ff87e6301c2fa090aa0cdea60f&scene=58&subscene=0#rd) - - [揭秘三种新型恶意软件的感染方式与传播路径](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119135&idx=2&sn=2905e636ee727ac3168a1f2c40456707&chksm=bd146ecc8a63e7da07f55371af31b651aae05f6145ded4ae8434b7b82475a70bad5b2807202c&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [微软反击称索尼对其合并动视的抗议是“自利的”](https://www.solidot.org/story?sid=73056) - - [微软准备将 AI 图像合成带到主流](https://www.solidot.org/story?sid=73055) - - [培养皿中的活体人脑细胞学会玩乒乓](https://www.solidot.org/story?sid=73054) - - [Nick Clegg 等人接受了 OnlyFans 的贿赂](https://www.solidot.org/story?sid=73053) - - [WhatsApp 非官方应用被发现会窃取用户账号](https://www.solidot.org/story?sid=73052) - - [马斯克的交易让 Twitter 员工辗转难安](https://www.solidot.org/story?sid=73051) - - [韦伯望远镜捕捉到双星形成的“指纹”](https://www.solidot.org/story?sid=73050) - - [复旦大学将推出“非升即走”的替代方案](https://www.solidot.org/story?sid=73049) - - [人类迷你大脑植入小鼠](https://www.solidot.org/story?sid=73048) - - [导致蛀牙的微生物能形成超有机体](https://www.solidot.org/story?sid=73047) - - [外骨骼“靴子”帮助更快走路](https://www.solidot.org/story?sid=73046) - - [台积电从美国获得一年的芯片设备出口许可证](https://www.solidot.org/story?sid=73045) - - [Netflix 在第三季度发布了 1026 集原创剧](https://www.solidot.org/story?sid=73044) - - [Opus 编解码器项目面临专利挑战](https://www.solidot.org/story?sid=73043) - - [《科学》期刊论文免费开放获取政策将于 2023 年生效](https://www.solidot.org/story?sid=73042) - - [Windows 11 和 Xbox 深度整合苹果服务和应用](https://www.solidot.org/story?sid=73041) - - [Google Play 批准特朗普的 Truth Social](https://www.solidot.org/story?sid=73040) -- CNCERT风险评估 - - [网络安全信息与动态周报2022年第41期（10月3日-10月9日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247497559&idx=1&sn=02f2bae8c9e20dff5d1632e18df556af&chksm=973ac435a04d4d23882611bae0456e3f9155e622ff8c4bb49aa54464ab46b1a7b9aba5e54e04&scene=58&subscene=0#rd) -- 星阑科技 - - [官宣！星阑科技成为华为云沃土初创伙伴](https://mp.weixin.qq.com/s?__biz=Mzg5NjEyMjA5OQ==&mid=2247495977&idx=1&sn=22502e03feb39d961894bd10ea71fabb&chksm=c0075cb5f770d5a38ab03b64944cdf75d4d2347ac9b5b0ed032d3ac02c83d94429fd00d091ac&scene=58&subscene=0#rd) -- Yak Project - - [新功能：史上最好用的反连&JavaHack，安全能力基座强化ing](https://mp.weixin.qq.com/s?__biz=Mzk0MTM4NzIxMQ==&mid=2247491180&idx=1&sn=5884aac8716de361a383c6e884bdca39&chksm=c2d262c8f5a5ebdecea937ebc8be5c322c21a1ffcda9b81d66e65d64dc84b64180ec937f122b&scene=58&subscene=0#rd) -- 中国信息安全 - - [专题·关基保护 | 关键信息基础设施安全国家标准进展](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166817&idx=1&sn=fd8e05811d4bd685205d4f093e70cac9&chksm=8b5ef758bc297e4e6637d4b424b0a86ed767612c7c5e4f37e660828474b192ec02359d888fce&scene=58&subscene=0#rd) - - [征订 | 欢迎订阅2023年《中国信息安全》杂志！](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166817&idx=2&sn=450f035a4dd4e3e1de0c8cc4d5d7e264&chksm=8b5ef758bc297e4ec470bb5129586ae16c7dcb26b75c20d0e014a0e09a9eaca5e480176007e8&scene=58&subscene=0#rd) - - [发布 | 中国信通院发布《勒索攻击安全防护要点》](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166817&idx=3&sn=b6ea3e35f0c960aab503907d006b79c9&chksm=8b5ef758bc297e4e7cb07d1edbc70b38fa6ca36abc44be2929de8d6fbae95faeb0c7037356e8&scene=58&subscene=0#rd) - - [央行：扎实开展数字人民币研发试点工作](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166817&idx=4&sn=ffcd92b58db6b406fefd56f196dd32ee&chksm=8b5ef758bc297e4e14a1e3acfb246b49f2459f89b9d667e54462e0d3aad4d342cb525df8122c&scene=58&subscene=0#rd) - - [关注 | 新疆网信办等有关部门查处曝光4起网上违法违规行为典型案例](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166817&idx=5&sn=c06ac5dd9b2eafb4c30b96a43154783a&chksm=8b5ef758bc297e4e654c7324d894a1d58d1c43381637f9de9259a793dadfb89073c728ee6c1b&scene=58&subscene=0#rd) -- vivo千镜安全实验室 - - [浅析数据安全之密态化计算](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247489494&idx=1&sn=d65d37d438816250915617388f8aa891&chksm=e9b931badeceb8acd05b11109ae54821de78d5372c9c84ec871f6cc7a00b805ae250874ba043&scene=58&subscene=0#rd) -- 网安国际 - - [论文分享 Measuring the Practical Effect of DNS Root Server Instances](https://mp.weixin.qq.com/s?__biz=MzA4ODYzMjU0NQ==&mid=2652311631&idx=1&sn=fbdc3c3c699ef39b7f5d4331994ad1ce&chksm=8bc48dc1bcb304d77bdf93274e00330c1a59916a455ef00d95873eae6e6d45bb18eacaa9d633&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-15.md b/archive/2022/2022-10-15.md deleted file mode 100644 index 1fb82287ea..0000000000 --- a/archive/2022/2022-10-15.md +++ /dev/null @@ -1,215 +0,0 @@ -# 每日安全资讯（2022-10-15） - -- SecWiki News - - [SecWiki News 2022-10-14 Review](http://www.sec-wiki.com/?2022-10-14) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [Garage Management System 1.0 - 'categoriesName' - Stored XSS](https://cxsecurity.com/issue/WLB-2022100037) -- 安全客-有思想的安全新媒体 - - [火热报名中｜OSCS 软件供应链安全技术论坛议程抢先看](https://www.anquanke.com/post/id/281743) - - [《网络安全法》的弹性——基于司法案例小样本的分析](https://www.anquanke.com/post/id/281664) - - [国家标准《信息安全技术 智能手机预装应用程序基本安全要求（征求意见稿）》公开征求意见](https://www.anquanke.com/post/id/281660) - - [欧洲多国基础设施接连遭到破坏禁忌正在被打破](https://www.anquanke.com/post/id/281656) - - [互联互通背景下对医疗数据安全保护的思考](https://www.anquanke.com/post/id/281648) - - [建设覆盖全社会的征信体系](https://www.anquanke.com/post/id/281644) - - [Claroty利用RCE在西门子PLC中发现硬编码的加密密钥](https://www.anquanke.com/post/id/281720) -- Der Flounder - - [Using the Jamf Pro API to report on Self Service policies](https://derflounder.wordpress.com/2022/10/14/using-the-jamf-pro-api-to-report-on-self-service-policies/) -- Twitter @Nicolas Krassas - - [Exploiting predictable UUID/GUID values](https://twitter.com/Dinosn/status/1581001357783601153) - - [Exploit Eternal Blue (MS17–010) for Window 7 and higher (custom payload)](https://twitter.com/Dinosn/status/1581000986251776000) - - [Australian police secret agents exposed in Colombian data leak](https://twitter.com/Dinosn/status/1581000878638497793) - - [LockBit 3.0 malware forced NHS tech supplier to shut down hosted sites](https://twitter.com/Dinosn/status/1580999947612479490) - - [Fast Fashion Retailer Data Breach Draws $1.9M Fine](https://twitter.com/Dinosn/status/1580999097850679298) - - [RT Netlas.io: Fortinet appliances are in the spotlight today! Authentication Bypass (CVE-2022-40684) by @Horizon3Attack: 👉🏼 Dork: 👉🏼 Link ...](https://twitter.com/Netlas_io/status/1580838167564804097) - - [Hackers release 500GB of data stolen in LA school district ransomware attack | Engadget](https://twitter.com/Dinosn/status/1580797611891519489) - - [$6000 with Microsoft Hall of Fame | Microsoft Firewall Bypass | CRLF to XSS | Microsoft Bug Bounty](https://twitter.com/Dinosn/status/1580785427073540096) - - [Aruba fixes critical RCE and auth bypass flaws in EdgeConnect](https://twitter.com/Dinosn/status/1580785118926737408) - - [FUD-UUID-Shellcode - Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID st...](https://twitter.com/Dinosn/status/1580785037821476866) - - [How to Investigate Insider Threats (Forensic Methodology)](https://twitter.com/Dinosn/status/1580784609536937985) - - [The discovery of Alchimist C2 tool, revealed a new attack framework to target Windows, macOS, and Linux systems](https://twitter.com/Dinosn/status/1580784228869865472) - - [PiRogue Tool Suite Mobile forensic & network analysis on a Raspberry Pie](https://twitter.com/Dinosn/status/1580784035441147904) - - [Novel npm Timing Attack Allows Corporate Targeting](https://twitter.com/Dinosn/status/1580783988813180928) - - [Magniber ransomware now infects Windows users via JavaScript files](https://twitter.com/Dinosn/status/1580783248338452480) - - [Banks face their 'darkest hour' as malware steps up, maker of antivirus says](https://twitter.com/Dinosn/status/1580782731143057413) - - [PoC Exploit Released for Critical Fortinet Auth Bypass Bug Under Active Attacks](https://twitter.com/Dinosn/status/1580782361343823873) - - [Mormon Church IT ransacked, data stolen by 'state-sponsored' cyber-thieves](https://twitter.com/Dinosn/status/1580782286093811712) - - [Microsoft is rebranding 'Office' to Microsoft 365](https://twitter.com/Dinosn/status/1580782243252838401) -- Microsoft Security Blog - - [New “Prestige” ransomware impacts organizations in Ukraine and Poland](https://www.microsoft.com/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=BD07E529-B3E2-5CB8-ACD4-AD7DAD69AFBD&utm_source=rss&utm_medium=rss) - - [Exploit for Unsafe Reflection in Apache Commons Jxpath exploit](https://sploitus.com/exploit?id=9B390AA9-4976-5E80-AF17-6F655FA9AAE0&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Privilege Management in Microsoft exploit](https://sploitus.com/exploit?id=3722FF3F-D30D-5D5C-802E-EEA4963C6848&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-2992 exploit](https://sploitus.com/exploit?id=5E536945-9F1C-59F4-B6FC-5B122E6BB1D7&utm_source=rss&utm_medium=rss) -- Blog & What's New | Offensive Security - - [Q3 Community Update | OffSec Academy, New Content, Giving Program](https://www.offensive-security.com/offsec/q3-update/) -- unSafe.sh - 不安全 - - [【免费领】智能设备安全技术干货：路由器0day漏洞挖掘指南](https://buaq.net/go-130935.html) - - [64位下使用回调函数实现监控](https://buaq.net/go-130936.html) - - [2022年CCF-绿盟科技“鲲鹏”科研基金](https://buaq.net/go-130958.html) - - [The Good, the Bad and the Ugly in Cybersecurity – Week 42](https://buaq.net/go-130916.html) - - [Ransom Cartel Ransomware: A Possible Connection With REvil](https://buaq.net/go-130907.html) - - [派周报 | 强推 USB Type-C 会阻碍创新吗？](https://buaq.net/go-130910.html) - - [Rewriting curl in three days](https://buaq.net/go-130901.html) - - [Matano - The Open-Source Security Lake Platform For AWS](https://buaq.net/go-130905.html) - - [crusj/bookmarks.nvim: Remember file locations and sort by time and frequency.](https://buaq.net/go-130893.html) - - [ziglang/zig: General-purpose programming language and toolchain for maintaining robust, optimal, and reusable software.](https://buaq.net/go-130892.html) - - [restsharp/RestSharp: Simple REST and HTTP API Client for .NET](https://buaq.net/go-130887.html) - - [SystemTap在应急排查中的应用](https://buaq.net/go-130896.html) - - [峰会倒计时9天！日程安排Get](https://buaq.net/go-130912.html) - - [卡巴斯基发现WhatsApp的一款恶意mod，用户面临账户窃取风险](https://buaq.net/go-130913.html) - - [2022 SDC 议题 | 从应用场景看金融安全 — 逻辑为王](https://buaq.net/go-130915.html) - - [House of apple 一种新的glibc中IO攻击方法](https://buaq.net/go-130914.html) - - [@你，招人！本周岗位更新](https://buaq.net/go-130911.html) -- 先知安全技术社区 - - [Resin内存马逆袭之路](https://xz.aliyun.com/t/11758) -- Security Boulevard - - [This Week in Malware – Over 50 Packages Discovered](https://securityboulevard.com/2022/10/this-week-in-malware-over-50-packages-discovered/) - - [BSidesLV 2022 Lucky13 GroundTruth – Sven Cattell’s ‘Model Robustness Isn’t Security’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-groundtruth-sven-cattells-model-robustness-isnt-security/) - - [XKCD ‘Fan Theories’](https://securityboulevard.com/2022/10/xkcd-fan-theories/) - - [Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 – Part 1: Root Cause Analysis](https://securityboulevard.com/2022/10/technical-analysis-of-windows-clfs-zero-day-vulnerability-cve-2022-37969-part-1-root-cause-analysis/) - - [Let’s stop the noise around false positives](https://securityboulevard.com/2022/10/lets-stop-the-noise-around-false-positives/) - - [Automate your API hacking with Autorize](https://securityboulevard.com/2022/10/automate-your-api-hacking-with-autorize/) - - [Older, Unpatched ERP Vulnerabilities Continue to Haunt Organizations](https://securityboulevard.com/2022/10/older-unpatched-erp-vulnerabilities-continue-to-haunt-organizations/) - - [VISA Study: Digital Commerce Remains “Richest Target for Cybercriminals”](https://securityboulevard.com/2022/10/visa-study-digital-commerce-remains-richest-target-for-cybercriminals/) - - [Cybersecurity News Round-Up: Week of October 10, 2022](https://securityboulevard.com/2022/10/cybersecurity-news-round-up-week-of-october-10-2022/) - - [Linux Fixes 5 Gaping Holes in Wi-Fi](https://securityboulevard.com/2022/10/linux-5-bugs-wi-fi-richixbw/) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [Gartner权威认可！360成唯一入选数字安全四大创新领域标杆供应商](https://www.4hou.com/posts/RBJ0) - - [漏洞预警|Apache Commons Text 远程代码执行漏洞](https://www.4hou.com/posts/QLGq) - - [Gartner权威认可|安全狗作为CWPP代表厂商入选报告](https://www.4hou.com/posts/LBzW) - - [【技术原创】Java利用技巧——AntSword-JSP-Template的优化](https://www.4hou.com/posts/XVVW) - - [权威报告发布：奇安信上榜零信任网络访问解决方案厂商领导者位置](https://www.4hou.com/posts/O9DG) - - [知道创宇再次登榜北京民营企业“科技创新百强”](https://www.4hou.com/posts/N1BK) - - [VM2远程代码执行漏洞曝光](https://www.4hou.com/posts/wgwm) - - [火热报名中｜OSCS 软件供应链安全技术论坛议程抢先看](https://www.4hou.com/posts/MBAB) -- Recent Commits to cve:main - - [Update Fri Oct 14 10:15:49 UTC 2022](https://github.com/trickest/cve/commit/d61c9096ca8db3ff6a9128132095def50fa069f6) -- 跳跳糖 - 安全与分享社区 - - [从TCTF的3rm1学习java动态代理](https://tttang.com/archive/1769/) -- 先知安全技术社区 - - [Resin内存马逆袭之路](https://xz.aliyun.com/t/11758) -- gynvael.coldwind//vx.log (pl) - - [Mega Sekurak Hacking Party - Październik 2022](https://gynvael.coldwind.pl/?id=755) -- SAP Blogs - - [HCM Brasil: Nova configuração disponível para ambientes de qualidade no eSocial](https://blogs.sap.com/2022/10/14/hcm-brasil-nova-configuracao-disponivel-para-ambientes-de-qualidade-no-esocial/) - - [Nota Técnica 2021.003: Número de Protocolo para Nota Fiscal de Energia Elétrica (NF3e modelo 66)](https://blogs.sap.com/2022/10/14/nota-tecnica-2021.003-numero-de-protocolo-para-nota-fiscal-de-energia-eletrica-nf3e-modelo-66/) - - [German Characters (ä,ö,ü) are showing as # in SAP Output File](https://blogs.sap.com/2022/10/14/german-characters-aou-are-showing-as-in-sap-output-file/) - - [SAP FI Cutover activity plan complete activities](https://blogs.sap.com/2022/10/14/sap-fi-cutover-activity-plan-complete-activities/) - - [Exploring the Tension between Individual and Corporate Values](https://blogs.sap.com/2022/10/14/exploring-the-tension-between-individual-and-corporate-values/) - - [Lazy Loading Columns with Intersection Observer (SAPUI5)](https://blogs.sap.com/2022/10/14/lazy-loading-columns-with-intersection-observer-sapui5/) - - [Cancel BTP workflow instance from ABAP](https://blogs.sap.com/2022/10/14/cancel-btp-workflow-instance-from-abap/) - - [Using Ariba for getting Supplier inputs for the calculation of the Greenhouse Gas emissions](https://blogs.sap.com/2022/10/14/using-ariba-for-getting-supplier-inputs-for-the-calculation-of-the-greenhouse-gas-emissions/) - - [Why Platform as a Service Is on the Rise for SAP Partners](https://blogs.sap.com/2022/10/14/why-platform-as-a-service-is-on-the-rise-for-sap-partners/) - - [Practical XSLT Development for SAP Cloud Integration with XSLT IDE](https://blogs.sap.com/2022/10/14/practical-xslt-development-for-sap-cloud-integration-with-xslt-ide/) -- Hex Rays - - [Igor’s tip of the week #110: Self-relative offsets](https://hex-rays.com/blog/igors-tip-of-the-week-110-self-relative-offsets/) -- SentinelOne - - [The Good, the Bad and the Ugly in Cybersecurity – Week 42](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-42-4/) -- The Daily Swig | Cybersecurity news and views - - [‘We don’t teach developers how to write secure software’ – Linux Foundation’s David A Wheeler on reversing the CVE surge](https://portswigger.net/daily-swig/we-dont-teach-developers-how-to-write-secure-software-linux-foundations-david-a-wheeler-on-reversing-the-cve-surge) - - [Adobe patches critical Magento XSS that puts sites at takeover risk](https://portswigger.net/daily-swig/adobe-patches-critical-magento-xss-that-puts-sites-at-takeover-risk) -- Tenable Blog - - [Cybersecurity Snapshot: 6 Things That Matter Right Now](https://www.tenable.com/blog/cybersecurity-snapshot-6-things-that-matter-right-now-oct-14) -- daniel.haxx.se - - [Rewriting curl in three days](https://daniel.haxx.se/blog/2022/10/14/rewriting-curl-in-three-days/) - - [There is a tab in my cookie](https://daniel.haxx.se/blog/2022/10/14/there-is-a-tab-in-my-cookie/) -- FreeBuf网络安全行业门户 - - [FreeBuf周报 | VMware某漏洞一年仍未修补；宜家智能照明系统发现漏洞](https://www.freebuf.com/news/346841.html) - - [Magniber勒索软件通过JavaScript文件感染Windows用户](https://www.freebuf.com/news/346826.html) - - [Sangfor华东战队：Windows计算机取证【上】](https://www.freebuf.com/sectool/346821.html) - - [混合云安全怎么做 | FreeBuf甲方群话题讨论](https://www.freebuf.com/articles/neopoints/346792.html) - - [SAST + SCA: 结合使用安全升级](https://www.freebuf.com/articles/web/346769.html) -- rtl-sdr.com - - [Internet Archive Seeks Donations of Materials to Build a Digital Library of Amateur Radio and Communications](https://www.rtl-sdr.com/internet-archive-seeks-donations-of-materials-to-build-a-digital-library-of-amateur-radio-and-communications/) -- KitPloit - PenTest & Hacking Tools - - [Matano - The Open-Source Security Lake Platform For AWS](http://www.kitploit.com/2022/10/matano-open-source-security-lake.html) -- Twitter @hakivvi - - [RT Shahar Tal: Re Ending with a demo on 16.1 latest beta 🤩](https://twitter.com/jifa/status/1580847815273906176) -- 绿盟科技技术博客 - - [SystemTap在应急排查中的应用](http://blog.nsfocus.net/systemtap/) - - [2022年CCF-绿盟科技“鲲鹏”科研基金正式发布](http://blog.nsfocus.net/2022kunpengfund/) -- Twitter @Octagon Networks - - [RT Kevin Beaumont: You might want to patch your Juniper devices for CVE-2022-22241 - patches out 2 days ago. Pre-auth RCE including in SSL VPN portal](https://twitter.com/GossiTheDog/status/1580951082926104576) -- 杨龙 - - [LVM lv删除过程](https://www.yanglong.pro/lvm-lv%e5%88%a0%e9%99%a4%e8%bf%87%e7%a8%8b/) - - [](https://www.yanglong.pro/2903-2/) -- 奇客Solidot–传递最新科技情报 - - [Microsoft Office 重命名为 Microsoft 365](https://www.solidot.org/story?sid=73064) - - [新冠鼻用疫苗在临床试验中被证明无效](https://www.solidot.org/story?sid=73063) - - [Firefox Relay 支持生成虚拟电话号码](https://www.solidot.org/story?sid=73062) - - [PostgreSQL 15 释出](https://www.solidot.org/story?sid=73061) - - [科学家识别影响男女寿命的候选基因](https://www.solidot.org/story?sid=73060) - - [从地球追溯地月历史](https://www.solidot.org/story?sid=73059) - - [Netflix 的广告支持套餐定价每月 7 美元](https://www.solidot.org/story?sid=73058) - - [近半数新冠患者尚未完全康复](https://www.solidot.org/story?sid=73057) -- 博客园 - 渗透测试中心 - - [记一次攻防演练实战总结 - 渗透测试中心](https://www.cnblogs.com/backlion/p/16791730.html) -- 雷神众测 - - [靶机练习-DC-5](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652500095&idx=1&sn=92842ca9a5cf5d33173dc8b4d8b3c6c2&chksm=f25853ccc52fdadaf00d02a91568e905f01aca2aaeeb49fa770fc8a9995bfed05b8370e620c8&scene=58&subscene=0#rd) -- 吾爱破解论坛 - - [【移动样本分析】多层Android锁机样本分析5](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651138526&idx=1&sn=3a711c3e2cbaa17ca6576987b12a91a6&chksm=bd50b98a8a27309ccaf2fb527954a57f8af1eae7bda3740416a63e2424e89dbfb02fbee9403b&scene=58&subscene=0#rd) -- 安全牛 - - [安芯网盾亮相全球最大科技展GITEX GLOBAL 2022，正式加入华为云丝绸之路技术生态伙伴](https://www.aqniu.com/vendor/89982.html) - - [盘点网络欺诈中最常用的情绪陷阱](https://www.aqniu.com/homenews/89965.html) - - [8款国外热门攻击面管理工具简介及特点分析](https://www.aqniu.com/hometop/89964.html) - - [牛聘 | 2022年度岗位招聘第29期](https://www.aqniu.com/%e7%89%9b%e8%81%98/89961.html) - - [硬核案例 | 打造安全堡垒 共筑平安校园](https://www.aqniu.com/vendor/89956.html) - - [Gartner权威认可！360入选数字安全四大创新领域标杆供应商](https://www.aqniu.com/vendor/89940.html) - - [医疗行业威胁态势加剧，安全新规陆续发布](https://www.aqniu.com/vendor/89938.html) -- Tide安全团队 - - [冰蝎（一）Java Webshell解析](https://mp.weixin.qq.com/s?__biz=Mzg2NTA4OTI5NA==&mid=2247500790&idx=1&sn=0fc47e19d4a447d1df46b5a1f6cf86d7&chksm=ce5de197f92a6881106339f5978d0d98e330dd9648376e85ecce7a6a729d84f0fc73ffb98eb6&scene=58&subscene=0#rd) -- 互联网安全内参 - - [违规处理政务类数据，某科技公司违反《数据安全法》被行政处罚](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506337&idx=1&sn=fb728307aa7d6aac20dac3429ec333ca&chksm=ebfa9e81dc8d179749e346ee0d54c3645436e5ad8d27cc5dd6fe1767c90d70cb72194574088b&scene=58&subscene=0#rd) - - [俄乌战争黑客阵营出现支持马斯克的“第三纵队”](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247506337&idx=2&sn=969d4fdf7f13bbbb24250bbac7e23d57&chksm=ebfa9e81dc8d1797f687c812a51a012c9bccf041d9a7af93bc6fe91f48d2cf96fb7dcba1a0b7&scene=58&subscene=0#rd) -- 安全研究GoSSIP - - [G.O.S.S.I.P 阅读推荐 2022-10-14 EvilScreen](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247492914&idx=1&sn=52403a2177409a69c74574c49ccaee5a&chksm=c063cbebf71442fd8626d9aff415fbf4a9df2c06fba6d2d5498417d80c25058d99051b29c5b2&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [推荐几个值得关注的网络安全公众号](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486642&idx=1&sn=7202963d3998d716d98ff4302cdc6134&chksm=fa5aa25fcd2d2b49e7c93cb20fac6d8393f08ff2b02ab744899ba14414c8a87bd3c5f330602c&scene=58&subscene=0#rd) - - [.NET矩阵星球优惠活动持续进行](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486642&idx=2&sn=b5021e26921bef32e0e97942bfe753bc&chksm=fa5aa25fcd2d2b499e8dd2793b74ee000b6dea80a5bcf150719d7135dbf1898cffc6c7125200&scene=58&subscene=0#rd) - - [.NET下规避双引号实现MySQL写入Shell](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486642&idx=3&sn=305cd0c1e5c7353c2974ad2e6cd55dad&chksm=fa5aa25fcd2d2b4979169495b5df1a53e3dfba98ee36773397ffd8d612209d9bb6ab36a8e6e3&scene=58&subscene=0#rd) - - [推荐 | 基于C#实现数据库连接字符解密工具](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486642&idx=4&sn=55055fba621991a2d04a576927e2ea00&chksm=fa5aa25fcd2d2b49eb949bba480bf041a68a1fcbc9456185601a981c3a33c5116642a0d40047&scene=58&subscene=0#rd) -- 极客公园 - - [都在说的「AI for Science」，到底怎么帮助科学进化？](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652970052&idx=1&sn=800d08fa96fa7e1782e44f3c30968d1d&chksm=7e5461f24923e8e4fdad7d34daba1632459d6d63d59b097a6762a16ddbaa61a0dd8f23bef189&scene=58&subscene=0#rd) - - [华为人事变动：企业、运营商 BG 总裁换人；大众砸重金与地平线成立合资公司；微软推免费 P 图软件，挑战 PS](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652970021&idx=1&sn=5ac51573cb322dbb396f7641daa2150d&chksm=7e5461934923e885c8aa4db75504672ff6c0ac089d10c71619c693291f2912003c3f1da4e3d8&scene=58&subscene=0#rd) -- 山石网科安全技术研究院 - - [第二章 离散对数与Diffie-Hellman （练习题）](https://mp.weixin.qq.com/s?__biz=MzUzMDUxNTE1Mw==&mid=2247496966&idx=1&sn=b0af543199fda960afde9533b98fe220&chksm=fa5220b8cd25a9ae143ec8542041a6a1f58922bc9fb74df6c4bd7f1101d5da8b4f537f687e43&scene=58&subscene=0#rd) -- 暗影安全 - - [EISS-2022企业信息安全峰会之深圳站(10月28日/周五)](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657163400&idx=1&sn=49f10c8dd8563ed3920005a5d6e7c6c8&chksm=f1d4ea6dc6a3637b5b4b93fdf0b54a665920b1ec1a466e03c2391e3f8481246bfd2cbcd314b4&scene=58&subscene=0#rd) -- 数世咨询 - - [[调研]2021年零售业勒索软件攻击上升75%](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247495680&idx=1&sn=3bc319ced7ed13cca0b67a6853e49382&chksm=c14482bdf6330bab1a17316a34ce2732a043122523c23b2743aa1fff715a53d45e47525e9bcc&scene=58&subscene=0#rd) -- 关键基础设施安全应急响应中心 - - [关键信息基础设施安全国家标准进展](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531749&idx=1&sn=cebb21d87e1134b1438d5db627b630bf&chksm=c1e9f0b4f69e79a2f9cc7f6b09143004dfddf2b3a7c4ae767c133cd5396b5d74e4a48cb63189&scene=58&subscene=0#rd) - - [拜登再次强调关键基础设施安全，要“锁紧数字大门”](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531749&idx=2&sn=2219742256cd959985677cc3a239ce8f&chksm=c1e9f0b4f69e79a24de3a6db713630bc846cc17f42d92c6e6855a3866fd23acf258ce11c26a9&scene=58&subscene=0#rd) - - [俄乌网络战惨烈时刻：乌关基保护负责人因导弹袭击丧生](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531749&idx=3&sn=6ce686836e211503cd0a9131757fb57c&chksm=c1e9f0b4f69e79a2aebf345012d198dc0069bf634abea686847da288aa8cc9da1432ca9c518c&scene=58&subscene=0#rd) -- 看雪学院 - - [2022 SDC 议题 | 从应用场景看金融安全 — 逻辑为王](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476715&idx=1&sn=5a90b6704b29ee618fbb97c8080c0340&chksm=b18e502186f9d93781ea8a17b74b531aad3d50c1a8af64062dabd48377e5b384f6bed84082f2&scene=58&subscene=0#rd) - - [House of apple 一种新的glibc中IO攻击方法](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476715&idx=2&sn=1a2d6c1f64a04a962159cbb5f8bb556c&chksm=b18e502186f9d937926277ef237b679e7f327dee4149375037d115622b58681dbc1cf9db1065&scene=58&subscene=0#rd) - - [卡巴斯基发现WhatsApp的一款恶意mod，用户面临账户窃取风险](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476715&idx=3&sn=a1eefa67de01d9a6db7f2503c4ef0600&chksm=b18e502186f9d93742e7fac85fb7d23cc286dcc025f2923f62f37d8cff3e10e45b07499bd1f7&scene=58&subscene=0#rd) - - [峰会倒计时9天！日程安排Get](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476715&idx=4&sn=faed6e0a5954c62f5ac62848bffb6e32&chksm=b18e502186f9d937ad8066d43db322cf1629a571febb920a2708665c9d90bbdda67dd12c12ae&scene=58&subscene=0#rd) - - [@你，招人！本周岗位更新](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476715&idx=5&sn=300e1252a7e410a97825e16091092013&chksm=b18e502186f9d9377a6d1c0c77f8b210366a7a9e5545c3f3ebee5f8a8ac918c2edc5b5ab686c&scene=58&subscene=0#rd) -- 情报分析师 - - [美国国家安全战略报告合集（2017-2022）](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518939&idx=1&sn=0e28791b655cb65df1d7f223a62d9c4c&chksm=87169bd0b06112c6472f9cc20aecf2a2d6f03c1dd8f5b0989b293356ec5b672605f747c8a0e1&scene=58&subscene=0#rd) - - [【重磅推荐】新书《警用地理信息系统—理论技术与应用》](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650518939&idx=2&sn=b4d654e9f7dc51b2c71a96729e2d35e7&chksm=87169bd0b06112c6bd70e5f34410de7a699aa46af74ddc3eb12ac91c3c877107fdaea81c0a56&scene=58&subscene=0#rd) -- HackerNews - - [SolarMarker 正在使用水坑攻击与伪造的 Chrome 浏览器更新进行攻击](https://hackernews.cc/archives/41900) - - [俄乌网络战惨烈时刻：乌关基保护负责人因导弹袭击丧生](https://hackernews.cc/archives/41898) - - [谷歌云发布重磅安全产品，逆转软件供应链领域攻防形势](https://hackernews.cc/archives/41894) - - [微软 MSRC 推出基于 RSS 的安全更新通知服务](https://hackernews.cc/archives/41891) -- 嘶吼专业版 - - [【技术原创】Java利用技巧——AntSword-JSP-Template的优化](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247552091&idx=1&sn=061377d83ca103c5d0ddbe36e914d2e8&chksm=e915dc61de6255770aee47e7bdf1d50bc6814a99def28b64ed63164faa547c08e28f7c1864c9&scene=58&subscene=0#rd) - - [VM2远程代码执行漏洞曝光](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247552091&idx=2&sn=445cd3cc9b5c1d062ed8c6c4a99dcfc4&chksm=e915dc61de6255774a3e4eb5b6e47ebc8f30d7aaac158cde1aeb35ef18677cfd20d370b07936&scene=58&subscene=0#rd) -- Checkmarx.com - - [Reducing Friction in AppSec Program Adoption: How Checkmarx One Can Help](https://checkmarx.com/blog/reducing-friction-in-appsec-program-adoption-how-checkmarx-one-can-help/) -- 字节跳动技术团队 - - [字节跳动基础架构团队参会报告：一文看懂 VLDB'22 技术趋势及精选论文](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247499493&idx=1&sn=ad5f6c819fed3e88160c0297f7207589&chksm=e9d33507dea4bc1150200a92cb552d408d40181e9d95934c7260d7550f8cf5333069f62cc362&scene=58&subscene=0#rd) - - [【活动推荐】即将开营｜报名获取跨平台与热更新技术操作秘籍！](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247499493&idx=2&sn=854c5f3cab053a36b19caa7f63d63f28&chksm=e9d33507dea4bc11eeb093a6ab584eda7c14c961b7ea07496e9f8b2c2299af171ad17eb4591e&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [揭秘三种新型恶意软件的感染方式与传播路径](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531928&idx=1&sn=14ed67c307c17d95b98684ba7363f9e9&chksm=fa93cb59cde4424fe8891b7a58cfec50fe887e1b3bb4c3c8a5a97f9899b6daa9d2957dab1139&scene=58&subscene=0#rd) - - [美国多个机场遭到亲俄罗斯威胁团伙Killnet的网络攻击](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531928&idx=2&sn=9bb30cf697a140918cae5a54896062ea&chksm=fa93cb59cde4424fd8d6ec2e2b45ef80dbd7a4816d3471bdce58704bf18d2466e55731fa1dd3&scene=58&subscene=0#rd) - - [汽车行业网络攻击风险升高](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531928&idx=3&sn=40b04ed2870beb17afef21053c8f581d&chksm=fa93cb59cde4424f9126f1dd2153b5b71e6b89628b74f14563171b77135146dbf9d8f7ff3bf8&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [这45个账号安全风险，你check了吗？](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247494521&idx=1&sn=07a0cd6080cd0ee4b499bf100498b1c6&chksm=eb12cd42dc6544543d69e64dce671845fbf1d9b79460f331db3ee98663f5d28fc653df300442&scene=58&subscene=0#rd) -- 火线Zone - - [重温OMI：分析CVE-2022-29149，Azure OMI中的权限提升漏洞](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247496915&idx=1&sn=f41ce8a944db1f5895aacb5bfdd94797&chksm=eaa97cf3dddef5e579d473cc823c5e15090bcf64d77a4f3460e97bc9c421edfd2070e52184a6&scene=58&subscene=0#rd) - - [火热报名中｜OSCS 软件供应链安全技术论坛议程抢先看](https://mp.weixin.qq.com/s?__biz=MzI2NDQ5NTQzOQ==&mid=2247496915&idx=2&sn=91f833782d16a31e63fa800d6163ca2a&chksm=eaa97cf3dddef5e5359fe780efca8126f80f29681f85d3170e8a76527fa1dab036b6168b460f&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-16.md b/archive/2022/2022-10-16.md deleted file mode 100644 index dc725ead4c..0000000000 --- a/archive/2022/2022-10-16.md +++ /dev/null @@ -1,71 +0,0 @@ -# 每日安全资讯（2022-10-16） - -- Security Boulevard - - [What is Threatening Your Data?](https://securityboulevard.com/2022/10/what-is-threatening-your-data/) - - [BSidesLV 2022 Lucky13 Hire Ground – Steve Winterfeld’s ‘Find Your North Star’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-hire-ground-steve-winterfelds-find-your-north-star/) - - [Anti-Money Laundering Service AMLBot Cleans House](https://securityboulevard.com/2022/10/anti-money-laundering-service-amlbot-cleans-house/) -- Twitter @Nicolas Krassas - - [HTB: Perspective](https://twitter.com/Dinosn/status/1581361024267014146) - - [New PHP Version of Ducktail info-stealer hijacks Facebook Business accounts](https://twitter.com/Dinosn/status/1581360892306128897) - - [GodGenesis - A Python3 Based C2 Server To Make Life Of Red Teamer A Bit Easier. The Payload Is Capable To Bypass All The Known Antiviruses And Endpoin...](https://twitter.com/Dinosn/status/1581297111920168960) - - [Events Ripper](https://twitter.com/Dinosn/status/1581297031691522048) - - [Palo Alto Networks fixed a high-severity auth bypass flaw in PAN-OS](https://twitter.com/Dinosn/status/1581296769488412672) - - [RT Ali Beydoun | 19: CLI C2 That I Developed With The Help Of @RET2_pwn & Can Do The Following: ✅Http Listeners ✅Generate Payloads ✅SQLITE Database...](https://twitter.com/itscyberali/status/1581274778610307074) - - [Student jailed for hacking female classmates’ email, Snapchat accounts](https://twitter.com/Dinosn/status/1581173801928491010) - - [Store credit card numbers in a debug log, lose millions of accounts. Cost? $1.9m](https://twitter.com/Dinosn/status/1581173690150309888) - - ['Baby Al Capone' to pay $22m to SIM-swap crypto-heist victim](https://twitter.com/Dinosn/status/1581171539524755456) - - [Indian Energy Company Tata Power's IT Infrastructure Hit By Cyber Attack](https://twitter.com/Dinosn/status/1581171476891586561) - - [Experts disclose technical details of now-patched CVE-2022-37969 Windows Zero-Day](https://twitter.com/Dinosn/status/1581171412563152897) - - [RT ϻг_ϻε: Now you see why we still cover Phar deserialization in Full Stack Web Attack!](https://twitter.com/steventseeley/status/1581129940707074049) - - [RT blueblue: GitHub - Warxim/CVE-2022-41852: CVE-2022-41852 Proof of Concept (unofficial) -](https://twitter.com/piedpiper1616/status/1581097770882326529) -- Recent Commits to cve:main - - [Update Sat Oct 15 10:15:49 UTC 2022](https://github.com/trickest/cve/commit/04c9a6ccf2676bcb357a454849a053b6ed771509) -- Sploitus.com Exploits RSS Feed - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=252F889F-2BFB-5D8D-B1CD-63075FB7EC34&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Sophos Firewall exploit](https://sploitus.com/exploit?id=FA1424FC-DEEC-59EB-A204-0082D635BE7E&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=84344B5F-D0D1-5F17-B938-9A8849618A51&utm_source=rss&utm_medium=rss) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [WordPress Zephyr Project Manager 3.2.42 SQL Injection](https://cxsecurity.com/issue/WLB-2022100038) -- unSafe.sh - 不安全 - - [31个！Golang常用工具来啦（建议收藏）](https://buaq.net/go-131029.html) - - [【 电工实训仿真教学软件 】适合从事电工的朋友！！！！](https://buaq.net/go-131039.html) - - [Red Team C2 Log Visualization](https://buaq.net/go-131014.html) - - [GodGenesis - A Python3 Based C2 Server To Make Life Of Red Teamer A Bit Easier. The Payload Is Capable To Bypass All The Known Antiviruses And Endpoints](https://buaq.net/go-131013.html) - - [How Meltdown and Spectre haunt Anti-Cheat: DVRT details](https://buaq.net/go-131011.html) - - [中汽数据助力2022 SDC，携手共建安全新生态](https://buaq.net/go-131025.html) - - [2022 SDC 倒计时8天！圆桌会谈：供应链安全](https://buaq.net/go-131023.html) - - [小小做题家之——musl 1.2.2的利用手法](https://buaq.net/go-131024.html) - - [Unicorn 高级逆向与反混淆](https://buaq.net/go-131022.html) - - [给本子安装 manjaro 出现无法关机的解决办法 - 糖醋鱼的小破站](https://buaq.net/go-130991.html) - - [从配色选择到系统功能妙用：这些技巧让 iPhone 更有个性](https://buaq.net/go-131003.html) - - [前瞻：也许没有发布会的十月，我们还能期待哪些 Apple 新品？](https://buaq.net/go-130990.html) - - [终于等到你，订阅软件时隔 1 年 3 个月再次限免](https://buaq.net/go-131038.html) - - [GoodSync 12 首次限免，跨平台文件同步工具](https://buaq.net/go-130983.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [研究人员从西门子PLC中提取主加密密钥](https://www.4hou.com/posts/zlz7) - - [攻击者如何在攻击中滥用原生 Linux 工具](https://www.4hou.com/posts/PJln) -- SAP Blogs - - [Change Record in S4HANA – A New Look to ECR/ECO in S4HANA](https://blogs.sap.com/2022/10/15/change-record-in-s4hana-a-new-look-to-ecr-eco-in-s4hana/) - - [AWS EC2 OS patching automation for SAP Landscape](https://blogs.sap.com/2022/10/15/aws-ec2-os-patching-automation-for-sap-landscape/) - - [Experience SAP Inside Track Bangalore 2022 with Visual Impressions](https://blogs.sap.com/2022/10/15/experience-sap-inside-track-bangalore-2022-with-visual-impressions/) -- Malware-Traffic-Analysis.net - Blog Entries - - [2022-10-14 - bb02 Qakbot (Qbot) infection](https://www.malware-traffic-analysis.net/2022/10/14/index.html) -- 博客园 - admin-神风 - - [Apache Commons Text远程代码执行漏洞(CVE-2022-42889)分析 - admin-神风](https://www.cnblogs.com/wh4am1/p/16795499.html) -- KitPloit - PenTest & Hacking Tools - - [GodGenesis - A Python3 Based C2 Server To Make Life Of Red Teamer A Bit Easier. The Payload Is Capable To Bypass All The Known Antiviruses And Endpoints](http://www.kitploit.com/2022/10/godgenesis-python3-based-c2-server-to.html) -- 博客园 - nice_0e3 - - [解读 Permission 注解权限认证流程 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16794557.html) -- Twitter @Octagon Networks - - [RT GreyNoise: Tag is out for CVE-2022-22241, a pre-authentication Phar deserialization vulnerability in Juniper JunOS, discovered by @PaulosYibelo and...](https://twitter.com/GreyNoiseIO/status/1581111245695918080) -- Malwarebytes Labs - - [FBI, CISA warn of disinformation ahead of midterms](https://www.malwarebytes.com/blog/news/2022/10/fbi-and-cisa-urge-americans-to-be-critical-of-information-in-light-of-midterm-election) -- Reverse Engineering - - [How Meltdown and Spectre haunt Anti-Cheat: DVRT details](https://www.reddit.com/r/ReverseEngineering/comments/y4l5y1/how_meltdown_and_spectre_haunt_anticheat_dvrt/) -- 杨龙 - - [PHP交换两个int变量的值（$a ^ $b Xor（按位异或） 将把 $a 和 $b 中一个为 1 另一个为 0 的位设为 1。）](https://www.yanglong.pro/php%e4%ba%a4%e6%8d%a2%e4%b8%a4%e4%b8%aaint%e5%8f%98%e9%87%8f%e7%9a%84%e5%80%bc%ef%bc%88a-bxor%ef%bc%88%e6%8c%89%e4%bd%8d%e5%bc%82%e6%88%96%ef%bc%89%e5%b0%86%e6%8a%8a-a-%e5%92%8c-b-%e4%b8%ad/) -- 奇客Solidot–传递最新科技情报 - - [马斯克要求五角大楼支付 Starlink 费用](https://www.solidot.org/story?sid=73068) - - [Crew Dragon 过去两年运送的宇航员数量超过其他国家](https://www.solidot.org/story?sid=73067) - - [墨西哥毒枭与华人地下钱庄合作洗钱](https://www.solidot.org/story?sid=73066) - - [英伟达取消发布 RTX 4080 12GB 显卡](https://www.solidot.org/story?sid=73065) diff --git a/archive/2022/2022-10-17.md b/archive/2022/2022-10-17.md deleted file mode 100644 index 7c07a3fb0d..0000000000 --- a/archive/2022/2022-10-17.md +++ /dev/null @@ -1,77 +0,0 @@ -# 每日安全资讯（2022-10-17） - -- Security Boulevard - - [BSidesLV 2022 Lucky13 Hire Ground – Wes G. Sheppard’s ‘Failing Upwards: How To Rise In Cybersecurity By Finding (And Exploiting) Your Weaknesses’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-hire-ground-wes-g-sheppards-failing-upwards-how-to-rise-in-cybersecurity-by-finding-and-exploiting-your-weaknesses/) - - [Three Cybersecurity Surprises from State Security Chiefs](https://securityboulevard.com/2022/10/three-cybersecurity-surprises-from-state-security-chiefs/) -- SecWiki News - - [SecWiki News 2022-10-16 Review](http://www.sec-wiki.com/?2022-10-16) -- Sploitus.com Exploits RSS Feed - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=A74FC70F-51E2-5B48-AC8B-D73376E8A78F&utm_source=rss&utm_medium=rss) - - [Exploit for OS Command Injection in Telesquare Sdt-Cs3B1 Firmware exploit](https://sploitus.com/exploit?id=2B2E61F0-0BE6-5E6D-B298-D7F09B622C2E&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Atlassian Confluence Data Center exploit](https://sploitus.com/exploit?id=321617C5-08C5-5919-9510-2571831D052E&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2021-44103 exploit](https://sploitus.com/exploit?id=A00E4CA2-764A-5006-9E88-00CDF5E0C3A9&utm_source=rss&utm_medium=rss) -- Twitter @Nicolas Krassas - - [Re @RoninDey @subtee @Hexacorn Same as well …](https://twitter.com/Dinosn/status/1581655476332531715) - - [Google search crashes when you ask "How many emojis on Apple"](https://twitter.com/Dinosn/status/1581560284522885127) - - [Video: Analysis of a Malicious HTML File (QBot), (Sun, Oct 16th)](https://twitter.com/Dinosn/status/1581560013977309184) - - [Almost 900 servers hacked using Zimbra zero-day flaw](https://twitter.com/Dinosn/status/1581542896003846144) -- unSafe.sh - 不安全 - - [Hijacked Wi-Fi? Thorough explanation of hacking techniques](https://buaq.net/go-131133.html) - - [秋季班报名 |《看雪安卓高级研修班》](https://buaq.net/go-131151.html) - - [iPhone 14等你拿！2022 KCTF 秋季赛防守方征题中](https://buaq.net/go-131153.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [十大未查出幕后组织的APT攻击](https://www.4hou.com/posts/BEjn) - - [安卓和Chrome将支持Passkey](https://www.4hou.com/posts/xjxn) -- No Headback - - [微服务税](http://xargin.com/microservice-tax-and-grpc-mock/) -- Recent Commits to cve:main - - [Update Sun Oct 16 10:15:43 UTC 2022](https://github.com/trickest/cve/commit/83d924f5365ba5e36a7e59ed5a44252adfd4011f) -- obaby@mars - - [Intel Alder Lake The BIOS Code from project C970 (Leaked)](http://h4ck.org.cn/2022/10/intel-alder-lake-the-bios-code-from-project-c970-leaked/) - - [十九年](http://h4ck.org.cn/2022/10/%e5%8d%81%e4%b9%9d%e5%b9%b4/) -- gynvael.coldwind//vx.log (pl) - - [Rozwiązania MSHP CTF (październik 2022)](https://gynvael.coldwind.pl/?id=756) -- CTFするぞ - - [Snyk Capture the Flag 101に参加しました](https://ptr-yudai.hatenablog.com/entry/2022/10/16/185229) -- Malwarebytes Labs - - [Android and iOS leak some data outside VPNs](https://www.malwarebytes.com/blog/news/2022/10/android-and-ios-suffer-from-leaky-tunnels) -- Quarkslab's blog - - [Internship Offers for the 2022-2023 Season](http://blog.quarkslab.com/internship-offers-for-the-2022-2023-season.html) -- SAP Blogs - - [SAP Activate & WRICEF for SAP CPQ](https://blogs.sap.com/2022/10/16/sap-activate-wricef-for-sap-cpq/) - - [The Power of Crystal Reports: Data Manipulation on the Fly](https://blogs.sap.com/2022/10/16/the-power-of-crystal-reports-data-manipulation-on-the-fly/) -- Hackerman's Hacking Tutorials - - [YAML Wrangling with Rust](https://parsiya.net/blog/2022-10-16-yaml-wrangling-with-rust/) -- 小草窝博客 - - [读读 fingerprintx ，一个端口指纹识别工具.md](https://x.hacking8.com/post-446.html) -- 高林の雑記ブログ - - [研究室ネットワークに対するMuninでの監視をAnsibleで自動化する](https://kakyouim.hatenablog.com/entry/2022/10/17/010445) -- 杨龙 - - [Solr 开源搜索平台 笔记](https://www.yanglong.pro/solr-%e5%bc%80%e6%ba%90%e6%90%9c%e7%b4%a2%e5%b9%b3%e5%8f%b0%e7%ac%94%e8%ae%b0/) - - [如何避免join（笛卡尔积）](https://www.yanglong.pro/%e5%a6%82%e4%bd%95%e9%81%bf%e5%85%8djoin%ef%bc%88%e7%ac%9b%e5%8d%a1%e5%b0%94%e7%a7%af%ef%bc%89/) -- 看雪学院 - - [今晚8点公开课直播预告 | 实战过某交友 APP Frida 检测](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476780&idx=1&sn=4652f7fd14c011f7de344301c3758c56&chksm=b18e506686f9d970061050337f178c56fc0c11cf7e743d951e7621e64b507a7d05044feb5257&scene=58&subscene=0#rd) - - [动静态结合分析非标准MD5算法及还原](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476780&idx=2&sn=cf9ad8790c78e2a1f67cd5d3d6606b69&chksm=b18e506686f9d970d035ab0af5f2c8884ed1c724b41f622aba20c4de944681f103de95ff6e2e&scene=58&subscene=0#rd) - - [iPhone 14等你拿！2022 KCTF 秋季赛防守方征题中](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476780&idx=3&sn=43cf4e4c5424753a3c819f930738e2d1&chksm=b18e506686f9d9706f4fc48b88d330096318d9b3b9ea2b02b7453258d8aae38d6e246d244a66&scene=58&subscene=0#rd) - - [2022 SDC 倒计时7天！极客市集等你来玩儿](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476780&idx=4&sn=43d7dfe72ce94ce2d97ff02acba23d0b&chksm=b18e506686f9d9700faf1ae6bd2f5821e454ca3de2e3e858fb75795826e4f719c271a80a6dc4&scene=58&subscene=0#rd) - - [秋季班报名 |《看雪安卓高级研修班》](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458476780&idx=5&sn=cf0a777db1ec3a124f5df701b6d6aec3&chksm=b18e506686f9d9708c5140e02496c1074f967de846400cb399bc84f9aac337daff8f4094e2b7&scene=58&subscene=0#rd) -- dotNet安全研究僧 - - [.NET矩阵一周热点主题 10.08-10.14](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247486668&idx=1&sn=b8560f913f7041e61e420994b4199961&chksm=fa5aa221cd2d2b37f3fcab8070b21feb3f11875d0e35cbb64eff59528a66517431d699a5aa30&scene=58&subscene=0#rd) -- 奇客Solidot–传递最新科技情报 - - [丹麦新党的领袖是 AI 聊天机器人](https://www.solidot.org/story?sid=73072) - - [Google Pixel 7 只支持 64 位应用](https://www.solidot.org/story?sid=73071) - - [Google 搜索 emojis 相关短语会发生崩溃](https://www.solidot.org/story?sid=73070) - - [猎天使魔女声优发声否认开发商说法呼吁抵制](https://www.solidot.org/story?sid=73069) -- 黑海洋 - WIKI - - [如何使用摸瓜快速查手机apk加壳(安卓反编译)](https://blog.upx8.com/3048) - - [Android AAB加固厂商特征](https://blog.upx8.com/3047) -- 安全圈 - - [【安全圈】警惕网络黑号，广西网警办理一批“四断”类违法犯罪案件](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020909&idx=1&sn=29de31b3565847a94c8dd1de67ec2fad&chksm=f36f8cedc41805fbbee6dfae4a59e258d767e84ca2d227499823e97bed2a28fcc8a6f0f3227d&scene=58&subscene=0#rd) - - [【安全圈】黑吃黑？男子下载外挂“薅羊毛”反被薅了](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020909&idx=2&sn=f05ae2e1ac4966a79577b3198f71b892&chksm=f36f8cedc41805fb5be08d2eb213877cb2a7b5efa4b21419fe87a2ca4a4da97420d45126ba1a&scene=58&subscene=0#rd) - - [【安全圈】Cloudflare 阻止了针对微软Minecraft服务器的每秒2.5TB流量的 DDoS 攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020909&idx=3&sn=da820fc2d32aa5c3c2969897a0de703a&chksm=f36f8cedc41805fb089417e459fdc6761c6c1c0569cbf3b2e21e7ff51c63536c8e03e9399ee2&scene=58&subscene=0#rd) - - [【安全圈】SolarMarker 正在使用水坑攻击与伪造的 Chrome 浏览器更新进行攻击](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652020909&idx=4&sn=7309f4c1a0efeeb9151f3bdecd85bcdb&chksm=f36f8cedc41805fbc500424c24bb1e67f13e795523e88037754ac059e7ef0a542530b6d65b63&scene=58&subscene=0#rd) -- 情报分析师 - - [【资料上新】面向英国国家安全的开源情报的未来](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650519107&idx=1&sn=56839da5951c62c8feb8c2d8d0a1e4d7&chksm=87169808b061111e37d6e21c8daeb79a194fccb7717dea06b9e1cb27aa419a83847793b10cb3&scene=58&subscene=0#rd) -- 极客公园 - - [一个国内大型 DAO 的「轰然倒塌」——教训和意义](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652970087&idx=1&sn=a65a789895e45cdada1fe8b8c66eb1f3&chksm=7e5461d14923e8c7edc766c1e68ac29b65e91ea9a19d9f0578bb44d4db239488d847697d9838&scene=58&subscene=0#rd) - - [苹果或推 iPad 底座智能音箱；特斯拉国内「首告」前员工侵害机密；国家邮政：2025 年底禁用不可降解包装 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2652970086&idx=1&sn=edd7b8836f54ba5149a70e99e66a7d43&chksm=7e5461d04923e8c6d17420aa5a6a5936ed6739a03919c32cf2919fbe9816b5b74f34b5bdae61&scene=58&subscene=0#rd) diff --git a/archive/2022/2022-10-18.md b/archive/2022/2022-10-18.md deleted file mode 100644 index 8f72190493..0000000000 --- a/archive/2022/2022-10-18.md +++ /dev/null @@ -1,240 +0,0 @@ -# 每日安全资讯（2022-10-18） - -- Files ≈ Packet Storm - - [Gentoo Linux Security Advisory 202210-09](https://packetstormsecurity.com/files/168756/glsa-202210-09.txt) - - [Ubuntu Security Notice USN-5682-1](https://packetstormsecurity.com/files/168755/USN-5682-1.txt) - - [MiniDVBLinux 5.4 Arbitrary File Read](https://packetstormsecurity.com/files/168754/ZSL-2022-5719.txt) - - [Gentoo Linux Security Advisory 202210-08](https://packetstormsecurity.com/files/168753/glsa-202210-08.txt) - - [WordPress Photo Gallery 1.8.0 Cross Site Scripting](https://packetstormsecurity.com/files/168752/wpphotogallery180-xss.txt) - - [RRX IOB LP 1.0 DNS Cache Snooping](https://packetstormsecurity.com/files/168751/VL-2261.txt) - - [Ubuntu Security Notice USN-5680-1](https://packetstormsecurity.com/files/168750/USN-5680-1.txt) - - [MiniDVBLinux 5.4 Remote Root Command Execution](https://packetstormsecurity.com/files/168749/ZSL-2022-5718.txt) - - [WiFi File Transfer 1.0.8 Cross Site Scripting](https://packetstormsecurity.com/files/168746/VL-2322.txt) - - [Backdoor.Win32.Redkod.d MVID-2022-0649 Hardcoded Credential](https://packetstormsecurity.com/files/168745/MVID-2022-0649.txt) - - [MiniDVBLinux 5.4 Remote Root Command Injection](https://packetstormsecurity.com/files/168744/ZSL-2022-5717.txt) - - [GNU Privacy Guard 2.3.8](https://packetstormsecurity.com/files/168747/gnupg-2.3.8.tar.bz2) - - [GNU Privacy Guard 2.2.40](https://packetstormsecurity.com/files/168748/gnupg-2.2.40.tar.bz2) - - [pfSense pfBlockerNG 2.1.4_26 Shell Upload](https://packetstormsecurity.com/files/168743/pfsense_pfblockerng_webshell.rb.txt) - - [Spring Cloud Gateway 3.1.0 Remote Code Execution](https://packetstormsecurity.com/files/168742/spring_cloud_gateway_rce.rb.txt) - - [Gentoo Linux Security Advisory 202210-07](https://packetstormsecurity.com/files/168741/glsa-202210-07.txt) - - [Webile 1.0.1 Directory Traversal](https://packetstormsecurity.com/files/168740/VL-2320.txt) - - [MiniDVBLinux 5.4 Unauthenticated Stream Disclosure](https://packetstormsecurity.com/files/168739/ZSL-2022-5716.txt) - - [Gentoo Linux Security Advisory 202210-06](https://packetstormsecurity.com/files/168738/glsa-202210-06.txt) - - [Nullcon Berlin 2023 Call For Papers](https://packetstormsecurity.com/files/168737/nullconBerlin2023-cfp.txt) - - [Gentoo Linux Security Advisory 202210-05](https://packetstormsecurity.com/files/168736/glsa-202210-05.txt) - - [Backdoor.Win32.DarkSky.23 MVID-2022-0648 Buffer Overflow](https://packetstormsecurity.com/files/168735/MVID-2022-0648.txt) - - [Ubuntu Security Notice USN-5683-1](https://packetstormsecurity.com/files/168734/USN-5683-1.txt) - - [MiniDVBLinux 5.4 Change Root Password](https://packetstormsecurity.com/files/168733/ZSL-2022-5715.txt) - - [MiniDVBLinux 5.4 SVDRP Control](https://packetstormsecurity.com/files/168732/ZSL-2022-5714.txt) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [MiniDVBLinux 5.4 Remote Root Command Injection](https://cxsecurity.com/issue/WLB-2022100049) - - [RRX IOB LP 1.0 DNS Cache Snooping](https://cxsecurity.com/issue/WLB-2022100048) - - [WiFi File Transfer 1.0.8 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100047) - - [pfSense pfBlockerNG 2.1.4_26 Shell Upload](https://cxsecurity.com/issue/WLB-2022100046) - - [MiniDVBLinux 5.4 Unauthenticated Stream Disclosure](https://cxsecurity.com/issue/WLB-2022100045) - - [MiniDVBLinux 5.4 Change Root Password](https://cxsecurity.com/issue/WLB-2022100044) - - [Backdoor.Win32.DarkSky.23 / Remote Stack Buffer Overflow (SEH)](https://cxsecurity.com/issue/WLB-2022100043) - - [Webile 1.0.1 Directory Traversal](https://cxsecurity.com/issue/WLB-2022100042) - - [OpenCart v3.x So Newsletter Custom Popup Module - Blind SQL Injection](https://cxsecurity.com/issue/WLB-2022100041) - - [Backdoor.Win32.Redkod.d / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022100040) - - [MiniDVBLinux 5.4 SVDRP Control](https://cxsecurity.com/issue/WLB-2022100039) -- Recent Commits to cve:main - - [Update Mon Oct 17 10:19:45 UTC 2022](https://github.com/trickest/cve/commit/e8538f1dc6e111d48081813d847a23e5df141940) -- 安全客-有思想的安全新媒体 - - [手机好像在“监听”你说话，你有过这种恐慌吗？](https://www.anquanke.com/post/id/281729) - - [CVE-2022-25237 Bonitasoft Platform RCE漏洞分析](https://www.anquanke.com/post/id/281732) - - [Magniber勒索团伙通过JavaScript文件感染Windows用户](https://www.anquanke.com/post/id/281791) - - [Thoma Bravo以23亿美元收购网络安全公司ForgeRock](https://www.anquanke.com/post/id/281794) - - [RansomExx泄露52 GB巴塞罗那健康中心数据](https://www.anquanke.com/post/id/281800) - - [数字安全观察每周简报【政策消息篇】2022.09.28-2022.10.12](https://www.anquanke.com/post/id/281824) - - [WhatsApp非官方应用被发现会窃取用户账号](https://www.anquanke.com/post/id/281811) - - [软件Firefox Relay支持生成虚拟电话号码](https://www.anquanke.com/post/id/281807) - - [漏洞分析 | 利用 CodeQL 分析 fastjson 1.2.80 利用链](https://www.anquanke.com/post/id/281733) - - [微软过时驱动程序列表让Windows PC易受恶意软件攻击](https://www.anquanke.com/post/id/281804) - - [闪电贷攻击？加密货币交易平台Mango Markets损失过亿](https://www.anquanke.com/post/id/281772) - - [Minecraft服务器Wynncraft遭DDoS攻击](https://www.anquanke.com/post/id/281777) - - [工信部通报 38 款侵害用户权益 App 涉及 2345 浏览器、丁香医生等](https://www.anquanke.com/post/id/281767) -- Twitter @Nicolas Krassas - - [MyDeal data breach impacts 2.2M users, stolen data for sale online](https://twitter.com/Dinosn/status/1582121402446278656) - - [WAM BAM - Recovering Web Tokens From Office](https://twitter.com/Dinosn/status/1582101855697444864) - - [Australian insurance firm Medibank confirms ransomware attack](https://twitter.com/Dinosn/status/1582078072223768579) - - [A journey of fuzzing Nvidia graphic driver leading to LPE exploitation](https://twitter.com/Dinosn/status/1582066704263544832) - - [Dutch Police Tricked Deadbolt Ransomware Gang Into Sharing Decryption Keys](https://twitter.com/Dinosn/status/1582066625947189248) - - [Hacking Automobile Keyless Entry Systems](https://twitter.com/Dinosn/status/1582066514194100225) - - [New UEFI rootkit Black Lotus offered for sale at $5,000](https://twitter.com/Dinosn/status/1582066405125783552) - - [2.2 million Woolworths MyDeal customers exposed in data breach](https://twitter.com/Dinosn/status/1582066296191320064) - - [RT ScanFactory: The most extensive & up-to-date collection of public exploits & references for CVEs that you'll ever need! #cybersec #infosec #bugboun...](https://twitter.com/scanfactory_io/status/1582039297703612416) - - [Shein Owner Zoetop Fined $1.9m Over Data Breach Response](https://twitter.com/Dinosn/status/1582031844895518720) - - [Researchers Say Microsoft Office 365 Uses Broken Email Encryption to Secure Messages](https://twitter.com/Dinosn/status/1582000828075847680) - - [Black Basta Ransomware Hackers Infiltrates Networks via Qakbot to Deploy Brute Ratel C4](https://twitter.com/Dinosn/status/1582000784572841984) - - [Japanese tech firm Oomiya hit by LockBit 3.0. Multiple supply chains potentially impacted](https://twitter.com/Dinosn/status/1582000744588226560) - - [Toner Deaf – Printing your next persistence (Hexacon 2022)](https://twitter.com/Dinosn/status/1581978087369019392) - - [How I Got $10,000 From GitHub For Bypassing Filtration oF HTML tags](https://twitter.com/Dinosn/status/1581978016766304257) - - [PoC for UAC bypass using arbitrary file delete in auto-elevated IFaultrepElevatedDataCollection COM object. Arbitrary file delete is abused to get SYS...](https://twitter.com/Dinosn/status/1581977484786302977) - - [RT Cube0x0: A new blog post on Relaying FIDO2 YubiKeys is up. Yubico is claiming that this is not subjected to Phishing so below is a PoC of phishing ...](https://twitter.com/cube0x0/status/1581918794275966977) - - [AWSome Pentesting Cheatsheet](https://twitter.com/Dinosn/status/1581878331003523073) - - [AD Security Intrusion Detection System](https://twitter.com/Dinosn/status/1581877762373038080) - - [Janus is a pre-build event that performs string obfuscation during compile time. This project is based off the CIA's Marble Framework](https://twitter.com/Dinosn/status/1581877682618654721) -- Sploitus.com Exploits RSS Feed - - [Webile 1.0.1 Directory Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:168740&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.DarkSky.23 MVID-2022-0648 Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:168735&utm_source=rss&utm_medium=rss) - - [WiFi File Transfer v1.0.8 - Cross Site Scripting Vulnerabilities exploit](https://sploitus.com/exploit?id=VULNERABLE:2322&utm_source=rss&utm_medium=rss) - - [MapTool 1.11.5 Denial Of Service exploit](https://sploitus.com/exploit?id=PACKETSTORM:168726&utm_source=rss&utm_medium=rss) - - [Stripe Green Downloads 2.03 - Cross Site Web Vulnerability exploit](https://sploitus.com/exploit?id=VULNERABLE:2287&utm_source=rss&utm_medium=rss) - - [pfSense pfBlockerNG 2.1.4_26 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168743&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Configuration Download exploit](https://sploitus.com/exploit?id=PACKETSTORM:168731&utm_source=rss&utm_medium=rss) - - [Garage Management System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168718&utm_source=rss&utm_medium=rss) - - [Joomla Vik Appointments 1.7.3 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168729&utm_source=rss&utm_medium=rss) - - [Spring Cloud Gateway 3.1.0 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38037&utm_source=rss&utm_medium=rss) - - [Spring Cloud Gateway 3.1.0 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168742&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Remote Root Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168749&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 SVDRP Control exploit](https://sploitus.com/exploit?id=PACKETSTORM:168732&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Change Root Password exploit](https://sploitus.com/exploit?id=PACKETSTORM:168733&utm_source=rss&utm_medium=rss) - - [WordPress Photo Gallery 1.8.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168752&utm_source=rss&utm_medium=rss) - - [WiFi File Transfer 1.0.8 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168746&utm_source=rss&utm_medium=rss) - - [Wordpress ImageMagick-Engine 1.7.4 Plugin - Remote Code Execution (Authenticated) Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38035&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Change Root Password Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38041&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Remote Root Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168744&utm_source=rss&utm_medium=rss) - - [Vicidial 2.14-783a Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168713&utm_source=rss&utm_medium=rss) - - [Exploit for Cross-site Scripting in Helpsystems Cobalt Strike exploit](https://sploitus.com/exploit?id=5B9ECD65-2210-5FE9-8ECE-77CFAEB44694&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-24990 exploit](https://sploitus.com/exploit?id=0A261A34-CF13-5D79-BD7F-6E9B54B96DEE&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Sophos Firewall exploit](https://sploitus.com/exploit?id=E88B092A-CAC3-5E4D-AA85-1C01600A7A46&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=77197575-9978-5136-A83D-F5FF790F2F34&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Control of Dynamically-Managed Code Resources in Vm2 Project Vm2 exploit](https://sploitus.com/exploit?id=B0D935D0-63C8-5C5E-94CD-4B434F315B0B&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Apache Commons Text exploit](https://sploitus.com/exploit?id=8DEA6A03-D2AB-5FF8-91AA-E75640EF27B2&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Apache Commons Configuration exploit](https://sploitus.com/exploit?id=06F61093-00F5-5EEB-B6FA-59F105962C41&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [4 tactics for cybersecurity at home or work](https://securityboulevard.com/2022/10/4-tactics-for-cybersecurity-at-home-or-work/) - - [PROFESSIONAL CYBERSECURITY SERVICES Datasheet](https://securityboulevard.com/2022/10/professional-cybersecurity-services-datasheet/) - - [Frontline Security GPA Datasheet](https://securityboulevard.com/2022/10/frontline-security-gpa-datasheet/) - - [The Expanding Role of Vulnerability Management in Proactive Cybersecurity](https://securityboulevard.com/2022/10/the-expanding-role-of-vulnerability-management-in-proactive-cybersecurity/) - - [Why You Need a Data-Driven Approach to Vulnerability Management | Lookout](https://securityboulevard.com/2022/10/why-you-need-a-data-driven-approach-to-vulnerability-management-lookout/) - - [GUEST ESSAY: A breakout of how Google, Facebook, Instagram enable third-party snooping](https://securityboulevard.com/2022/10/guest-essay-a-breakout-of-how-google-facebook-instagram-enable-third-party-snooping/) - - [$3 BILLION in DeFi Hacks in 2022—So Far](https://securityboulevard.com/2022/10/3-billion-defi-hacks-richixbw/) - - [BSidesLV 2022 Lucky13 Hire Ground – Tom Eston’s ‘Management Hacking 101: Leading High Performance Teams’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-hire-ground-tom-estons-management-hacking-101-leading-high-performance-teams/) - - [Real-time OWASP vulnerabilities as you code with Code Sight and Rapid Scan Static](https://securityboulevard.com/2022/10/real-time-owasp-vulnerabilities-as-you-code-with-code-sight-and-rapid-scan-static/) - - [Combining Cybersecurity with Gaming: Cheats, Insider Threats, Ransomware and More](https://securityboulevard.com/2022/10/combining-cybersecurity-with-gaming-cheats-insider-threats-ransomware-and-more/) -- SecWiki News - - [SecWiki News 2022-10-17 Review](http://www.sec-wiki.com/?2022-10-17) -- paper - Last paper - - [Android NFC 条件竞争漏洞分析（CVE-2021-0870）](https://paper.seebug.org/1987/) - - [8220 Gang 云僵尸网络感染全球约 3 万台主机](https://paper.seebug.org/1986/) -- unSafe.sh - 不安全 - - [Out Of Band Update: Cobalt Strike 4.7.2](https://buaq.net/go-131335.html) - - [8 KB is not enough: why WAFs can’t protect APIs](https://buaq.net/go-131336.html) - - [All Eyes on Cloud | Why the Cloud Surface Attracts Attacks](https://buaq.net/go-131321.html) - - [Detecting Emerging Network Threats From Newly Observed Domains](https://buaq.net/go-131318.html) -- 安全脉搏 - - [域渗透之委派攻击全集](https://www.secpulse.com/archives/189184.html) - - [web类 | XXE漏洞总结](https://www.secpulse.com/archives/189161.html) - - [常用Webshell管理工具上线利用方式](https://www.secpulse.com/archives/189104.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [工信部通报38款App，苹果iOS也被点名](https://www.4hou.com/posts/kMLY) - - [2022 Q1-Q3网络安全投融资季度专题分析](https://www.4hou.com/posts/PJEl) - - [获Gartner首推！360 BAS如何成安全能力度量标尺？](https://www.4hou.com/posts/jJKz) - - [Android逆向分析工具性能对比分析](https://www.4hou.com/posts/6VNQ) - - [CVE-2019-10999 在Shambles上的漏洞重现](https://www.4hou.com/posts/504Z) - - [攻击者利用Microsoft Office文件传播Agent Tesla 和njRat](https://www.4hou.com/posts/KEvz) - - [谷歌搜索emoji相关特定关键词时报错](https://www.4hou.com/posts/8YN5) - - [欺骗的艺术——你被社工了吗？](https://www.4hou.com/posts/037G) -- Bug Bounty in InfoSec Write-ups on Medium - - [HTTP request smuggling Explained and Exploited Part 0x1](https://infosecwriteups.com/http-request-smuggling-explained-and-exploited-part-0x1-89ce2956534f?source=rss----7b722bfd1b8d--bug_bounty) - - [How I Got $10,000 From GitHub For Bypassing Filtration oF HTML tags](https://infosecwriteups.com/how-i-got-10-000-from-github-for-bypassing-filtration-of-html-tags-db31173c8b37?source=rss----7b722bfd1b8d--bug_bounty) -- XPN InfoSec Blog - - [WAM BAM - Recovering Web Tokens From Office](https://blog.xpnsec.com/wam-bam/) -- Horizon3.ai - - [Test Event Title Here](https://www.eventbrite.com/#new_tab) - - [Test Event Title 1](https://www.eventbrite.com/#new_tab) -- SAP Blogs - - [The Times They are A-Changin’ – A Faster time to Value for SAP S/4HANA Cloud, public edition](https://blogs.sap.com/2022/10/17/the-times-they-are-a-changin-a-faster-time-to-value-for-sap-s-4hana-cloud-public-edition/) - - [SAP BusinessObjects BI Platform 4.3 SP02 Available on SAP Cloud Appliance Library](https://blogs.sap.com/2022/10/17/sap-businessobjects-bi-platform-4.3-sp02-available-on-sap-cloud-appliance-library/) - - [SAP Commissions – Build Containerize Python Application using Docker](https://blogs.sap.com/2022/10/17/sap-commissions-build-containerize-python-application-using-docker/) - - [HCM Nómina España: Escenarios de utilización del Mensaje FIE](https://blogs.sap.com/2022/10/17/hcm-nomina-espana-como-ejecutar-el-mensaje-fie-para-un-empleado-2/) - - [MAIL OAuth using PI/PO](https://blogs.sap.com/2022/10/17/mail-oauth-using-pi-po/) - - [Volunteers Wanted: Looking for Input for a New Profile Project](https://blogs.sap.com/2022/10/17/volunteers-wanted-looking-for-input-for-a-new-profile-project/) - - [SAP UI5 Smart filter approach for passing date filter to a parameterized CDS view](https://blogs.sap.com/2022/10/17/sap-ui5-smart-filter-approach-for-passing-date-filter-to-a-parameterized-cds-view/) - - [Influence SAP Commerce Cloud development via SAP Customer Engagement Initiatives](https://blogs.sap.com/2022/10/17/influence-sap-commerce-cloud-development-via-sap-customer-engagement-initiatives/) - - [Customer Statement/ Vendor Invoices/ & Dunning sent automatically by BTE Implementation](https://blogs.sap.com/2022/10/17/customer-statement-vendor-invoices-dunning-sent-automatically-by-bte-implementation/) -- blog.avast.com EN - - [Caffeine makes phishing easy](https://blog.avast.com/caffeine-phishing) -- XPN InfoSec Blog - - [WAM BAM - Recovering Web Tokens From Office](https://blog.xpnsec.com/wam-bam/) -- Securelist - - [DiceyF deploys GamePlayerFramework in online casino development studio](https://securelist.com/diceyf-deploys-gameplayerframework-in-online-casino-development-studio/107723/) -- Malwarebytes Labs - - [A week in security (October 10 - 16)](https://www.malwarebytes.com/blog/news/2022/10/a-week-in-security-october-10-16) -- Application Security Blog - - [Real-time OWASP vulnerabilities as you code with Code Sight and Rapid Scan Static](https://www.synopsys.com/blogs/software-security/real-time-owasp-vulnerabilities-code-sight-rapid-scan-static/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/y641ib/rreverseengineerings_weekly_questions_thread/) -- Exploit-DB.com RSS Feed - - [[webapps] Wordpress Plugin ImageMagick-Engine 1.7.4 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/51025) -- Rhynorater's InfoSec Blog - - [Hacker Healthcare](https://rhynorater.github.io/Hacker-Healthcare) -- hackademix.net - - [2 Months of TabGuard](https://hackademix.net/2022/10/17/2-months-of-tabguard/) - - [NoScript, Red or Blue? Whatever Suits You!](https://hackademix.net/2022/10/17/noscript-red-or-blue-whatever-suits-you/) -- SentinelOne - - [All Eyes on Cloud | Why the Cloud Surface Attracts Attacks](https://www.sentinelone.com/blog/all-eyes-on-cloud-why-the-cloud-surface-attracts-attacks/) -- Wallarm - - [8 KB is not enough: why WAFs can’t protect APIs](https://lab.wallarm.com/8-kb-is-not-enough-why-wafs-cant-protect-apis/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 韩国多个网络平台瘫痪总统道歉；部分iPhone 14存在“不支持SIM卡”问题](https://www.freebuf.com/news/347061.html) - - [字节招聘 | 高级安全工程师、技术专家岗等你来投！](https://www.freebuf.com/jobs/347056.html) - - [加密货币平台Mango Markets遭攻击损失超1亿美元，黑客宣布返还6700万](https://www.freebuf.com/articles/blockchain-articles/347025.html) - - [因盗取信息，下载“果照”，一学生被判 13 个月监禁](https://www.freebuf.com/news/346999.html) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（2022.10.08-2022.10.16）](http://blog.nsfocus.net/weeklyreport42/) - - [攻击推理-一文了解“离地攻击”的攻与防](http://blog.nsfocus.net/attackanddefense/) -- 安全牛 - - [工信部通报38款App，苹果iOS也被点名](https://www.aqniu.com/vendor/89992.html) - - [Brute Ratel C4（BRC4）攻击框架TLS加密流量分析](https://www.aqniu.com/industry/89991.html) - - [Gartner推荐：360抗攻击能力评估系统打造行业标杆](https://www.aqniu.com/vendor/89990.html) - - [混合办公，以安全弹性锻造企业可持续发展韧性](https://www.aqniu.com/vendor/89989.html) -- 博客园 - 渗透测试中心 - - [端口复用后门总结 - 渗透测试中心](https://www.cnblogs.com/backlion/p/16798021.html) -- KitPloit - PenTest & Hacking Tools - - [JSubFinder - Searches Webpages For Javascript And Analyzes Them For Hidden Subdomains And Secrets](http://www.kitploit.com/2022/10/jsubfinder-searches-webpages-for.html) -- Seebug漏洞平台 - - [404星链计划 | Antenna、CF 版本更新](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650965663&idx=1&sn=13f16640460c344687c984645a424430&chksm=8079c4adb70e4dbbd0c3045f5d2c7b6dfa59d803ffadd04af3f57330fee6d9a0c09355d0bb43&scene=58&subscene=0#rd) -- 代码卫士 - - [奇安信代码安全实验室研究成果入选Black Hat和POC安全大会议题](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514220&idx=1&sn=750a288be57eb8452af469145908204b&chksm=ea948906dde3001079435980a74be8cd2323e4db3b1658dd30655296b28c8fa54cacfd9002d3&scene=58&subscene=0#rd) -- HackerNews - - [国际刑警组织领导的行动推翻了“ Black Axe”网络犯罪组织](https://hackernews.cc/archives/41938) - - [因盗取信息，下载“果照”，一学生被判 13 个月监禁](https://hackernews.cc/archives/41935) - - [Palo Alto Networks 修复了 PAN-OS 中的高危身份验证绕过漏洞](https://hackernews.cc/archives/41930) - - [微软过时驱动程序列表让 Windows PC 易受恶意软件攻击](https://hackernews.cc/archives/41924) - - [黑客利用 Wi-Fi 无人机远程渗透了金融公司内网](https://hackernews.cc/archives/41920) -- 奇客Solidot–传递最新科技情报 - - [现代人类祖先与尼安德特人共存数千年](https://www.solidot.org/story?sid=73078) - - [Meta 的元宇宙世界令人失望](https://www.solidot.org/story?sid=73077) - - [天文学家展示世界最大数码相机](https://www.solidot.org/story?sid=73076) - - [MICROSCOPE 卫星最终结果证实爱因斯坦弱等效原理](https://www.solidot.org/story?sid=73075) - - [对华半导体限制也伤及美国企业](https://www.solidot.org/story?sid=73073) -- 安全牛 - - [简析五种常用勒索软件检测技术的特点和不足](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119196&idx=1&sn=cae2c3534309990b45a71281b025385a&chksm=bd146e8f8a63e79968f513bd06869c5b469e942a3cd97da67bbc91219854a7c381a1f142ca5a&scene=58&subscene=0#rd) - - [安全头条 | 工信部通报38款侵害用户权益的APP；ISACA中国2022年度大会延期举办](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119196&idx=2&sn=f741c39f3da6fc39704ec5adc3e7ab2e&chksm=bd146e8f8a63e799104d66f95e02f1a1944115326eeddab6d3d42b5ac888654a1b7093a42e4a&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（48期）：数据出境安全评估要点解读（二）](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119196&idx=3&sn=af14ca0b1259983ea577cc8325f65a39&chksm=bd146e8f8a63e799c1317bf2acc3aaff89677d05af5f21675d6ac369af918579894ad456e6b8&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [最新季度Android App收集个人信息检测报告来了](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247491905&idx=1&sn=235d0aa10f8f3a6a82ece0e17ec72f88&chksm=ec699169db1e187f24bdd88b676f8ebaf450847917c9c0e32ab2bbbfdc25974e37426f9b7685&scene=58&subscene=0#rd) -- 博客园 - nice_0e3 - - [Java安全之Spring Security绕过总结 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16798843.html) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20221017期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531783&idx=1&sn=a00ed35e016f3496c9cef4145744bb4b&chksm=c1e9f156f69e7840754af076f7ab420ec1263c1f43666b779e14da82ccd3d86a3f90c36e5b86&scene=58&subscene=0#rd) - - [传统技术如何阻碍零信任以及如何应对](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531783&idx=2&sn=ff892452e12ee3e8be9572044d93d02c&chksm=c1e9f156f69e7840740574deb949322e4f785894104b9ee7e0e2f52bb238750fc287f396265e&scene=58&subscene=0#rd) - - [十大未查出幕后组织的APT攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531783&idx=3&sn=d90f1c478c97d07051d5730275189a7c&chksm=c1e9f156f69e7840c3a575074e0a2567ca4ade5f7cea8c5c6534f3cb5f691a6c6dd2585319c0&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [国家工程研究中心安全资讯周报20221017期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531958&idx=1&sn=85d27100a2fc095a47dfce99b133fbd5&chksm=fa93cb77cde4426178a5bd5e87178bb87cb0c912070cdc166348a6de2fdbe9898b37f219775b&scene=58&subscene=0#rd) - - [2021年零售业勒索软件攻击上升75%](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531958&idx=2&sn=0532463a2866f1b7bdfd01af9e563cbc&chksm=fa93cb77cde44261de0af4d7b25d1fce6393ab3c0f7fee810b2528133e7c8263a27f02bc7258&scene=58&subscene=0#rd) - - [勒索软件新技术趋势：间歇性加密](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531958&idx=3&sn=7ceb2d892a1adb65c0014990fe2b059d&chksm=fa93cb77cde44261f0be9da2318a5d24d0ef0a30259d0a9b963ebf65d1aab26f7b62c52cc1b1&scene=58&subscene=0#rd) -- M01NTeam - - [攻击技术研判 | 典型BYOVD利用与Ring0防御削弱技术研判](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489886&idx=1&sn=a8cb6f678fc2f1163eb32527dbc06081&chksm=c187d94ff6f050592013ee9c5a004201d76f37b14aed6248cebdf0ed1d167c692f76733f91d6&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [永安在线入选2022中国网络安全「API安全防护」领域代表厂商](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247494544&idx=1&sn=16c056cff81af9ba30c56f56eba976a5&chksm=eb12cdabdc6544bda8c7e6762f3321a2445e8c48c33668464ad3d4205c108ba9ecee387a3f1f&scene=58&subscene=0#rd) -- 中国信息安全 - - [专题·关基保护 | 国家关键信息基础设施安全保护的法治进展](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166933&idx=1&sn=991da02ca061da3814810bfa77643aa4&chksm=8b5ef4ecbc297dfa452070a6022a4b560b8f914b953e29aa7effad39c62cade21b1875bbcfba&scene=58&subscene=0#rd) - - [前沿 | 网络安全在油气储运行业的发展与思考](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166933&idx=2&sn=ec539ea00d92ae0301ba0623e2256867&chksm=8b5ef4ecbc297dfa5620cf9766f77835f9011030b19debd162bf17343fdbf3e0f9048a009345&scene=58&subscene=0#rd) - - [专题·数字政府安全 | 企业视角的数字政府安全保障举措（一）](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166933&idx=3&sn=9b19050e8fb8fce130201bb48f3e5e9e&chksm=8b5ef4ecbc297dfa40880128d9f3e3099f8a69a5ea71791df5b468390de26e011b678207d81c&scene=58&subscene=0#rd) - - [法治 | 延伸司法职能共治网络生态](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166933&idx=4&sn=66008b55d482d916bfccb84be8e4c259&chksm=8b5ef4ecbc297dfac9383ed604ea54bc513dac99a913d808de9627e0a6c54524d7b56ee9cc38&scene=58&subscene=0#rd) -- Beacon Tower Lab - - [最新CS RCE（CVE-2022-39197）复现心得分享](https://mp.weixin.qq.com/s?__biz=MzkzNjMxNDM0Mg==&mid=2247485450&idx=1&sn=5662a9f2c081fc8521eee651b357323f&chksm=c2a1dc83f5d655957cf2a1c88adf45cd0d028316f536e0a8a18c9e7cb0440869ed4077822ce8&scene=58&subscene=0#rd) diff --git a/archive/README.md b/archive/README.md deleted file mode 100644 index a194671887..0000000000 --- a/archive/README.md +++ /dev/null @@ -1 +0,0 @@ -# 历史存档 diff --git a/bot.py b/bot.py index e8c5b5b5aa..98c696c218 100644 --- a/bot.py +++ b/bot.py @@ -1,19 +1,19 @@ import time import json -import yaml import telegram +import asyncio import requests import smtplib import subprocess +import re from email.header import Header from email.mime.text import MIMEText from pathlib import Path from datetime import datetime -from pyrate_limiter import Duration, Limiter, RequestRate - from utils import Color +from db import getArticlesForBot, updateArticlesStatus -__all__ = ["feishuBot", "wecomBot", "dingtalkBot", "qqBot", "telegramBot", "mailBot"] +__all__ = ["feishuBot", "wecomBot", "dingtalkBot", "telegramBot", "mailBot"] today = datetime.now().strftime("%Y-%m-%d") @@ -77,21 +77,19 @@ def parse_results(results: list): return text_list def send(self, text_list: list): - limiter = Limiter(RequestRate(20, Duration.MINUTE)) # 频率限制，20条/分钟 for text in text_list: - with limiter.ratelimit('identity', delay=True): - print(f'{len(text)} {text[:50]}...{text[-50:]}') + print(f'{len(text)} {text[:50]}...{text[-50:]}') - data = {"msgtype": "markdown", "markdown": {"content": text}} - headers = {'Content-Type': 'application/json'} - url = f'https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={self.key}' - r = requests.post(url=url, headers=headers, data=json.dumps(data), proxies=self.proxy) + data = {"msgtype": "markdown", "markdown": {"content": text}} + headers = {'Content-Type': 'application/json'} + url = f'https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={self.key}' + r = requests.post(url=url, headers=headers, data=json.dumps(data), proxies=self.proxy) - if r.status_code == 200: - Color.print_success('[+] wecomBot 发送成功') - else: - Color.print_failed('[-] wecomBot 发送失败') - print(r.text) + if r.status_code == 200: + Color.print_success('[+] wecomBot 发送成功') + else: + Color.print_failed('[-] wecomBot 发送失败') + print(r.text) class dingtalkBot: @@ -112,91 +110,19 @@ def parse_results(results: list): return text_list def send(self, text_list: list): - limiter = Limiter(RequestRate(20, Duration.MINUTE)) # 频率限制，20条/分钟 for (feed, text) in text_list: - with limiter.ratelimit('identity', delay=True): - print(f'{len(text)} {text[:50]}...{text[-50:]}') - - data = {"msgtype": "markdown", "markdown": {"title": feed, "text": text}} - headers = {'Content-Type': 'application/json'} - url = f'https://oapi.dingtalk.com/robot/send?access_token={self.key}' - r = requests.post(url=url, headers=headers, data=json.dumps(data), proxies=self.proxy) - - if r.status_code == 200: - Color.print_success('[+] dingtalkBot 发送成功') - else: - Color.print_failed('[-] dingtalkBot 发送失败') - print(r.text) - - -class qqBot: - """QQ群机器人 - https://github.com/Mrs4s/go-cqhttp - """ - cqhttp_path = Path(__file__).absolute().parent.joinpath('cqhttp') - - def __init__(self, group_id: list) -> None: - self.server = 'http://127.0.0.1:5700' - self.group_id = group_id - - @staticmethod - def parse_results(results: list): - text_list = [] - for result in results: - (feed, value), = result.items() - text = f'[ {feed} ]\n\n' - for title, link in value.items(): - text += f'{title}\n{link}\n\n' - text_list.append(text.strip()) - return text_list + print(f'{len(text)} {text[:50]}...{text[-50:]}') - def send(self, text_list: list): - limiter = Limiter(RequestRate(20, Duration.MINUTE)) # 频率限制，20条/分钟 - for text in text_list: - with limiter.ratelimit('identity', delay=True): - print(f'{len(text)} {text[:50]}...{text[-50:]}') - - for id in self.group_id: - try: - r = requests.post(f'{self.server}/send_group_msg?group_id={id}&&message={text}') - if r.status_code == 200: - Color.print_success(f'[+] qqBot 发送成功 {id}') - else: - Color.print_failed(f'[-] qqBot 发送失败 {id}') - except Exception as e: - Color.print_failed(f'[-] qqBot 发送失败 {id}') - print(e) - - def start_server(self, qq_id, qq_passwd, timeout=60): - config_path = self.cqhttp_path.joinpath('config.yml') - with open(config_path, 'r') as f: - data = yaml.load(f, Loader=yaml.FullLoader) - data['account']['uin'] = int(qq_id) - data['account']['password'] = qq_passwd - with open(config_path, 'w+') as f: - yaml.dump(data, f) - - subprocess.run('cd cqhttp && ./go-cqhttp -d', shell=True) - - timeout = time.time() + timeout - while True: - try: - requests.get(self.server) - Color.print_success('[+] qqBot 启动成功') - return True - except Exception as e: - time.sleep(1) - - if time.time() > timeout: - qqBot.kill_server() - Color.print_failed('[-] qqBot 启动失败') - return False - - @classmethod - def kill_server(cls): - pid_path = cls.cqhttp_path.joinpath('go-cqhttp.pid') - subprocess.run(f'cat {pid_path} | xargs kill', stderr=subprocess.DEVNULL, shell=True) + data = {"msgtype": "markdown", "markdown": {"title": feed, "text": text}} + headers = {'Content-Type': 'application/json'} + url = f'https://oapi.dingtalk.com/robot/send?access_token={self.key}' + r = requests.post(url=url, headers=headers, data=json.dumps(data), proxies=self.proxy) + if r.status_code == 200: + Color.print_success('[+] dingtalkBot 发送成功') + else: + Color.print_failed('[-] dingtalkBot 发送失败') + print(r.text) class mailBot: """邮件机器人 @@ -255,9 +181,8 @@ class telegramBot: https://core.telegram.org/bots/api """ def __init__(self, key, chat_id: list, proxy_url='') -> None: - proxy = telegram.utils.request.Request(proxy_url=proxy_url) self.chat_id = chat_id - self.bot = telegram.Bot(token=key, request=proxy) + self.bot = telegram.Bot(token=key) def test_connect(self): try: @@ -267,27 +192,35 @@ def test_connect(self): Color.print_failed('[-] telegramBot 连接失败') return False + async def sendMsg(self, chat_id, text): + async with self.bot: + print(await self.bot.send_message(chat_id=chat_id, text = text, parse_mode='HTML')) + @staticmethod def parse_results(results: list): - text_list = [] - for result in results: - (feed, value), = result.items() - text = f'{feed}\n' - for idx, (title, link) in enumerate(value.items()): - text += f'{idx+1}. {title}\n' - text_list.append(text.strip()) - return text_list + results = getArticlesForBot() + ids = [] + text = '' + for (id, feed_name, feed_url, title, url) in results: + newfeedname = re.sub(r'[()\[\]|<> \s]+', ' ', feed_name) + newtitle = re.sub(r'[()\[\]|<> \s]+', ' ', title) + ids.append(id) + text += f'[{newfeedname}] {newtitle}\n\n' + text += '频道: @icocoon' + + return ids, text - def send(self, text_list: list): - limiter = Limiter(RequestRate(20, Duration.MINUTE)) # 频率限制，20条/分钟 - for text in text_list: - with limiter.ratelimit('identity', delay=True): - print(f'{len(text)} {text[:50]}...{text[-50:]}') - - for id in self.chat_id: - try: - self.bot.send_message(chat_id=id, text=text, parse_mode='HTML') + def send(self, text: str): + for id in self.chat_id: + for i in range(10): + try: + ids, text = self.parse_results([]) + if len(ids) > 0: + asyncio.run(self.sendMsg(id, text)) Color.print_success(f'[+] telegramBot 发送成功 {id}') - except Exception as e: - Color.print_failed(f'[-] telegramBot 发送失败 {id}') - print(e) + updateArticlesStatus(ids) + else: + break; + except Exception as e: + Color.print_failed(f'[-] telegramBot 发送失败 {id}') + print(e) diff --git a/config.json b/config.json index da4c60490c..d4ddc73f19 100644 --- a/config.json +++ b/config.json @@ -4,48 +4,7 @@ "rss": false, "bot": false }, - "rss": { - "CustomRSS": { - "enabled": true, - "filename": "CustomRSS.opml" - }, - "CyberSecurityRSS": { - "enabled": true, - "url": "https://raw.githubusercontent.com/zer0yu/CyberSecurityRSS/master/CyberSecurityRSS.opml", - "filename": "CyberSecurityRSS.opml" - }, - "CyberSecurityRSS-tiny": { - "enabled": false, - "url": "https://raw.githubusercontent.com/zer0yu/CyberSecurityRSS/master/tiny.opml", - "filename": "CyberSecurityRSS-tiny.opml" - }, - "Chinese-Security-RSS": { - "enabled": true, - "url": "https://raw.githubusercontent.com/zhengjim/Chinese-Security-RSS/master/Chinese-Security-RSS.opml", - "filename": "Chinese-Security-RSS.opml" - }, - "awesome-security-feed": { - "enabled": false, - "url": "https://raw.githubusercontent.com/mrtouch93/awesome-security-feed/main/security_feeds.opml", - "filename": "awesome-security-feed.opml" - }, - "SecurityRSS": { - "enabled": false, - "url": "https://github.com/Han0nly/SecurityRSS/blob/master/SecureRss.opml", - "filename": "SecureRss.opml" - }, - "wechatRSS": { - "enabled": true, - "url": "https://wechat2rss.xlab.app/opml/sec.opml", - "filename": "wechatRSS.opml" - }, - "chinese-independent-blogs": { - "enabled": false, - "url": "https://raw.githubusercontent.com/timqian/chinese-independent-blogs/master/feed.opml", - "filename": "chinese-independent-blogs.opml" - } - }, - + "filterWords": ["降价", "特价", "美元", "美金", "直聘", "招募", "罚款", "广告"], "bot": { "feishu": { "enabled": false, @@ -65,25 +24,25 @@ "qq": { "enabled": false, "secrets": "QQ_KEY", - "qq_id": "2419110059", - "group_id": ["808542982", "217863340"], + "qq_id": "", + "group_id": [""], "key": "xxxxxxxxxx" }, "telegram":{ - "enabled": false, + "enabled": true, "secrets": "TELEGRAM_KEY", - "chat_id": ["-799557100"], + "chat_id": ["-1001781778395"], "key": "xxxxxxxxxx" }, "mail": { - "enabled": true, + "enabled": false, "secrets": "MAIL_KEY", "secrets_receiver": "MAIL_RECEIVER", - "address": "firmianay@163.com", + "address": "a@163.com", "server": "smtp.163.com", - "from": "security-bot ", + "from": "a@163.com", "receiver": "a@163.com,b@163.com", "key": "xxxxxxxxxx" } } -} \ No newline at end of file +} diff --git a/cqhttp/config.yml b/cqhttp/config.yml deleted file mode 100644 index 1f30598bc5..0000000000 --- a/cqhttp/config.yml +++ /dev/null @@ -1,112 +0,0 @@ -# go-cqhttp 默认配置文件 - -account: # 账号相关 - uin: 1233456 # QQ账号 - password: '' # 密码为空时使用扫码登录 - encrypt: false # 是否开启密码加密 - status: 0 # 在线状态 请参考 https://docs.go-cqhttp.org/guide/config.html#在线状态 - relogin: # 重连设置 - delay: 3 # 首次重连延迟, 单位秒 - interval: 3 # 重连间隔 - max-times: 0 # 最大重连次数, 0为无限制 - - # 是否使用服务器下发的新地址进行重连 - # 注意, 此设置可能导致在海外服务器上连接情况更差 - use-sso-address: true - # 是否允许发送临时会话消息 - allow-temp-session: false - -heartbeat: - # 心跳频率, 单位秒 - # -1 为关闭心跳 - interval: 5 - -message: - # 上报数据类型 - # 可选: string,array - post-format: string - # 是否忽略无效的CQ码, 如果为假将原样发送 - ignore-invalid-cqcode: false - # 是否强制分片发送消息 - # 分片发送将会带来更快的速度 - # 但是兼容性会有些问题 - force-fragment: false - # 是否将url分片发送 - fix-url: false - # 下载图片等请求网络代理 - proxy-rewrite: '' - # 是否上报自身消息 - report-self-message: false - # 移除服务端的Reply附带的At - remove-reply-at: false - # 为Reply附加更多信息 - extra-reply-data: false - # 跳过 Mime 扫描, 忽略错误数据 - skip-mime-scan: false - -output: - # 日志等级 trace,debug,info,warn,error - log-level: warn - # 日志时效 单位天. 超过这个时间之前的日志将会被自动删除. 设置为 0 表示永久保留. - log-aging: 15 - # 是否在每次启动时强制创建全新的文件储存日志. 为 false 的情况下将会在上次启动时创建的日志文件续写 - log-force-new: true - # 是否启用日志颜色 - log-colorful: true - # 是否启用 DEBUG - debug: false # 开启调试模式 - -# 默认中间件锚点 -default-middlewares: &default - # 访问密钥, 强烈推荐在公网的服务器设置 - access-token: '' - # 事件过滤器文件目录 - filter: '' - # API限速设置 - # 该设置为全局生效 - # 原 cqhttp 虽然启用了 rate_limit 后缀, 但是基本没插件适配 - # 目前该限速设置为令牌桶算法, 请参考: - # https://baike.baidu.com/item/%E4%BB%A4%E7%89%8C%E6%A1%B6%E7%AE%97%E6%B3%95/6597000?fr=aladdin - rate-limit: - enabled: false # 是否启用限速 - frequency: 1 # 令牌回复频率, 单位秒 - bucket: 1 # 令牌桶大小 - -database: # 数据库相关设置 - leveldb: - # 是否启用内置leveldb数据库 - # 启用将会增加10-20MB的内存占用和一定的磁盘空间 - # 关闭将无法使用 撤回 回复 get_msg 等上下文相关功能 - enable: true - - # 媒体文件缓存， 删除此项则使用缓存文件(旧版行为) - cache: - image: data/image.db - video: data/video.db - -# 连接服务列表 -servers: - # 添加方式，同一连接方式可添加多个，具体配置说明请查看文档 - #- http: # http 通信 - #- ws: # 正向 Websocket - #- ws-reverse: # 反向 Websocket - #- pprof: #性能分析服务器 - - - http: # HTTP 通信设置 - host: 127.0.0.1 # 服务端监听地址 - port: 5700 # 服务端监听端口 - timeout: 5 # 反向 HTTP 超时时间, 单位秒，<5 时将被忽略 - long-polling: # 长轮询拓展 - enabled: false # 是否开启 - max-queue-size: 2000 # 消息队列大小，0 表示不限制队列大小，谨慎使用 - middlewares: - <<: *default # 引用默认中间件 - post: # 反向HTTP POST地址列表 - #- url: '' # 地址 - # secret: '' # 密钥 - # max-retries: 3 # 最大重试，0 时禁用 - # retries-interval: 1500 # 重试时间，单位毫秒，0 时立即 - #- url: http://127.0.0.1:5701/ # 地址 - # secret: '' # 密钥 - # max-retries: 10 # 最大重试，0 时禁用 - # retries-interval: 1000 # 重试时间，单位毫秒，0 时立即 diff --git a/db.py b/db.py new file mode 100644 index 0000000000..65cd2f92c6 --- /dev/null +++ b/db.py @@ -0,0 +1,185 @@ +#!/usr/bin/python +# -*- coding: UTF-8 -*- + +import sqlite3 +import datetime +import time + +def getRss(): + conn = sqlite3.connect('rss/rss.db3') + cur = conn.cursor() + + query_sql = ''' + select * from (SELECT title, xml_url FROM t_rss WHERE status = 1 ORDER BY sort desc limit 1000) order by random() limit 500 + ''' + + cur.execute(query_sql) + + list = [] + + for title, xml_url in cur.fetchall(): + list.append(xml_url) + + # print(list) + + cur.close() + conn.close() + + return list + +def updateRssInvalid(url): + ''' + 降低失效源的排序 + ''' + conn = sqlite3.connect('rss/rss.db3') + cur = conn.cursor() + + sql = ''' + update t_rss set sort = sort -1, updated_at = ? where xml_url in (?) + ''' + + cur.execute(sql, [datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S'), url]) + conn.commit() + + cur.close() + conn.close() + +def toDate(d): + if d: + return datetime.datetime(d[0], d[1], d[2], d[3], d[4], d[5]) + return datetime.datetime.now() + +def addArticles(list): + ''' + 记录文章, 用于推送和展示 + ''' + conn = sqlite3.connect('rss/rss.db3') + cur = conn.cursor() + + for (ret, feed, link, articles) in list: + try: + for item in articles: + cur.execute(''' + insert into t_article(feed_name, feed_url, title, url, status, created_at, published_at) + values(?, ?, ?, ?, ?, ?, ?) + ''', [ + feed, + link, + item.title, + item.link, + 0, + datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S'), + toDate(item.published_parsed) + ]) + + cur.execute(''' + update t_rss set article_num = (select count(*) from t_article b where b.feed_url = ?), sort = sort + 1, updated_at = ? + where xml_url = ? + ''', [ + link, + datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S'), + link + ]) + except Exception as e: + print(str(e)) + + conn.commit() + + cur.close() + conn.close() + + +def getArticles(): + ''' + 存档目录文章 + ''' + conn = sqlite3.connect('rss/rss.db3') + cur = conn.cursor() + + fromDate = datetime.datetime.combine(datetime.datetime.now() + datetime.timedelta(hours=-8), datetime.time.min) + # fromDate = datetime.datetime.now().replace(hour=0, minute=0, second=0, microsecond=0) + toDate = datetime.datetime.combine(datetime.datetime.now() + datetime.timedelta(days=1), datetime.time.min) + + cur.execute(''' + select feed_name, feed_url, title, url from t_article where published_at >= ? and published_at < ? order by feed_name + ''', [ + fromDate.strftime('%Y-%m-%d'), + toDate.strftime('%Y-%m-%d') + ]) + + result = cur.fetchall() + + cur.close() + conn.close() + return result + +def getArticlesForReadme(): + ''' + 首页文章展示 + ''' + conn = sqlite3.connect('rss/rss.db3') + cur = conn.cursor() + + # 有些源返回数据是0时区, 所以统一前推8小时 + # fromDate = datetime.datetime.combine(datetime.datetime.now() + datetime.timedelta(hours=-8), datetime.time.min) + fromDate = datetime.datetime.now().replace(hour=0, minute=0, second=0, microsecond=0) + toDate = datetime.datetime.combine(datetime.datetime.now() + datetime.timedelta(days=1), datetime.time.min) + + cur.execute(''' + select feed_name, feed_url, title, url, published_at, updated_at from t_article where updated_at >= ? and updated_at < ? order by updated_at desc + ''', [ + fromDate.strftime('%Y-%m-%d'), + toDate.strftime('%Y-%m-%d') + ]) + + result = cur.fetchall() + + cur.close() + conn.close() + return result + +def getArticlesForBot(): + ''' + 获取待推送文章列表 + ''' + conn = sqlite3.connect('rss/rss.db3') + cur = conn.cursor() + + cur.execute(''' + select id, feed_name, feed_url, title, url from t_article where status = 0 order by updated_at desc limit 8 + ''') + + result = cur.fetchall() + + cur.close() + conn.close() + return result + +def updateArticlesStatus(ids: list): + conn = sqlite3.connect('rss/rss.db3') + cur = conn.cursor() + + for id in ids: + cur.execute(''' + update t_article set status = 1 where id = ? + ''', [id]) + + conn.commit() + + cur.close() + conn.close() + +def deleteHistory(): + conn = sqlite3.connect('rss/rss.db3') + cur = conn.cursor() + + fromDate = datetime.datetime.combine(datetime.datetime.now() + datetime.timedelta(days=-365), datetime.time.min) + + cur.execute(''' + delete from t_article where published_at < ? + ''', [ + fromDate + ]) + + cur.close() + conn.close() \ No newline at end of file diff --git a/install.sh b/install.sh deleted file mode 100755 index 173e28161a..0000000000 --- a/install.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash - -python3 -m pip install -r requirements.txt - -sudo apt-get install -y wget -wget -q https://github.com/Mrs4s/go-cqhttp/releases/download/v1.0.0-rc2/go-cqhttp_linux_amd64.tar.gz -O ./cqhttp/go-cqhttp.tar.gz -cd cqhttp && tar xzf go-cqhttp.tar.gz go-cqhttp && rm go-cqhttp.tar.gz diff --git a/requirements.txt b/requirements.txt old mode 100755 new mode 100644 index b491cefae5..4f4213493f --- a/requirements.txt +++ b/requirements.txt @@ -1,11 +1,8 @@ requests feedparser -pyfiglet colorama schedule -pyyaml python-telegram-bot PySocks pyrate-limiter -poetry -git+https://github.com/kurtmckee/listparser +redis diff --git a/rss/Chinese-Security-RSS.opml b/rss/Chinese-Security-RSS.opml deleted file mode 100644 index dec8f36987..0000000000 --- a/rss/Chinese-Security-RSS.opml +++ /dev/null @@ -1,523 +0,0 @@ - - - - Chinese-Security-RSS - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/rss/CustomRSS.opml b/rss/CustomRSS.opml deleted file mode 100644 index 1925caeb8b..0000000000 --- a/rss/CustomRSS.opml +++ /dev/null @@ -1,7 +0,0 @@ - - -CustomRSS - - - - \ No newline at end of file diff --git a/rss/CyberSecurityRSS-tiny.opml b/rss/CyberSecurityRSS-tiny.opml deleted file mode 100644 index 66fddc379c..0000000000 --- a/rss/CyberSecurityRSS-tiny.opml +++ /dev/null @@ -1,556 +0,0 @@ - - - -FoucesSecurity - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/rss/CyberSecurityRSS.opml b/rss/CyberSecurityRSS.opml deleted file mode 100644 index dce7da9534..0000000000 --- a/rss/CyberSecurityRSS.opml +++ /dev/null @@ -1,944 +0,0 @@ - - - -CyberSecurityRSS - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/rss/SecureRss.opml b/rss/SecureRss.opml deleted file mode 100644 index 1d5f5fb9d4..0000000000 --- a/rss/SecureRss.opml +++ /dev/null @@ -1,2402 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SecurityRSS/SecureRss.opml at master · Han0nly/SecurityRSS · GitHub - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Skip to content - - - - - - - - - - - - -
- -
- - - - - - - -
- - - - - -
- - - - - - - - - - -
-
-
- - - - - - - - - - - - - - - -
- - - - - - -
- - -
- - - - - - - - -Permalink - -
- -
-
- - - master - - - - -
-
-
- Switch branches/tags - -
- - - -
- -
- -
- - -
- -
- - - - - - - - - - - - - - - -
- - - - -
-
- -
- -
- -

- SecurityRSS/SecureRss.opml -

- Go to file - -
- - - - -
    -
  • - - Go to file - -
    • -
  • -
    • -
  • -
  • - - - Copy path - -
    • -
  • - - - - Copy permalink - - -
    • -
-
-
- - - - - - - - - -
- -
-
- - - -
-
- - - - update Privacy - -
- - - - - -
-
- - Latest commit - b00ca5d - May 21, 2020 - - - - - - History - - -
-
- -
- -
-
- - - 1 - - contributor - - -
- -

- Users who have contributed to this file -

-
- - - - - - - -
-
-
- - - - - - - - - -
- -
- - -
- - 188 lines (188 sloc) - - 25.4 KB -
- -
- - -
- Raw - Blame -
- -
- -
-
-
-
- -
-
-
-
-
- - - Open in GitHub Desktop -
-
-
-
-
- - - -
-
- - - -
-
- -
-
- - - - - -
-
-
- - - -
- - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
<?xml version="1.0" encoding="utf-8"?>
<opml version="1.0">
<head>Leaf Subscriptions</head>
<body>
<outline title="CTFtime.org: upcoming CTF events" xmlUrl="https://ctftime.org/event/list/upcoming/rss/" type="rss" text="CTFtime.org: upcoming CTF events"/>
<outline title="Privacy">
<outline title="Check Point Software" xmlUrl="http://blog.checkpoint.com/feed/" type="rss" text="Check Point Software"/>
<outline title="DomainTools" xmlUrl="http://blog.domaintools.com/feed/" type="rss" text="DomainTools"/>
<outline title="WeLiveSecurity" xmlUrl="http://blog.eset.com/feed" type="rss" text="WeLiveSecurity"/>
<outline title="Fox-IT International blog" xmlUrl="http://blog.fox-it.com/feed/" type="rss" text="Fox-IT International blog"/>
<outline title="Kaspersky official blog" xmlUrl="http://blog.kaspersky.com/feed/" type="rss" text="Kaspersky official blog"/>
<outline title="Malwarebytes Labs" xmlUrl="http://blog.malwarebytes.org/feed/" type="rss" text="Malwarebytes Labs"/>
<outline title="Morphisec Moving Target Defense Blog" xmlUrl="http://blog.morphisec.com/rss.xml" type="rss" text="Morphisec Moving Target Defense Blog"/>
<outline title="The PhishLabs Blog" xmlUrl="http://blog.phishlabs.com/rss.xml" type="rss" text="The PhishLabs Blog"/>
<outline title="Cofense" xmlUrl="http://blog.phishme.com/feed/" type="rss" text="Cofense"/>
<outline title="Radware Blog" xmlUrl="http://blog.radware.com/feed/" type="rss" text="Radware Blog"/>
<outline title="Tenable Blog" xmlUrl="http://blog.tenablesecurity.com/atom.xml" type="rss" text="Tenable Blog"/>
<outline title="Trail of Bits Blog" xmlUrl="http://blog.trailofbits.com/feed/" type="rss" text="Trail of Bits Blog"/>
<outline title="Zimperium Mobile Security Blog" xmlUrl="http://blog.zimperium.com/feed/" type="rss" text="Zimperium Mobile Security Blog"/>
<outline title="AWS Security Blog" xmlUrl="http://blogs.aws.amazon.com/security/blog/feed/recentPosts.rss" type="rss" text="AWS Security Blog"/>
<outline title="Security – Cisco Blogs" xmlUrl="http://blogs.cisco.com/rss/security/" type="rss" text="Security – Cisco Blogs"/>
<outline title="Cisco Threat Blogs" xmlUrl="http://blogs.cisco.com/security/talos/feed" type="rss" text="Cisco Threat Blogs"/>
<outline title="cybercrime – McAfee Blogs" xmlUrl="http://blogs.mcafee.com/tag/cybercrime/feed" type="rss" text="cybercrime – McAfee Blogs"/>
<outline title="Microsoft Security" xmlUrl="http://blogs.technet.com/mmpc/rss.xml" type="rss" text="Microsoft Security"/>
<outline title="Microsoft Security Response Center" xmlUrl="http://blogs.technet.com/msrc/rss.xml" type="rss" text="Microsoft Security Response Center"/>
<outline title="Cyberwarzone" xmlUrl="http://cyberwarzone.com/feed/" type="rss" text="Cyberwarzone"/>
<outline title="Errata Security" xmlUrl="http://erratasec.blogspot.com/feeds/posts/default" type="rss" text="Errata Security"/>
<outline title="AlienVault Blogs" xmlUrl="http://feeds.feedblitz.com/alienvault-blogs" type="rss" text="AlienVault Blogs"/>
<outline title="Heimdal Security Blog" xmlUrl="http://feeds.feedburner.com/HeimdalSecurityBlog" type="rss" text="Heimdal Security Blog"/>
<outline title="Imperva Cyber Security Blog" xmlUrl="http://feeds.feedburner.com/Imperviews?format=xml" type="rss" text="Imperva Cyber Security Blog"/>
<outline title="Naked Security - Sophos" xmlUrl="http://feeds.feedburner.com/NakedSecurity" type="rss" text="Naked Security - Sophos"/>
<outline title="DataBreaches.net" xmlUrl="http://feeds.feedburner.com/OfficeOfInadequateSecurity" type="rss" text="DataBreaches.net"/>
<outline title="SecurityWeek" xmlUrl="http://feeds.feedburner.com/Securityweek" type="rss" text="SecurityWeek"/>
<outline title="Unit42" xmlUrl="http://feeds.feedburner.com/Unit42" type="rss" text="Unit42"/>
<outline title="Darknet" xmlUrl="http://feeds.feedburner.com/darknethackers" type="rss" text="Darknet"/>
<outline title="Fortinet All Blogs" xmlUrl="http://feeds.feedburner.com/fortinet/blogs" type="rss" text="Fortinet All Blogs"/>
<outline title="Infosec Resources" xmlUrl="http://feeds.feedburner.com/infosecResources" type="rss" text="Infosec Resources"/>
<outline title="Positive Technologies - learn and secure" xmlUrl="http://feeds.feedburner.com/positiveTechnologiesResearchLab" type="rss" text="Positive Technologies - learn and secure"/>
<outline title="TrendLabs Security Intelligence Blog" xmlUrl="http://feeds.trendmicro.com/Anti-MalwareBlog/" type="rss" text="TrendLabs Security Intelligence Blog"/>
<outline title="Help Net Security" xmlUrl="http://feeds2.feedburner.com/HelpNetSecurity" type="rss" text="Help Net Security"/>
<outline title="SANS Internet Storm Center, InfoCON: green" xmlUrl="http://iscxml.sans.org/rssfeed.xml" type="rss" text="SANS Internet Storm Center, InfoCON: green"/>
<outline title="Krebs on Security" xmlUrl="http://krebsonsecurity.com/feed/" type="rss" text="Krebs on Security"/>
<outline title="Bitdefender Labs" xmlUrl="http://labs.bitdefender.com/feed/" type="rss" text="Bitdefender Labs"/>
<outline title="Naked Security" xmlUrl="http://nakedsecurity.sophos.com/feed/" type="rss" text="Naked Security"/>
<outline title="Exploit Files ≈ Packet Storm" xmlUrl="http://packetstormsecurity.org/exploits.xml" type="rss" text="Exploit Files ≈ Packet Storm"/>
<outline title="Packet Storm Security" xmlUrl="http://packetstormsecurity.org/headlines.xml" type="rss" text="Packet Storm Security"/>
<outline title="zscaler Research Blog" xmlUrl="http://research.zscaler.com/feeds/posts/default" type="rss" text="zscaler Research Blog"/>
<outline title="Palo Alto Networks Blog" xmlUrl="http://researchcenter.paloaltonetworks.com/feed/" type="rss" text="Palo Alto Networks Blog"/>
<outline title="Code Execution Files ≈ Packet Storm" xmlUrl="http://rss.packetstormsecurity.com/files/tags/code_execution/" type="rss" text="Code Execution Files ≈ Packet Storm"/>
<outline title="0 Day News ≈ Packet Storm" xmlUrl="http://rss.packetstormsecurity.org/news/tags/zero_day/" type="rss" text="0 Day News ≈ Packet Storm"/>
<outline title="Full Disclosure" xmlUrl="http://seclists.org/rss/fulldisclosure.rss" type="rss" text="Full Disclosure"/>
<outline title="The Exploit Database - CXSecurity.com" xmlUrl="http://securityreason.com/rss/ExploitAlert" type="rss" text="The Exploit Database - CXSecurity.com"/>
<outline title="CXSECURITY Database RSS Feed - CXSecurity.com" xmlUrl="http://securityreason.com/rss/SecurityAlert" type="rss" text="CXSECURITY Database RSS Feed - CXSecurity.com"/>
<outline title="The Hacker News" xmlUrl="http://thehackernews.com/feeds/posts/default" type="rss" text="The Hacker News"/>
<outline title="Threatpost" xmlUrl="http://threatpost.com/feed" type="rss" text="Threatpost"/>
<outline title="Anomali Blog" xmlUrl="http://threatstream.com/site/blog-rss" type="rss" text="Anomali Blog"/>
<outline title="Black Hills Information Security" xmlUrl="http://www.blackhillsinfosec.com/?feed=rss2" type="rss" text="Black Hills Information Security"/>
<outline title="VMware Carbon Black" xmlUrl="http://www.carbonblack.com/feed/" type="rss" text="VMware Carbon Black"/>
<outline title="Deeplinks" xmlUrl="http://www.eff.org/rss/updates.xml" type="rss" text="Deeplinks"/>
<outline title="Exploit Database" xmlUrl="http://www.exploit-db.com/rss.php" type="rss" text="Exploit Database"/>
<outline title="Fire Eye Threat Research " xmlUrl="http://www.fireeye.com/blog/feed" type="rss" text="Fire Eye Threat Research "/>
<outline title="Future of Privacy Forum" xmlUrl="http://www.futureofprivacy.org/feed/" type="rss" text="Future of Privacy Forum"/>
<outline title="Privacy &amp; Information Security Law Blog" xmlUrl="http://www.huntonprivacyblog.com/feed/" type="rss" text="Privacy &amp; Information Security Law Blog"/>
<outline title="Intezer" xmlUrl="http://www.intezer.com/feed/" type="rss" text="Intezer"/>
<outline title="CERT Recently Published Vulnerability Notes" xmlUrl="http://www.kb.cert.org/vulfeed" type="rss" text="CERT Recently Published Vulnerability Notes"/>
<outline title="Schneier on Security" xmlUrl="http://www.schneier.com/blog/index.rdf" type="rss" text="Schneier on Security"/>
<outline title="Securelist" xmlUrl="http://www.securelist.com/en/rss/allupdates" type="rss" text="Securelist"/>
<outline title="The Register – Security" xmlUrl="http://www.theregister.co.uk/security/headlines.atom" type="rss" text="The Register – Security"/>
<outline title="ThreatConnect | Intelligence-Driven Security Operations" xmlUrl="http://www.threatconnect.com/feed/" type="rss" text="ThreatConnect | Intelligence-Driven Security Operations"/>
<outline title="CISA ICS All Docs Feed" xmlUrl="http://www.us-cert.gov/control_systems/xml/rss.xml" type="rss" text="CISA ICS All Docs Feed"/>
<outline title="CISA Current Activity" xmlUrl="http://www.us-cert.gov/current/index.rdf" type="rss" text="CISA Current Activity"/>
<outline title="Virus Bulletin's blog" xmlUrl="http://www.virusbtn.com/library/feeds/news.rdf" type="rss" text="Virus Bulletin's blog"/>
<outline title="Blog – Volexity" xmlUrl="http://www.volexity.com/blog/?feed=rss2" type="rss" text="Blog – Volexity"/>
<outline title="Latest topics for ZDNet in Security" xmlUrl="http://www.zdnet.com/topic-security/rss.xml" type="rss" text="Latest topics for ZDNet in Security"/>
<outline title="Talos Blog || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence" xmlUrl="https://blog.talosintelligence.com/feeds/posts/default" type="rss" text="Talos Blog || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence"/>
<outline title="Updates from the Tor Project" xmlUrl="https://blog.torproject.org/blog/feed" type="rss" text="Updates from the Tor Project"/>
<outline title="Verisign Blog" xmlUrl="https://blog.verisign.com/feed/" type="rss" text="Verisign Blog"/>
<outline title="Microsoft on the Issues" xmlUrl="https://blogs.microsoft.com/on-the-issues/feed/" type="rss" text="Microsoft on the Issues"/>
<outline title="Microsoft Security" xmlUrl="https://cloudblogs.microsoft.com/microsoftsecure/feed/" type="rss" text="Microsoft Security"/>
<outline title="Qualys Blog" xmlUrl="https://community.qualys.com/blogs/feeds/posts" type="rss" text="Qualys Blog"/>
<outline title="RSA NetWitness Platform" xmlUrl="https://community.rsa.com/community/products/netwitness/blog/feeds/posts" type="rss" text="RSA NetWitness Platform"/>
<outline title="Symantec Blogs" xmlUrl="https://content.connect.symantec.com/rss/v1/blogs/rss.xml/211" type="rss" text="Symantec Blogs"/>
<outline title="JVNRSS Feed - Update Entry" xmlUrl="https://jvn.jp/en/rss/jvn.rdf" type="rss" text="JVNRSS Feed - Update Entry"/>
<outline title="SpecterOps Blog" xmlUrl="https://posts.specterops.io/feed" type="rss" text="SpecterOps Blog"/>
<outline title="IAPP Daily Dashboard" xmlUrl="https://privacyassociation.org/rss/daily-dashboard/" type="rss" text="IAPP Daily Dashboard"/>
<outline title="DuckDuckGo Blog" xmlUrl="https://spreadprivacy.com/feed" type="rss" text="DuckDuckGo Blog"/>
<outline title="Vulnerabilities – Threatpost" xmlUrl="https://threatpost.com/category/vulnerabilities/feed/" type="rss" text="Vulnerabilities – Threatpost"/>
<outline title="Center for Internet Security - Multi-State Information Sharing and Analysis Center" xmlUrl="https://www.cisecurity.org/feed/advisories" type="rss" text="Center for Internet Security - Multi-State Information Sharing and Analysis Center"/>
<outline title="Cylance Blog" xmlUrl="https://www.cylance.com/content/dam/cylance/blog/rss.xml?_ga=2.224021458.81418824.1516223824-2079281210.1516223824" type="rss" text="Cylance Blog"/>
<outline title="Digital Shadows" xmlUrl="https://www.digitalshadows.com/blog-and-research/feed/" type="rss" text="Digital Shadows"/>
<outline title="Blog – Flashpoint" xmlUrl="https://www.flashpoint-intel.com/blog/feed/" type="rss" text="Blog – Flashpoint"/>
<outline title="Privacy International" xmlUrl="https://www.privacyinternational.org/rss.xml" type="rss" text="Privacy International"/>
<outline title="Private Internet Access Blog" xmlUrl="https://www.privateinternetaccess.com/blog/feed/" type="rss" text="Private Internet Access Blog"/>
<outline title="Proofpoint News Feed" xmlUrl="https://www.proofpoint.com/rss.xml" type="rss" text="Proofpoint News Feed"/>
<outline title="Recorded Future" xmlUrl="https://www.recordedfuture.com/feed/" type="rss" text="Recorded Future"/>
<outline title="Secureworks Cybersecurity Resources" xmlUrl="https://www.secureworks.com/rss?feed=resources" type="rss" text="Secureworks Cybersecurity Resources"/>
<outline title="CISA Alerts" xmlUrl="https://www.us-cert.gov/ncas/alerts.xml" type="rss" text="CISA Alerts"/>
</outline>
<outline title="Security">
<outline title="Minded Security Blog" xmlUrl="http://blog.mindedsecurity.com/feeds/posts/default" type="rss" text="Minded Security Blog"/>
<outline title="Graham Cluley" xmlUrl="http://feeds.feedburner.com/GrahamCluleysBlog" type="rss" text="Graham Cluley"/>
<outline title="Troy Hunt's Blog" xmlUrl="http://feeds.feedburner.com/TroyHunt" type="rss" text="Troy Hunt's Blog"/>
<outline title="HackRead" xmlUrl="http://feeds.feedburner.com/hackread" type="rss" text="HackRead"/>
<outline title="The State of Security" xmlUrl="http://feeds.feedburner.com/tripwire-state-of-security" type="rss" text="The State of Security"/>
<outline title="Project Zero" xmlUrl="http://googleprojectzero.blogspot.com/feeds/posts/default" type="rss" text="Project Zero"/>
<outline title="🔐Blog of Osanda" xmlUrl="http://osandamalith.wordpress.com/feed/" type="rss" text="🔐Blog of Osanda"/>
<outline title="SecPod Community" xmlUrl="http://secpod.org/blog/?feed=rss2" type="rss" text="SecPod Community"/>
<outline title="Security Intelligence" xmlUrl="http://securityintelligence.com/feed/" type="rss" text="Security Intelligence"/>
<outline title="Securosis Blog" xmlUrl="http://securosis.com/feeds/blog-complete" type="rss" text="Securosis Blog"/>
<outline title="Talos Blog || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence" xmlUrl="http://vrt-sourcefire.blogspot.com/feeds/posts/default" type="rss" text="Talos Blog || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence"/>
<outline title="BleepingComputer" xmlUrl="http://www.bleepingcomputer.com/feed/" type="rss" text="BleepingComputer"/>
<outline title="CSO Online" xmlUrl="http://www.csoonline.com/index.rss" type="rss" text="CSO Online"/>
<outline title="E Hacking News - Latest Hacker News and IT Security News" xmlUrl="http://www.ehackingnews.com/feeds/posts/default" type="rss" text="E Hacking News - Latest Hacker News and IT Security News"/>
<outline title="Infosec Island Latest Articles" xmlUrl="http://www.infosecisland.com/rss.html" type="rss" text="Infosec Island Latest Articles"/>
<outline title="Bad Packets" xmlUrl="https://badpackets.net/feed/" type="rss" text="Bad Packets"/>
<outline title="/var/log/messages" xmlUrl="https://labs.mwrinfosecurity.com/blog/rss" type="rss" text="/var/log/messages"/>
<outline title="Check Point Research" xmlUrl="https://research.checkpoint.com/feed" type="rss" text="Check Point Research"/>
<outline title="Scott Helme" xmlUrl="https://scotthelme.co.uk/feed/" type="rss" text="Scott Helme"/>
</outline>
<outline title="TOP50">
<outline title="Secure Thoughts" xmlUrl="http://feeds2.feedburner.com/securethoughts" type="rss" text="Secure Thoughts"/>
<outline title="Krebs on Security" xmlUrl="http://krebsonsecurity.com/feed" type="rss" text="Krebs on Security"/>
<outline title="TaoSecurity" xmlUrl="http://taosecurity.blogspot.com/atom.xml" type="rss" text="TaoSecurity"/>
<outline title="Blog – Compass Cyber Security" xmlUrl="http://www.compasscyber.com/blog/feed" type="rss" text="Blog – Compass Cyber Security"/>
<outline title="Cyber Security Blog" xmlUrl="http://www.cyber-security-blog.com/feeds/posts/default?alt=rss" type="rss" text="Cyber Security Blog"/>
<outline title="Dark Reading:" xmlUrl="http://www.darkreading.com/rss/all.xml" type="rss" text="Dark Reading:"/>
<outline title="Forbes - Security" xmlUrl="http://www.forbes.com/security/index.xml" type="rss" text="Forbes - Security"/>
<outline title="infosecurity-magazine.com:443" xmlUrl="http://www.infosecurity-magazine.com/rss/news/" type="rss" text="infosecurity-magazine.com:443"/>
<outline title="Security on TechRepublic" xmlUrl="http://www.techrepublic.com/rssfeeds/topic/security/?feedType=rssfeeds" type="rss" text="Security on TechRepublic"/>
<outline title="Latest Security Articles from Techworld" xmlUrl="http://www.techworld.com/security/rss" type="rss" text="Latest Security Articles from Techworld"/>
<outline title="The State of Security" xmlUrl="http://www.tripwire.com/state-of-security/feed" type="rss" text="The State of Security"/>
<outline title="TrustArc Privacy Blog" xmlUrl="http://www.truste.com/blog/feed/" type="rss" text="TrustArc Privacy Blog"/>
<outline title="Application Security Research, News, and Education Blog" xmlUrl="http://www.veracode.com/blog/feed/" type="rss" text="Application Security Research, News, and Education Blog"/>
<outline title="ZDNet | security RSS" xmlUrl="http://www.zdnet.com/blog/security/rss" type="rss" text="ZDNet | security RSS"/>
<outline title="ZoneAlarm Security Blog" xmlUrl="http://www.zonealarm.com/blog/index.php/feed/" type="rss" text="ZoneAlarm Security Blog"/>
<outline title="Adam Levin" xmlUrl="https://adamlevin.com/feed" type="rss" text="Adam Levin"/>
<outline title="PCI Perspectives" xmlUrl="https://blog.pcisecuritystandards.org/rss.xml" type="rss" text="PCI Perspectives"/>
<outline title="Application and Cybersecurity Blog" xmlUrl="https://blog.securityinnovation.com/rss.xml" type="rss" text="Application and Cybersecurity Blog"/>
<outline title="Troy Hunt" xmlUrl="https://feeds.feedburner.com/TroyHunt" type="rss" text="Troy Hunt"/>
<outline title="Heimdal Security Blog" xmlUrl="https://heimdalsecurity.com/blog/feed" type="rss" text="Heimdal Security Blog"/>
<outline title="Naked Security" xmlUrl="https://nakedsecurity.sophos.com/feed" type="rss" text="Naked Security"/>
<outline title="SWAP - The Most Advanced Web Protection I Cloudbric" xmlUrl="https://www.cloudbric.com/feed" type="rss" text="SWAP - The Most Advanced Web Protection I Cloudbric"/>
<outline title="Core Security blogs" xmlUrl="https://www.coresecurity.com/blog/feed" type="rss" text="Core Security blogs"/>
<outline title="Graham Cluley" xmlUrl="https://www.grahamcluley.com/feed" type="rss" text="Graham Cluley"/>
<outline title="Help Net Security" xmlUrl="https://www.helpnetsecurity.com/feed" type="rss" text="Help Net Security"/>
<outline title="Cyber Security – IT Governance UK Blog" xmlUrl="https://www.itgovernance.co.uk/blog/category/cyber-security/feed" type="rss" text="Cyber Security – IT Governance UK Blog"/>
<outline title="News and Events Feed by Topic" xmlUrl="https://www.nist.gov/news-events/health/rss.xml" type="rss" text="News and Events Feed by Topic"/>
<outline title="News and Events Feed by Topic" xmlUrl="https://www.nist.gov/news-events/information%20technology/rss.xml" type="rss" text="News and Events Feed by Topic"/>
<outline title="PayPal - PayPal Stories" xmlUrl="https://www.paypal.com/stories/rest/blog/rss/us" type="rss" text="PayPal - PayPal Stories"/>
<outline title="Proofpoint News Feed" xmlUrl="https://www.proofpoint.com/us/rss.xml" type="rss" text="Proofpoint News Feed"/>
<outline title="Cyber Attacks, Cyber Crime and Cyber Security" xmlUrl="https://www.reddit.com/r/cyb3rs3c/.rss" type="rss" text="Cyber Attacks, Cyber Crime and Cyber Security"/>
<outline title="Cyber Security" xmlUrl="https://www.reddit.com/r/cyber_security/.rss" type="rss" text="Cyber Security"/>
<outline title="SANS Institute Security Awareness Tip of the Day" xmlUrl="https://www.sans.org/tip-of-the-day/rss" type="rss" text="SANS Institute Security Awareness Tip of the Day"/>
<outline title="Schneier on Security" xmlUrl="https://www.schneier.com/blog/atom.xml" type="rss" text="Schneier on Security"/>
<outline title="Webroot Blog" xmlUrl="https://www.webroot.com/blog/feed" type="rss" text="Webroot Blog"/>
<outline title="Security Latest" xmlUrl="https://www.wired.com/feed/category/security/latest/rss" type="rss" text="Security Latest"/>
</outline>
<outline title="安全团队">
<outline title="Page not found - BH Consulting" xmlUrl="http://bhconsulting.ie/securitywatch/?feed=rss2" type="rss" text="Page not found - BH Consulting"/>
<outline title="Attack and Defense Labs" xmlUrl="http://blog.andlabs.org/feeds/posts/default" type="rss" text="Attack and Defense Labs"/>
<outline title="blog.trendmicro.com" xmlUrl="http://blog.trendmicro.com/feed" type="rss" text="blog.trendmicro.com"/>
<outline title="Speaking of Security - The RSA Blog and Podcast" xmlUrl="http://blogs.rsa.com/feed/" type="rss" text="Speaking of Security - The RSA Blog and Podcast"/>
<outline title="Lockheed Martin Cybersecurity Blog" xmlUrl="http://cyber.lockheedmartin.com/blog/rss.xml" type="rss" text="Lockheed Martin Cybersecurity Blog"/>
<outline title="Cyber Security Buzz" xmlUrl="http://cybersec.buzz/feed" type="rss" text="Cyber Security Buzz"/>
<outline title="WeLiveSecurity" xmlUrl="http://feeds.feedburner.com/eset/blog" type="rss" text="WeLiveSecurity"/>
<outline title="Government Technology State &amp; Local Articles - e.Republic" xmlUrl="http://feeds.feedburner.com/govtech/blogs/lohrmann_on_infrastructure" type="rss" text="Government Technology State &amp; Local Articles - e.Republic"/>
<outline title="Google Online Security Blog" xmlUrl="http://googleonlinesecurity.blogspot.com/atom.xml" type="rss" text="Google Online Security Blog"/>
<outline title="The Last Watchdog" xmlUrl="http://lastwatchdog.com/feed/" type="rss" text="The Last Watchdog"/>
<outline title="Marco Ramilli's Blog" xmlUrl="http://marcoramilli.blogspot.com/feeds/posts/default" type="rss" text="Marco Ramilli's Blog"/>
<outline title="NISL@THU" xmlUrl="http://netsec.ccert.edu.cn/feed" type="rss" text="NISL@THU"/>
<outline title="Privacy Ref Blog" xmlUrl="http://privacyref.com/wordpress/feed" type="rss" text="Privacy Ref Blog"/>
<outline title="Cyber security" xmlUrl="http://pwc.blogs.com/cyber_security_updates/rss.xml" type="rss" text="Cyber security"/>
<outline title="Packet Storm" xmlUrl="http://rss.packetstormsecurity.org/files/tags/paper/" type="rss" text="Packet Storm"/>
<outline title="Packet Storm" xmlUrl="http://rss.packetstormsecurity.org/files/tags/tool/" type="rss" text="Packet Storm"/>
<outline title="Security Affairs" xmlUrl="http://securityaffairs.co/wordpress/feed" type="rss" text="Security Affairs"/>
<outline title="Paul's Security Weekly" xmlUrl="http://securityweekly.com/podcast/psw.xml" type="rss" text="Paul's Security Weekly"/>
<outline title="SANS Blog" xmlUrl="http://software-security.sans.org/blog/feed/" type="rss" text="SANS Blog"/>
<outline title="Threatpost" xmlUrl="http://threatpost.com/feed/" type="rss" text="Threatpost"/>
<outline title="CIO" xmlUrl="http://www.cio.com/category/security/index.rss" type="rss" text="CIO"/>
<outline title="DEF CON Announcements!" xmlUrl="http://www.defcon.org/defconrss.xml" type="rss" text="DEF CON Announcements!"/>
<outline title="FreeBuf互联网安全新媒体平台" xmlUrl="http://www.freebuf.com/feed" type="rss" text="FreeBuf互联网安全新媒体平台"/>
<outline title="blogs.microsoft.com" xmlUrl="https://blogs.microsoft.com/microsoftsecure/feed" type="rss" text="blogs.microsoft.com"/>
<outline title="Security – Cisco Blogs" xmlUrl="https://feeds.feedburner.com/CiscoBlogSecurity" type="rss" text="Security – Cisco Blogs"/>
<outline title="Exploit-DB.com RSS Feed" xmlUrl="https://www.exploit-db.com/rss.xml" type="rss" text="Exploit-DB.com RSS Feed"/>
<outline title="SecWiki News" xmlUrl="https://www.sec-wiki.com/news/rss" type="rss" text="SecWiki News"/>
</outline>
</body>
</opml>
-
- - - -
- -
- - - - -
- - -
- - -
 -
- - - -
- -
- - -
- - - - -
-
- -
- - - - - - - - - - - - - - - - - - - - - diff --git a/rss/awesome-security-feed.opml b/rss/awesome-security-feed.opml deleted file mode 100644 index eadd89d0f0..0000000000 --- a/rss/awesome-security-feed.opml +++ /dev/null @@ -1,366 +0,0 @@ - - - - Sun, 24 Oct 2021 08:30:02 +0000 - Tiny Tiny RSS Feed Export - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/rss/chinese-independent-blogs.opml b/rss/chinese-independent-blogs.opml deleted file mode 100644 index 6718f6e569..0000000000 --- a/rss/chinese-independent-blogs.opml +++ /dev/null @@ -1 +0,0 @@ -中文独立博客列表 \ No newline at end of file diff --git a/rss/opml2db.py b/rss/opml2db.py new file mode 100644 index 0000000000..8bb09d9a30 --- /dev/null +++ b/rss/opml2db.py @@ -0,0 +1,77 @@ +#!/usr/bin/python +# -*- coding: UTF-8 -*- + +import sqlite3 +import datetime +import os +from xml.dom.minidom import parse +import xml.dom.minidom + + +def insert(cursor, category, title, type, xml_url, html_url, entry_content, scan_delay): + try: + cursor.execute(''' + insert or ignore into t_rss(category, title, type, status, xml_url, html_url, entry_content, scan_delay, created_at) + values(?, ?, ?, ?, ?, ?, ?, ?, ?) + ''', [ + category, + title, + type, + 1, + xml_url, + html_url, + entry_content, + scan_delay, + datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S') + ]) + except Exception as e: + print("插入错误", e) + pass + return + +def opml2db(path): + conn = sqlite3.connect('rss.db3') + cur = conn.cursor() + # 使用minidom解析器打开 XML 文档 + DOMTree = xml.dom.minidom.parse(path) + collection = DOMTree.documentElement + if collection.hasAttribute("version"): + print("Root element : %s" % collection.getAttribute("version")) + + body = collection.getElementsByTagName('body')[0]; + + outlines = body.getElementsByTagName('outline'); + + for outline in outlines: + # 如果包含outline, 表示该项为目录 + if outline.getElementsByTagName('outline'): + category = outline.getAttribute('title'); + for subOutline in outline.getElementsByTagName('outline'): + title = subOutline.getAttribute("title"); + type = subOutline.getAttribute("type"); + xmlUrl = subOutline.getAttribute("xmlUrl"); + htmlUrl = subOutline.getAttribute("htmlUrl"); + entryContent = subOutline.getAttribute("entryContent"); + scanDelay = subOutline.getAttribute("scanDelay"); + print(category, title, type, scanDelay) + insert(cur, category, title, type, xmlUrl, htmlUrl, entryContent, scanDelay) + conn.commit() + else: + title = outline.getAttribute("title"); + type = outline.getAttribute("type"); + xmlUrl = outline.getAttribute("xmlUrl"); + htmlUrl = outline.getAttribute("htmlUrl"); + entryContent = outline.getAttribute("entryContent"); + scanDelay = outline.getAttribute("scanDelay"); + print(title, type, scanDelay) + insert(cur, '', title, type, xmlUrl, htmlUrl, entryContent, scanDelay) + conn.commit() + + cur.close() + conn.close() + +names = os.listdir(".") + +for name in names: + if name.endswith('.opml'): + opml2db(name) \ No newline at end of file diff --git a/rss/rss.db3 b/rss/rss.db3 new file mode 100644 index 0000000000..22beaf42e2 Binary files /dev/null and b/rss/rss.db3 differ diff --git a/rss/wechatRSS.opml b/rss/wechatRSS.opml deleted file mode 100644 index 912fec2333..0000000000 --- a/rss/wechatRSS.opml +++ /dev/null @@ -1,281 +0,0 @@ - - - - 安全技术公众号 created by tmr [https://wechat2rs.xlab.app] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > - - - - - - - - - - - - - \ No newline at end of file diff --git a/today.md b/today.md deleted file mode 100644 index 8f72190493..0000000000 --- a/today.md +++ /dev/null @@ -1,240 +0,0 @@ -# 每日安全资讯（2022-10-18） - -- Files ≈ Packet Storm - - [Gentoo Linux Security Advisory 202210-09](https://packetstormsecurity.com/files/168756/glsa-202210-09.txt) - - [Ubuntu Security Notice USN-5682-1](https://packetstormsecurity.com/files/168755/USN-5682-1.txt) - - [MiniDVBLinux 5.4 Arbitrary File Read](https://packetstormsecurity.com/files/168754/ZSL-2022-5719.txt) - - [Gentoo Linux Security Advisory 202210-08](https://packetstormsecurity.com/files/168753/glsa-202210-08.txt) - - [WordPress Photo Gallery 1.8.0 Cross Site Scripting](https://packetstormsecurity.com/files/168752/wpphotogallery180-xss.txt) - - [RRX IOB LP 1.0 DNS Cache Snooping](https://packetstormsecurity.com/files/168751/VL-2261.txt) - - [Ubuntu Security Notice USN-5680-1](https://packetstormsecurity.com/files/168750/USN-5680-1.txt) - - [MiniDVBLinux 5.4 Remote Root Command Execution](https://packetstormsecurity.com/files/168749/ZSL-2022-5718.txt) - - [WiFi File Transfer 1.0.8 Cross Site Scripting](https://packetstormsecurity.com/files/168746/VL-2322.txt) - - [Backdoor.Win32.Redkod.d MVID-2022-0649 Hardcoded Credential](https://packetstormsecurity.com/files/168745/MVID-2022-0649.txt) - - [MiniDVBLinux 5.4 Remote Root Command Injection](https://packetstormsecurity.com/files/168744/ZSL-2022-5717.txt) - - [GNU Privacy Guard 2.3.8](https://packetstormsecurity.com/files/168747/gnupg-2.3.8.tar.bz2) - - [GNU Privacy Guard 2.2.40](https://packetstormsecurity.com/files/168748/gnupg-2.2.40.tar.bz2) - - [pfSense pfBlockerNG 2.1.4_26 Shell Upload](https://packetstormsecurity.com/files/168743/pfsense_pfblockerng_webshell.rb.txt) - - [Spring Cloud Gateway 3.1.0 Remote Code Execution](https://packetstormsecurity.com/files/168742/spring_cloud_gateway_rce.rb.txt) - - [Gentoo Linux Security Advisory 202210-07](https://packetstormsecurity.com/files/168741/glsa-202210-07.txt) - - [Webile 1.0.1 Directory Traversal](https://packetstormsecurity.com/files/168740/VL-2320.txt) - - [MiniDVBLinux 5.4 Unauthenticated Stream Disclosure](https://packetstormsecurity.com/files/168739/ZSL-2022-5716.txt) - - [Gentoo Linux Security Advisory 202210-06](https://packetstormsecurity.com/files/168738/glsa-202210-06.txt) - - [Nullcon Berlin 2023 Call For Papers](https://packetstormsecurity.com/files/168737/nullconBerlin2023-cfp.txt) - - [Gentoo Linux Security Advisory 202210-05](https://packetstormsecurity.com/files/168736/glsa-202210-05.txt) - - [Backdoor.Win32.DarkSky.23 MVID-2022-0648 Buffer Overflow](https://packetstormsecurity.com/files/168735/MVID-2022-0648.txt) - - [Ubuntu Security Notice USN-5683-1](https://packetstormsecurity.com/files/168734/USN-5683-1.txt) - - [MiniDVBLinux 5.4 Change Root Password](https://packetstormsecurity.com/files/168733/ZSL-2022-5715.txt) - - [MiniDVBLinux 5.4 SVDRP Control](https://packetstormsecurity.com/files/168732/ZSL-2022-5714.txt) -- CXSECURITY Database RSS Feed - CXSecurity.com - - [MiniDVBLinux 5.4 Remote Root Command Injection](https://cxsecurity.com/issue/WLB-2022100049) - - [RRX IOB LP 1.0 DNS Cache Snooping](https://cxsecurity.com/issue/WLB-2022100048) - - [WiFi File Transfer 1.0.8 Cross Site Scripting](https://cxsecurity.com/issue/WLB-2022100047) - - [pfSense pfBlockerNG 2.1.4_26 Shell Upload](https://cxsecurity.com/issue/WLB-2022100046) - - [MiniDVBLinux 5.4 Unauthenticated Stream Disclosure](https://cxsecurity.com/issue/WLB-2022100045) - - [MiniDVBLinux 5.4 Change Root Password](https://cxsecurity.com/issue/WLB-2022100044) - - [Backdoor.Win32.DarkSky.23 / Remote Stack Buffer Overflow (SEH)](https://cxsecurity.com/issue/WLB-2022100043) - - [Webile 1.0.1 Directory Traversal](https://cxsecurity.com/issue/WLB-2022100042) - - [OpenCart v3.x So Newsletter Custom Popup Module - Blind SQL Injection](https://cxsecurity.com/issue/WLB-2022100041) - - [Backdoor.Win32.Redkod.d / Weak Hardcoded Credentials](https://cxsecurity.com/issue/WLB-2022100040) - - [MiniDVBLinux 5.4 SVDRP Control](https://cxsecurity.com/issue/WLB-2022100039) -- Recent Commits to cve:main - - [Update Mon Oct 17 10:19:45 UTC 2022](https://github.com/trickest/cve/commit/e8538f1dc6e111d48081813d847a23e5df141940) -- 安全客-有思想的安全新媒体 - - [手机好像在“监听”你说话，你有过这种恐慌吗？](https://www.anquanke.com/post/id/281729) - - [CVE-2022-25237 Bonitasoft Platform RCE漏洞分析](https://www.anquanke.com/post/id/281732) - - [Magniber勒索团伙通过JavaScript文件感染Windows用户](https://www.anquanke.com/post/id/281791) - - [Thoma Bravo以23亿美元收购网络安全公司ForgeRock](https://www.anquanke.com/post/id/281794) - - [RansomExx泄露52 GB巴塞罗那健康中心数据](https://www.anquanke.com/post/id/281800) - - [数字安全观察每周简报【政策消息篇】2022.09.28-2022.10.12](https://www.anquanke.com/post/id/281824) - - [WhatsApp非官方应用被发现会窃取用户账号](https://www.anquanke.com/post/id/281811) - - [软件Firefox Relay支持生成虚拟电话号码](https://www.anquanke.com/post/id/281807) - - [漏洞分析 | 利用 CodeQL 分析 fastjson 1.2.80 利用链](https://www.anquanke.com/post/id/281733) - - [微软过时驱动程序列表让Windows PC易受恶意软件攻击](https://www.anquanke.com/post/id/281804) - - [闪电贷攻击？加密货币交易平台Mango Markets损失过亿](https://www.anquanke.com/post/id/281772) - - [Minecraft服务器Wynncraft遭DDoS攻击](https://www.anquanke.com/post/id/281777) - - [工信部通报 38 款侵害用户权益 App 涉及 2345 浏览器、丁香医生等](https://www.anquanke.com/post/id/281767) -- Twitter @Nicolas Krassas - - [MyDeal data breach impacts 2.2M users, stolen data for sale online](https://twitter.com/Dinosn/status/1582121402446278656) - - [WAM BAM - Recovering Web Tokens From Office](https://twitter.com/Dinosn/status/1582101855697444864) - - [Australian insurance firm Medibank confirms ransomware attack](https://twitter.com/Dinosn/status/1582078072223768579) - - [A journey of fuzzing Nvidia graphic driver leading to LPE exploitation](https://twitter.com/Dinosn/status/1582066704263544832) - - [Dutch Police Tricked Deadbolt Ransomware Gang Into Sharing Decryption Keys](https://twitter.com/Dinosn/status/1582066625947189248) - - [Hacking Automobile Keyless Entry Systems](https://twitter.com/Dinosn/status/1582066514194100225) - - [New UEFI rootkit Black Lotus offered for sale at $5,000](https://twitter.com/Dinosn/status/1582066405125783552) - - [2.2 million Woolworths MyDeal customers exposed in data breach](https://twitter.com/Dinosn/status/1582066296191320064) - - [RT ScanFactory: The most extensive & up-to-date collection of public exploits & references for CVEs that you'll ever need! #cybersec #infosec #bugboun...](https://twitter.com/scanfactory_io/status/1582039297703612416) - - [Shein Owner Zoetop Fined $1.9m Over Data Breach Response](https://twitter.com/Dinosn/status/1582031844895518720) - - [Researchers Say Microsoft Office 365 Uses Broken Email Encryption to Secure Messages](https://twitter.com/Dinosn/status/1582000828075847680) - - [Black Basta Ransomware Hackers Infiltrates Networks via Qakbot to Deploy Brute Ratel C4](https://twitter.com/Dinosn/status/1582000784572841984) - - [Japanese tech firm Oomiya hit by LockBit 3.0. Multiple supply chains potentially impacted](https://twitter.com/Dinosn/status/1582000744588226560) - - [Toner Deaf – Printing your next persistence (Hexacon 2022)](https://twitter.com/Dinosn/status/1581978087369019392) - - [How I Got $10,000 From GitHub For Bypassing Filtration oF HTML tags](https://twitter.com/Dinosn/status/1581978016766304257) - - [PoC for UAC bypass using arbitrary file delete in auto-elevated IFaultrepElevatedDataCollection COM object. Arbitrary file delete is abused to get SYS...](https://twitter.com/Dinosn/status/1581977484786302977) - - [RT Cube0x0: A new blog post on Relaying FIDO2 YubiKeys is up. Yubico is claiming that this is not subjected to Phishing so below is a PoC of phishing ...](https://twitter.com/cube0x0/status/1581918794275966977) - - [AWSome Pentesting Cheatsheet](https://twitter.com/Dinosn/status/1581878331003523073) - - [AD Security Intrusion Detection System](https://twitter.com/Dinosn/status/1581877762373038080) - - [Janus is a pre-build event that performs string obfuscation during compile time. This project is based off the CIA's Marble Framework](https://twitter.com/Dinosn/status/1581877682618654721) -- Sploitus.com Exploits RSS Feed - - [Webile 1.0.1 Directory Traversal exploit](https://sploitus.com/exploit?id=PACKETSTORM:168740&utm_source=rss&utm_medium=rss) - - [Backdoor.Win32.DarkSky.23 MVID-2022-0648 Buffer Overflow exploit](https://sploitus.com/exploit?id=PACKETSTORM:168735&utm_source=rss&utm_medium=rss) - - [WiFi File Transfer v1.0.8 - Cross Site Scripting Vulnerabilities exploit](https://sploitus.com/exploit?id=VULNERABLE:2322&utm_source=rss&utm_medium=rss) - - [MapTool 1.11.5 Denial Of Service exploit](https://sploitus.com/exploit?id=PACKETSTORM:168726&utm_source=rss&utm_medium=rss) - - [Stripe Green Downloads 2.03 - Cross Site Web Vulnerability exploit](https://sploitus.com/exploit?id=VULNERABLE:2287&utm_source=rss&utm_medium=rss) - - [pfSense pfBlockerNG 2.1.4_26 Shell Upload exploit](https://sploitus.com/exploit?id=PACKETSTORM:168743&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Configuration Download exploit](https://sploitus.com/exploit?id=PACKETSTORM:168731&utm_source=rss&utm_medium=rss) - - [Garage Management System 1.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168718&utm_source=rss&utm_medium=rss) - - [Joomla Vik Appointments 1.7.3 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168729&utm_source=rss&utm_medium=rss) - - [Spring Cloud Gateway 3.1.0 Remote Code Execution Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38037&utm_source=rss&utm_medium=rss) - - [Spring Cloud Gateway 3.1.0 Remote Code Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168742&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Remote Root Command Execution exploit](https://sploitus.com/exploit?id=PACKETSTORM:168749&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 SVDRP Control exploit](https://sploitus.com/exploit?id=PACKETSTORM:168732&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Change Root Password exploit](https://sploitus.com/exploit?id=PACKETSTORM:168733&utm_source=rss&utm_medium=rss) - - [WordPress Photo Gallery 1.8.0 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168752&utm_source=rss&utm_medium=rss) - - [WiFi File Transfer 1.0.8 Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168746&utm_source=rss&utm_medium=rss) - - [Wordpress ImageMagick-Engine 1.7.4 Plugin - Remote Code Execution (Authenticated) Exploit exploit](https://sploitus.com/exploit?id=1337DAY-ID-38035&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Change Root Password Vulnerability exploit](https://sploitus.com/exploit?id=1337DAY-ID-38041&utm_source=rss&utm_medium=rss) - - [MiniDVBLinux 5.4 Remote Root Command Injection exploit](https://sploitus.com/exploit?id=PACKETSTORM:168744&utm_source=rss&utm_medium=rss) - - [Vicidial 2.14-783a Cross Site Scripting exploit](https://sploitus.com/exploit?id=PACKETSTORM:168713&utm_source=rss&utm_medium=rss) - - [Exploit for Cross-site Scripting in Helpsystems Cobalt Strike exploit](https://sploitus.com/exploit?id=5B9ECD65-2210-5FE9-8ECE-77CFAEB44694&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-24990 exploit](https://sploitus.com/exploit?id=0A261A34-CF13-5D79-BD7F-6E9B54B96DEE&utm_source=rss&utm_medium=rss) - - [Exploit for Injection in Sophos Firewall exploit](https://sploitus.com/exploit?id=E88B092A-CAC3-5E4D-AA85-1C01600A7A46&utm_source=rss&utm_medium=rss) - - [Exploit for CVE-2022-40684 exploit](https://sploitus.com/exploit?id=77197575-9978-5136-A83D-F5FF790F2F34&utm_source=rss&utm_medium=rss) - - [Exploit for Improper Control of Dynamically-Managed Code Resources in Vm2 Project Vm2 exploit](https://sploitus.com/exploit?id=B0D935D0-63C8-5C5E-94CD-4B434F315B0B&utm_source=rss&utm_medium=rss) - - [Exploit for Code Injection in Apache Commons Text exploit](https://sploitus.com/exploit?id=8DEA6A03-D2AB-5FF8-91AA-E75640EF27B2&utm_source=rss&utm_medium=rss) - - [Exploit for Vulnerability in Apache Commons Configuration exploit](https://sploitus.com/exploit?id=06F61093-00F5-5EEB-B6FA-59F105962C41&utm_source=rss&utm_medium=rss) -- Security Boulevard - - [4 tactics for cybersecurity at home or work](https://securityboulevard.com/2022/10/4-tactics-for-cybersecurity-at-home-or-work/) - - [PROFESSIONAL CYBERSECURITY SERVICES Datasheet](https://securityboulevard.com/2022/10/professional-cybersecurity-services-datasheet/) - - [Frontline Security GPA Datasheet](https://securityboulevard.com/2022/10/frontline-security-gpa-datasheet/) - - [The Expanding Role of Vulnerability Management in Proactive Cybersecurity](https://securityboulevard.com/2022/10/the-expanding-role-of-vulnerability-management-in-proactive-cybersecurity/) - - [Why You Need a Data-Driven Approach to Vulnerability Management | Lookout](https://securityboulevard.com/2022/10/why-you-need-a-data-driven-approach-to-vulnerability-management-lookout/) - - [GUEST ESSAY: A breakout of how Google, Facebook, Instagram enable third-party snooping](https://securityboulevard.com/2022/10/guest-essay-a-breakout-of-how-google-facebook-instagram-enable-third-party-snooping/) - - [$3 BILLION in DeFi Hacks in 2022—So Far](https://securityboulevard.com/2022/10/3-billion-defi-hacks-richixbw/) - - [BSidesLV 2022 Lucky13 Hire Ground – Tom Eston’s ‘Management Hacking 101: Leading High Performance Teams’](https://securityboulevard.com/2022/10/bsideslv-2022-lucky13-hire-ground-tom-estons-management-hacking-101-leading-high-performance-teams/) - - [Real-time OWASP vulnerabilities as you code with Code Sight and Rapid Scan Static](https://securityboulevard.com/2022/10/real-time-owasp-vulnerabilities-as-you-code-with-code-sight-and-rapid-scan-static/) - - [Combining Cybersecurity with Gaming: Cheats, Insider Threats, Ransomware and More](https://securityboulevard.com/2022/10/combining-cybersecurity-with-gaming-cheats-insider-threats-ransomware-and-more/) -- SecWiki News - - [SecWiki News 2022-10-17 Review](http://www.sec-wiki.com/?2022-10-17) -- paper - Last paper - - [Android NFC 条件竞争漏洞分析（CVE-2021-0870）](https://paper.seebug.org/1987/) - - [8220 Gang 云僵尸网络感染全球约 3 万台主机](https://paper.seebug.org/1986/) -- unSafe.sh - 不安全 - - [Out Of Band Update: Cobalt Strike 4.7.2](https://buaq.net/go-131335.html) - - [8 KB is not enough: why WAFs can’t protect APIs](https://buaq.net/go-131336.html) - - [All Eyes on Cloud | Why the Cloud Surface Attracts Attacks](https://buaq.net/go-131321.html) - - [Detecting Emerging Network Threats From Newly Observed Domains](https://buaq.net/go-131318.html) -- 安全脉搏 - - [域渗透之委派攻击全集](https://www.secpulse.com/archives/189184.html) - - [web类 | XXE漏洞总结](https://www.secpulse.com/archives/189161.html) - - [常用Webshell管理工具上线利用方式](https://www.secpulse.com/archives/189104.html) -- 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com - - [工信部通报38款App，苹果iOS也被点名](https://www.4hou.com/posts/kMLY) - - [2022 Q1-Q3网络安全投融资季度专题分析](https://www.4hou.com/posts/PJEl) - - [获Gartner首推！360 BAS如何成安全能力度量标尺？](https://www.4hou.com/posts/jJKz) - - [Android逆向分析工具性能对比分析](https://www.4hou.com/posts/6VNQ) - - [CVE-2019-10999 在Shambles上的漏洞重现](https://www.4hou.com/posts/504Z) - - [攻击者利用Microsoft Office文件传播Agent Tesla 和njRat](https://www.4hou.com/posts/KEvz) - - [谷歌搜索emoji相关特定关键词时报错](https://www.4hou.com/posts/8YN5) - - [欺骗的艺术——你被社工了吗？](https://www.4hou.com/posts/037G) -- Bug Bounty in InfoSec Write-ups on Medium - - [HTTP request smuggling Explained and Exploited Part 0x1](https://infosecwriteups.com/http-request-smuggling-explained-and-exploited-part-0x1-89ce2956534f?source=rss----7b722bfd1b8d--bug_bounty) - - [How I Got $10,000 From GitHub For Bypassing Filtration oF HTML tags](https://infosecwriteups.com/how-i-got-10-000-from-github-for-bypassing-filtration-of-html-tags-db31173c8b37?source=rss----7b722bfd1b8d--bug_bounty) -- XPN InfoSec Blog - - [WAM BAM - Recovering Web Tokens From Office](https://blog.xpnsec.com/wam-bam/) -- Horizon3.ai - - [Test Event Title Here](https://www.eventbrite.com/#new_tab) - - [Test Event Title 1](https://www.eventbrite.com/#new_tab) -- SAP Blogs - - [The Times They are A-Changin’ – A Faster time to Value for SAP S/4HANA Cloud, public edition](https://blogs.sap.com/2022/10/17/the-times-they-are-a-changin-a-faster-time-to-value-for-sap-s-4hana-cloud-public-edition/) - - [SAP BusinessObjects BI Platform 4.3 SP02 Available on SAP Cloud Appliance Library](https://blogs.sap.com/2022/10/17/sap-businessobjects-bi-platform-4.3-sp02-available-on-sap-cloud-appliance-library/) - - [SAP Commissions – Build Containerize Python Application using Docker](https://blogs.sap.com/2022/10/17/sap-commissions-build-containerize-python-application-using-docker/) - - [HCM Nómina España: Escenarios de utilización del Mensaje FIE](https://blogs.sap.com/2022/10/17/hcm-nomina-espana-como-ejecutar-el-mensaje-fie-para-un-empleado-2/) - - [MAIL OAuth using PI/PO](https://blogs.sap.com/2022/10/17/mail-oauth-using-pi-po/) - - [Volunteers Wanted: Looking for Input for a New Profile Project](https://blogs.sap.com/2022/10/17/volunteers-wanted-looking-for-input-for-a-new-profile-project/) - - [SAP UI5 Smart filter approach for passing date filter to a parameterized CDS view](https://blogs.sap.com/2022/10/17/sap-ui5-smart-filter-approach-for-passing-date-filter-to-a-parameterized-cds-view/) - - [Influence SAP Commerce Cloud development via SAP Customer Engagement Initiatives](https://blogs.sap.com/2022/10/17/influence-sap-commerce-cloud-development-via-sap-customer-engagement-initiatives/) - - [Customer Statement/ Vendor Invoices/ & Dunning sent automatically by BTE Implementation](https://blogs.sap.com/2022/10/17/customer-statement-vendor-invoices-dunning-sent-automatically-by-bte-implementation/) -- blog.avast.com EN - - [Caffeine makes phishing easy](https://blog.avast.com/caffeine-phishing) -- XPN InfoSec Blog - - [WAM BAM - Recovering Web Tokens From Office](https://blog.xpnsec.com/wam-bam/) -- Securelist - - [DiceyF deploys GamePlayerFramework in online casino development studio](https://securelist.com/diceyf-deploys-gameplayerframework-in-online-casino-development-studio/107723/) -- Malwarebytes Labs - - [A week in security (October 10 - 16)](https://www.malwarebytes.com/blog/news/2022/10/a-week-in-security-october-10-16) -- Application Security Blog - - [Real-time OWASP vulnerabilities as you code with Code Sight and Rapid Scan Static](https://www.synopsys.com/blogs/software-security/real-time-owasp-vulnerabilities-code-sight-rapid-scan-static/) -- Reverse Engineering - - [/r/ReverseEngineering's Weekly Questions Thread](https://www.reddit.com/r/ReverseEngineering/comments/y641ib/rreverseengineerings_weekly_questions_thread/) -- Exploit-DB.com RSS Feed - - [[webapps] Wordpress Plugin ImageMagick-Engine 1.7.4 - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/51025) -- Rhynorater's InfoSec Blog - - [Hacker Healthcare](https://rhynorater.github.io/Hacker-Healthcare) -- hackademix.net - - [2 Months of TabGuard](https://hackademix.net/2022/10/17/2-months-of-tabguard/) - - [NoScript, Red or Blue? Whatever Suits You!](https://hackademix.net/2022/10/17/noscript-red-or-blue-whatever-suits-you/) -- SentinelOne - - [All Eyes on Cloud | Why the Cloud Surface Attracts Attacks](https://www.sentinelone.com/blog/all-eyes-on-cloud-why-the-cloud-surface-attracts-attacks/) -- Wallarm - - [8 KB is not enough: why WAFs can’t protect APIs](https://lab.wallarm.com/8-kb-is-not-enough-why-wafs-cant-protect-apis/) -- FreeBuf网络安全行业门户 - - [FreeBuf早报 | 韩国多个网络平台瘫痪总统道歉；部分iPhone 14存在“不支持SIM卡”问题](https://www.freebuf.com/news/347061.html) - - [字节招聘 | 高级安全工程师、技术专家岗等你来投！](https://www.freebuf.com/jobs/347056.html) - - [加密货币平台Mango Markets遭攻击损失超1亿美元，黑客宣布返还6700万](https://www.freebuf.com/articles/blockchain-articles/347025.html) - - [因盗取信息，下载“果照”，一学生被判 13 个月监禁](https://www.freebuf.com/news/346999.html) -- 绿盟科技技术博客 - - [绿盟科技威胁周报（2022.10.08-2022.10.16）](http://blog.nsfocus.net/weeklyreport42/) - - [攻击推理-一文了解“离地攻击”的攻与防](http://blog.nsfocus.net/attackanddefense/) -- 安全牛 - - [工信部通报38款App，苹果iOS也被点名](https://www.aqniu.com/vendor/89992.html) - - [Brute Ratel C4（BRC4）攻击框架TLS加密流量分析](https://www.aqniu.com/industry/89991.html) - - [Gartner推荐：360抗攻击能力评估系统打造行业标杆](https://www.aqniu.com/vendor/89990.html) - - [混合办公，以安全弹性锻造企业可持续发展韧性](https://www.aqniu.com/vendor/89989.html) -- 博客园 - 渗透测试中心 - - [端口复用后门总结 - 渗透测试中心](https://www.cnblogs.com/backlion/p/16798021.html) -- KitPloit - PenTest & Hacking Tools - - [JSubFinder - Searches Webpages For Javascript And Analyzes Them For Hidden Subdomains And Secrets](http://www.kitploit.com/2022/10/jsubfinder-searches-webpages-for.html) -- Seebug漏洞平台 - - [404星链计划 | Antenna、CF 版本更新](https://mp.weixin.qq.com/s?__biz=MzAxNDY2MTQ2OQ==&mid=2650965663&idx=1&sn=13f16640460c344687c984645a424430&chksm=8079c4adb70e4dbbd0c3045f5d2c7b6dfa59d803ffadd04af3f57330fee6d9a0c09355d0bb43&scene=58&subscene=0#rd) -- 代码卫士 - - [奇安信代码安全实验室研究成果入选Black Hat和POC安全大会议题](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247514220&idx=1&sn=750a288be57eb8452af469145908204b&chksm=ea948906dde3001079435980a74be8cd2323e4db3b1658dd30655296b28c8fa54cacfd9002d3&scene=58&subscene=0#rd) -- HackerNews - - [国际刑警组织领导的行动推翻了“ Black Axe”网络犯罪组织](https://hackernews.cc/archives/41938) - - [因盗取信息，下载“果照”，一学生被判 13 个月监禁](https://hackernews.cc/archives/41935) - - [Palo Alto Networks 修复了 PAN-OS 中的高危身份验证绕过漏洞](https://hackernews.cc/archives/41930) - - [微软过时驱动程序列表让 Windows PC 易受恶意软件攻击](https://hackernews.cc/archives/41924) - - [黑客利用 Wi-Fi 无人机远程渗透了金融公司内网](https://hackernews.cc/archives/41920) -- 奇客Solidot–传递最新科技情报 - - [现代人类祖先与尼安德特人共存数千年](https://www.solidot.org/story?sid=73078) - - [Meta 的元宇宙世界令人失望](https://www.solidot.org/story?sid=73077) - - [天文学家展示世界最大数码相机](https://www.solidot.org/story?sid=73076) - - [MICROSCOPE 卫星最终结果证实爱因斯坦弱等效原理](https://www.solidot.org/story?sid=73075) - - [对华半导体限制也伤及美国企业](https://www.solidot.org/story?sid=73073) -- 安全牛 - - [简析五种常用勒索软件检测技术的特点和不足](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119196&idx=1&sn=cae2c3534309990b45a71281b025385a&chksm=bd146e8f8a63e79968f513bd06869c5b469e942a3cd97da67bbc91219854a7c381a1f142ca5a&scene=58&subscene=0#rd) - - [安全头条 | 工信部通报38款侵害用户权益的APP；ISACA中国2022年度大会延期举办](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119196&idx=2&sn=f741c39f3da6fc39704ec5adc3e7ab2e&chksm=bd146e8f8a63e799104d66f95e02f1a1944115326eeddab6d3d42b5ac888654a1b7093a42e4a&scene=58&subscene=0#rd) - - [直播预告 | 网安大讲堂（48期）：数据出境安全评估要点解读（二）](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651119196&idx=3&sn=af14ca0b1259983ea577cc8325f65a39&chksm=bd146e8f8a63e799c1317bf2acc3aaff89677d05af5f21675d6ac369af918579894ad456e6b8&scene=58&subscene=0#rd) -- 奇安信病毒响应中心 - - [最新季度Android App收集个人信息检测报告来了](https://mp.weixin.qq.com/s?__biz=MzI5Mzg5MDM3NQ==&mid=2247491905&idx=1&sn=235d0aa10f8f3a6a82ece0e17ec72f88&chksm=ec699169db1e187f24bdd88b676f8ebaf450847917c9c0e32ab2bbbfdc25974e37426f9b7685&scene=58&subscene=0#rd) -- 博客园 - nice_0e3 - - [Java安全之Spring Security绕过总结 - nice_0e3](https://www.cnblogs.com/nice0e3/p/16798843.html) -- 关键基础设施安全应急响应中心 - - [关键基础设施安全资讯周报20221017期](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531783&idx=1&sn=a00ed35e016f3496c9cef4145744bb4b&chksm=c1e9f156f69e7840754af076f7ab420ec1263c1f43666b779e14da82ccd3d86a3f90c36e5b86&scene=58&subscene=0#rd) - - [传统技术如何阻碍零信任以及如何应对](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531783&idx=2&sn=ff892452e12ee3e8be9572044d93d02c&chksm=c1e9f156f69e7840740574deb949322e4f785894104b9ee7e0e2f52bb238750fc287f396265e&scene=58&subscene=0#rd) - - [十大未查出幕后组织的APT攻击](https://mp.weixin.qq.com/s?__biz=MzkyMzAwMDEyNg==&mid=2247531783&idx=3&sn=d90f1c478c97d07051d5730275189a7c&chksm=c1e9f156f69e7840c3a575074e0a2567ca4ade5f7cea8c5c6534f3cb5f691a6c6dd2585319c0&scene=58&subscene=0#rd) -- 网络安全应急技术国家工程实验室 - - [国家工程研究中心安全资讯周报20221017期](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531958&idx=1&sn=85d27100a2fc095a47dfce99b133fbd5&chksm=fa93cb77cde4426178a5bd5e87178bb87cb0c912070cdc166348a6de2fdbe9898b37f219775b&scene=58&subscene=0#rd) - - [2021年零售业勒索软件攻击上升75%](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531958&idx=2&sn=0532463a2866f1b7bdfd01af9e563cbc&chksm=fa93cb77cde44261de0af4d7b25d1fce6393ab3c0f7fee810b2528133e7c8263a27f02bc7258&scene=58&subscene=0#rd) - - [勒索软件新技术趋势：间歇性加密](https://mp.weixin.qq.com/s?__biz=MzUzNDYxOTA1NA==&mid=2247531958&idx=3&sn=7ceb2d892a1adb65c0014990fe2b059d&chksm=fa93cb77cde44261f0be9da2318a5d24d0ef0a30259d0a9b963ebf65d1aab26f7b62c52cc1b1&scene=58&subscene=0#rd) -- M01NTeam - - [攻击技术研判 | 典型BYOVD利用与Ring0防御削弱技术研判](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247489886&idx=1&sn=a8cb6f678fc2f1163eb32527dbc06081&chksm=c187d94ff6f050592013ee9c5a004201d76f37b14aed6248cebdf0ed1d167c692f76733f91d6&scene=58&subscene=0#rd) -- 永安在线情报平台 - - [永安在线入选2022中国网络安全「API安全防护」领域代表厂商](https://mp.weixin.qq.com/s?__biz=MzI3NDY3NDUxNg==&mid=2247494544&idx=1&sn=16c056cff81af9ba30c56f56eba976a5&chksm=eb12cdabdc6544bda8c7e6762f3321a2445e8c48c33668464ad3d4205c108ba9ecee387a3f1f&scene=58&subscene=0#rd) -- 中国信息安全 - - [专题·关基保护 | 国家关键信息基础设施安全保护的法治进展](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166933&idx=1&sn=991da02ca061da3814810bfa77643aa4&chksm=8b5ef4ecbc297dfa452070a6022a4b560b8f914b953e29aa7effad39c62cade21b1875bbcfba&scene=58&subscene=0#rd) - - [前沿 | 网络安全在油气储运行业的发展与思考](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166933&idx=2&sn=ec539ea00d92ae0301ba0623e2256867&chksm=8b5ef4ecbc297dfa5620cf9766f77835f9011030b19debd162bf17343fdbf3e0f9048a009345&scene=58&subscene=0#rd) - - [专题·数字政府安全 | 企业视角的数字政府安全保障举措（一）](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166933&idx=3&sn=9b19050e8fb8fce130201bb48f3e5e9e&chksm=8b5ef4ecbc297dfa40880128d9f3e3099f8a69a5ea71791df5b468390de26e011b678207d81c&scene=58&subscene=0#rd) - - [法治 | 延伸司法职能共治网络生态](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664166933&idx=4&sn=66008b55d482d916bfccb84be8e4c259&chksm=8b5ef4ecbc297dfac9383ed604ea54bc513dac99a913d808de9627e0a6c54524d7b56ee9cc38&scene=58&subscene=0#rd) -- Beacon Tower Lab - - [最新CS RCE（CVE-2022-39197）复现心得分享](https://mp.weixin.qq.com/s?__biz=MzkzNjMxNDM0Mg==&mid=2247485450&idx=1&sn=5662a9f2c081fc8521eee651b357323f&chksm=c2a1dc83f5d655957cf2a1c88adf45cd0d028316f536e0a8a18c9e7cb0440869ed4077822ce8&scene=58&subscene=0#rd) diff --git a/utils.py b/utils.py index 9724c9a280..06346e2a62 100644 --- a/utils.py +++ b/utils.py @@ -1,7 +1,7 @@ import pprint +import os from colorama import Fore - class Color: @staticmethod def print_focus(data: str): diff --git a/yarb.py b/yarb.py old mode 100755 new mode 100644 index 248a33a107..0fc36fd89d --- a/yarb.py +++ b/yarb.py @@ -4,45 +4,69 @@ import json import time import schedule -import pyfiglet import argparse import datetime -import listparser import feedparser +import re from pathlib import Path from concurrent.futures import ThreadPoolExecutor, as_completed from bot import * from utils import Color, Pattern +from db import * import requests requests.packages.urllib3.disable_warnings() today = datetime.datetime.now().strftime("%Y-%m-%d") +# 替换圆括号和中括号为空格 +def replace_brackets_with_space(string): + replaced_string = re.sub(r'[()\[\]| \s]+', ' ', string) + return replaced_string -def update_today(data: list=[]): +# 处理长字符串 +def truncate_string(string, length = 18): + if len(string) <= length: + return string + else: + return string[:length] + '...' + +def update_today(): """更新today""" root_path = Path(__file__).absolute().parent - data_path = root_path.joinpath('temp_data.json') - today_path = root_path.joinpath('today.md') + today_path = root_path.joinpath('README.md') archive_path = root_path.joinpath(f'archive/{today.split("-")[0]}/{today}.md') - if not data and data_path.exists(): - with open(data_path, 'r') as f1: - data = json.load(f1) - archive_path.parent.mkdir(parents=True, exist_ok=True) - with open(today_path, 'w+') as f1, open(archive_path, 'w+') as f2: - content = f'# 每日安全资讯（{today}）\n\n' - for item in data: - (feed, value), = item.items() - content += f'- {feed}\n' - for title, url in value.items(): - content += f' - [{title}]({url})\n' + + data = getArticlesForReadme() + with open(today_path, 'w+', encoding='utf-8-sig') as f1: + content = f'# {today}\n\n' + content += f'|来源|标题|\n' + content += f'|---|---|\n' + prefeed = '' + for (feed, link, title, url, published_at, updated_at) in data: + newfeed = truncate_string(replace_brackets_with_space(feed)) + newtitle = replace_brackets_with_space(title) + if(prefeed != newfeed): + content += f'|[{newfeed}]({link})|[{newtitle}]({url})|\n' + prefeed = newfeed + else: + content += f'||[{newtitle}]({url})|\n' f1.write(content) - f2.write(content) + data = getArticles() + with open(archive_path, 'w+', encoding='utf-8-sig') as f2: + content = f'# 每日资讯（{today}）\n\n' + preFeed = '' + for (feed, link, title, url) in data: + if(preFeed != feed): + preFeed = feed + content += f'- [{feed}]({link})\n' + newtitle = replace_brackets_with_space(title) + content += f' - [{newtitle}]({url})\n' + f2.write(content) def update_rss(rss: dict, proxy_url=''): """更新订阅源文件""" @@ -69,6 +93,23 @@ def update_rss(rss: dict, proxy_url=''): return result +def check_reply_number(text): + # 使用正则表达式查找#reply及其后面的数字 + match = re.search(r'#reply(\d+)', text) + + # 如果找到了匹配项 + if match: + # 获取匹配的数字 + number = int(match.group(1)) + + # 判断数字是否大于10 + if number > 10: + return True + else: + return False + else: + # 如果未找到匹配项，返回True + return True def parseThread(url: str, proxy_url=''): """获取文章线程""" @@ -79,27 +120,42 @@ def parseThread(url: str, proxy_url=''): 'Accept-Language': 'zh-CN,zh;q=0.9', } + ret = True + title = '' - result = {} + link = '' + result = [] try: r = requests.get(url, timeout=10, headers=headers, verify=False, proxies=proxy) r = feedparser.parse(r.content) title = r.feed.title + link = r.feed.link for entry in r.entries: d = entry.get('published_parsed') if not d: d = entry.updated_parsed - yesterday = datetime.date.today() + datetime.timedelta(-1) - pubday = datetime.date(d[0], d[1], d[2]) - if pubday == yesterday: - item = {entry.title: entry.link} - print(item) - result |= item - Color.print_success(f'[+] {title}\t{url}\t{len(result.values())}/{len(r.entries)}') + # 转换日期格式 + pubday = datetime.datetime(d[0], d[1], d[2], d[3], d[4], d[5]) + + beginTime = datetime.datetime.now().replace(hour=0, minute=0, second=0, microsecond=0) + tomorrow = datetime.datetime.today() + datetime.timedelta(1) + + # 过滤v2ex回复较少的发帖 + if not check_reply_number(entry.link): + continue + + if pubday > beginTime and pubday < tomorrow: + result.append(entry) + continue + + # 因rss一般是按时间新->旧排序, 当遇到一条发布时间不满足的情况, 基本可以确定后续都不满足, 直接跳出循环 + break + Color.print_success(f'[+] {title}\t{url}\t{len(result)}/{len(r.entries)}') except Exception as e: + ret = False Color.print_failed(f'[-] failed: {url}') print(e) - return title, result + return ret, title, url, result def init_bot(conf: dict, proxy_url=''): @@ -113,10 +169,6 @@ def init_bot(conf: dict, proxy_url=''): receiver = os.getenv(v['secrets_receiver']) or v['receiver'] bot = globals()[f'{name}Bot'](v['address'], key, receiver, v['from'], v['server']) bots.append(bot) - elif name == 'qq': - bot = globals()[f'{name}Bot'](v['group_id']) - if bot.start_server(v['qq_id'], key): - bots.append(bot) elif name == 'telegram': bot = globals()[f'{name}Bot'](key, v['chat_id'], proxy_url) if bot.test_connect(): @@ -126,59 +178,20 @@ def init_bot(conf: dict, proxy_url=''): bots.append(bot) return bots - -def init_rss(conf: dict, update: bool=False, proxy_url=''): - """初始化订阅源""" - rss_list = [] - enabled = [{k: v} for k, v in conf.items() if v['enabled']] - for rss in enabled: - if update: - if rss := update_rss(rss, proxy_url): - rss_list.append(rss) - else: - (key, value), = rss.items() - rss_list.append({key: root_path.joinpath(f'rss/{value["filename"]}')}) - - # 合并相同链接 - feeds = [] - for rss in rss_list: - (_, value), = rss.items() - try: - rss = listparser.parse(open(value).read()) - for feed in rss.feeds: - url = feed.url.strip().rstrip('/') - short_url = url.split('://')[-1].split('www.')[-1] - check = [feed for feed in feeds if short_url in feed] - if not check: - feeds.append(url) - except Exception as e: - Color.print_failed(f'[-] 解析失败：{value}') - print(e) - - Color.print_focus(f'[+] {len(feeds)} feeds') - return feeds - - -def cleanup(): - """结束清理""" - qqBot.kill_server() - - def job(args): """定时任务""" - print(f'{pyfiglet.figlet_format("yarb")}\n{today}') - global root_path root_path = Path(__file__).absolute().parent if args.config: config_path = Path(args.config).expanduser().absolute() else: config_path = root_path.joinpath('config.json') - with open(config_path) as f: + with open(config_path, encoding='utf-8-sig') as f: conf = json.load(f) proxy_rss = conf['proxy']['url'] if conf['proxy']['rss'] else '' - feeds = init_rss(conf['rss'], args.update, proxy_rss) + feeds = getRss() + Color.print_focus(f'[+] {len(feeds)} feeds') results = [] if args.test: @@ -191,19 +204,18 @@ def job(args): with ThreadPoolExecutor(100) as executor: tasks.extend(executor.submit(parseThread, url, proxy_rss) for url in feeds) for task in as_completed(tasks): - title, result = task.result() - if result: - numb += len(result.values()) - results.append({title: result}) + ret, title, link, result = task.result() + if ret: + if result: + numb += len(result) + results.append(task.result()) + else: + updateRssInvalid(link) Color.print_focus(f'[+] {len(results)} feeds, {numb} articles') - # temp_path = root_path.joinpath('temp_data.json') - # with open(temp_path, 'w+') as f: - # f.write(json.dumps(results, indent=4, ensure_ascii=False)) - # Color.print_focus(f'[+] temp data: {temp_path}') - - # 更新today - update_today(results) + addArticles(results) + # 更新today + update_today() # 推送文章 proxy_bot = conf['proxy']['url'] if conf['proxy']['bot'] else '' @@ -211,8 +223,7 @@ def job(args): for bot in bots: bot.send(bot.parse_results(results)) - cleanup() - + deleteHistory() def argument(): parser = argparse.ArgumentParser()