Aggregator

近日Oracle通报了一个反序列化漏洞CVE-2022-21445，未经身份认证的远程攻击者可利用该漏洞实现反序列化操作导致任意代码执行。任何基于ADF Faces框架开发的程序都受到此漏洞的影响，包括Oracle的多个产品。

The Atlassian Confluence vulnerability is here to stay. See Akamai's research into the stats two weeks after the advisory was released.

Pluggable Authentication Modules (PAM) on Unix based systems are useful to change logon behavior and enforce authentication via various means. In “Red Team Strategies” the chapter “Protecting the Pentester” walks the reader through the configuration of a PAM module to get notified in real-time via a pop-up when someone logs on to the machine (e.g. system compromise). But there are also bad things that can be done with PAM (especially post-exploitation) and this is what this post is about.

近日监测到 Apache 发布安全的公告，修复了一个存在于 Apache Flume 中的代码执行漏洞CVE-2022-25167，攻击者可通过发送特制的 JNDI 查找，从而在目标系统上执行任意代码。

introduce

OS: Linux
Difficulty: Hard
Points: 40
Release: 05 Mar 2022
IP: 10.10.11.149

Spring Data MongoDB 是一个开源项目，它提供了与 MongoDB 文档数据库的集成。近日监控到 Spring Data MongoDB 爆出 SpEL 表达式注入漏洞 CVE-2022-22980

Read about our recent Terraform updates and managed database services, our latest Meet the Developer articles, and stream videos on edge computing.

在提笔写文章的时候，忽然发现6月已经过了大半了，时光总是匆匆的感觉。6月其实花了很多时间去研究一个叫做潮汐平台的东西.

Today, as the world celebrates International Women in Engineering Day, we recognize and honor women engineers at Verisign, whose own stories have helped shape dreams and encouraged young women and girls to take up engineering careers. Here are three of their stories: Shama Khakurel, Senior Software Engineer When Shama Khakurel was in high school, she […]

The post Celebrating Women Engineers Today and Every Day at Verisign appeared first on Verisign Blog.

Windows自启动技术-注册表 注册表自启动 Windows的Run和RunOnce注册表项可以让用户登陆系统时自动启动一些程序。 其中涉及到的注册表项如下： HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY

Bots can be used for good, but can also be nefarious. In this post, see Akamai's research on the Israeli Gamken bot copycat.

Explore how DDoS attacks are practically unrecognizable from those of the past few years thanks to constant innovation in the threat landscape

作者：404notfound@柳星。此文仅代表个人观点，与团队、公司无关，如有不妥之处，一定要提醒我，我改！

作者介绍Y4tacker真是太牛逼了，新一代的java王子，每天一花活又强又卷年纪轻轻还有女朋友。头像还这么

Windows自启动技术快速启动目录 前言 最近比较忙，整理一点琐碎的东西 自启动技术 在windows 系统中，存在很多可以实现开启自启动的地方。windows系统下有自带的快速启动文件夹。只要程序放到这个快速启动目录下，系统在启动的时候会自动加载并且运行这个程序，实现开机启动。 快速启动的目录不

Confluence CVE-2022-26134 漏洞分析 调试环境配置 这里在 p牛的 vulhub 的基 […]

上海观安信息招聘售前数据安全方向，诚聘精英。

记得在 AntSword新类型 CmdLinux 预览 这篇文章最后立了个 Flag

资产安全领域的一个主要工作是根据信息对组织的价值进行分类。所有后续操作都取决于分类。例如，高度机密的数据需要严格的安全控制；相比之下，非机密数据使用较少的安全控制。