Aggregator

Explaining the Widespread log4j Vulnerability

3 years 4 months ago

The log4j security vulnerability is one of the most widespread cybersecurity vulnerabilities in recent years. Here's a non-technical explanation of it.

信息安全BP的能力模型

思想花火

3 years 4 months ago

利用飞机上的时间，自创一套信息安全BP的能力模型，欢迎探讨。

信息安全BP的能力模型

思想花火

3 years 4 months ago

利用飞机上的时间，自创一套信息安全BP的能力模型，欢迎探讨。

甲方需谨慎对待log4shell漏洞的修复

赛博回忆录

3 years 4 months ago

面对铺天盖地的修复方案，甲方人员加班的手忙脚乱，但是还是要冷静下来不可以乱修

甲方需谨慎对待log4shell漏洞的修复

赛博回忆录

3 years 4 months ago

面对铺天盖地的修复方案，甲方人员加班的手忙脚乱，但是还是要冷静下来不可以乱修

Log4j 严重漏洞修复方案参考 CVE-2021-44228

KINGX

3 years 4 months ago

KINGX

漏洞复现：《CVE-2021-44228：Apache Log4j2 远程代码执行》

深潜之眼

3 years 4 months ago

先是在野0day 《Grafana未授权任意文件读取》传出，随后更劲爆的《Apache Log4j2远程代码执行》的POC、EXP相继出现，后者的payloads传播速度之快、以及影响范围之广，使其在业内堪称 “核弹级” 漏洞。

log4j2 JNDI 注入漏洞分析

Panda - 专注于网络空间安全研究

3 years 4 months ago

0x01 写在前面2021 年 12 月 9 号注定是一个不眠之夜，著名的Apache Log4j 项目被爆存在远程代码执行漏洞，且利用简单，影响危害巨大，光是引入了 log4j2 依赖的组件都...

panda

CVE-2021-44228 - Patching is Recommended for Evolving Zero Day Vulnerability in Apache Log4j that allows remote code execution (RCE)

The Akamai Blog

3 years 4 months ago

Akamai has been monitoring the rapidly evolving developments of CVE-2021-44228. We have been working closely with our customers and internal application teams to mitigate the risks posed by the threat of unauthorized remote code execution. This includes deploying an update to our existing Apache WAF rules to include mitigation for this Zero Day CVE, and updating the Log4j library to version 2.15.0 or later.

Akamai