Aggregator

关注高级攻防对抗技术热点，研究对手技术进行高级威胁模拟，研判攻击安全发展方向。

关注高级攻防对抗技术热点，研究对手技术进行高级威胁模拟，研判攻击安全发展方向。

Web安全Cookie Sandwich：新型HttpOnly Cookie窃取技术https://portswigger.net/research/stealing-httponly-cookies

Submit #484922 / VDB-259596

A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/model/addOrUpdate of the component Add Model Management Page. The manipulation of the argument 模板前缀 leads to cross site scripting. This vulnerability was named CVE-2025-0708. The attack can be initiated remotely. Furthermore, there is an exploit available.

Submit #483364 / VDB-293237

浏览器漏洞利用一直是备受关注的热点话题。浏览器作为用户与互联网进行交互的主要工具，也是黑客攻击的重要目标之一。当浏览器存在漏洞时，黑客可以利用这些漏洞进行恶意攻击，例如窃取用户的个人信息、安装恶意软件

有意向者可点击文末【阅读原文】投递简历~职位更新湛蓝空间网络科技公司职位经验/学历薪资地点Android/iOS漏洞安全5-10年/不限50-60k广州iOS逆向开发专家5-10年/不限40-50k广

分析过程定位算法的步骤这里就省略了，直接从一个hook结果开始分析：mtgsig = { "a0": "3.0", "a1": "4069cb78-e02b-45f6-9f0a-b34dd

1月24日，Pwn2Own Automotive 2024黑客大赛在日本东京拉开帷幕，首日便吸引了全球顶尖安全研究人员的参与。本次比赛专注于汽车网络安全，目标包括特斯拉车载信息娱乐系统（IVI）、电动

从零开始学习浏览器漏洞利用，掌握oob技术、JIT编译原理

特斯拉电动车充电器在Pwn2Own东京大赛中被黑客攻破两次

文末投递简历

看雪论坛作者ID：Tubbs

A vulnerability was found in Rise Group Rise Mode Temp CPU 2.1. It has been classified as critical. This affects an unknown part in the library CRYPTBASE.dll of the component Startup. The manipulation leads to untrusted search path. This vulnerability is uniquely identified as CVE-2025-0707. The attack needs to be approached locally. There is no exploit available.

Submit #482662 / VDB-293236

Компании по всему миру спешно обновляют системы, чтобы избежать последствий.