Aggregator

01.NET漏洞背景微软的.NET技术广泛应用于全球企业级产品，包括其知名的Exchange、SharePoint等，国内如某友的Cloud、某通的T系列、某蝶的云产品等也广泛采用。各行业核心业务均依

在红队渗透测试的过程中，数据库信息往往是关键突破口之一。许多 Web 应用程序将数据库连接字符串、账号和密码等敏感信息存储在配置文件中，而开发者往往忽视了对这些文件的加密和保护措施。本文我们将利用 S

01阅读须知此文所提供的信息只为网络安全人员对自己所负责的网站、服务器等（包括但不限于）进行检测或维护参考，未经授权请勿利用文章中的技术资料对任何计算机系统进行入侵操作。利用此文所提供的信息而造成的直

Trend surveyed 750 cybersecurity professionals in 49 countries to learn more about the state of cybersecurity, from job pressures to the need for more advanced tools. Explore what cloud security engineers teams had to say.

01前  言依据《关于加快煤矿智能化发展的指导意见》，按照 “智能化煤矿应建设高速高可靠的通信网络”的建设目标，实现终端机械化、系统自动化、综合智能化、管理信息化的建设方向，明确了矿井信息化建设的总体

为智慧矿山数字化转型与智能化升级奠定坚实基础。

A vulnerability was found in 2daybiz Polls Script. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file searchvote.php. The manipulation of the argument category leads to sql injection. This vulnerability is known as CVE-2010-5004. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in Neosys Neon WebMail up to 5.7 and classified as critical. This issue affects some unknown processing. The manipulation of the argument ID leads to Remote Code Execution. The identification of this vulnerability is CVE-2006-4952. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple macOS up to 10.14.4. It has been rated as critical. Affected by this issue is some unknown functionality of the component WebKit. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2019-8611. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in HP System Management Homepage up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2012-2014. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in HP System Management Homepage up to 2.0.1. It has been classified as critical. This affects an unknown part. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2012-2015. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in HP System Management Homepage up to 2.0.1. Affected is an unknown function. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2012-2012. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in HP System Management Homepage up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to denial of service. This vulnerability is known as CVE-2012-2013. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Microsoft Windows. This affects an unknown part of the component Client/Server Run-Time Subsystem. The manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2011-1967. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Microsoft Windows 7/Server 2008/Vista and classified as critical. Affected by this issue is some unknown functionality of the component File Metadata Parser. The manipulation leads to improper resource management. This vulnerability is handled as CVE-2011-1971. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Microsoft Windows. It has been classified as problematic. This affects an unknown part of the component Remote Desktop Protocol. The manipulation leads to improper resource management. This vulnerability is uniquely identified as CVE-2011-1968. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Microsoft Office 2000/2003/2004/2007/Xp. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Drawing Object Handler. The manipulation leads to improper resource management. This vulnerability is known as CVE-2007-1747. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in file 4.19. It has been classified as very critical. This affects the function file_printf. The manipulation leads to numeric error. This vulnerability is uniquely identified as CVE-2007-1536. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

关于问题的产生场景，是发生在SDL建设比较重的状态下。对于重的最简单理解就是：每个工单均需要做人工安全测试，并设置卡点，通过之后才允许上线。此时就会出现：业务方提交安全测试后，工单积压排队的情况。一方面是研发安全团队人员有限、加紧测试，另一方面是业务方需要知道安全测试排队情况，于是就产生了该需求。 对于SDL安全建设来说，这是个“中间态”。若这种状态长期下去，不利研发安全团队发展（疲于工单测试产生厌倦）、不利于业务方支撑（安全提测总拖后腿），急需要做出改变： 1、不要恋战人工测试：对待测系统进行分级，不要对每个系统每次发版都人工测试，对同一系统测试多次后也会出现思路短缺； 2、寻找其他措施兜底：建立完善的安全检测攻击链（黑白灰盒安全测试），引入红蓝渗透、SRC等机制补充人工测试能力覆盖不足，才能放做到有的放矢。 只有在充分弄清楚人工安全测试的作用后，方可做出科学有效的SDL机制调整。 更多软件安全内容，可以访问： 1、SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 设计阶段应开展哪些安全活动？ 如何选择开源组件安全扫描(SCA)工具？ SCA工具扫描出很多漏洞，如何处理？ SCA工具识别出高风险协议，如何处理？ 应该如何选型代码安全扫描工具？ 如何推进有问题的jar包更新？ SCA工具的误报率怎样？ 如何说服业务完成checklist自检？ sdl会对项目变更代码做review吗？ 怎么解决源代码两张皮导致安全失效？ 开发安全培训是否有效？ 安全组件如何在SDL中落地？ 如何安全管理研发提交代码到GitHub进行开源？ 安全组件(SDK)能够否覆盖Owasp Top 10? SDL建设是难中难，该如何做？ 如何定位及落地威胁建模？ 关于安全测试标准化的讨论？ SDL是否适合互联网公司？ 有什么SDL相关的评价体系？ 如何引导业务方进行自助式安全扫描？ 前端修复bug需要进行SAST扫描吗？ SDL 53/100问：在DevOps中用到哪些自动化的安全工具？ 2、SDL创新实践系列 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 从安全视角，看研发安全 数字化转型下的研发安全痛点