Cloud Security

Thoughts on vulnerabilities caused by a Python command 0x00 cause Recently, when testing a project, you have no intention of discovering that you can directly run a Python command on the client machine to execute the Python script on the server.

Microsoft Windows FastFAT. sys FAT partition Denial Of Service Vulnerability Reproduction Do you still remember the MS14-063 FAT32 driver kernel Overflow Vulnerability last year? The sequent is coming out today, but this time it is in the FAT12

Elevation of Privilege in WindowsImagine this: You got a Meterpreter session on a machine, and you are ready to rungetsystemCommand, but if the request fails, are you ready to admit it? Only a coward can admit defeat. But you are not, are you? You

Vulnerability Analysis and exploitation of Windows Media Center Released by Microsoft in September 8 this yearMS15-100 Security noticeFixed the remote code execution vulnerability in a Windows Media Center. If Windows Media Center opens a specially

Google Chrome opj_dwt_decode_1 * DoS Vulnerability (CVE-2015-6776)Google Chrome opj_dwt_decode_1 * DoS Vulnerability (CVE-2015-6776) Release date:Updated on:Affected Systems: Google Chrome Description: CVE (CAN) ID: CVE-2015-6776Google Chrome

DNS root server under DDoS Attack The DNS root server administrator reported two waves of attacks on January 1, November 30 and January 1, December 1. The attack time was from UTC to UTC on the first day, and from UTC to UTC on the first day. The

Android Media Framework Information Leak Vulnerability (CVE-2015-6628)Android Media Framework Information Leak Vulnerability (CVE-2015-6628) Release date:Updated on:Affected Systems: Android Android 6.0 Description: CVE (CAN) ID: CVE-2015-6628

Apple iOS kernel Memory Corruption Vulnerability (CVE-2015-7083)Apple iOS kernel Memory Corruption Vulnerability (CVE-2015-7083) Release date:Updated on:Affected Systems: Apple iOS Apple OS X Apple tvOS Description: CVE (CAN) ID: CVE-2015-7083

Cyrus IMAP index_urlfetch Integer Overflow Vulnerability (CVE-2015-8077)Cyrus IMAP index_urlfetch Integer Overflow Vulnerability (CVE-2015-8077) Release date:Updated on:Affected Systems: Cyrus Cyrus IMAP Server 2.5.6Cyrus Cyrus IMAP Server

Apple Xcode Security Vulnerability (CVE-2015-7082)Apple Xcode Security Vulnerability (CVE-2015-7082) Release date:Updated on:Affected Systems: Apple XCode Description: CVE (CAN) ID: CVE-2015-7082Xcode is a development tool used on Apple

Microsoft Office Memory Corruption Vulnerability (CVE-2015-6091) (MS15-116)Microsoft Office Memory Corruption Vulnerability (CVE-2015-6091) (MS15-116) Release date:Updated on:Affected Systems: Microsoft Office 2010 SP2Microsoft Word 2016Microsoft

Libpng png_set_PLTE/png_get_PLTE out-of-bounds Write Vulnerability (CVE-2015-8126)Libpng png_set_PLTE/png_get_PLTE out-of-bounds Write Vulnerability (CVE-2015-8126) Release date:Updated on:Affected Systems: Libpng 1.6.x-1.6.19Libpng

Bounce proxy penetrating the Intranet The roommate has gone out for an internship and has to choose a course again. The school's educational administration system does not seem to be accessible from the Internet, so we will consider providing them

What is the secret behind the ransomware Chimera?     0 × 00 Preface Recently, the ransomware world has brought many surprises to netizens: CryptoWall 4 is active on the Internet, and a ransomware called Chimera has appeared. So far, it has found

Malicious behavior of porn virus Phantom Killer and analysis of black product interest chain 0x00 Overview Recently, the Alibaba mobile security team found that a large number of pornographic viruses have begun to flood in some forums or

SQL Injection exists in a clothing Management System & unrestricted Getshel (no DBA permission required) Detailed description: F22 clothing Management SoftwareOne injection, without the DBA permission POST / HTTP/1.1Host:

SQL injection vulnerability in a third-party sub-station in China Network disconnection ...... Not going deep. Just repair it ~Detailed description: After registering a user, you can add a contact and then search for the injection. The packet

An SQL injection exists at a specific place (it can span 5 databases and contain the Administrator table) An SQL injection exists at a specific place (it can span 5 databases and contain the Administrator table)Detailed description: Objective: To

Mysql injection point remote Trojan (no web physical path/non-root permission) When there are injection points in the Application Scenario, but the physical path cannot be exposed, this method can be used to obtain server permissions if the file

Why is your API insecure? 0 × 00 background Some time ago, I reported to Spree Commerce about the JSONP + CSRF vulnerability in all its API paths. Similarly, the Instagram API has the CSRF vulnerability. The APIs of Disqus, Stripe, and Shopify leak