Cloud Security

Apache Ranger Security Restriction Bypass Vulnerability (CVE-2016-0735)Apache Ranger Security Restriction Bypass Vulnerability (CVE-2016-0735) Release date:Updated on:Affected Systems: Apache Group Ranger 0.5.x Description: CVE (CAN) ID: CVE-2

Code Analysis of browser Lexer and XSS-HTML 0 × 00 Introduction 0 × 01 decoding process overview 0 × 02 lexical analysis in browsers 0 × 03 HTML encoding and HTML Parsing 0 × 04 common mistakes 0 × 05 interesting Fault Tolerance behavior of

Apple iOS Profiles Spoofing Vulnerability (CVE-2016-1766)Apple iOS Profiles Spoofing Vulnerability (CVE-2016-1766) Release date:Updated on:Affected Systems: Apple iOS Description: CVE (CAN) ID: CVE-2016-1766IOS is an operating system

Foxit PhantomPDF after The ListBox value is released, the remote code execution vulnerability is reused.Foxit PhantomPDF after The ListBox value is released, the remote code execution vulnerability is reused. Release date:Updated on:Affected

UXSS vulnerability caused by logical defects in Android and QQ browsersI. Vulnerability description The X5 kernel of the QQ browser used by both the Android platform and the QQ browser has a logic defect in ip address processing and domain name

Analysis on the trojan evolution Report of "Dancing moth"I. Overview Recently, the 360 mobile security team detected that a cloud Control Trojan was exploding. The trojan family was first captured by February 2015 mobile security teams in 360, and

PowerPoint custom operations to trigger malicious Payload instead of macros When analyzing recent phishing attacks, we found that attackers started to use PowerPoint custom operations to trigger malicious Payload instead of macros. Although the use

OpenSSL DROWN death Vulnerability Detection and repair methods I. Vulnerability Description: popular servers and clients use TLS encryption. SSL and TLS protocols ensure that users surf the Internet, shop, and instant messaging without being read by

Design defects/brute-force cracking + large-scale credential stuffing The problem is found at personal center> basic Settings> modify email address:Packet Capture analysis:The normal business logic here should be to verify the current user's

Pseudo-static SQL injection (with verification script) exists in a station in flush) Pseudo-static SQL injection at a site in huashun The injection point is http://data.10jqka.com.cn/ifyyb/yybstockxt/code/600811/date/1?input parameter. The asterisk

163 leakage of the online storage service mailbox can cause any User Password Reset Vulnerability RT: I forced the vendor to write a mistake yesterday. Face it. Due to some negligence, all emails sent to the 163 Network Disk are disclosed, which can

Analysis of a security implementation method of IAT Hooking0 × 01 Introduction The Hook import table (IAT hooking) is a well-documented technique used to intercept imported function calls. However, many methods depend on some suspicious API

A vulnerability in shundian online store may leak a large number of member and order information (various payment keys) In November 12, 2014, Shenzhen shundian Chain Co., Ltd. was successfully listed on the New Three board, known as "Chinese Nasdaq.

Improper command execution vulnerability repair and bypass on a Baidu website A command execution vulnerability on a Baidu site, which can be used to fix improper Bypass #1 vulnerability referenceWooYun: Execute the st2 command on a Baidu site

The weak password Getshell exists in multiple core systems of Min 'an Property Insurance Co., Ltd. 1. Core Business System of Min 'an Property Insurance Co., Ltd.Http: // 218.17.200.230: 9004/casserver/login? Service = http % 3A % 2F % 2F218. 17.200

Analysis of security problems caused by releasing files to temporary folders Recently, McAfee's advanced Vulnerability Detection System (AEDS) has detected some interesting RTF files that execute "additional" content in the document. In general,

Magento The magento XSS vulnerability is not introduced. Baidu is everywhere. Here, we will simply record the processing process (relatively crude, whether it is valid or not, not verified) Edit App/design/adminhtml/default/template/sales/order/

Multiple SQL injection vulnerabilities on ruiming medical master site cause Sensitive Information Leakage RT Chengdu ruiming Medical Information Technology Co., Ltd. is a high-tech enterprise dedicated to researching, developing, producing and

Seven response analysis methods in WEB Fuzz WEB application fuzzy testing (WEB Fuzz) is a special form of network protocol fuzzy testing, which focuses on network data packets that follow HTTP specifications.WEB Fuzz is not a new concept. At present,

How to handle ntp server exceptions Preface: First, what is a reflection amplification attack? NTP is transmitted over UDP, so the source address can be forged.There is a type of query command in the NTP protocol. A short command can be used to send