Cloud Security

XEpan Cross-Site Request Forgery Vulnerability (CVE-2014-8429) Release date:Updated on: Affected Systems:XEpan XEpanDescription:Bugtraq id: 71309CVE (CAN) ID: CVE-2014-8429 XEpan is an open source php cms. XEpan does not effectively authenticate

GNU glibc Arbitrary Command Execution Vulnerability (CVE-2014-7817) Release date:Updated on: Affected Systems:GNU glibcDescription:Bugtraq id: 71216CVE (CAN) ID: CVE-2014-7817 Glibc is the implementation of C libraries in most Linux operating

APP security analysis-taxi hailing Software Recently, I found that the APK of a taxi hailing software is very popular. I heard that they are providing very strict protection to prevent users from packing twice. Today, let's analyze how secure he is.

Huawei MT2 temperature control system design defects The Huawei MT2 mobile phone uses the [Generic Thermal sysfs driver] To monitor the temperature of the device. This driver provides a real-time monitoring function for the temperature of the device,

Multiple Linksys EA Series Router Information Leakage Vulnerability (CVE-2014-8244) Release date:Updated on: Affected Systems:Linksys EA Series router EA6900Linksys EA Series router EA6700Linksys EA Series router EA6500Linksys EA Series router EA6400

Privilege Escalation Vulnerability in Linux PolicyKit Release date:Updated on: Affected Systems:PolicyKitDescription:CVE (CAN) ID: CVE-2011-1485 Policykit is a framework for managing policies and permissions. PolicyKit (polkit) version 0.96 is

Arbitrary Code Execution Vulnerability in binutils (CVE-2014-8485) Release date:Updated on: Affected Systems:GNU Binutils 2.24GNU BinutilsDescription:Bugtraq id: 70741CVE (CAN) ID: CVE-2014-8485 GNU BinUtils is a binary tool set used to perform

Linux Kernel KVM DoS Vulnerability (CVE-2014-3645) Release date:Updated on: Affected Systems:Linux kernel 3.16.0Linux kernelDescription:Bugtraq id: 70746CVE (CAN) ID: CVE-2014-3645 Linux Kernel is the Kernel of the Linux operating system. Linux

The 12306 Old certificate issues can cause man-in-the-middle attacks (attach attack method) Simply put, "12306" allows users to download the root certificate over HTTP. This gives the man-in-the-middle an opportunity to replace the official

Production Environment CentOS Server System Security ConfigurationChapter 1 account security and permissions 1. Disable super users other than root 1. Check Method: Cat/etc/passwd: view the password file in the following format: Login_name: password:

The appearance of Duqu, the child of the earthquake net virus Stuxnet Stuxnet worm (zhennet, also known as the super factory virus) is the world's first destructive virus specially designed for industrial control systems, attackers can exploit

The old Zbot Trojan can easily bypass mailbox security detection after it is installed. Recently, the 360 security center intercepted a Zbot variant Trojan to steal personal information such as bank cards and email passwords from netizens. This

On Linux, how does one verify the authenticity and integrity of downloaded files? (1) After you download a file (such as an installer, ISO image, or compressed file) from the Internet, the file may be damaged due to various errors, for example, due

How to find the background without using tools A common problem I often encounter when I look at the discussion is that a website is directly scanned by tools instead of looking at it first, if the Administrator considers that the web security

The Hang Seng Electronics it o & M management platform is constructed and can be uploaded using SHELL.   There is nothing to do, and then you can search for it. Then I saw a piece of news from Hang Seng Electronics Co., Ltd., and I was so curious

Reading getshell from arbitrary system files   Attackers can read arbitrary files in the jcms system and directly obtain sensitive information such as administrator accounts, passwords, database passwords, and configurations, you can easily obtain

UWA-2X (v2.1.3) Foreground unrestricted getshell caused by a function defect   Vulnerability in cookie encryption function public static function encrypt($txt, $key = '') {$encrypt_key = md5(mt_rand(0, 32000));$ctr = 0;$tmp = '';for($i = 0; $i Why

Php webshell directly rebounded shell (without using any other language)In linux, sometimes obtaining the webshell requires Elevation of Privilege, And the Elevation of Privilege requires an interactive shell. I have read the commonly used php

TinyShop blind injection and storage xss at the same place Parameters are not filtered, resulting in SQL injection and backend storage xss at the same location.Let's take a look at how tinyshop handles the passed

Future of SSLStrip-HTTPS front-end hijacking (1) 0x00 Preface In the previous article on traffic hijacking, we mentioned a scheme of "HTTPS downgrading"-replacing all the HTTPS hyperlinks on the page with the HTTP Version, allows users to