Cloud Security

Eliminate virtual server security concerns Server Virtualization has many advantages. Solution providers are processing an increasing number of requests for server virtualization to transition customers to large-scale virtual server deployment,

Samba Log Analysis As the security level of file sharing increases, logs need to be recorded and audited in more and more cases. The configuration file of the Samba service in Linux is smb. conf. Many graphical configuration tools, such as Webmin,

"Blood cases" caused by the Ghost Vulnerability"0x00 background A security company recently discovered the glibc gethostbyname buffer overflow vulnerability, which is named as ghost because the Gethostbyname function of glibc caused a heap overflow

Binary vulnerability Mining0X00 preface: Binary vulnerability research can be divided into vulnerability analysis and exploitation and vulnerability mining. A large number of articles can be found on the Internet used for vulnerability analysis, but

FreeBSD VT_WAITACTIVE signature conversion Vulnerability (CVE-2014-0998) Release date:Updated on: Affected Systems:FreeBSD 10.1-RELEASEDescription:Bugtraq id: 72344CVE (CAN) ID: CVE-2014-0998 FreeBSD is a UNIX operating system. SCTP provides

WordPress CSPRNG Missing Security Vulnerability (CVE-2014-6412) Release date:Updated on: Affected Systems:WordPressDescription:Bugtraq id: 72589CVE (CAN) ID: CVE-2014-6412 WordPress is a blog platform developed in PHP. you can build your own

Rsync path Spoofing Vulnerability Release date:Updated on: Affected Systems:Samba rsync 3.1.1Description:CVE (CAN) ID: CVE-2014-9512 Rsync is a fast incremental file transfer tool used for internal backup on the same host. Rsync 3.1.1 has the

Apache WSS4J Security Restriction Bypass Vulnerability (CVE-2015-0227) Release date:Updated on: Affected Systems:Apache Group WSS4J Apache Group WSS4J Apache Group WSS4JDescription:Bugtraq id: 72557CVE (CAN) ID: CVE-2015-0227 WSS4J implements

Empty Word file attachment: A New Method to bypass spam filtering Security researchers recently discovered that spammers are using a new method to bypass the spam filter system-Empty Word documents.  Blank Word Document The documents in the

CentOS boot php-fpm self-start script # Set php-fpm as a service and enable Automatic startup upon startup # Note: I only tested CentOS7.0 and did not test reliability and

126 mailbox storage XSS can hijack others' accounts to access the recipient's mailbox First, the problem lies in the attachment Preview (currently, the mailbox body is filtered almost ), attachment preview: If you preview files of the doc docx type,

Sina Real Estate Forum one storage-type XSS Mainly share the journey of successfully inserting js PrefacePoc address, move the mouse to the sharing location, and blindly press the cookie in the login status with the md5

Mawaidi's website or injection of root permissions (with verification scripts) Http://cmccsh.wiwide.com/login login universal password login, SQL blind note Admin 'or 1 = 1 #Failed:  When correct:  The script runs to the result:User; root @

Pipi genie bypasses the background of an important website The official website of Pipi genie has design defects and can be bypassed. You can modify and publish any information. If attackers exploit this information, they can imagine that the

126/163 email body storage type XSS After chrome entered the 36 age, there was another method to introduce external HTML: On twitter, MK used this method to bypass chrome audit: audit.Netease mailbox shot.First prepare an external HTML:

Phpok csrf success getshell (2) Register an account at the front end, upload a zip file, and upgrade the csrf background (the file is uploaded as a zip file). getshell is successful.The Update file is not verified. Version: 4.2.100The front-end can

No restrictions on getshell at the front end of the latest version of Feifei Film No restrictions on getshell v2.9 Any file contains:Demo site test:  Code Analysis: myaction. class. php display('my_'.trim($id));echo $id;echo '11111111111111111111111

The latest version 1.3.145 of Alibaba Cloud locks can be Bypass. Three bypass protection packages \ X00: Apart from post protection, get \ cookie can be bypassed. In addition, X-Forward-For injection statements in header are completely unprotected.

07073 game network root injection: 5 k tables on all websites. Hundreds of databases can be written to shell 3. Site: tieba.07073.com Boolean insert blind sqliPOCTrue: POST /home/addmainwet/ HTTP/1.1Host: tieba.07073.comUser-Agent: Mozilla/5.0

The Qianlong network sub-station has SQL injection to getshell. Sub-station http://mi.qianlong.com/, with sqlinjection in place, permission allocation is not appropriate, and the network site configuration is not necessarily an explosion path Is