Cloud Security

Open source stepping stone Jumpserver I believe you are familiar with the bastion host. To ensure server security, we have added a bastion host. All ssh connections are completed through the bastion host, the bastion host also needs functions such

Note app any user data modification In the past two days, I have heard of tens of millions of users who are familiar with all kinds of pictures and movies in the app, and then I downloaded them. The problem lies in modifying personal data.  Modify

An APP with excessive permissions can modify the nickname of any user You can simply look at the popular APP fotoplace and find that there is an excessive permission.   The problem occurs when you modify the profile of any user.  POST

Reuse Vulnerability after the FFmpeg ff_h1__free_tables function is releasedReuse Vulnerability after the FFmpeg ff_h1__free_tables function is released Release date:Updated on:Affected Systems: FFmpeg Description: CVE (CAN) ID:

HP Capture and Route Software information leakage (CVE-2015-2115)HP Capture and Route Software information leakage (CVE-2015-2115) Release date:Updated on:Affected Systems: HP Capture and Route Software HP Capture and Route Software HP Capture and

Apache HTTP Server 'Protocol. c' Remote Denial of Service VulnerabilityApache HTTP Server 'Protocol. c' Remote Denial of Service Vulnerability Release date:Updated on:Affected Systems: Apache Group HTTP Server 2.4.12Apache Group HTTP Server

SSRF-issues ignored during design Sometimes there is a wall in front of you, blocking your path. At this time, we only need to open a door on the wall, but the door must be locked. Otherwise, a security vulnerability will occur. There are many

TCP connection EstablishmentIn order to establish a TCP connection, the computer needs to do the following for us: 1. the requester (usually called the customer) sends a SYN segment to indicate the server port to which the customer intends to

The age of being shot by others with no worries The hearts of the people ...... We can't remember when we were used to browsing the Web page carefully, so we were used to every kind of deception.Various traps The Internet has become a part of our

Dos classification for juniper Protection Detection Juniper DOS Classification I. Network dos 1. SYN Flood Use three-way handshakes for spoofing attacks A sends SYN fragments to B, B uses SYN/ACK fragments for response, and A uses ACK fragments for

Universal key products of Wi-Fi network security allow enterprises to break through the boundaries of users   In the previous article. it has always been emphasized. this software may only provide temporary convenience. the hidden danger is

Docker malware Analysis Series IV: javascript anti-obfuscation Analysis  0x00 Introduction This chapter mainly introduces the Javascript anti-obfuscation technology, which is very important for analyzing webpage Trojans, exploiting client

A linux system poisoning record On the company's linux server, we found that the cpu load was too high. Use top to see the abnormal process: ijcfwyjoqkThe parent process is init run: ps-l 10854 display cmd column as uptime run: whereis ijcfwyjoqk

Quantum encryption of light speed operation Imagine the following three scenarios: Hospitals send MRI results directly to your mobile phone without worrying about your personal health data leakage; learn that your financial information is safe to

Django framework Arbitrary File Inclusion VulnerabilityOn July 6, April 21, the python-based open-source web framework Django released a Security Bulletin, saying that the contrib. markup package in MySQL 1.5 or earlier has the Arbitrary File

A service of Pipi network is improperly configured (as a result, the client can be replaced to update files and implant backdoors) A service of Pipi network is improperly configured (as a result, the client can be replaced to update files and

Security risks caused by PHP featuresPHP scripts are weak types of scripts, which refer to a number of standards for string processing, such as IEEE 754. However, design and implementation may lead to security risks.Type conversion risks in case 1

U-Mail system second injection (no problem, you can directly obtain the administrator password) U-Mail don't cry. In addition, the wooyun-2010-093049 update does not need to log on and can be batch getshell exp, casually tested, batch easily get

For example, you can directly place an order to purchase a product for a website of 0 RMB. LAX Verification Http://youxuan.homeinns.com/this domain name through the mobile phone access, and then choose the product, order, packet capture to change

Murder Case 2 caused by Guangdong building Vulnerability (getshell information leakage of hundreds of users nationwide) You can upload any file in the background using getshell. Add a link to upload the problem file and upload a sentence directly.