每日安全动态推送(12-11)
2023-12-11 11:2:29 Author: mp.weixin.qq.com(查看原文) 阅读量:2 收藏

Tencent Security Xuanwu Lab Daily News

• Hijackable Go Module Repositories:
https://vulncheck.com/blog/go-repojacking

   ・ Go模块存储库容易受到repojacking攻击,文章对此进行了详细分析并披露了新的漏洞信息。 – SecTodayBot

• Attacking an EDR - Part 1:
https://riccardoancarani.github.io/2023-08-03-attacking-an-edr-part-1/

   ・ 本文讨论了现代EDR产品中常见的缺陷,并详细介绍了针对顶级EDR产品的特定攻击。通过黑盒分析方法,介绍了发现EDR产品漏洞的假设和方法。  – SecTodayBot

• P4wnP1 LTE updates:
https://sensepost.com/blog/2023/p4wnp1-lte-updates/

   ・ 在LTE调制解调器上运行P4wnP1进行USB攻击的过程,解决了LTE连接和SSH的问题,并通过MTU调整来解决问题。 – SecTodayBot

• index.md:
https://gist.github.com/paj28/86c7b8f37371d89c9a36ed0280fcf450

   ・ 介绍了一种新型的Unicode XSS漏洞,利用了组合字符的变体,通过详细分析漏洞的根本原因以及相应的利用方法 – SecTodayBot

• Achieving Remote Code Execution in Steam: a journey into the Remote Play protocol:
https://blog.thalium.re/posts/achieving-remote-code-execution-in-steam-remote-play/

   ・ 针对Steam远程播放协议的逆向工程和漏洞发现过程,尤其是涉及到远程代码执行漏洞的发现。 – SecTodayBot

• It's not a Feature, It's a Vulnerability:
https://blog.solidsnail.com/posts/vscode-shell-integ-rce

   ・ 揭示了VSCode的shell集成功能存在的新漏洞,以及如何利用该漏洞进行攻击。同时介绍了漏洞的详细分析和利用代码 – SecTodayBot

• Issues with the implementation · Issue #12 · Dongdongshe/neuzz:
https://github.com/Dongdongshe/neuzz/issues/12

   ・ 介绍了Neuzz fuzzer存在的漏洞,并对漏洞的根本原因进行了详细分析。 – SecTodayBot

• Tricks for Reliable Split-Second DNS Rebinding in Chrome and Safari:
https://www.intruder.io/research/split-second-dns-rebinding-in-chrome-and-safari

   ・ 介绍了在Chrome、Edge和Safari中实现可靠的DNS重绑定的新技术,并讨论了绕过本地网络限制的技术。通过分析慢缓存的根本原因,提出了新的解决技术。文章披露了利用DNS重绑定在Chrome、Edge和Safari中实现瞬时DNS重绑定的攻击技术。 – SecTodayBot

• Cueing up a calculator: an introduction to exploit development on Linux:
https://github.blog/2023-12-06-cueing-up-a-calculator-an-introduction-to-exploit-development-on-linux/

   ・ 介绍了如何利用CVE-2023-43641漏洞进行利用开发,包括了对漏洞的详细分析、利用开发的实例以及绕过安全防护的讨论。文章重点讨论了利用漏洞的过程和技术 – SecTodayBot

* 查看或搜索历史推送内容请访问:
https://sec.today

* 新浪微博账号:腾讯玄武实验室
https://weibo.com/xuanwulab


文章来源: https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651959456&idx=1&sn=9cc3abbf00cc5df279ab8f0fa5d5389e&chksm=8baed03fbcd9592900192f6d3e4c42cffe35c00dee07ab4a9b5bd85890145283f3656ab50edf&scene=58&subscene=0#rd
如有侵权请联系:admin#unsafe.sh