DNS rebinding allows attackers to take advantage of web-based consoles to exploit internal networks by abusing the domain name system.

root@PandorasBox:~#

npmにも影響を与える node-tarの脆弱性(CVE-2021-32804)について解説します。

回顾Android内核漏洞史可以发现，大部分Android内核漏洞属于内存漏洞，而逻辑漏洞相对少见。由于内存漏洞具有典型的漏洞模式、明显的副作用以及较完善的检测方法，因此这类漏洞较容易发现。对应地，逻辑漏洞没有典型的漏洞模式（往往与功能紧密相关）、不确定的副作用以及缺乏普适的检测方法，因此，挖掘这类漏洞相对困难。正因为如此，逻辑漏洞有它独特的魅力。

Contribute to httpvoid/writeups development by creating an account on GitHub.

packet captures of real-world ddos attacks. Contribute to StopDDoS/packet-captures development by creating an account on GitHub.

Publico la herramienta con la que he realizado el análisis de los ataques recibidos por ssh, de tal forma que cualquiera puede revisarlos

Usually we don't do blog posts about CTF challenges but we recently stumbled across a challenge that was a good opportunity to talk about several macOS/iOS internals, security mechanisms and exploit m

JFrog Security research teams are constantly looking for new and previously unknown vulnerabilities in popular open-source projects to help improve their security posture. As part of this effort, we recently discovered a potentially critical vulnerability…

JFrog Security research teams are constantly looking for new and previously unknown vulnerabilities in popular open-source projects to help improve their security posture. As part of this effort, we recently discovered a potentially critical vulnerability…

tl;dr A pull request for Nuclei template of CVE-2021–26084 turned out to be a leak of our Pre-Auth RCE exploit payload for Atlassian…

Automated malware analysis tools, such as analysis sandboxes, save time and help with triage during incident response and forensic investigations. They provide an overview of the specimen's capa

Lilith >_> of Cisco Talos discovered this vulnerability.

Cisco Talos recently discovered an exploitable heap-based buffer overflow vulnerability in Ribbonsoft’s dxflib library that could lead to code execution.

The dxflib library is a C++ library utilized…

Paving the way for 0days Dedicated to: Zix , who spent precious-time guiding me within the last two-months . Mohammed , Jalil , Zakariae ...

Fuzzing or Fuzz Testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program then observe how the program processes it. In one of our recent projects, we were interested…

Hey, Today I will showcase how I found a file upload vulnerability which I bypassed and popped a reverse shell .

RCE 0-day for GhostScript 9.50 - Payload generator - duc-nt/RCE-0-day-for-GhostScript-9.50

Proof-of-concept exploit code was published online over the weekend for an unpatched Ghostscript vulnerability that puts all servers that rely on the component at risk of attacks.