CVE Vulnerabilities - Defense.One

CVE Vulnerabilities

sy64

https://www.mitiga.io/blog/tactical-guide-to-threat-hunting-in-snowflake-environments

Snowflake 是一个基于云的数据仓库服务，旨在提供高性能、弹性和易用的数据管理和分析解决方案。它由 Snowflake Inc. 开发，并在各大云平台（如 AWS、Azure 和 Google Cloud）上运行。

https://www.hudsonrock.com/blog/snowflake-massive-breach-access-through-infostealer-infection

sy64

CVE-2024-20017

https://corp.mediatek.com/product-security-bulletin/March-2024

CVE CVE-2024-20017
Title Improper input validation in wlan service
Severity High
Vulnerability Type RCE
CWE CWE-20 Improper Input Validation
Description In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation
Affected Chipsets MT6890, MT7915, MT7916, MT7981, MT7986
Affected Software Versions SDK version 7.4.0.1 and before (for MT7915) / SDK version 7.6.7.0 and before (for MT7916, MT7981 and MT7986) / OpenWrt 19.07, 21.02

sy64

https://0xbigshaq.github.io/2024/05/24/njs-vr-bugs/

寻找 Nginx JavaScript 引擎 (njs) 中的漏洞

sy64

https://mantodeasecurity.de/en/2024/05/cve-2024-22058-ivanti-landesk-lpe/

sy64

https://clearbluejar.github.io/posts/patch-tuesday-diffing-cve-2024-20696-windows-libarchive-rce/

sy64

https://0xdf.gitlab.io/2024/06/01/htb-analysis.html

sy64

https://secsi.io/docker-security-playground/

sy64

Chaining N-days to Compromise All :

Part 6 — Windows Kernel LPE: Get SYSTEM : https://medium.com/@vr-blog/chaining-n-days-to-compromise-all-part-6-windows-kernel-lpe-get-system-83cd756ce90a

Part 4 — VMware Workstation Information leakage : https://blog.theori.io/chaining-n-days-to-compromise-all-part-4-vmware-workstation-information-leakage-44476b05d410

Part 5 — VMware Workstation Guest-to-Host Escape : https://blog.theori.io/chaining-n-days-to-compromise-all-part-5-vmware-workstation-host-to-guest-escape-5a1297e431b5

Part 3 — Windows Driver LPE: Medium to System : https://blog.theori.io/chaining-n-days-to-compromise-all-part-3-windows-driver-lpe-medium-to-system-12f7821d97bb

Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape) : https://blog.theori.io/chaining-n-days-to-compromise-all-part-2-windows-kernel-lpe-a-k-a-chrome-sandbox-escape-44cb49d7a4f8

Part 1 — Chrome Renderer RCE : https://blog.theori.io/chaining-n-days-to-compromise-all-part-1-chrome-renderer-rce-1afccf56721b

sy64

https://www.synacktiv.com/advisories/windows-10-plugscheduler-elevation-of-privilege

sy64

Recording of my Hexacon talk "Exploiting Hardened .NET Deserialization: New Exploitation Ideas and Abuse of Insecure Serialization" is available!

Talk: https://youtu.be/_CJmUh0_uOM?si=81Tot7HUgp7RQAlL
White paper: https://github.com/thezdi/presentations/blob/main/2023_Hexacon/whitepaper-net-deser.pdf

sy64

https://blog.plerion.com/things-you-wish-you-didnt-need-to-know-about-s3/

匿名 API 请求可以删除 S3 桶,而无需任何身份验证。
列出未完成的分块上传可以泄露上传者的 ARN,这可能被攻击者利用。
S3 ACL 可以根据电子邮件地址授予访问权限,这可能被用于枚举 AWS 账户。
上传者可以自行选择 S3 对象的存储类型,这可能会导致意外的成本。
S3 对象键区分大小写,这可能会导致应用程序出现意外行为。
即使 S3 桶被配置为不公开访问,也可能通过 CloudFront 或 Cognito 身份池使其公开。

sy64

https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle

sy64

我们很高兴与大家分享 TyphoonCon 2024 的幻灯片和 v8ctf 的漏洞利用代码。我们希望这对那些研究浏览器漏洞的人有所帮助🙂

https://github.com/kaist-hacking/CVE-2023-6702
https://kaist-hacking.github.io/pubs/2024/lee:v8-ctf-slides.pdf

sy64

Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218) : https://blog.theori.io/exploiting-windows-kernel-wild-copy-with-user-fault-handling-cve-2023-28218-89f5189d0926

Unveiling hidden paths - Unearthing vulnerabilities & exploiting modern windows kernel : https://youtube.com/watch?v=YTyrBnXKrcg

Ref :

Discovering and exploiting a kernel pool overflow on modern Windows 10 : https://synacktiv.com/sites/default/files/2021-10/2021_sthack_windows_lpe.pdf

sy64

https://github.com/yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD

通过LD_PRELOA绕过disable_functions（不需要/usr/sbin/sendmail）

sy64

https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/

sy64

https://github.com/es3n1n/no-defender

https://infosec.exchange/@wdormann/112519819907312803

sy64

https://www.outflank.nl/blog/2024/06/03/edr-internals-macos-linux/

sy64

https://github.com/tsale/EDR-Telemetry

这个页面是关于一个名为"EDR-Telemetry"的GitHub项目,主要目的是比较和评估各种端点检测和响应(EDR)产品的遥测功能。