Sys-Adm.in - Сайт для сисадминов и не только. Здесь собраны различные материалы основанные на личной практике. Блог Евгения Гончарова.

Capcom Co., Ltd. (Capcom) has previously issued statements from November 4, 2020 through January 12, 2021 (

Learn more about GitLab Critical Security Release: 13.10.3, 13.9.6, and 13.8.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

In this article we will have a look at how a simple phishing attack through an Android messaging application could result in the direct leakage of data found in unprotected device storage (/sdcard). Then we will show how the two aforementioned WhatsApp vulnerabilities made it possible for attackers to remotely collect TLS cryptographic material for TLS 1.3 and TLS 1.2 sessions. With the TLS secrets at hand, we will demonstrate how a man-in-the-middle attack can lead to the compromise of WhatsApp communications, to remote code execution on the victim device and to the extraction of Noise [05] protocol keys, used for end-to-end encryption in user communications.

Release updates from the Chrome team

0x01-概述2021年4月13日，安全研究人员Rajvardhan Agarwal在推特公布了本周第一个远程代码执行（RCE）的0Day漏洞，该漏洞可在当前版本（89.0.4389.114）的谷歌Chrome浏览器上成功触发。Agarwal公布的漏洞，是基于Chromium内核的浏览器中V8 JavaScript引擎的远程代码执行漏洞，同时还发布了该漏洞的PoC。 2021年4月14日，360高级攻防实验室安全研究员frust公布了本周第二个Chromium 0day(Issue 1195777)以及Chrome 89.0.4389.114的poc视频验证。该漏洞会影响当前最新版本的Google Chrome 90.0.4430.72，以及Microsoft Edge和其他可能基于Chromium的浏览器。 Chrome浏览器沙盒可以拦截该漏洞。但如果该漏洞与其他漏洞进行组合，就有可能绕过Chrome沙盒。 0x02-漏洞PoC目前四个漏洞issue 1126249、issue 1150649、issue 1196683、issue 1195777的exp均使用同一绕过缓解措施手法（截至文章发布，后两个issue尚未公开），具体细节可参考文章。 基本思路是创建一个数组，然后调用shift函数构造length为-1的数组，从而实现相对任意地址读写。

Google’s new page experience measurements are going to be included in their search ranking in May 2021. Learn more about how to improve your page experience with AMP and Cloudflare Workers.

The National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) jointly released a Cybersecurity Advisory, “Russian SVR

In December 2020, the COVID-19 cold chain was targeted by cyber adversaries. IBM Security X-Force discovered another 50 files tied to spear-phishing emails.

CVE-2021-20291 leads to a denial of service of the container engines CRI-O and Podman when pulling a malicious image from a registry.

As of 1.9.0, GitHub Actions is available in your terminal. Two new top-level commands, `gh run` and `gh workflow`, provide insight into workflow runs.

Insecure URL handling leading to 1-click code execution vulnerabilities in Telegram, Nextcloud (CVE-2021-22879), VLC, LibreOffice (CVE-2021-25631), OpenOffice (CVE-2021-30245), Bitcoin/Dogecoin Wallets, Wireshark (CVE-2021-22191) and Mumble (CVE-2021-27229).

A Central Control Plane for AWS Permissions and Access - Netflix/consoleme

Do you need to centrally manage Linux systems and user accounts under an Active Directory domain? Here's how to do it.

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.