106 matches found
jarm
JARM 请阅读最初的 JARM 博客文章 了解更多信息。 JARM 是一个主动的传输层安全（TLS）服务器指纹识别工具。 JARM 指纹可用于： 快速验证一组服务器是否具有相同的 TLS 配置。 按配置对互联网上不同的服务器进行分组，例如识别出某个服务器属于 Google、Salesforce 还是 Apple。 识别默认应用程序或基础设施。 识别互联网上的恶意软件命令与控制基础设施及其他恶意服务器。 JARM 支持已被或正在被添加到： SecurityTrails Shodan BinaryEdge RiskIQ Palo Alto Networks Censys 360 运行 JA...
fixing-google-secops-detections
Google SecOps Chronicle Curated Detections: Flaw Analysis & Tuning This repository documents architectural design flaws, logic discrepancies, and tuning strategies for native Google SecOps Chronicle Curated Detections. While Google Threat Intelligence GTIG provides exceptional conceptual threat...
Python Library sqlparse < 0.6.0 Multiple Vulnerabilities
The version of the sqlparse Python library installed on the remote host is prior to 0.6.0. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists in sqlparse due to the regular expressions used by the lexer to match dollar-quoted strings and multiline...
GHSA-PWGV-4X5Q-6M9F sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Summary sqlparse ships hard limits MAXGROUPINGDEPTH=100, MAXGROUPINGTOKENS=10000 intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself Ondepth per token-group construction. A 1-2 KB SQL payload e.g. SELECT 1 ... with 500-2000 nesting levels, or ...
CVE-2026-71491
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...
CVE-2026-23513 FOSSBilling: Broken Authorization in Client Transaction and Order Listings
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. Details In ServiceTransaction::getSearchQuery and...
[SECURITY] Fedora 43 Update: alertmanager-0.33.0-1.fc43
The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It a lso takes care of silencing and inhibition of alerts...
[SECURITY] Fedora 43 Update: perl-Config-IniFiles-3.001000-1.fc43
Config::IniFiles provides a way to have readable configuration files outside your Perl script. Configurations can be imported inherited, stacked,..., sections can be grouped, and settings can be accessed from a tied hash...
JLSEC-2026-579
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data...
signal-echo-radar
Signal Echo Radar Signal Echo Radar is a static cybersecurity...
curl: Argument Injection via curl Short-Flag Grouping
This report details how the curl -os command facilitates an Argument Injection vulnerability in applications that wrap the curl command-line tool. The specific command curl -os /etc/passwd --url http://example.com demonstrates a subtle but dangerous behavior. Because -s silent follows -o output,...
[SECURITY] Fedora 43 Update: chunkah-0.3.2-1.fc43
chunkah is an OCI building tool that takes a flat rootfs and outputs a layered OCI image with content-based layers. It optimizes container image layer reuse by grouping files based on their content e.g., by RPM package rather than by Dockerfile instruction order. It is a generalized successor to...
[SECURITY] Fedora 43 Update: alertmanager-0.31.1-2.fc43
The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It a lso takes care of silencing and inhibition of alerts...
[SECURITY] Fedora 42 Update: alertmanager-0.31.1-2.fc42
The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It a lso takes care of silencing and inhibition of alerts...
CVE-2026-2673 OpenSSL TLS 1.3 server may choose unexpected key agreement group
Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is...
Firefox Will Give Users an AI Kill Switch for Better Privacy
Not everyone wants AI in their browser. Firefox 148 is introducing easy toggles to disable chatbots and AI tab grouping. Discover how Mozilla is prioritising user choice and privacy in its latest 2026 update...
AlertBERT: A Noise-Robust Alert Grouping Framework for Simultaneous Cyber Attacks
Automated detection of cyber attacks is a critical capability to counteract the growing volume and sophistication of cyber attacks. However, the high numbers of security alerts issued by intrusion detection systems lead to alert fatigue among analysts working in security operations centres SOC,...
Firefox is giving users the AI off switch
Some software providers have decided to lead by example and offer users a choice about the Artificial Intelligence AI features built into their products. The latest example is Mozilla, which now offers users a one-click option to disable generative AI features in the Firefox browser. Audiences ar...
Mozilla Adds One-Click Option to Disable Generative AI Features in Firefox
Mozilla on Monday announced a new controls section in its Firefox desktop browser settings that allows users to completely turn off generative artificial intelligence GenAI features. "It provides a single place to block current and future generative AI features in Firefox," Ajit Varma, head of...