slsa

SLSA（"salsa"）是软件工件供应链级别（Supply-chain Levels for Software Artifacts） SLSA（发音 “ salsa ”）是一个从源头到服务的安全框架，为所有使用软件的人提供了一种通用语言，用于提高软件安全和供应链完整性的各个级别。它让你从足够安全到在链条的任何环节都尽可能具有弹性。 了解 SLSA 参见 https://slsa.dev 了解 SLSA。 这个仓库里有什么？ 该仓库的主要内容是 spec/ 目录，该目录包含核心 SLSA 规范，以及 www/ 目录，该目录包含 slsa.dev 网站的源文件。在该目录的 README.m...

CVE-2020-0981

A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker who successfully exploited the vulnerability could allow an application with a certain integrity level to execute code at a different integrity level, leading to a sandbox escape.T...

CVE-2020-0875

An information disclosure vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system low-integrity to medium-integrity. This vulnerability by itself does not allow...

CVE-2020-0790

A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity. This vulnerability by itself does not allow arbitrary code...

Microsoft Windows 10 - Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111)

Source: https://code.google.com/p/google-security-research/issues/detail?id=486 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Platform: Windows 10 build 10240, earlier versions do not have the functionality Class: Security Feature Bypass Summary: A mitigation added to Windows ...

MicEnum - Mandatory Integrity Control Enumerator for Windows

In the context of the Microsoft Windows family of operating systems, Mandatory Integrity Control MIC is a core security feature introduced in Windows Vista and implemented in subsequent lines of Windows operating systems. It adds Integrity LevelsIL-based isolation to running processes and objects...

CVE-2015-2417

CVE-2015-2417 describes an OLE-based elevation-of-privilege vulnerability in multiple Windows platforms (Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012 Gold/R2, Windows RT Gold/8.1). The root cause is an input validation flaw in OLE t...

UBUNTU-CVE-2015-3101

The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143...