owasp-cstg

OWASP 云安全测试指南 云安全测试指南（CSTG） 是一份全面、厂商中立的云环境安全测试手册。它面向渗透测试人员、云和平台工程师、安全架构师、检测工程师以及审计师——任何需要评估或防御运行在主流云提供商上的基础设施的人员。 云提供商发布和变更服务的速度比任何单一个团队能够追踪的速度都要快，而每一项新的托管服务都带来了其自身的身份模型、网络暴露面和滥用路径。传统的网络和应用测试方法论无法捕获这些提供商特定的风险：一个 S3 存储桶策略、一个权限过高的 IAM 角色、一个附加到虚拟机的托管标识、或者一个可写入的部署存储桶——这些都不是端口扫描或 Web 代理能够发现的结果。CSTG...

nextpnr

nextpnr -- 便携式FPGA布局布线工具 nextpnr 的目标是成为一个供应商中立、时序驱动、开源免费的FPGA布局布线工具。 目前nextpnr支持： 由Project IceStorm支持的Lattice iCE40器件 由Project Trellis支持的Lattice ECP5器件 由Project Oxide支持的Lattice Nexus器件 由Project Apicula支持的高云小蜜蜂和Aurora V器件 由Project Beyond支持的NanoXplore NG-Ultra器件 由Project Peppercorn支持的Cologne Chip...

BYOT-CPS: A Hybrid Cyber-Physical Systems Testbed for IoT Security Assessment and Platform Evaluation

Internet of Things IoT security research continues to face a methodological gap between scalable virtual experimentation and realistic device behaviour. While pure simulation and emulation platforms provide control, repeatability, and scale, they do not fully reproduce firmware-specific behaviour...

CVE-2024-42368

A vulnerability was found in OpenTelemetry, specifically in the github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension. This flaw impacts anyone using the bearertokenauth server authenticator. Malicious clients with network access to the collector may perform...

[SECURITY] Fedora 34 Update: trojita-0.7.0.1-0.13.20220117git266c757.fc34

Trojit=EF=BF=BD=EF=BF=BD is a IMAP e-mail client which: Enables you to access your mail anytime, anywhere. Does not slow you down. If we can improve the productivity of an e-mail user, we better do. Respects open standards and facilitates modern technologies. We value the vendor-neutrality that...

The 2021 Naughty and Nice Lists: Cybersecurity Edition

Editor’s note: We had planned to publish our Hacky Holidays blog series throughout December 2021 – but then Log4Shell happened, and we dropped everything to focus on this major vulnerability that impacted the entire cybersecurity community worldwide. Now that it’s 2022, we’re feeling in need of...

Full Disclosure List Rises From the Ashes For Fresh Start

When the Full Disclosure mailing list closed down last week, many in the security community wondered what, if anything, would fill the void. As it turns out, Full Disclosure will fill that void. John Cartwright, one of the creators of the list, announced on March 19 that he was shutting it down...

Critical: evolution security update

evolution-2.0.2-35.0.4.el46.1: 2.0.2-35.0.4.el4.1 - Add patch for RH bug 435797 format string vulnerability. evolution28-2.8.0-53.el46.2.0.1: 2.8.0-53.el46.2.0.1 - Comment evolution-2.8.0-red-hat-branding.patch to make evolution as vendor neutral 2.8.0-53.el46.2 - Fix hardcoded %dist tag for...