[B! security] yujioramaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

yujiorama id:yujiorama

securityã«é–¢ã™ã‚‹yujioramaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (187)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ç¤¾å†…ç”¨GitHub Actionsã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã‚’å…¬é–‹ã—ã¾ã™ | ãƒ¡ãƒ«ã‚«ãƒªã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°
ã“ã®è¨˜äº‹ã¯ã€Merpay Tech Openness Month 2023 ã®4æ—¥ç›®ã®è¨˜äº‹ã§ã™ã€‚ ã“ã‚“ã«ã¡ã¯ã€‚ãƒ¡ãƒ«ã‚³ã‚¤ãƒ³ã®ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®@goroã§ã™ã€‚ ã¯ã˜ã‚ã« ã“ã®GitHub Actionsã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã¯ã€ç¤¾å†…ã§Github Actionsã®åˆ©ç”¨ã«å…ˆé§†ã‘ã€ç¤¾å†…æœ‰å¿—ã«ã‚ˆã£ã¦æ¤œè¨Žã•ã‚Œã¾ã—ãŸã€‚ã€ŒGitHub Actionsã‚’ä½¿ã†ã«ã‚ãŸã‚Šã©ã†ã„ã£ãŸç‚¹ã«ç•™æ„ã™ã‚Œã°æœ€ä½Žé™ã®å®‰å…¨æ€§ã‚’ç¢ºä¿ã§ãã‚‹ã‹å¦ç¿’ã—ã¦ã‚‚ã‚‰ã„ãŸã„ã€ã€Œå®šæœŸçš„ã«æœ¬ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã‚’è¦‹è¿”ã—ã¦ã‚‚ã‚‰ã„è‡ªåˆ†ãŸã¡ã®ãƒªãƒã‚¸ãƒˆãƒªãƒ¼ãŒå®‰å…¨ãªçŠ¶æ…‹ã«ãªã£ã¦ã„ã‚‹ã‹ç‚¹æ¤œã™ã‚‹éš›ã«å½¹ç«‹ã¦ã¦ã‚‚ã‚‰ã„ãŸã„ã€ã¨ã„ã†æ€ã„ã«åŸºã¥ã„ã¦ä½œæˆã•ã‚Œã¦ã„ã¾ã™ã€‚ ä»Šå›žã¯ãã‚“ãªã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã®ä¸€éƒ¨ã‚’ã€ç¤¾å¤–ã®æ–¹ã€…ã«ã‚‚å½¹ç«‹ã¤ã¨æ€ã„å…¬é–‹ã™ã‚‹ã“ã¨ã«ã—ã¾ã—ãŸã€‚ ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã«ãŠã‘ã‚‹ç›®æ¨™ ã“ã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã¯äº‹å‰ã«2æ®µéšŽã®ç›®æ¨™ã‚’è¨å®šã—ã¦ä½œæˆã•ã‚Œã¦ã„ã¾ã™ã€‚ã¾ãšç¬¬1ã«ã€Œå¸¸ã«é”æˆã—ãŸã„ã“ã¨
yujiorama 2023/06/10
github

security
ãƒªãƒ³ã‚¯
Git security vulnerabilities announced
AI & MLLearn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry. Generative AILearn how to build with generative AI. GitHub CopilotChange how you work with GitHub Copilot. LLMsEverything developers need to know about LLMs. Machine learningMachine learning tips, tricks, and best practices. How AI code generation worksExplore the capabilities and be
yujiorama 2023/02/15
security
ãƒªãƒ³ã‚¯
æ´»å‹•æˆæžœï½œISOG-Jï¼šã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾å¿œçµ„ç¹”ã®æ•™ç§‘æ›¸ ç¬¬3.1ç‰ˆ
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾å¿œçµ„ç¹”ã®æ•™ç§‘æ›¸ ç¬¬3.1ç‰ˆ (2023å¹´10æœˆ) 2023å¹´10æœˆ18æ—¥ã«ç¬¬3.1ç‰ˆã®PDFã®ãƒ†ã‚ã‚¹ãƒˆã‚„ç”»åƒã®ã‚³ãƒ”ãƒ¼ã‚’ã§ãã‚‹ã‚ˆã†ã«ä¿®æ£ã—ã¦å†é…å¸ƒã—ã¾ã—ãŸã€‚ãŠæ‰‹æ•°ã§ã™ãŒå¿…è¦ãªæ–¹ã¯å†ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã‚’ãŠé¡˜ã„ã—ã¾ã™ã€‚ 2023å¹´10æœˆã«ã€ã€Œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾å¿œçµ„ç¹”ã®æ•™ç§‘æ›¸ ç¬¬3.1ç‰ˆã€ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ä»˜éŒ²ã¨ãªã‚‹ã€Œã‚µãƒ¼ãƒ“ã‚¹ãƒãƒ¼ãƒˆãƒ•ã‚©ãƒªã‚ªã‚·ãƒ¼ãƒˆã€ã‚‚å…¬é–‹ã—ã¾ã—ãŸã€‚ãœã²ã”æ´»ç”¨ãã ã•ã„ã€‚ ã€WG6ã€‘ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚ªãƒšãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³é€£æºWGã«ãŠã„ã¦ã€ã€Œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾å¿œçµ„ç¹”ã®æ•™ç§‘æ›¸ ç¬¬2.1ç‰ˆã€ã®æ”¹ç‰ˆã«å‘ã‘ã¦è°è«–ã‚’ç¶šã‘ã¦ãã¾ã—ãŸã€‚2021å¹´10æœˆã«å…¬é–‹ã•ã‚ŒãŸITU-Tå‹§å‘ŠX.1060ã€X.1060ã®æ—¥æœ¬èªžç‰ˆã®æ¨™æº–ã¨ãªã‚‹TTCæ¨™æº–JT-X1060ã«åˆã‚ã›ãŸå½¢ã§ã®å…¨é¢çš„ãªæ”¹ç‰ˆã¨ãªã‚Šã¾ã™ã€‚ ç¬¬3.1ç‰ˆ åŸ·ç†é–¢ä¿‚è€…(ç¤¾åäº”åéŸ³é †) é‡Žå°» æ³°å¼˜ NECã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã‚¤ãƒŽãƒ™ãƒ¼ã‚¿æ ªå¼ä¼šç¤¾ æ—©å· æ•¦å² NECã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³
yujiorama 2023/02/13
security
ãƒªãƒ³ã‚¯
Mobile-OTP: Strong Two-Factor Authentication with Mobile Phones
strong, two-factor authentication with mobile phones Standard phone and BlackBerry (J2ME) iPhone Google Android Windows Phone 7 PalmOS webOS Maemo Openmoko Universal Web App Windows Linux MacOS last update of this site: April 17th, 2024 News (2024-04-17): Tingfeng ported Mobile-OTP to Dart (see Links) (2024-01-03): Adrian published a GUI for Moblie-OTP in Python on Github (see Links) (2022-10-01):
yujiorama 2023/02/04
J

security
ãƒªãƒ³ã‚¯
ImageMagick: The hidden vulnerability behind your online images
By Bryan Gonzalez from Ocelot Team Introduction ImageMagick is a free and open-source software suite for displaying, converting, and editing image files. It can read and write over 200 image file formats and, therefore, is very common to find it in websites worldwide since there is always a need to process pictures for usersâ€™ profiles, catalogs, etc. In a recent APT Simulation engagement, the Ocel
yujiorama 2023/02/04
security
ãƒªãƒ³ã‚¯
IIJ SmartKeyï½œã‚¹ãƒ©ã‚¤ãƒ‰èªè¨¼ãƒ»ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ç®¡ç†
IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ã‚ˆã‚‹èªè¨¼ã ã‘ã§ã¯ãªãã€IIJ SmartKeyã§èªè¨¼ã™ã‚‹ã“ã¨ã§ã€ä¸¡æ–¹ã®èªè¨¼ãŒæˆåŠŸã—ãŸå ´åˆã«ãƒã‚°ã‚¤ãƒ³ã§ãã¾ã™ã€‚ ä¸‡ãŒä¸€ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒæµå‡ºã—ã¦ã—ã¾ã£ã¦ã‚‚ã€ã‚ãªãŸã®ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚’æŒã£ã¦ã„ãªã„é™ã‚Šã€ç¬¬ä¸‰è€…ã¯ãƒã‚°ã‚¤ãƒ³ã™ã‚‹ã“ã¨ãŒã§ãã¾ã›ã‚“ã€‚ åˆ©ç”¨ã™ã‚‹Webã‚µã‚¤ãƒˆã”ã¨ã«ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒˆãƒ¼ã‚¯ãƒ³ã‚’æŒã¤å¿…è¦ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ã‚ãªãŸã®ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ãŒã™ã¹ã¦ã®Webã‚µã‚¤ãƒˆã®ãŸã£ãŸ1ã¤ã® â€œéµâ€ ã«ãªã‚Šã¾ã™ã€‚ ç¬¬ä¸‰è€…ãŒã‚ãªãŸã®ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚’æ“ä½œã—ã‚ˆã†ã¨ã—ã¦ã‚‚ã€Touch IDã‚„ãƒ‘ã‚¹ã‚³ãƒ¼ãƒ‰ã«ã‚ˆã‚‹ã‚¢ãƒ—ãƒªãƒãƒƒã‚¯ã‚’è¨å®šã—ã¦ãŠã‘ã°ã€IIJ SmartKeyã‚’èµ·å‹•ã§ãã¾ã›ã‚“ã€‚ æ„å›³ã—ãªã„èª¤æ“ä½œã‚„ä¸æ£æ“ä½œã‚’é˜²ãã€å®‰å¿ƒæ©Ÿèƒ½ã§ã™ã€‚ ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚’æ©Ÿç¨®å¤‰æ›´ã™ã‚‹ã¨ãã«ã€ã‚µãƒ¼ãƒ“ã‚¹ã®ç™»éŒ²ã‚’ã‚„ã‚ŠãªãŠã™ä½œæ¥ã¯é¢å€’ã§ã™ã€‚ IIJ SmartKeyãªã‚‰ã€è¨å®šã‚’QRã‚³ãƒ¼ãƒ‰ã§ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã§ãã‚‹ã®ã§ã€ãã‚Œã‚’æ–°æ©Ÿç¨®ã‹ã‚‰ã‚¹ã‚ãƒ£ãƒ³ã™ã‚‹
yujiorama 2023/01/09
security

otp
ãƒªãƒ³ã‚¯
FreeOTP
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
yujiorama 2023/01/09
RedHatãŒæ”¯æ´ã—ã¦ã‚‹ã®ã§æŽ¨ã—ã¦ã„ããŸã„

security

OTP
ãƒªãƒ³ã‚¯
è„†å¼±æ€§æƒ…å ±ã«èª¤è¨˜ãŒã‚ã‚‹ã¨ãå•ã„åˆã‚ã›ã‚‹ã¨ä¿®æ£ã—ã¦ã‚‚ã‚‰ãˆã‚‹ - hogashi.*
ç›®æ¬¡ ç›®æ¬¡ å®Ÿéš›ã®ä¾‹ NVD CVE ç•ªå¤–ç·¨: Security NEXT ã‚€ã™ã³ ã“ã‚“ã«ã¡ã¯ã€ id:hogashi ã§ã™ã€‚ ã¯ã¦ãª ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ Advent Calendar 2022 - Hatena Developer Blog ã® 30æ—¥ç›®ã®è¨˜äº‹ã§ã™ã€‚æ˜¨æ—¥ã¯ id:stefafafan ã•ã‚“ã® ã¯ã¦ãªã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨ã—ã¦æ—¥ã€…æ„è˜ã—ãªãŒã‚‰ã‚„ã£ã¦ã„ã‚‹ã“ã¨ã‚’ç´¹ä»‹ã—ã¾ã™ - stefafafan ã® fa ã¯3ã¤ã§ã™ ã§ã—ãŸã€‚å¹´ã®ç€¬MAXã§ã™ãã€‚ åƒ•ã¯æ¥å‹™ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼šã¨ã„ã†ã‚‚ã®ã«å‚åŠ ã—ã¦ã„ã¦ã€æ¯Žé€±ã®å®šä¾‹ã§è„†å¼±æ€§æƒ…å ±ã‚’çœºã‚ã¦ã„ã¾ã™ã€‚è„†å¼±æ€§æƒ…å ±ã€ç‰¹ã« CVE Record ãªã©ã«ã¯ãªã‚“ã¨ãªãæ£ç¢ºã•ã‚’æœŸå¾…ã—ã¾ã™ãŒã€äººé–“ãŒé‹ç”¨ã—ã¦ã„ã‚‹ä»¥ä¸ŠãƒŸã‚¹ã¯ã‚ã‚‹ã‚‚ã®ã§ã€ãŸã¾ã« typo ãªã©èª¤è¨˜ãŒã‚ã‚‹ã“ã¨ã‚‚ã‚ã‚Šã¾ã™ã€‚ ãã†ã„ã†ã‚‚ã®ã«æ°—ã¥ã„ãŸã¨ãã«ã¯ã€ä¿®æ£ã—ã¦ã‚‚ã‚‰ãˆã‚‹ã‚ˆã†å•ã„åˆã‚ã›ã¦ã¿ãŸã‚Šã—ã¦ã„ã¾ã™ã€‚ã‚ˆãè¦‹ã‚‹ã¨
yujiorama 2022/12/30
æ·±åˆ»åº¦ãŒcriticalã§ã‚‚ãã‚“ãªã“ã¨ã‚ã‚‹ã‚“ã

security
ãƒªãƒ³ã‚¯
CIã®ã‚·ãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆå¤‰æ•°ã«1Password CLIã‚’åˆ©ç”¨ã™ã‚‹ - 24/7 twenty-four seven
CIã§ã„ã‚ã„ã‚ãªã‚¿ã‚¹ã‚¯ã‚’è‡ªå‹•åŒ–ã—ã¦ã„ã‚‹ã¨ã€CIã§å¿…è¦ã¨ã™ã‚‹APIã®ãƒˆãƒ¼ã‚¯ãƒ³ã‚„ã‚¢ã‚«ã‚¦ãƒ³ãƒˆæƒ…å ±ãªã©è¨å®šã—ã¦ã„ã‚‹ã‚·ãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆå¤‰æ•°ãŒå¢—ãˆã¦ãã¾ã™ã€‚ ãŸã„ã¦ã„ã®å ´åˆã¯CIã‚µãƒ¼ãƒ“ã‚¹ã®ã‚·ãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆå¤‰æ•°ã‚’åˆ©ç”¨ã™ã‚Œã°ã‚ˆã„ã§ã™ãŒã€ã‚µãƒ¼ãƒ“ã‚¹ã«ã‚ˆã£ã¦ã¯ä¸€åº¦è¨å®šã—ãŸã‚·ãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆå¤‰æ•°ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ããªã‹ã£ãŸã‚Šï¼ˆGitHub Actionsã‚„Circle CIãŒè©²å½“ï¼‰ã€ãƒˆãƒ¼ã‚¯ãƒ³ã‚„ã‚¢ã‚«ã‚¦ãƒ³ãƒˆæƒ…å ±ã®æ›´æ–°ã‚„è¿½åŠ ãŒã‚ã£ãŸã¨ãã«CIã®å¤‰æ•°ã‚’æ›´æ–°ã—ã¦ã„ãã®ãŒå¤§å¤‰ã ã£ãŸã‚Šã€ã‚·ãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆå¤‰æ•°ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã¯ãã“ãã“é¢å€’ãªä½œæ¥ã§ã™ã€‚ æ€§è³ªä¸Šã‹ãªã‚Šå¼·ã„æ¨©é™ãŒè¨å®šã•ã‚Œã¦ã„ã‚‹ãƒˆãƒ¼ã‚¯ãƒ³ã ã£ãŸã‚Šã™ã‚‹ã“ã¨ã‚‚ã‚ã‚‹ã®ã§ã€èª°ãŒãã®å€¤ã‚’ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã§ãã‚‹ã‹ã€ã¨ã„ã†ç®¡ç†ã®å•é¡Œã‚‚ã‚ã‚Šã¾ã™ã€‚ ãã“ã§1Passwordã‚’ã‚¢ã‚«ã‚¦ãƒ³ãƒˆæƒ…å ±ã®å…±æœ‰ã«ä½¿ã£ã¦ã„ã‚‹çµ„ç¹”ãªã‚‰ã€1Passwordã¯CLIã®æ“ä½œãŒæä¾›ã•ã‚Œã¦ã„ã‚‹ã®ã§CIã‹ã‚‰1Passwordã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆæƒ…å ±ã‚’å–å¾—ã™ã‚‹
yujiorama 2022/12/28
ä¾¿åˆ©

security
ãƒªãƒ³ã‚¯
Scaling Libs security analysis with Differential Fuzzing
yujiorama 2022/11/06
perl

security
ãƒªãƒ³ã‚¯
CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows - OpenSSL Blog
Today we published an advisory about CVE-2022-3786 (â€œX.509 Em ail Address Variable Length Buffer Overflowâ€) and CVE-2022-3602 (â€œX.509 Em ail Address 4-byte Buffer Overflowâ€). Please read the advisory for specific details about these CVEs and how they might impact you. This blog post will address some common questions that we expect to be asked about these CVEs. Q: The 3.0.7 release was announced as
yujiorama 2022/11/02
security
ãƒªãƒ³ã‚¯
GitHubã®Issueã‚„Pull requestsã«ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã—ãŸç”»åƒã®å‰Šé™¤ - coincheck tech blog
ã¯ã˜ã‚ã« ã‚µã‚¤ãƒãƒ¼ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æŽ¨é€²éƒ¨ã®å‰ç”°ã§ã™ã€‚æ™®æ®µã¯ã€CSIRTãƒ¡ãƒ³ãƒãƒ¼ã¨ã—ã¦AWSç’°å¢ƒã‚„å„ç¨®ç«¯æœ«ã®ãƒ¢ãƒ‹ã‚¿ãƒªãƒ³ã‚°ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆå¯¾å¿œã€ç¤¾å†…ã‹ã‚‰ã®ã‚µã‚¤ãƒãƒ¼ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹ç›¸è«‡å¯¾å¿œãªã©ã®æ¥å‹™ã‚’è¡Œã£ã¦ã„ã¾ã™ã€‚ 2023/05/10 è¿½è¨˜ GitHubã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã«ã‚ˆã£ã¦ã€ãƒ—ãƒ©ã‚¤ãƒ™ãƒ¼ãƒˆãƒªãƒã‚¸ãƒˆãƒªã®Issueã‚„Pull Requestsã«æ–°ãŸã«ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚ŒãŸãƒ•ã‚¡ã‚¤ãƒ«ã¯ã€æ¨©é™ã‚’æŒãŸãªã„å¤–éƒ¨ã‹ã‚‰ã¯å‚ç…§ã§ããªããªã£ãŸã‚ˆã†ã§ã™ã€‚è©³ç´°ã«ã¤ãã¾ã—ã¦ã¯ã€ä»¥ä¸‹ã®GitHubã®ãƒ–ãƒã‚°ã‚’ã”ç¢ºèªãã ã•ã„ã€‚ https://github.blog/changelog/2023-05-09-more-secure-private-attachments/ æ¦‚è¦ GitHubã®Issueã‚„Pull requestsã«æ·»ä»˜ã—ãŸç”»åƒã¯Webã«ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚Œã€ãƒ‘ãƒ–ãƒªãƒƒã‚¯ãªURLãŒå‰²ã‚Šå½“ã¦ã‚‰ã‚Œã¾ã™ã€‚ã“ã®URLã¯
yujiorama 2022/10/22
éžãƒ†ã‚ã‚¹ãƒˆæƒ…å ±ã‚‚ã‚ã‚‹ã»ã†ãŒé–“é•ã„ãªãä¾¿åˆ©ãªã®ã§èªè¨¼èªå¯ã—ã¦æ¬²ã—ã„ã€‚GitHubãŒã‚„ã£ã¦ãªã„ã ã‘ãªã®ã§ã€‚

github

security
ãƒªãƒ³ã‚¯
ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼å¯¾å¿œã«ã¤ã„ã¦ï½žã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è¦³ç‚¹ã‹ã‚‰ï½ž ç¬¬4å›ž ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼æ¼ãˆã„æ™‚ã®æƒ³å®šè¢«å®³ã«ã¤ã„ã¦ | NTTãƒ‡ãƒ¼ã‚¿å…ˆç«¯æŠ€è¡“æ ªå¼ä¼šç¤¾
Tweet ç¬¬3å›žã§ã¯ã€ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼ã®è¨˜è¼‰å¸³ç¥¨ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®æ¦‚è¦ã‚’ãŠä¼ãˆã—ã¾ã—ãŸã€‚ ãã‚Œã§ã¯ã€ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼ãŒæ¼ãˆã„ã™ã‚‹ã¨ã€ã©ã®ã‚ˆã†ãªè¢«å®³ãŒè€ƒãˆã‚‰ã‚Œã‚‹ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿç¬¬4å›žã§ã¯ã€ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼æ¼ãˆã„æ™‚ã«æœ¬äººãŒã“ã†ã‚€ã‚‹æƒ³å®šè¢«å®³ã«ã¤ã„ã¦ã€ã”èª¬æ˜Žã—ã¾ã™ã€‚ 1. æµ·å¤–ã«ãŠã‘ã‚‹è¢«å®³ã®äº‹ä¾‹ã¯ï¼Ÿ ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼å…ˆé€²å›½ã®ç±³å›½ã‚„éŸ“å›½ã§ã¯ã€æ—¥æœ¬ã¨ç•°ãªã‚Šä¿è·è¦åˆ¶ãŒåŽ³ã—ããªãã€ãªã‚Šã™ã¾ã—ã«ã‚ˆã‚‹è¢«å®³ãŒç™ºç”Ÿã—ã¦ã„ã¾ã™ã€‚ ç±³å›½ã§ã¯ã€é€£é‚¦å–å¼•å§”å“¡ä¼šã«ã‚ˆã‚‹ã¨ã€ãªã‚Šã™ã¾ã—è¢«å®³ã¯2006å¹´ï½ž2008å¹´ã®3å¹´é–“ã§1,170ä¸‡äººã€æå®³é¡ãŒæ¯Žå¹´ç´„5å…†å††ã¨å ±å‘Šã•ã‚Œã¦ã„ã¾ã™ã€‚ ç¤¾ä¼šä¿éšœç•ªå·ã®ä¸æ£åˆ©ç”¨ã«ã‚ˆã‚Š å¹´é‡‘ãŠã‚ˆã³åŒ»ç™‚çµ¦ä»˜é‡‘ãªã©ã®ä¸æ£å—çµ¦ å¤±æ¥çµ¦ä»˜é‡‘ã®äºŒé‡å—çµ¦ ä»–äººã®ç¤¾ä¼šä¿éšœç•ªå·ã«ã‚ˆã‚‹éŠ€è¡Œå£åº§ã®é–‹è¨ ã¨ã„ã£ãŸè¢«å®³ãŒç™ºç”Ÿã—ã¦ã„ã¾ã™ã€‚ ã¾ãŸã€éŸ“å›½ã§ã¯ã€æ°‘é–“ã§ã®ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼åŽé›†ã®å¼Šå®³ã¨ã—ã¦ã€å¤§è¦æ¨¡ãªä½æ°‘ç™»éŒ²ç•ªå·ã®æ¼ãˆã„ã€ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰ã®ä¸æ£
yujiorama 2022/10/10
security

ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼
ãƒªãƒ³ã‚¯
Twilioã«ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã€Authyãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒä¾µå®³å—ã‘å½±éŸ¿å¤§ã®å¯èƒ½æ€§
8æœˆä¸Šæ—¬ã€ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ãƒ³ã‚°ã‚µãƒ¼ãƒ“ã‚¹ã®TwilioãŒã‚½ãƒ¼ã‚·ãƒ£ãƒ«ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°æ”»æ’ƒã‚’å—ã‘ã€æ·±åˆ»ãªãƒ‡ãƒ¼ã‚¿æ¼æ´©ã«è¦‹èˆžã‚ã‚Œã¦ã„ãŸã‚ˆã†ã ã€‚ã‚µã‚¤ãƒãƒ¼çŠ¯ç½ªè€…ãŒåŒç¤¾ã®å¾“æ¥å“¡ã«å¯¾ã—ã¦ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°æ”»æ’ƒã‚’è¡Œã„ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãƒ‡ãƒ¼ã‚¿ãŒä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã‚’å—ã‘ãŸã ã‘ã§ãªãã€æ”»æ’ƒãŒã‚ˆã‚Šåºƒç¯„å›²ã«åŠã‚“ã§ã„ãŸã“ã¨ãŒæ˜Žã‚‰ã‹ã¨ãªã£ãŸã€‚ Twilioã¯8æœˆ24æ—¥(ç±³å›½æ™‚é–“)ã€ã€ŒIncident Report: Employee and Customer Account Compromiseã€ã«ãŠã„ã¦ã€åŒç¤¾ã®äºŒè¦ç´ èªè¨¼(2FA: Two-Factor Authentication)ã‚¢ãƒ—ãƒªã§ã‚ã‚‹Authyã®ä¸€éƒ¨ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚¢ã‚«ã‚¦ãƒ³ãƒˆãŒæ”»æ’ƒè€…ã«ä¾µå®³ã•ã‚ŒãŸã¨ä¼ãˆãŸã€‚ä»Šå›žã®ä¾µå®³ã§å½±éŸ¿ã‚’å—ã‘ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯å°‘æ•°ã¨ã•ã‚Œã¦ã„ã‚‹ãŒã€ãã®å½±éŸ¿ã¯éžå¸¸ã«æ·±åˆ»ã§ã‚ã‚‹å¯èƒ½æ€§ãŒé«˜ã„ã€‚ Incident Report: Employee and Customer Account
yujiorama 2022/08/30
security
ãƒªãƒ³ã‚¯
Security Incident December 2022 Update - LastPass - The LastPass Blog
Please refer to the latest article for updated information. Update as of Thursday, December 22, 2022 To Our LastPass Community, We recently notified you that an unauthorized party gained access to a third-party cloud-based storage service, which LastPass uses to store archived backups of our production data. In keeping with our commitment to transparency, we want to provide you with an update rega
yujiorama 2022/08/26
web

security
ãƒªãƒ³ã‚¯
The Plausibly Deniable DataBase (PDDB): Itâ€™s Real Now! Â« bunnie's blog
yujiorama 2022/07/31
security

Xous
ãƒªãƒ³ã‚¯
npm security update: Attack campaign using stolen OAuth tokens
Securitynpm security update: Attack campaign using stolen OAuth tokensnpm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings. As of June 2, 2022, GitHub has completed directly notifying all impacted users for whom we were able to detect abuse from the attack on npm. If you have not received a notification directly from GitHub, we do not have evidence that yo
yujiorama 2022/05/29
security
ãƒªãƒ³ã‚¯
Account Takeover and Malicious Replacement of ctx Project â€” Python Security 0.0 documentation
SummaryÂ¶ The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.it ems() when instantiating Ctx objects. The captured environment variables were sent as a base64 encoded query parameter to a heroku application running at https://anti-theft-web.herokuapp.com. Between 2022-0
yujiorama 2022/05/25
Pythonã®ctxãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ä¹—ã£å–ã‚ŠãŒç™ºè¦‹ã•ã‚ŒãŸã¿ãŸã„ã

security
ãƒªãƒ³ã‚¯
ã€ŒJavaã€ã«ç½²åæ¤œè¨¼ãŒãƒ•ãƒªãƒ¼ãƒ‘ã‚¹ã«ãªã£ã¦ã—ã¾ã†å±é™ºãªè„†å¼±æ€§ ï½žå½±éŸ¿ã¯è¨ˆã‚ŠçŸ¥ã‚Œãšï¼2022å¹´4æœˆã®ã€ŒCritical Patch Updateã€ã§å¯¾ç–æ¸ˆã¿ã€æœ€æ–°ç‰ˆã¸ã®æ›´æ–°ã‚’
yujiorama 2022/04/22
java

security
ãƒªãƒ³ã‚¯
drwetter/testssl.sh: Testing TLS/SSL encryption anywhere on any port
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
yujiorama 2022/04/22
testing

security
ãƒªãƒ³ã‚¯
1 2 3 4 5 6 7 8 9 10 æ¬¡ã®ãƒšãƒ¼ã‚¸