[B! è„†å¼±æ€§] lyiaseã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lyiase id:lyiase

è„†å¼±æ€§ã«é–¢ã™ã‚‹lyiaseã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

è„†å¼±æ€§å¯¾å¿œã«ãŠã‘ã‚‹ãƒªã‚¹ã‚¯è©•ä¾¡æ‰‹æ³•ã®ã¾ã¨ã‚ | ãƒ‡ã‚¸ã‚¿ãƒ«äººæã®è‚²æˆ | IPA ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
èƒŒæ™¯ æœ¬ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯ã€ICSCoE7æœŸç”Ÿã«ãŠã„ã¦ã€å®Ÿæ¥å‹™ã§è„†å¼±æ€§å¯¾å¿œã‚’è¡Œã†éš›ã«ã€æ—¥ã€…å…¬è¡¨ã•ã‚Œã‚‹å…¨ã¦ã®è„†å¼±æ€§ã«å¯¾å¿œã—ãã‚Œãªã„ã¨ã„ã†å•é¡Œã‚„ã€CVSSï¼ˆCommon Vulnerability Scoring Systemï¼‰åŸºæœ¬å€¤ã®ã‚¹ã‚³ã‚¢ã‚’è„†å¼±æ€§ã®å¯¾å¿œå„ªå…ˆåº¦ã‚’æ±ºã‚ã‚‹ãŸã‚ã«åˆ©ç”¨ã™ã‚‹ã«ã¯ä¸ååˆ†ã§ã‚ã‚‹ã¨è€ƒãˆã€ã“ã‚Œã‚’è§£æ±ºã™ã¹ãç«‹ã¡ä¸Šã’ã‚‰ã‚ŒãŸã€‚CVSSåŸºæœ¬å€¤ãŒè„†å¼±æ€§ãã®ã‚‚ã®ã®æ·±åˆ»åº¦ã‚’è©•ä¾¡ã™ã‚‹ç‚¹ã§ã¯æœ‰ç”¨ã§ã‚ã‚‹ã‚‚ã®ã®ã€è„†å¼±æ€§ã®æ‚ªç”¨çŠ¶æ³ã‚„ãƒ¦ãƒ¼ã‚¶ã®ç’°å¢ƒæƒ…å ±ã‚’è€ƒæ…®ã—ã¦ã„ãªã„ãŸã‚ã€è„†å¼±æ€§å¯¾å¿œã®å„ªå…ˆåº¦ã‚’æ±ºå®šã™ã‚‹ãŸã‚ã«ã€å˜ä½“ã§ä½¿ç”¨ã™ã‚‹ã®ã¯é©åˆ‡ã§ã¯ãªã„ã¨è€ƒãˆãŸã€‚ã¾ãŸã€CVSSã‚„EPSSï¼ˆExploit Prediction Scoring Systemï¼‰ãªã©ã®ãƒªã‚¹ã‚¯è©•ä¾¡å€¤ã‚’è„†å¼±æ€§å¯¾å¿œã®å„ªå…ˆåº¦ä»˜ã‘ã«ä½¿ç”¨ã™ã‚‹å ´åˆã€é©åˆ‡ãªé–¾å€¤ã‚’è¨å®šã™ã‚‹å¿…è¦ãŒã‚ã‚‹ã¨åˆ¤æ–ã—ãŸã€‚ã“ã‚Œã‚‰ã‚’è¸ã¾ãˆã¦ã€è©•ä¾¡å€¤ã®å¦¥å½“æ€§ã‚„åŠ¹çŽ‡çš„ãªé‹ç”¨æ–¹æ³•ãŒãªã„ã‹ã¨ã„ã†ç‚¹ã«ã¤
lyiase 2024/08/05
CVSSv3.1/CVSSv4.0/SSVC/EPSS/KEVã®ç´¹ä»‹ã¨ãã‚Œã‚’ç”¨ã„ãŸè©•ä¾¡æ‰‹æ³•ã®ã¾ã¨ã‚ã€‚SSVCã‚’ä½¿ã£ãŸæ–¹æ³•ãŒä¸»ã«ç´¹ä»‹ã€‚ / å€‹äººçš„ã«ã€Œç¾åœ¨ã®æ‚ªç”¨äº‹ä¾‹ã€ã‚„ã€Œå¤–éƒ¨ã‹ã‚‰ã®ã‚¢ã‚¯ã‚»ã‚¹æ€§ã€ã‚’ä½¿ã£ãŸæ–¹æ³•ã¯ç¾åœ¨ã«ãŠã„ã¦æœ‰ç”¨ã«æ€ãˆãªã„ãªã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
é€”åˆ‡ã‚ŒãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼æƒ…å ±ã®ã€Œä¾›çµ¦ç¶²ã€ã€ãªãœåŠç”°ç—…é™¢ã¯è„†å¼±æ€§ã‚’æ”¾ç½®ã™ã‚‹ã«è‡³ã£ãŸã‹
å¾³å³¶çœŒã®ã¤ã‚‹ãŽç”ºç«‹åŠç”°ç—…é™¢ã‚’çªå¦‚è¥²ã£ãŸ2021å¹´10æœˆã®ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚¨ã‚¢ï¼ˆèº«ä»£é‡‘è¦æ±‚åž‹ã‚¦ã‚¤ãƒ«ã‚¹ï¼‰è¢«å®³ã€‚èª¿æŸ»ã«å½“ãŸã£ãŸæœ‰è˜è€…ä¼šè°ã¯ãã®èª¿æŸ»å ±å‘Šæ›¸ã«ãŠã„ã¦ã€æ”»æ’ƒè€…ã¯ç±³Fortinetï¼ˆãƒ•ã‚©ãƒ¼ãƒ†ã‚£ãƒãƒƒãƒˆï¼‰è£½VPNï¼ˆä»®æƒ³ç§è¨ç¶²ï¼‰è£…ç½®ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ã¦ä¸æ£ä¾µå…¥ã—ãŸå¯èƒ½æ€§ãŒæ¥µã‚ã¦é«˜ã„ã¨çµè«–ä»˜ã‘ãŸã€‚ä»–ã®ä¾µå…¥æ‰‹æ®µã‚‚æ¤œè¨¼ã—ãŸã‚‚ã®ã®ã€åŒç—…é™¢ã®ã‚±ãƒ¼ã‚¹ã§ã¯è€ƒãˆã«ãã„ã¨ã—ãŸã€‚ ã¤ã¾ã‚Šã€VPNè£…ç½®ã®è„†å¼±æ€§ã‚’é©åˆ‡ã«ä¿®æ£ã—ã¦ãŠã‘ã°ä¸æ£ä¾µå…¥ã•ã‚Œãšã€è¢«å®³ã‚’å…ã‚ŒãŸå¯èƒ½æ€§ãŒååˆ†ã«ã‚ã£ãŸã“ã¨ã«ãªã‚‹ã€‚å¾³å³¶çœŒè¥¿éƒ¨åŒ»ç™‚åœã®åœ°åŸŸåŒ»ç™‚ã®è¦ã§ã‚ã‚‹åŠç”°ç—…é™¢ã¯ã€ITæ‹…å½“è€…ãŒ1äººã—ã‹ãŠã‚‰ãšã€è„†å¼±æ€§ã®æƒ…å ±ã‚’è‡ªã‚‰åŽé›†ã™ã‚‹ãªã©ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼å¯¾ç–ã‚’è¬›ã˜ã‚‹ä½™è£•ãŒãªã‹ã£ãŸã€‚ãã‚Œã§ã‚‚ã€è„†å¼±æ€§ã®ä¿®æ£ãŒå¿…è¦ãªã“ã¨ã‚„ã€ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚¨ã‚¢ã¸ã®æ³¨æ„å–šèµ·ãŒã‚‚ãŸã‚‰ã•ã‚Œã¦ã„ã‚Œã°ã€ä½œæ¥ã®å„ªå…ˆåº¦ã‚’èª¿æ•´ã—ã¦å¯¾å‡¦ã§ããŸå¯èƒ½æ€§ã¯ã‚ã‚‹ã ã‚ã†ã€‚ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼é–¢é€£æƒ…å ±ã‚’åŠç”°ç—…é™¢ã«å±Šã‘ã‚‹ãƒ«ãƒ¼ãƒˆã¯ä¸»
lyiase 2024/05/13
ã‚ã¨ã§èªã‚€

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Disclosure of a vulnerability that allows the theft of visitors' email addresses using Medium's custom domain feature / Mediumã®ç‹¬è‡ªãƒ‰ãƒ¡ã‚¤ãƒ³ãƒ—ãƒ©ãƒ³ã‚’ä½¿ã£ã¦è¨ªå•è€…ã®ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒçªƒå–ã§ãã‚‹è„†å¼±æ€§ã®é–‹ç¤º
0_medium_vuln_en.md Disclosure of a vulnerability that allows the theft of visitors' em ail addresses using Medium's custom domain feature Author: mala Introduction This article describes a vulnerability in a web service called Medium that allows you to steal visitors' e-mail addresses by using custom domain plan of Medium. This is done as my personal activity and is not related to my organization.
lyiase 2023/07/18
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
WebLogic ã®è„†å¼±æ€§(CVE-2017-10271)ã‚’ç‹™ã†æ”»æ’ƒè€…ãŸã¡ã®æ‰‹æ³•
2018å¹´2æœˆ24æ—¥ ç¬¬3å›žãƒãƒ‹ãƒ¼ãƒãƒƒã‚¿ãƒ¼æŠ€è¡“äº¤æµä¼šç™ºè¡¨è³‡æ–™ @morihi_soc #hanipo_tech https://hanipo-tech.connpass.com/event/78002/
lyiase 2018/02/27
è„†å¼±æ€§
ãƒªãƒ³ã‚¯
PHPMailerã®è„†å¼±æ€§CVE-2016-10033ã¯Exim4ã‚„WordPress4.6ã§ã‚‚å½±éŸ¿ãŒã‚ã£ãŸ
ã‚¨ã‚°ã‚¼ã‚¯ãƒ†ã‚£ãƒ–ã‚µãƒžãƒª PHPMailerã®ãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒ¼ãƒ‰å®Ÿè¡Œè„†å¼±æ€§CVE-2016-10033ã¯ã€å¾“æ¥MTAã¨ã—ã¦sendmailã‚’ç”¨ã„ã‚‹å ´åˆã®ã¿å½±éŸ¿ãŒã‚ã‚‹ã¨ã•ã‚Œã¦ã„ãŸã€‚ã¾ãŸã€WordPressã¯PHPMailerã‚’ãƒãƒ³ãƒ‰ãƒ«ã—ã¦ã„ã‚‹ãŒã€CVE-2016-10033ã«ã‚ˆã‚‹WordPressã«å¯¾ã™ã‚‹ãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒ¼ãƒ‰å®Ÿè¡Œæ”»æ’ƒã¯ã§ããªã„ã¨ã•ã‚Œã¦ã„ãŸã€‚ã—ã‹ã—ã€MTAã¨ã—ã¦Exim4ã‚’ç”¨ã„ã‚‹å ´åˆã«ã¯ã€PHPMailerå˜ä½“ãŠã‚ˆã³WordPress 4.6ã‹ã‚‰ã®ãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒ¼ãƒ‰å®Ÿè¡ŒãŒå¯èƒ½ã§ã‚ã‚‹ã“ã¨ãŒã‚ã‹ã£ãŸã®ã§å ±å‘Šã™ã‚‹ã€‚ ã¯ã˜ã‚ã« æ˜¨å¹´æœ«ã«è©±é¡Œã¨ãªã£ãŸPHPMailerã®ãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒ¼ãƒ‰å®Ÿè¡Œè„†å¼±æ€§CVE-2016-10033ã§ã™ãŒã€å½“åˆå…¬è¡¨ã•ã‚Œã¦ã„ãŸPoCãŒsendmailã‚³ãƒžãƒ³ãƒ‰ã® -X ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã‚’ç”¨ã„ãŸã‚‚ã®ã§ã‚ã£ãŸãŸã‚ã€-X ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã®ãªã„MTAï¼ˆpostfix, qmail, exim4ç‰ï¼‰ã¯ç›´ã¡ã«
lyiase 2017/05/09
è„†å¼±æ€§

wordpress
ãƒªãƒ³ã‚¯
GHOST è„†å¼±æ€§ã¯å¦‚ä½•æ§˜ã«ä½¿ã†ã®ã‹ | Webã‚·ã‚¹ãƒ†ãƒ é–‹ç™ºï¼æ•™è‚²ã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚¿ã‚¤ãƒ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ¡ãƒ‡ã‚£ã‚¢
å…ˆæ—¥ GHOST ã¨å‘¼ã°ã‚Œã‚‹ glibc ã®è„†å¼±æ€§ãŒç™ºè¡¨ã•ã‚ŒãŸã€‚ãªã‚“ã§ã‚‚ã€ã€Œãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã§ãã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€ã‚‰ã—ã„ã§ã¯ãªã„ã‹ã€‚ã—ã‹ã‚‚æ§˜ã€…ãªãƒ—ãƒã‚°ãƒ©ãƒ ã§åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªéƒ¨åˆ†ã®å•é¡Œã¨ã‚ã£ã¦ã€å½±éŸ¿ç¯„å›²ãŒã¨ã¦ã‚‚åºƒã„ã€‚ãªã‹ãªã‹åŽ„ä»‹ãªã“ã¨ã§ã‚ã‚‹ã€‚ ã¯ã¦ã€ã—ã‹ã—ä¸€ä½“å…¨ä½“ã©ã†ã‚„ã£ã¦ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã—ã‚ˆã†ã¨ã„ã†ã®ã ã‚ã†ï¼Ÿ è©±ã‚’èžãã«ã€ãŸã‹ãŒæ•°ãƒã‚¤ãƒˆã®æƒ…å ±ã‚’ç¯„å›²å¤–ã®ãƒ¡ãƒ¢ãƒªã«æ›¸ãè¾¼ã‚ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã ã‘ã ã¨ã„ã†ã€‚å®Ÿéš›ãã‚Œã ã‘ã®ã“ã¨ã§ã‚µãƒ¼ãƒãƒ¼ã®ä¹—ã£å–ã‚Šãªã©ã§ãã‚‹ã‚‚ã®ãªã®ã ã‚ã†ã‹ã€‚ãã‚“ãªã‚ã‘ã§ã€ãã®ç–‘å•ã«ç”ãˆã‚‹ã¹ãã€æœ¬è¨˜äº‹ã§ã¯ä»¥ä¸‹ã® URL ã§è§£èª¬ã•ã‚Œã¦ã„ã‚‹å®Ÿéš›ã®æ”»æ’ƒæ–¹æ³•ã‚’è‹¥å¹²ç«¯æŠ˜ã£ã¦ç´¹ä»‹ã—ã¦ã¿ã‚ˆã†ã¨æ€ã†ã€‚ http://www.openwall.com/lists/oss-security/2015/01/27/9 ãªãŠã€æœ¬è¨˜äº‹ã¯ã“ã®è„†å¼±æ€§ãã®ã‚‚ã®ã«å¯¾ã™ã‚‹ç·Šæ€¥åº¦ãªã©ã«ã¤ã„ã¦è¨€
lyiase 2015/01/30
GHOSTè„†å¼±æ€§ã®çªãæ–¹ã¨ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã®æ”»æ’ƒã®ä»•æ–¹ã€‚ã¨ã¦ã‚‚å‚è€ƒã«ãªã‚‹ã€‚

è§£èª¬

ãƒ—ãƒã‚°ãƒ©ãƒ

Linux

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
1