[B! vulnerability] teppeisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

teppeis id:teppeis

vulnerabilityã«é–¢ã™ã‚‹teppeisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (71)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Twitterã‚«ãƒ¼ãƒ‰ãŒè²¼ã‚‰ã‚ŒãŸãƒ„ã‚¤ãƒ¼ãƒˆã¯ã™ã¹ã¦è©æ¬ºã§ã™ã€ã¨ã„ã†æ™‚ä»£ - Qiita
æœ€è¿‘è¦‹ã¤ã‘ãŸç¾è±¡ã§æ—¢ã«è«–ã˜ã‚‰ã‚Œã¦ã„ã‚‹ã‹ã¨æ€ã£ãŸãŒã¡ã‚‡ã£ã¨è§£èª¬ãŒè¦‹ã¤ã‹ã‚‰ãªã‹ã£ãŸã®ã§ã¾ã¨ã‚ã¦ãŠãã€‚ æ‰‹çŸã« X(æ—§Twitter)ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã§è¡¨ç¤ºã•ã‚Œã‚‹Twitterã‚«ãƒ¼ãƒ‰ã«ã¤ã„ã¦ã‚«ãƒ¼ãƒ‰ã«è¡¨ç¤ºã•ã‚Œã‚‹ãƒ‰ãƒ¡ã‚¤ãƒ³ã¨ã¯é•ã†ãƒšãƒ¼ã‚¸ã«ãƒªãƒ³ã‚¯ã•ã›ã‚‹æ‰‹æ³•ãŒå˜åœ¨ã™ã‚‹ ã“ã®æ‰‹æ³•ã¯ç¬¬ä¸‰è€…ã®Twitterã‚«ãƒ¼ãƒ‰ã‚’åˆ©ç”¨ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ ã¤ã¾ã‚Šæ‚ªç”¨è€…ã¯ç¬¬ä¸‰è€…ã®Twitterã‚«ãƒ¼ãƒ‰ã‚’è¡¨ç¤ºã•ã›ãªãŒã‚‰è‡ªèº«ã®æ„å›³ã™ã‚‹ãƒšãƒ¼ã‚¸ã«é–²è¦§è€…ã‚’èª˜å°Žã™ã‚‹ã“ã¨ãŒã§ãã‚‹ ã“ã‚Œã¯ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã®æ‰‹æ³•ã«ãªã‚Šã†ã‚‹ è¦‹ã¤ã‘ãŸãƒ„ã‚¤ãƒ¼ãƒˆ ä»¥ä¸‹ã®ãƒ„ã‚¤ãƒ¼ãƒˆã¯Googleã€Bloombergã€æ—¥çµŒãƒ“ã‚¸ãƒã‚¹ã®Twitterã‚«ãƒ¼ãƒ‰ãŒæ·»ä»˜ã•ã‚Œã¦ã„ã‚‹ãŒã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ãã‚Œã‚‰ã¨ã¯ç•°ãªã‚‹æƒ…å ±å•†æã‚µã‚¤ãƒˆã«ã‚¸ãƒ£ãƒ³ãƒ—ã™ã‚‹ã€‚ãƒªãƒ³ã‚¯å…ˆã«å±é™ºãªä»•çµ„ã¿ã¯ãªã„ã¨æ€ã‚ã‚Œã‚‹ãŒã‚¯ãƒªãƒƒã‚¯ã¯è‡ªå·±è²¬ä»»ã§ã€‚å¿µã‚’å…¥ã‚ŒãŸã„äººã¯ curl -Lã€€ã§ã€‚ PCãƒ–ãƒ©ã‚¦ã‚¶ã§ã‚«ãƒ¼ã‚½ãƒ«ã‚’åˆã‚ã›ã¦ã‚‚Xã®çŸç¸®URLã‚µãƒ¼ãƒ“ã‚¹ã§ã‚
teppeis 2023/12/08
ã‚«ãƒ¼ãƒ‰æƒ…å ±å–å¾—æ™‚ã«ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã‚’å‡ºã—åˆ†ã‘ã¦ã‚‹èª¬ã‹ã€‚å¯¾ç–ã¨ã—ã¦å˜ç´”ã«ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆå…ˆã‚’èªã¾ãªã„ã‚ˆã†ã«ã—ã¡ã‚ƒã†ã¨ã€ã¯ã¦ãƒ–ã¿ãŸã„ãªæŒ™å‹•ãŒå‹•ã‹ãªããªã£ã¡ã‚ƒã†ã

twitter

redirect

security

vulnerability
ãƒªãƒ³ã‚¯
CVE-2023-45857 (CWE-359) XSRF-TOKEN value is disclosed to an unauthorised actor Â· Issue #6006 Â· axios/axios
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
teppeis 2023/10/27
axios

csrf

vulnerability

security
ãƒªãƒ³ã‚¯
[2023-01-31 12:00 JST æ›´æ–°] JWTã®ã‚·ãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ã«é–¢ã™ã‚‹å•é¡Œ
2019å¹´1æœˆ30æ—¥ PST æœ¬è„†å¼±æ€§ã®æ‚ªç”¨ã‚·ãƒŠãƒªã‚ªã®å‰ææ¡ä»¶ã«é–¢ã™ã‚‹ã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ã‹ã‚‰ã®ãƒ•ã‚£ãƒ¼ãƒ‰ãƒãƒƒã‚¯ã‚’å—ã‘ã€ç§ãŸã¡ã¯Auth0ã¨å”åŠ›ã—ã¦CVE-2022-23529ã‚’æ’¤å›žã™ã‚‹ã“ã¨ã‚’æ±ºå®šã—ã¾ã—ãŸã€‚ æœ¬ç¨¿ã§è§£èª¬ã—ãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å•é¡Œã¯JsonWebTokenãƒ©ã‚¤ãƒ–ãƒ©ãƒªãŒå®‰å…¨ã§ãªã„æ–¹æ³•ã§ä½¿ç”¨ã•ã‚ŒãŸå ´åˆã«ã¯ä¾ç„¶ã¨ã—ã¦æ‡¸å¿µã•ã‚Œã‚‹ã‚‚ã®ã§ã™ã€‚ãã®ã‚·ãƒŠãƒªã‚ªã§ã¯ã€ã™ã¹ã¦ã®å‰ææ¡ä»¶ã‚’æº€ãŸã›ã°ã“ã®å•é¡Œã‚’æ‚ªç”¨ã§ãã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ç§ãŸã¡ã¯ã€ãã®å ´åˆã®ãƒªã‚¹ã‚¯ã®å¤§å…ƒã¯ãƒ©ã‚¤ãƒ–ãƒ©ãƒªå´ã§ãªãå‘¼ã³å‡ºã—å´ã®ã‚³ãƒ¼ãƒ‰ã«ã‚ã‚‹ã“ã¨ã«åŒæ„ã—ã¾ã™ã€‚ ã“ã®å•é¡Œã«å¯¾å‡¦ã™ã‚‹ãŸã‚JsonWebTokenã®ã‚³ãƒ¼ãƒ‰ã«ã¯é‡è¦ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯ãŒè¿½åŠ ã•ã‚Œã¾ã—ãŸã€‚ jsonwebtoken 8.5.1ä»¥å‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’ãŠä½¿ã„ã®å ´åˆã¯æœ€æ–°ç‰ˆã®9.0.0ã«ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã™ã‚‹ã“ã¨ã‚’ãŠå‹§ã‚ã—ã¾ã™ã€‚æœ€æ–°ç‰ˆã§ã¯åŒã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã‚’å«ã‚€å•é¡Œã‚’ä¿®æ£æ¸ˆã¿ã§ã€ã‚ˆã‚Šå®‰å…¨ãª
teppeis 2023/01/11
jwt

security

vulnerability
ãƒªãƒ³ã‚¯
SSVCã‚’å‚è€ƒã«ã—ãŸè„†å¼±æ€§ç®¡ç†ã«ã¤ã„ã¦æœ¬æ°—å‡ºã—ã¦è€ƒãˆã¦ã¿ã¦ã„ã‚‹ï¼ˆé€²è¡Œä¸ï¼‰ - ãƒšãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã—ã®ã¹ãã‚“
ã¯ã˜ã‚ã« ã“ã“æœ€è¿‘è„†å¼±æ€§ç®¡ç†ã«ã¤ã„ã¦ãšã£ã¨è€ƒãˆã¦ã„ãŸã®ã§ã™ãŒã€SSVCã‚’çŸ¥ã£ã¦ã‹ã‚‰ã¨ã„ã†ã‚‚ã®ã€ã‹ãªã‚Šã‚·ãƒ³ãƒ—ãƒ«ã«è€ƒãˆã‚‰ã‚Œã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚è©¦ã¿è‡ªä½“ã¯ã¾ã é€”ä¸Šãªã®ã§ã™ãŒã€ä»¥ä¸‹ã®ã‚ˆã†ãªã“ã¨ã‚’ç›®çš„ã¨ã—ã¦ã€SSVCã®æ¦‚è¦ã‚„ã€ç¾æ™‚ç‚¹ã§ã®çµŒéŽã‚„ç§ã®è€ƒãˆã‚’æ–‡å—ã«èµ·ã“ã—ã¦ã¿ã¾ã™ã€‚ ã‚¢ã‚¤ãƒ‡ã‚¢ã‚’æ•´ç†ã—ãŸã„ è„†å¼±æ€§ç®¡ç†ãƒ»é‹ç”¨ã«æ‚©ã‚“ã§ã„ã‚‹äººã¨å‚·ã‚’èˆã‚åˆã„ãŸã„ ã‚ã‚ã‚ˆãã°æœ‰è˜è€…ã®ç›®ã«æ¢ã¾ã£ã¦ã”æ„è¦‹ã‚’è³œã‚ŠãŸã„ï¼ˆè¾›è¾£ãªã®ã¯ã‚¤ãƒ¤ï¼‰ SSVCã¨ã¯ï¼Ÿ Stakeholder-Specific Vulnerability Categolizationã®ç•¥ã€‚CERT/CCãŒè€ƒæ¡ˆã—ãŸè„†å¼±æ€§ç®¡ç†æ‰‹æ³•ã§ã™ã€‚CVSSãŒã€Œè„†å¼±æ€§ã®è©•ä¾¡æ‰‹æ³•ã€ã§ã‚ã‚‹ã“ã¨ã«å¯¾ã—ã¦ã€SSVCã¯ã€Œè„†å¼±æ€§å¯¾å¿œæ–¹é‡ã®åˆ¤æ–æ‰‹æ³•ã€ã§ã‚ã‚‹ã¨è¨€ãˆã¾ã™ã€‚ ãŸã¶ã‚“ä»Šä¸€ç•ªåˆ†ã‹ã‚Šã‚„ã™ã„è§£èª¬ãƒšãƒ¼ã‚¸ã€‚PWCã ã„ã—ã‚…ãï¼ www.pwc.com å®Ÿéš›ã®è³‡æ–™ã¯ã€CERT/CCã®GitHubãƒª
teppeis 2022/10/02
ssvc

security

vulnerability
ãƒªãƒ³ã‚¯
Node.jsã®MySQLãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«ãŠã‘ã‚‹ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã ã‘ã§ã¯é˜²ã’ãªã„ã€Œéš ã‚ŒãŸã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ - GMO Flatt Security Blog
â€»æœ¬è¨˜äº‹ã¯ç†è€…styprãŒè‹±èªžã§åŸ·ç†ã—ãŸè¨˜äº‹ã‚’æ ªå¼ä¼šç¤¾Flatt Securityç¤¾å†…ã§æ—¥æœ¬èªžã«ç¿»è¨³ã—ãŸã‚‚ã®ã«ãªã‚Šã¾ã™ã€‚ TL;DR Node.jsã®ã‚¨ã‚³ã‚·ã‚¹ãƒ†ãƒ ã§æœ€ã‚‚äººæ°—ã®ã‚ã‚‹MySQLãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ä¸€ã¤ã§ã‚ã‚‹ mysqljs/mysql (https://github.com/mysqljs/mysql)ã«ãŠã„ã¦ã€ã‚¯ã‚¨ãƒªã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—é–¢æ•°ã®äºˆæœŸã›ã¬å‹•ä½œãŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’å¼•ãèµ·ã“ã™å¯èƒ½æ€§ãŒã‚ã‚‹ã“ã¨ãŒåˆ¤æ˜Žã—ã¾ã—ãŸã€‚ é€šå¸¸ã€ã‚¯ã‚¨ãƒªã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—é–¢æ•°ã‚„ãƒ—ãƒ¬ãƒ¼ã‚¹ãƒ›ãƒ«ãƒ€ã¯SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’é˜²ãã“ã¨ãŒçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ã—ã‹ã—ã€mysqljs/mysql ã¯ã€å€¤ã®ç¨®é¡žã«ã‚ˆã£ã¦ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ–¹æ³•ãŒç•°ãªã‚‹ã“ã¨ãŒçŸ¥ã‚‰ã‚Œã¦ãŠã‚Šã€æ”»æ’ƒè€…ãŒç•°ãªã‚‹å€¤ã®ç¨®é¡žã§ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚’æ¸¡ã™ã¨ã€æœ€çµ‚çš„ã«äºˆæœŸã›ã¬å‹•ä½œã‚’å¼•ãèµ·ã“ã™å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚äºˆæœŸã›ã¬å‹•ä½œã¨ã¯ã€ãƒã‚°ã®ã‚ˆã†ãªå‹•ä½œã‚„SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©ã§ã™ã€‚ ã»ã¼ã™ã¹ã¦ã®ã‚ªãƒ³ãƒ©
teppeis 2022/02/16
ã‚¯ã‚¨ãƒªã®ãƒ—ãƒ¬ã‚¤ã‚¹ãƒ›ãƒ«ãƒ€ã«ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆåž‹ãŒæ¸¡ã‚‹ã¨ç‰¹æ®Šãªè§£é‡ˆã‚’ã™ã‚‹ä»•æ§˜ã‚’çªã„ãŸSQLiè„†å¼±æ€§ã€‚ã“ã†ã„ã†å¤‰ã«ä¾¿åˆ©æ©Ÿèƒ½ã‚ã‚‹ã¨å±é™ºãªã‚„ã¤ã€log4jã§è¦‹ãŸ

node.js

mysql

db

vulnerability

security
ãƒªãƒ³ã‚¯
ï¼³ï½‹ï½™è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ãƒ«ãƒ¼ãƒ«ãƒ–ãƒƒã‚¯
teppeis 2022/01/27
ãŠãŠã€CVSS v3ãƒ™ãƒ¼ã‚¹ã§å ±å¥¨é‡‘ã®è©•ä¾¡ã™ã‚‹ã‚“ã

security

vulnerability
ãƒªãƒ³ã‚¯
ï¼³ï½‹ï½™è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ï½œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»è„†å¼±æ€§ã«ã¤ã„ã¦ï½œï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾
ï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾ï¼ˆä»¥ä¸‹ã€ï¼³ï½‹ï½™ã¾ãŸã¯å¼Šç¤¾ï¼‰ã§ã¯ã€å¼Šç¤¾ãŒæä¾›ã™ã‚‹å¯¾è±¡å•†å“ãƒ»ã‚µãƒ¼ãƒ“ã‚¹ã®è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ã”å ±å‘Šã„ãŸã ã„ãŸæ–¹ã¸ã®è¬ç¤¼ã¨ã—ã¦ã€å ±å¥¨é‡‘ã‚’ãŠæ”¯æ‰•ã„ã™ã‚‹ã€Œï¼³ï½‹ï½™è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ï¼ˆä»¥ä¸‹ã€æœ¬åˆ¶åº¦ï¼‰ã€ã‚’å®Ÿæ–½ã—ã¦ã„ã¾ã™ã€‚ ç›®çš„ æœ¬åˆ¶åº¦ã¯ã€å¼Šç¤¾ãŒæä¾›ã™ã‚‹å•†å“ãƒ»ã‚µãƒ¼ãƒ“ã‚¹ã«å˜åœ¨ã™ã‚‹ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã®æ—©æœŸç™ºè¦‹ã¨æ”¹ä¿®ã‚’ç›®çš„ã¨ã—ãŸåˆ¶åº¦ã§ã™ã€‚ å‚åŠ æ¡ä»¶ ä»¥ä¸‹ã®æ¡ä»¶ã‚’æº€ãŸã—ãŸæ–¹ã«ã”å‚åŠ ã„ãŸã ã‘ã¾ã™ã€‚ å ±å‘Šæ™‚ç‚¹ã§ï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾ã®å¾“æ¥å“¡ã§ã¯ãªã„ã“ã¨ å ±å‘Šæ™‚ç‚¹ã§æ¥å‹™å§”è¨—å¥‘ç´„ã€å‡ºå‘å¥‘ç´„ã€æ´¾é£å¥‘ç´„ç‰ã®å¥‘ç´„å½¢æ…‹ã«ã‚ˆã‚Šã€ï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾ã®æ¥å‹™ã«å¾“äº‹ã—ã¦ã„ãªã„ã“ã¨ éŽåŽ»ã«ï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾ã®æ£ç¤¾å“¡ã¨ã—ã¦é›‡ç”¨ã•ã‚Œã¦ã„ãªã„ã“ã¨ éŽåŽ»ã«ï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾ã§ã€å•†å“é–‹ç™ºãŠã‚ˆã³ã‚¯ãƒ©ã‚¦ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹é‹ç”¨é–¢é€£ã®æ¥å‹™ã«å¾“äº‹ã—ã¦ã„ãªã„ã“ã¨ æ—¥æœ¬èªžã¾ãŸã¯è‹±èªžã§ã€Sky-SIRTã¨ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒã§ãã‚‹ã“ã¨ æœ¬åˆ¶åº¦ã«åŒæ„ã„ãŸã ã‘ã‚‹ã“ã¨ å‚åŠ æ–¹æ³• æœ¬åˆ¶åº¦ã«å‚åŠ ã™ã‚‹å ´åˆã¯
teppeis 2022/01/27
security

vulnerability
ãƒªãƒ³ã‚¯
ã€Œï¼³ï½‹ï½™è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ï¼ˆSky Bug Bounty Programï¼‰ã€ã‚’é–‹å§‹ã—ã¾ã™ï½œï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾
èƒŒæ™¯ è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’å¼·åŒ–ã™ã‚‹ç›®çš„ã§ã™ã§ã«æµ·å¤–ã®å¤§æ‰‹ITä¼æ¥ãŒå–ã‚Šå…¥ã‚Œã€å›½å†…ã®ITä¼æ¥ã§ã‚‚ã‚ˆã‚Šå®‰å…¨ãªè£½å“ã‚„ã‚µãƒ¼ãƒ“ã‚¹ã®æä¾›ã«å¿…è¦ãªå–ã‚Šçµ„ã¿ã®ä¸€ã¤ã¨ã—ã¦è€ƒãˆã‚‰ã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦ãã¦ã„ã¾ã™ã€‚ãã“ã§ã€ï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾ã«ãŠã„ã¦ã‚‚ã€ãŠå®¢æ§˜ã«ã‚ˆã‚Šå®‰å…¨ã§å®‰å¿ƒãªè£½å“ãƒ»ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”æä¾›ã™ã‚‹ãŸã‚ã€Œï¼³ï½‹ï½™è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã€ã‚’æ§‹ç¯‰ã€‚è£½å“ãƒ»ã‚µãƒ¼ãƒ“ã‚¹ã®è„†å¼±æ€§ã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®èª²é¡Œã«é–¢ã™ã‚‹æƒ…å ±ã‚’åºƒãã”æä¾›ã™ã‚‹å–ã‚Šçµ„ã¿ã¨ã—ã¦å®Ÿæ–½ã™ã‚‹ã“ã¨ã«ãªã‚Šã¾ã—ãŸã€‚ã“ã‚Œã¾ã§ã‚‚è‡ªç¤¾å•†å“ãƒ»ã‚µãƒ¼ãƒ“ã‚¹ãªã©ã«å¯¾ã—ã¦ç¬¬ä¸‰è€…ã«ã‚ˆã‚‹è„†å¼±æ€§è¨ºæ–ã‚’å®šæœŸçš„ã«è¡Œã†ãªã©ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»è„†å¼±æ€§ã¸ã®å„ç¨®å–ã‚Šçµ„ã¿ã‚’ç¶™ç¶šã—ã¦ãã¾ã—ãŸãŒã€æœ¬åˆ¶åº¦ã®é‹ç”¨ã«ã‚ˆã‚Šæ¤œçŸ¥é›£æ˜“åº¦ã®é«˜ã„æ½œåœ¨çš„ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ã‚’ã„ã¡æ—©ãç™ºè¦‹ã§ãã‚‹ã¨è€ƒãˆã¦ã„ã¾ã™ã€‚ï¼³ï½‹ï½™æ ªå¼ä¼šç¤¾ã¯ã€ã“ã‚Œã¾ã§ä»¥ä¸Šã«é€Ÿã‚„ã‹ãªå¯¾ç–ã¨ãŠå®¢æ§˜ã¸ã®æƒ…å ±æä¾›ã‚’è¡Œã£ã¦ã€è£½å“ã‚„ã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã•ã‚Œã‚‹ãŠå®¢æ§˜ã®æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®
teppeis 2022/01/27
vulnerability

security
ãƒªãƒ³ã‚¯
Twitter Mentions More Effective Than CVSS at Reducing Exploitability
Twitter Mentions More Effective Than CVSS at Reducing Exploitability Monitoring Twitter mentions of vulnerabilities may be twice as effective as CVSS scores at helping organizations prioritize which bugs to patch first, according to new research. Kenna Securityâ€™sÂ latest report,Â Prioritization to Prediction, Volume 8: Measuring and Minimizing Exploitability, was compiled with help from the Cyentia
teppeis 2022/01/22
twitter

cvss

security

vulnerability
ãƒªãƒ³ã‚¯
Safari 15 IndexedDB Leaks
Information leaks resulting from an IndexedDB same-origin policy violation in WebKit (a browser engine primarily used in Safari, as well as all iOS and iPadOS web browsers).
teppeis 2022/01/18
Safari 15ã«å¤–éƒ¨ã‚µã‚¤ãƒˆã‹ã‚‰åˆ©ç”¨è€…ã®Google IDã‚’å–å¾—å¯èƒ½ãªè„†å¼±æ€§

safari

vulnerability

privacy
ãƒªãƒ³ã‚¯
Updating follow-redirects to version 1.14.7 by guscsales Â· Pull Request #4379 Â· axios/axios
teppeis 2022/01/16
axiosã¯ä¾å˜ã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’ãƒžãƒ¼ã‚¸ã¯ã—ãŸãŒnpm publishã¯ã—ã¦ã„ãªã„ https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

axios

vulnerability

security

cookie
ãƒªãƒ³ã‚¯
huntr - The worldâ€™s first bug bounty platform for AI/ML
Supported byÂ Protect AIÂ and leading the way to MLSecOps and greater AI security.
teppeis 2022/01/16
npmã®follow-redirectsãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆå…ƒãƒ‰ãƒ¡ã‚¤ãƒ³ã®cookieã‚’ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆå…ˆã®åˆ¥ãƒ‰ãƒ¡ã‚¤ãƒ³ã«é€ä¿¡ã™ã‚‹è„†å¼±æ€§ã€‚axiosãŒä¾å˜ã—ã¦ã‚‹ã‹ã‚‰å½±éŸ¿ãŒå¤§ããã†

cookie

vulnerability

security

npm

axios
ãƒªãƒ³ã‚¯
CVE-2022-0155 - GitHub Advisory Database
teppeis 2022/01/16
Exposure of sensitive information in follow-redirects

axios

vulnerability

cookie
ãƒªãƒ³ã‚¯
Apache Log4jã«å˜åœ¨ã™ã‚‹ RCE è„†å¼±æ€§(CVE-2021-44228)ã«ã¤ã„ã¦ã®æ¤œè¨¼ãƒ¬ãƒãƒ¼ãƒˆ | æ ªå¼ä¼šç¤¾NTTãƒ‡ãƒ¼ã‚¿å…ˆç«¯æŠ€è¡“
2021å¹´12æœˆ6æ—¥ã«Apache Software Foundationã«ã‚ˆã‚Šä¿®æ£ã•ã‚ŒãŸLog4j ã«å˜åœ¨ã™ã‚‹ãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ï¼ˆCVE-2021-44228ï¼‰ã«ã¤ã„ã¦ã®æ¤œè¨¼ã‚’å®Ÿæ–½ã—ã€è„†å¼±æ€§ã®æ‚ªç”¨ãŒå¯èƒ½ã§ã‚ã‚‹ã“ã¨ã‚’ç¢ºèªã—ã¾ã—ãŸã€‚[1][2] (2022.2.16) è¿½åŠ æƒ…å ±ï¼š ä»¥ä¸‹è¿½åŠ æƒ…å ±ã¨ã—ã¦ã€ã€ŒApache Log4jã«é–¢ã™ã‚‹è§£èª¬ 1.6ç‰ˆã€ã‚’å…¬é–‹ã—ã¾ã—ãŸã®ã§ã”è¦§ãã ã•ã„ã€‚ 1. æœ¬è„†å¼±æ€§ã®æ¦‚è¦ Log4j ã¯ã€Apache Software FoundationãŒæä¾›ã™ã‚‹ãƒã‚®ãƒ³ã‚°ç”¨ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã§ã€Javaç‰ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§ãƒã‚°å‡ºåŠ›ã‚’è¡Œã†å®Ÿè£…ã¨ã—ã¦å¹…åºƒãåˆ©ç”¨ã•ã‚Œã¦ã„ã¾ã™ã€‚æœ¬è„†å¼±æ€§ã¯Log4shellã¨ã‚‚å‘¼ç§°ã•ã‚Œã€Log4j ã«å˜åœ¨ã™ã‚‹ JNDI(Java Naming and Directory Interface) Lookupæ©Ÿèƒ½ã«å«ã¾ã‚Œã‚‹å•é¡Œã«èµ·å› ã—ã¾ã™ã€‚ æœ¬è„†å¼±æ€§ã®
teppeis 2021/12/16
log4j

vulnerability
ãƒªãƒ³ã‚¯
Log4jã§è©±é¡Œã«ãªã£ãŸWAFã®å›žé¿/é›£èªåŒ–ã¨ã¯ä½•ã‹
ã¯ã˜ã‚ã« 2021å¹´12æœˆã«ç™ºè¦‹ã•ã‚ŒãŸLog4jã®CVE-2021-44228ã¯ã€ç¨€ã«è¦‹ã‚‹ãƒ¬ãƒ™ãƒ«ã€ã¾ã•ã«è¶…å¼©ç´šã®è„†å¼±æ€§ã¨ãªã£ã¦ã„ã¾ã™ã€‚ä»Šå›žã€ç§ã¯Twitterã‚’ä¸»ãªè¶³ãŒã‹ã‚Šã¨ã—ã¦æƒ…å ±åŽé›†ã‚’è¡Œã„ã¾ã—ãŸãŒã€(è‹±èªžãƒ»æ—¥æœ¬èªžã©ã¡ã‚‰ã«ãŠã„ã¦ã‚‚)ã‹ãªã‚ŠWAFãã®ã‚‚ã®ãŒè©±é¡Œã«ãªã£ã¦ã„ã‚‹ã“ã¨ã«é©šãã¾ã—ãŸã€‚ã‚ã‚‹äººã¯ã€ŒWAFãŒæ—©é€Ÿå¯¾å¿œã—ã¦ãã‚ŒãŸã‹ã‚‰å®‰å¿ƒã ï¼ã€ã¨å«ã³ã€åˆ¥ã®äººã¯ã€ŒWAFã‚’å›žé¿ã§ãã‚‹é›£èªåŒ–ã®æ–¹æ³•ãŒè¦‹ã¤ã‹ã£ãŸã€‚WAFã¯å½¹ã«ç«‹ãŸãªã„ï¼ã€ã¨ä¸»å¼µã™ã‚‹ã€‚ã•ã‚‰ã«ã¯GitHubã«ã€ŒWAFã‚’å›žé¿ã§ãã‚‹ãƒšã‚¤ãƒãƒ¼ãƒ‰(æ”»æ’ƒæ–‡å—åˆ—)ä¸€è¦§ã€ãŒã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚Œã€ãã‚Œã«ã¤ã„ã¦ã€ŒScutumã§ã¯ã“ã®ãƒ‘ã‚¿ãƒ¼ãƒ³ã‚‚æ¢ã¾ã‚Šã¾ã™ã‹ï¼Ÿã€ã¨å•ã„åˆã‚ã›ãŒæ¥ã‚‹ãªã©ã€ã‹ãªã‚ŠWAFã§ã®é˜²å¾¡ã¨ãã®å›žé¿æ–¹æ³•ã«ã¤ã„ã¦æ³¨ç›®ãŒé›†ã¾ã‚Šã¾ã—ãŸã€‚ å®Ÿã¯WAFã«ãŠã„ã¦ã¯ã€ã€Œå›žé¿(Evasionã‚ã‚‹ã„ã¯Bypass)ã€ã¨ã®æˆ¦ã„ã¯æ°¸é ã®ãƒ†ãƒ¼ãƒžã§ã™ã€‚ã“ã‚Œã¯ä»Šå›žLog4jã®ä»¶ã§
teppeis 2021/12/16
log4j

vulnerability

waf

security
ãƒªãƒ³ã‚¯
Salesforce Help
teppeis 2021/12/16
salesforce

log4j

security

vulnerability
ãƒªãƒ³ã‚¯
Log4j hole revives chatter on Big Biz funding open source
teppeis 2021/12/16
log4j

oss

security

vulnerability
ãƒªãƒ³ã‚¯
Log4Shell / Apache Log4j Injection Vulnerability - Truesec
teppeis 2021/12/15
log4j

vulnerability
ãƒªãƒ³ã‚¯
Update for Apache Log4j2 Issue (CVE-2021-44228)
AWS is aware of the recently disclosed issues relating to the open-source Apache â€œLog4j2" utility (CVE-2021-44228 and CVE-2021-45046). Responding to security issues such as this one shows the value of having multiple layers of defensive techno logies, which is so important to maintaining the security of our customersâ€™ data and workloads. We've taken this issue very seriously, and our world-class te
teppeis 2021/12/14
aws

log4j

vulnerability
ãƒªãƒ³ã‚¯
https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4
teppeis 2021/12/14
apache

vulnerability

log4j
ãƒªãƒ³ã‚¯
1 2 3 4 æ¬¡ã®ãƒšãƒ¼ã‚¸