Author: HuanGMz@Knownsec 404 Team Chinese version: https://paper.seebug.org/1906/ 1.Vulnerability introduction It has been more than a month since the high-risk vulnerability CVE-2022–26809 was repaired in April 2022. During this period, there was no other news except that @L1nk post an analysis about trigger conditions of GetCoalescedBuffer() vulnerability function. …

Author：sunglin@Knownsec 404 Team Date: November 9, 2021 Chinese Version: https://paper.seebug.org/1734/ 0x00 Application of RDP protocol RDP (Remote Desktop Protocol) is a proprietary protocol created by Microsoft. It allows system users to connect to remote systems through graphical interfaces. RDP is mainly divided into server and client. In this article we will talk about applications related…

Author：LoRexxar’@Knownsec 404 Team Date: April 16, 2021 Chinese Version: https://paper.seebug.org/1559/ On April 12th, @cursered published an article on starlabs “You Talking To Me?”, which shared some mechanisms and security issues about Webdriver. Through a series of attack chains, we successfully realized the RCE of Webdriver. …

Author：LoRexxar’@Knownsec 404 Team Date: September 23, 2020 Chinese Version: https://paper.seebug.org/1339/ Since mankind invented tools, mankind has been exploring how to do anything more conveniently and quickly. In the process of scientific and technological development, mankind keeps on trial，error, and thinking. So there is a great modern technological era. In the…

Author：Longofo@Knownsec 404 Team Date: July 10, 2020 Chinese Version: https://paper.seebug.org/1271/ F5 BIG-IP has recently suffered a serious RCE vulnerability. The main public entrypoint is the tmsh and hsqldb. There are many uses and analysis of tmsh. If you have reproduced the use of tmsh, you should know that this place…

Author: LoRexxar’@Knownsec 404 Team Date: March 31,2020. Chinese Version: https://paper.seebug.org/1267 This article was originally completed on March 31, 2020. Because it involves 0day utilization, it was reported to the vendor on March 31, 2020, and released after the 90-day vulnerability disclosure period. A few days ago, I accidentally saw a…

Author: Badcode and Longofo@Knownsec 404 Team Date: 2020/02/09 Chinese Version: https://paper.seebug.org/1260/ Foreword At the beginning of September 2019, we responded to the Nexus Repository Manager 2.x command injection vulnerability (CVE-2019–5475). The general reason and steps for recurrence are on Hackerone. It was announced that after emergency response to this vulnerability, we…

Author: Heige(a.k.a Superhei) of KnownSec 404 Team Date: May 25,2020 Chinese version:https://paper.seebug.org/1219/ We had released ZoomEye’s historical data API query interface in ZoomEye 2020 that had launched in January this year: https://medium.com/@80vul/zoomeye-2020-has-started-8414d6aaf38. …

Author：LoRexxar@Knownsec 404 Team Time: May 11, 2020 Chinese version: https://paper.seebug.org/1197/ I took a look at the third Web Open of the null pointer this weekend, and after a little research, I found that this is the latest version of the DZ3.4 environment with almost default configuration. We need to pwn…