چه ارگان و سازمانی مسوول شماره گذاری ( CVE)آسیب پذیریها است ؟

✅The Mitre Corporation functions as Editor and Primary CNA

✅Various CNAs assign CVE numbers for their own products (e.g., Microsoft, Oracle, HP, Red Hat)

✅A third-party coordinator such as CERT Coordination Center may assign CVE numbers for products not covered by other CNAs

⛳️CVE Numbering Authority (CNA)
@Engineer_Computer

Fast Detection , Fast Respond

PSIRT Advisories
FortiOS - Plain-text credentials in GET request via SSL VPN web portal

Summary
A use of GET request method with sensitive query strings vulnerability [CWE-598] in the FortiOS SSL VPN component may allow an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services (found in logs, referers, caches, etc...)

Affected Products FortiOS version 7.4.0
FortiOS version 7.2.0 through 7.2.5
FortiOS version 7.0.0 through 7.0.12

Solutions
Please upgrade to FortiOS version 7.4.1 or above
Please upgrade to FortiOS version 7.2.6 or above
Please upgrade to upcoming FortiOS version 7.0.13 or above

Timeline
2023-09-29: Initial publication

https://www.fortiguard.com/psirt/FG-IR-23-120

⁩@Engineer_Computer

IoT Security
IoT Bug Bounty Hunting

Part 1: https://bugprove.com/knowledge-hub/iot-bug-bounty-hunting-using-bug-prove

Part 2: https://bugprove.com/knowledge-hub/iot-bug-hunting-part-2-walkthrough-of-discovering-command-injections-in-firmware-binaries

⁩@Engineer_Computer

Offensive security
Red Team Tactics

A Hitch-hacker's Guide to DACL-Based Detections
Part 1A: https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a

Part 1B: https://trustedsec.com/blog/a-hitch-hackers-guide-to-dacl-based-detections-part-1b

Part 2: https://trustedsec.com/blog/a-hitch-hackers-guide-to-dacl-based-detections-part-2

Part 3: https://trustedsec.com/blog/a-hitch-hackers-guide-to-dacl-based-detections-part-3

⁩@Engineer_Computer

exploit
1. CVE-2023-20198:
Cisco ISO XE Software Web Management User Interface Vulnerability
https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software

Checknoscript: https://github.com/Atea-Redteam/CVE-2023-20198

2. CVE-2023-36728:
Windows SQL Server Pre-Auth Overflow Read
https://v-v.space/2023/10/16/sqlserver-dos-CVE-2023-36728

3. CVE-2023-38545:
Socks5 heap buffer overflow
https://github.com/d0rb/CVE-2023-38545

⁩@Engineer_Computer

Hardening
‎( امن سازي و مقاوم سازي)
Cisco Secure Firewall Management Center Hardening Guide Ver. 7.2 2023

Cisco Hardening Guides:
https://www.cisco.com/c/en/us/support/security/defense-center/products-installation-and-configuration-guides-list.html

⁩@Engineer_Computer

Tech book
Cloud Security
Design and Deploy a Secure Azure: Environment Mapping the NIST Cybersecurity Framework to Azure Services 2023.
⁩@Engineer_Computer

hardening
Tech book
Cloud Security
AWS Identity and Access Management User Guide 2023.
⁩@Engineer_Computer

یکی از بهترین مخازن کانتنت های اسپلانک
رایگان


This project gives you access to our repository of Analytic Stories, security guides that provide background on tactics, techniques and procedures (TTPs), mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls. They include Splunk searches, machine learning algorithms and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats


https://github.com/splunk/security_content

⁩@Engineer_Computer

ترند های فناورانه در سال ۲۰۲۴
https://www-networkworld-com.cdn.ampproject.org/c/s/www.networkworld.com/article/3708635/gartner-top-strategic-technology-trends-for-2024.amp.html

⁩@Engineer_Computer

۱۰ متخصص امنیت سایبری که دنبال کردن آنها در شبکه های اجتماعی توصیه می‌شود

https://www.techtarget.com/whatis/feature/10-cybersecurity-experts-to-follow-on-social-media

⁩@Engineer_Computer