1、三星SecEmailUI脚本注入

https://code.google.com/p/google-security-research/issues/detail?id=494

https://www.exploit-db.com/exploits/38554/

2、三星Galaxy S6: Samsung Gallery 应用gif解析crash漏洞POC

https://www.exploit-db.com/exploits/38610/

3、三星Galaxy S6: android.media.process脸部识别内存损坏POC

https://www.exploit-db.com/exploits/38611/

4、关于redis安全的一些小事,国内是通过已知路径直接写webshell的,他这里是写ssh私钥,实现远程SSH连接

http://antirez.com/news/96

5、有关Docker安全的三个很好的资源

http://events.linuxfoundation.org/sites/events/files/slides/Containers,%20Docker,%20and%20Security_%20State%20of%20the%20Union.pdf

http://opensource.com/business/14/9/security-for-docker

https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.6_Benchmark_v1.0.0.pdf

6、vBulletin 5.x.x 远程代码执行0day的演示视频,以及怀疑利用这个0DAY攻击了foxit(一款流行的PDF阅读软件)论坛,导致用户信息被盗

http://www.databreaches.net/vbulletin-foxit-software-forums-hacked-by-coldzer0-hundreds-of-thousands-of-users-info-stolen/

http://0day.today/exploit/description/24492

https://www.youtube.com/watch?v=5x4upULiQ4s

7、有关 PKCS#11 HSM 漏洞不能说的秘密

https://cryptosense.com/the-untold-story-of-pkcs11-hsm-vulnerabilities/

8、namp 6.49BETA6发行了,增加了10个新的NSE脚本,新的OS指纹库探测等新功能。另外一篇在渗透时,用NMAP做探测不错的技巧文章

http://seclists.org/nmap-announce/2015/5

https://isc.sans.edu/forums/diary/Enhancing+pentesting+recon+with+nmap/20331

9、XcodeGhost S:在美国发现新的变种

https://www.fireeye.com/blog/threat-research/2015/11/xcodeghost_s_a_new.html

10、t1msammut分享了一个技巧:本地wireshark通过ssh连接远程查看tcpdump实时抓包

wireshark -k -i <(ssh root@host "tcpdump -i eth1 -w -")

11、PathArmor:使用Context-sensitive CFI实践rop保护

http://labs.lastline.com/patharmor-practical-rop-protection-using-context-sensitive-cfi