Exploits | Containing Self Made Perl Reproducers / PoC Codes | Computer Vision library

ok, I have the following method in an angular-cli service, I use it to update a table in "real time", pipe and tap, they work as I want, the bad thing is that it makes the http.get request constantly and obviously that's what it does which exploits the memory of the browser. I know that I can make a POST method and add the pipe and tap there, I add a button in my interface to add a new record and it is updated in real time (that works and is ideal). Unfortunately the http.POST method I use is in .dart / flutter. That is why I use pipe and tap in my angular http.GET getOrders method, so I find myself observing the changes, but what I want is to observe the changes as long as there is one. But what is happening is that this making call after call to the API asking if another new record was added, if it is correct it updates the view. How do I solve that?

control-de-carga-service.ts

So I'm fetching an API call which I'm then trying to iterate over in order to display as a list. My code so far is:

I just installed @Vue-cli and I decided to create my first project using Vue3. After running vue create hello-world and it finished building the project, the cli said 7 moderate severity vulnerabilities

How bad are these? moderate is very subjective. I tried running npm audit fix --force which instead said 28 vulnerabilities (16 moderate, 12 high).

Is this just one of the things you should just accept and hope that no one exploits the vulnerabilities?

After running npm audit it said this

I have a MySql server locally (on Windows 10) and want to run a python script from a trigger. For taht, i want to use sys_exec(). I got the lib_mysqludf_sys_64.dll from here: https://github.com/rapid7/metasploit-framework/tree/master/data/exploits/mysql

and set the UDF up as described here: https://osandamalith.com/2018/02/11/mysql-udf-exploitation/

sys_exec is working:

From various sources, I have come to the understanding that there are four main techniques of string formatting/interpolation in Python 3 (3.6+ for f-strings):

1. Formatting with %, which is similar to C's printf
2. The str.format() method
3. Formatted string literals/f-strings
4. Template strings from the standard library string module

My knowledge of usage mainly comes from Python String Formatting Best Practices (source A):

• str.format() was created as a better alternative to the %-style, so the latter is now obsolete
  • However, str.format() is vulnerable to attacks if user-given format strings are not properly handled
• f-strings allow str.format()-like behavior only for string literals but are shorter to write and are actually somewhat-optimized syntactic sugar for concatenation
• Template strings are safer than str.format() (demonstrated in the first source) and the other two methods (implied in the first source) when dealing with user input

I understand that the aforementioned vulnerability in str.format() comes from the method being usable on any normal strings where the delimiting braces are part of the string data itself. Malicious user input containing brace-delimited replacement fields can be supplied to the method to access environment attributes. I believe this is unlike the other ways of formatting where the programmer is the only one that can supply variables to the pre-formatted string. For example, f-strings have similar syntax to str.format() but, because f-strings are literals and the inserted values are evaluated separately through concatenation-like behavior, they are not vulnerable to the same attack (source B). Both %-formatting and Template strings also seem to only be supplied variables for substitution by the programmer; the main difference pointed out is Template's more limited functionality.

I have seen a lot of emphasis on the vulnerability of str.format() which leaves me with questions of what I should be wary of when using the other techniques. Source A describes Template strings as the safest of the above methods "due to their reduced complexity":

The more complex formatting mini-languages of the other string formatting techniques might introduce security vulnerabilities to your programs.

1. Yes, it seems like f-strings are not vulnerable in the same way str.format() is, but are there known concerns about f-string security as is implied by source A? Is the concern more like risk mitigation for unknown exploits and unintended interactions?

I am not familiar with C and I don't plan on using the clunkier %/printf-style formatting, but I have heard that C's printf had its own potential vulnerabilities. In addition, both sources A and B seem to imply a lack of security with this method. The top answer in Source B says,

String formatting may be dangerous when a format string depends on untrusted data. So, when using str.format() or %-formatting, it's important to use static format strings, or to sanitize untrusted parts before applying the formatter function.

1. Do %-style strings have known security concerns?
2. Lastly, which methods should be used and how can user input-based attacks be prevented (e.g. filtering input with regex)?
   • More specifically, are Template strings really the safer option? and Can f-strings be used just as easily and safely while granting more functionality?

I'm not an expert in cyber security and exploits. I need help figuring out if my app is vulnerable and in what way.

Let's assume I'm an idiot (and I'm not to this extent), and I leave the possibility for client users to upload (exploiting my front end) any file they want on my server in a subfolder (let's call it 'danger') of my ASP.NET application, hosted on IIS. Being that way, anybody can upload a generic example.hml file and access it back at the url mydomain.com/danger/example.html. They can also upload JS files and whatever they want.

Let's forget for a moment the fact they can fill my disk.

Given I prevented ASP execution from files in that folder, what kind of damage can I be subjected to?

Thanks in advance.

I'm making a small program with Python and openpyxl. I have created a function and I would like to reuse it according to a conditional, I have seen that eval() can be dangerous for possible exploits of attackers.

But using the eval() method in a local program, where the conditionals are not passed by the user, is it dangerous? do you have any alternative to modify my code and use it the way I want without the use of eval()?

The function have to move the values from one or multiple cols to another col/cols depending on a certain condition.

The function doesn't work now, I want to clarify myself first and then I will write it. I hope you understand what I want to do.

JavaScript is returning the error: Uncaught TypeError: clickerLink.select is not a function.

I'm trying to make a button copy a certain string.
copy\

We have received the following policy violation after implementing the Google Play SMS retriever for two-factor authentication. After fixing it by following the documentation and resubmitting, it was rejected again.

Step 1: Fix the policy violation with your app

During review, we found that your app...APK Versions..., violates the Device and Network Abuse policy:

We don’t allow code that introduces or exploits security vulnerabilities. Check out the App Security Improvement Program to find out about the most recent security issues flagged to developers. You can read through the Device and Network Abuse policy page for more details and examples of common violations.

For example, your app contains an Intent Redirection issue which can allow malicious apps to access private app components or files.

{package name}.modules.smsuserconsent.c.onReceive

Following the documentation (https://support.google.com/faqs/answer/9267555) we have decided to fix it by using: Option 2:

Option 2: Ensure that the extracted Intent is from a trustworthy source.
You can verify that the originating Activity can be trusted using methods like getCallingActivity. For example: