Продолжаем рассказывать о рождении и развитии индустрии полупроводников, транзисторов и микросхем, без которых были бы невозможны любые современные электронные устройства. В прошлой статье мы остановились на 1954 году, когда ученые из компании Texas Instruments создали первый кремниевый транзистор. В этом материале мы расскажем об изобретении интегральной микросхемы и процессора, создании первого массового компьютера и о состоянии полупроводниковой индустрии сегодня. Читать далее
Смартфоны с гибким дисплеем уже давно стали привычными. Помню, как после выхода в продажу первого такого девайса новости об этом появились везде, даже на самых непрофильных ресурсах. Сейчас же моделей смартфонов со складным экраном уже несколько десятков, если учитывать…
Когда речь заходит о получении водительских прав, многие люди задаются вопросом о том, как можно быстро и легко получить эту нужную документацию, права купить. Однако, стоит отметить, что законодательство предусматривает определенные требования и сроки для прохождения обучения и сдачи экзаменов. Поэтому, чтобы не нарушать закон и обеспечить свою безопасность на дороге, необходимо правильно выбрать автошколу […] Сообщение Как быстро получить «права»? появились сначала на Androha.ru.
The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.
The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available…
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.
External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability. Improvements were made to include deny-lists not only during the check of the provided connection data,
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.