資安事件新聞週報 2019/2/18 ~ 2019/2/22

資安事件新聞週報  2019/2/18  ~  2019/2/22
1.重大弱點漏洞
多個廠商IP Camera未授權遠程命令執行漏洞
https://www.seebug.org/vuldb/ssvid-97810
Dell SonicWall SonicOS 安全漏洞  CVE-2018-9867
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9867
VyOS權限提升漏洞  CVE-2018-18556
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18556
WinRAR 被曝存在遺留19年的漏洞，影響全球多達5億用戶
https://www.freebuf.com/news/196281.html
存在 14 年的 WinRAR 安全漏洞終於修復
https://www.twcert.org.tw/subpages/securityInfo/securitypolicy_details.aspx?id=810
WinRAR versions released in the last 19 years impacted by severe security flaw
https://www.zdnet.com/article/winrar-versions-released-in-the-last-19-years-impacted-by-severe-security-flaw/#ftag=RSSbaffb68
Severe vulnerabilities uncovered in popular password managers
https://www.zdnet.com/article/critical-vulnerabilities-uncovered-in-popular-password-managers/#ftag=RSSbaffb68
安全播報：新型POODLE攻擊漏洞，影響TLS 1.2協議
https://wosign.com/news/news_2019021402.htm
D-Link DIR-823G無需驗證重啟漏洞  CVE-2018-17880
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17880
OfficeScan XG SP1 重大更新通知 CP5294
http://www.trend.com.tw/support/downloads/OSCE/12/TC/patch/osce_xg_sp1_win_zh_tw_criticalpatch_5294_Readme.html
Polycom RealPresence Web Suite信息泄露漏洞 CVE-2018-12592
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12592
JVNVU#97449410 Microsoft Exchange 2013 およびそれ以降における NTLM 中継攻撃が可能な脆弱性
https://jvn.jp/vu/JVNVU97449410/
微軟修補IIS造成CPU使用率飆到100%的漏洞
https://ithome.com.tw/news/128905
微軟 Internet Information Services (IIS) 阻斷服務漏洞
https://www.bleepingcomputer.com/news/security/windows-servers-vulnerable-to-iis-resource-exhaustion-dos-attacks/

資安新聞及事件週報 2018/2/19 ~ 2018/2/22

資安新聞及事件週報  2018/2/19  ~  2018/2/22

**1.重大弱點漏洞**
   
    NVIDIA發現處理器漏洞新變種：成功黑掉一臺i7 Macbook
    https://www.dailyfocus.cc/p/102724.html


    幽靈、熔斷漏洞出現新變種
    https://itw01.com/IN6QEX4.html


    微軟這次修復了 50 個漏洞，有 14 個關鍵漏洞
    https://gogonews.cc/article/3193241.html?


    趨勢科技數款軟體UMH模組具DLL劫持弱點，另IMSVA日誌內容遭任意存取
    https://www.twcert.org.tw/subpages/securityInfo/loophole_details.aspx?id=4897


    聯想Broadcom芯片組安全漏洞曝光，至少25款ThinkPad受影響
    http://www.anquanxue.com/secure/7408.html


    用 uTorrent 載片的人注意！軟體出現重大漏洞，一不小心就會被駭客搞死
    http://www.limitlessiq.com/news/post/view/id/3655/


    輕鬆登錄他人的NetGear路由器，無需密碼
    https://www.pixpo.net/others/0IOFP3XZ.html


    駭客探勘PYBITMESSAGE 0.6.2即時通0-DAY漏洞，利用RCE竊取比特幣錢包
    https://www.twcert.org.tw/subpages/securityInfo/loophole_details.aspx?id=4899

資安事件新聞週報 2019/2/11 ~ 2019/2/15

資安事件新聞週報  2019/2/11  ~  2019/2/15
1.重大弱點漏洞
Imperva：2018 Web 應用漏洞數量比2017 增加了21％
https://www.codercto.com/a/51263.html
Cisco Network Assurance Engine（NAE） 存在安全性弱點
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190212-nae-dos
The State of Web Application Vulnerabilities in 2018
https://www.imperva.com/blog/the-state-of-web-application-vulnerabilities-in-2018/
Wordpress外掛漏洞讓駭客得以接管網站
https://www.ithome.com.tw/news/128704?fbclid=IwAR3Hc8Fphi-hjS985qUa3FjCqJH6hovv94R1TL7-YwcfJxRYcbV11SUJqo4
用戶投訴美國交友平台OKCupid:系統漏洞致帳號遭攻擊
https://news.sina.com.tw/article/20190211/29990794.html
微軟一口氣推出 77 項產品更新修補程式
https://www.twcert.org.tw/subpages/securityInfo/securitypolicy_details.aspx?id=800
微軟資安中心指出，0Day 攻擊比例日漸上升
https://www.twcert.org.tw/subpages/securityInfo/securitypolicy_details.aspx?id=798
數據揭示Windows漏洞的實際破壞性正在降低
https://news.sina.com.tw/article/20190211/29989630.html
微軟為何推Windows 10強制更新？黑客漏洞攻擊沒活路
https://www.ithome.com/0/408/663.htm

資安事件新聞週報 2/4 ~ 2/8

資安事件新聞週報  2/4  ~  2/8
1.重大弱點漏洞
Marvell Avastar Wi-Fi 多個漏洞
https://www.hkcert.org/my_url/zh/alert/19020802
Zyxel VMG3312-B10B DSL-491HNU-B1B v2 Modem - Cross-Site Request Forgery
https://www.exploit-db.com/exploits/46326
pfSense 2.4.4-p1 - Cross-Site Scripting
https://www.exploit-db.com/exploits/46316
Nessus 8.2.1 - Cross-Site Scripting
https://www.exploit-db.com/exploits/46315
phpMyAdmin 多個漏洞
https://www.hkcert.org/my_url/zh/alert/19020101
廈門航空客服系統任意文件下載漏洞
https://shuimugan.com/bug/view?bug_no=171322
某省出入境便民服务平台存在SQL注射漏洞
https://shuimugan.com/bug/view?bug_no=168827
研究人員發現macOS漏洞：可獲取用戶密碼
https://www.feng.com/iPhone/news/2019-02-07/The-researchers-found-that-the-macOS-to-get-the-user-password_700704.shtml

資安事件新聞週報 1/28 ~ 2/1

資安事件新聞週報  1/28  ~  2/1
1.重大弱點漏洞
偷窺別人隱私！ 陸媒揭「智慧攝影機」漏洞
https://bit.ly/2FPiX5O
防毒軟體反成駭客入口，研究人員揭露ZoneAlarm的權限擴張漏洞
https://www.ithome.com.tw/news/128468
APT/APT-GET RCE Vulnerability (CVE-2019-3462) Handling Guide
https://nsfocusglobal.com/apt-RCE-Vulnerability-Handling-Guide
phpMyAdmin 多個漏洞
https://www.auscert.org.au/bulletins/74738
蘋果官方再次致謝，360成就史上最強“漏洞挖掘大滿貫”
http://www.360.cn/n/10560.html
Apple 發佈多個安全性弱點
https://support.apple.com/en-us/HT201222
蘋果 iOS 零日資料洩露漏洞
https://9to5mac.com/2019/01/28/facetime-bug-hear-audio/
Apple Facetime資訊洩露漏洞
https://www.nccst.nat.gov.tw/VulnerabilityNewsDetail?lang=zh&seq=1415
macOS < 10.14.3 / iOS < 12.1.3 - Kernel Heap Overflow in PF_KEY due to Lack of Bounds Checking when Retrieving Statistics
https://www.exploit-db.com/exploits/46300
macOS < 10.14.3 / iOS < 12.1.3 XNU - 'vm_map_copy' Optimization which Requires Atomicity isn't Atomic
https://www.exploit-db.com/exploits/46299