資安事件新聞週報 2021/6/21 ~ 2021/6/25

 資安事件新聞週報 2021/6/21  ~  2021/6/25

1.重大弱點漏洞/後門/Exploit/Zero Day
VMware Releases Security Updates
https://us-cert.cisa.gov/ncas/current-activity/2021/06/23/vmware-releases-security-updates

VMware vCenter Server RCE 6.5 / 6.7 / 7.0 - Remote Code Execution (RCE) (Unauthenticated)
https://www.exploit-db.com/exploits/50056

Solaris SunSSH 11.0 x86 - libpam Remote Root (3)
https://www.exploit-db.com/exploits/50039

Cisco Releases Security Updates for Multiple Products
https://us-cert.cisa.gov/ncas/current-activity/2021/06/17/cisco-releases-security-updates-multiple-products

群暉 Synology 宣布 DSM 7.0 將於 6/29 推出正式版以及 C2 公有雲四項新服務
https://news.xfastest.com/interview/96968/%E7%BE%A4%E6%9A%89-synology-%E5%AE%A3%E5%B8%83-dsm-7-0-%E5%B0%87%E6%96%BC-6-29-%E6%8E%A8%E5%87%BA%E6%AD%A3%E5%BC%8F%E7%89%88%E4%BB%A5%E5%8F%8A-c2-%E5%85%AC%E6%9C%89%E9%9B%B2%E5%9B%9B%E9%A0%85%E6%96%B0/

Dell裝置的管理軟體SupportAssist再爆4漏洞，將允許駭客自遠端執行程式
https://www.ithome.com.tw/news/145255

WD呼籲「My Book Live」用戶快把網路線拔掉，否則硬碟內容可能會被駭客清空
https://www.techbang.com/posts/87940-wd-calls-for-my-book-live

合勤警告SSL VPN、防火牆裝置遭駭客鎖定
https://www.ithome.com.tw/news/145256

一週釋出兩次更新！Google 緊急修補 4 項 Chrome 高風險漏洞
https://3c.ltn.com.tw/news/44868

資安事件新聞週報 2021/6/14 ~ 2021/6/18

 資安事件新聞週報 2021/6/14  ~  2021/6/18

1.重大弱點漏洞/後門/Exploit/Zero Day
Zoll心臟電擊器管理軟體重大漏洞可上傳Excel檔執行惡意指令
https://www.ithome.com.tw/news/145056

CISA Releases Advisory on ZOLL Defibrillator Dashboard
https://us-cert.cisa.gov/ncas/current-activity/2021/06/14/cisa-releases-advisory-zoll-defibrillator-dashboard

Google App爆資安漏洞！用戶隱私數據面臨風險
https://newtalk.tw/news/view/2021-06-18/590929

Cisco Releases Security Updates for Multiple Products
https://us-cert.cisa.gov/ncas/current-activity/2021/06/17/cisco-releases-security-updates-multiple-products

7-Year-Old Polkit Flaw Lets Unprivileged Linux Users Gain Root Access
https://thehackernews.com/2021/06/7-year-old-polkit-flaw-lets.html

資安事件新聞週報 2021/6/7 ~ 2021/6/11

 資安事件新聞週報 2021/6/7  ~  2021/6/11

1.重大弱點漏洞/後門/Exploit/Zero Day
GitHub Updates Policy to Remove Exploit Code When Used in Active Attacks
https://thehackernews.com/2021/06/github-updates-policy-to-remove-exploit.html

F5 Networks BIG-IP : BIG-IP APM ACL bypass vulnerability (K75540265)
https://www.tenable.com/plugins/nessus/150460

New UAF Vulnerability Affecting Microsoft Office to be Patched Today
https://thehackernews.com/2021/06/new-uaf-vulnerability-affecting.html

10 Critical Flaws Found in CODESYS Industrial Automation Software
https://thehackernews.com/2021/06/10-critical-flaws-found-in-codesys.html

Check Point在Microsoft Office中發現四個安全漏洞
https://finance.sina.com.cn/tech/2021-06-09/doc-ikqcfnca0056198.shtml

微軟 6 月的星期二補丁：修補了 50 個漏洞，六個零日漏洞被廣泛利用
https://docsxyz.com/zh-hant/wiki/news/microsoft-june-2021-patch-tuesday-20210609

Update Your Windows Computers to Patch 6 New In-the-Wild Zero-Day Bugs
https://thehackernews.com/2021/06/update-your-windows-computers-to-patch.html

資安事件新聞週報 2021/5/31 ~ 2021/6/4

 資安事件新聞週報 2021/5/31  ~  2021/6/4

1.重大弱點漏洞/後門/Exploit/Zero Day
Fortinet fixed a Post-Auth RCE in FortiWeb (CVE-2021-22123)
https://www.fortiguard.com/psirt/FG-IR-20-120

Researchers Warn of Critical Bugs Affecting Realtek Wi-Fi Module
https://thehackernews.com/2021/06/researchers-warn-of-critical-bugs.html

Open Source Vulnerabilities Converging DevOps & SecOps
https://cybersecdn.com/index.php/2021/05/31/open-source-vulnerabilities-converging-devops-secops/

FBI警告APT組織廣泛開採各類已知漏洞，廠商給修補但使用者無作為，等於坐等被入侵
https://www.ithome.com.tw/news/144692

SonicWall產品存在安全性弱點
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0014

Newly Discovered Bugs in VSCode Extensions Could Lead to Supply Chain Attacks
https://thehackernews.com/2021/05/newly-discovered-bugs-in-vscode.html

CSS-WHAT PACKAGE 直到5.0.0 於NODE.JS ATTRIBUTE 未知漏洞
https://vuldb.com/zh/?id.176096

RHEL 7 : kernel-alt (RHSA-2021:1379)
https://www.tenable.com/plugins/nessus/149235

Hackers‌ ‌Actively‌ ‌Exploiting‌ ‌0-Day‌ ‌in WordPress Plugin Installed on Over ‌17,000‌ ‌Sites
https://thehackernews.com/2021/06/hackers-actively-exploiting-0-day-in.html

資安事件新聞週報 2021/5/24 ~ 2021/5/28

 資安事件新聞週報 2021/5/24  ~  2021/5/28

1.重大弱點漏洞/後門/Exploit/Zero Day
New High-Severity Vulnerability Reported in Pulse Connect Secure VPN
https://thehackernews.com/2021/05/new-high-severity-vulnerability.html

Updates to Alert on Pulse Connect Secure
https://us-cert.cisa.gov/ncas/current-activity/2021/05/27/updates-alert-pulse-connect-secure

Synology 14 項套件的生命週期終止公告
https://www.synology.com/zh-tw/products/status/EOL_announcement_for_synology_package_202105

CVE-2021-21985: VMware vCenter Server遠程代碼執行漏洞通告
https://cert.360.cn/warning/detail?id=21bda4287b2b47416e93cc7817bf4a1a

VMware虛擬化解決方案發現遠程代碼執行漏洞
https://finance.sina.com.cn/tech/2021-05-26/doc-ikmyaawc7657251.shtml

Critical RCE Vulnerability Found in VMware vCenter Server — Patch Now!
https://thehackernews.com/2021/05/critical-rce-vulnerability-found-in.html

研究人員揭露PDF規格的兩個安全漏洞，將允許駭客偷偷竄改已認證文件內容
https://www.ithome.com.tw/news/144669

macOS 連爆多個 0-Day 漏洞 !! 黑客可取得 Mac 設備的麥克風、鏡頭、屏幕錄影等權限
https://hk.xfastest.com/116752/apple-macos-0-day-loopholes/

macOS 曝重大零日漏洞！蘋果釋出修復版本，用戶盡快更新以免遭駭
https://3c.ltn.com.tw/news/44487

Ｍac重大漏洞更新　防駭客偷錄螢幕隱私
https://tw.appledaily.com/gadget/20210526/X3BFYPLDFJHYXOHO7P7N47EGUI/

Apple‌ Issues Patches to Combat Ongoing 0-Day Attacks on macOS, tvOS
https://thehackernews.com/2021/05/apple-issues-patches-to-combat-ongoing.html

Apple Security Update for Safari - Exploitation in the Wild Reported
https://support.apple.com/en-us/HT212340

設計違反ARM架構規範！蘋果M1曝出無法修復漏洞
https://www.eet-china.com/mp/a53737.html

Unfixable Apple M1 chip bug enables cross-process chatter, breaking OS security model
https://www.theregister.com/2021/05/27/apple_m1_chip_bug/

廣告商可能竊取資訊　外媒：蘋果M1具有安全漏洞
https://finance.ettoday.net/amp/amp_news.php7?news_id=1992330

資安事件新聞週報 2021/5/17 ~ 2021/5/21

 資安事件新聞週報 2021/5/17  ~  2021/5/21

1.重大弱點漏洞/後門/Exploit/Zero Day
Google I / O之前的新漏洞聲稱Android 12可能包括小部件和通知的更改
https://www.inin.news/?p=15627

Android Issues Patches for 4 New Zero-Day Bugs Exploited in the Wild
https://thehackernews.com/2021/05/android-issues-patches-for-4-new-zero.html

Android的5月安全更新已有4個漏洞遭到開採
https://www.ithome.com.tw/news/144536

MikroTik RouterOS 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-20214

Cisco Link Layer Discovery Protocol緩衝區溢出漏洞
https://vul.wangan.com/a/CNVD-2021-35515

Qnap Systems Malware Remover 操作系统命令注入漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36198

RHEL 7 / 8 : Ansible security update (2.9.20) (Moderate) (RHSA-2021:1343)
https://www.tenable.com/plugins/nessus/148945

ORACLE SOLARIS 10 BASH 未知漏洞
https://vuldb.com/zh/?id.92787

ORACLE WEBCENTER CONTENT 10.1.3.5.1/11.1.1.6.0/11.1.1.7.0 SITE STUDIO 未知漏洞
https://vuldb.com/zh/?id.9607

Oracle Secure Global Desktop輸入驗證錯誤漏洞
https://www.oracle.com/security-alerts/cpuapr2021.html

ORACLE HTTP SERVER 11.1.1.7.0/12.1.2.0 PLUGIN 1.1 未知漏洞
https://vuldb.com/zh/?id.67085

資安事件新聞週報 2021/5/10 ~ 2021/5/14

 資安事件新聞週報 2021/5/10  ~  2021/5/14

1.重大弱點漏洞/後門/Exploit/Zero Day
所有Wi-Fi裝置皆存在FragAttacks漏洞，可被駭客用來竊取個人資訊和攻擊裝置
https://www.ithome.com.tw/news/144352

Nearly All Wi-Fi Devices Are Vulnerable to New FragAttacks
https://thehackernews.com/2021/05/nearly-all-wifi-devices-are-vulnerable.html

研究人員再掀蘋果AirTag與Find My安全漏洞
https://www.ithome.com.tw/news/144390

模仿 AirTag 傳輸模式！資安業者：蘋果「Find My」功能恐有安全漏洞
https://www.inside.com.tw/article/23500-find-my-network-arbitrary-data-messages

Juniper 產品存在安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/05/11/juniper-networks-releases-security-updates

CVE-2021-21551- Hundreds of Millions of Dell Computers at Risk Due to Multiple BIOS Driver Privilege Escalation Flaws
https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/

Windows版Cisco AnyConnect Secure Mobility Client
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1496
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1430
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1429
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1428
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1427

Cisco Security Advisory - May 11 2021
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu

Cisco 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/05/06/cisco-releases-security-updates-multiple-products