資安事件新聞週報 2020/2/10 ~ 2020/2/14

1.重大弱點漏洞/後門/Exploit/Zero Day
OSSEC-HIDS服務器組件緩衝區溢出漏洞
https://github.com/ossec/ossec-hids/issues/1816

Gemalto Ezio Server訪問控制錯誤漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9158

安全人員發現以色列政府DNS服務器存在Open SSH安全漏洞
https://www.cnbeta.com/articles/soft/939923.htm

中興保全Dr.ID 門禁考勤系統存在安全漏洞
http://net.nthu.edu.tw/2009/mailing:announcement:20200212_01

全景Windows版ServiSign 安控元件存在安全漏洞
http://net.nthu.edu.tw/2009/mailing:announcement:20200212_02

Dell電腦內建管理軟體SupportAssist 爆權限升級漏洞
https://www.ithome.com.tw/news/135782

Oracle Financial Services Applications Banking Payments存在未明漏洞
https://www.oracle.com/security-alerts/cpujan2020.html

Oracle Financial Services Applications FLEXCUBE Investor Servicing存在未明漏洞
https://www.oracle.com/security-alerts/cpujan2020.html

2月份資安社群及教育訓練活動分享

Taipei Rails Meetup  2/11
https://www.meetup.com/rails-taiwan/events/dlgzljybcdbpb/

高雄 Rails Meetup 2/12
https://www.meetup.com/rails-taiwan/events/qxfvjkybcdbqb/

讓遠端工作機會成為你的職場跳板 2/12
https://www.meetup.com/TaipeiWomeninTech/events/268501510/

制御システムセキュリティカンファレンス 2020 2020年2月14日
https://www.jpcert.or.jp/event/ics-conference2020.html

【板橋/2020二月】WordPress #歡迎你來聚 2/15
https://www.meetup.com/Taipei-WordPress/events/268347650/

金融大數據分析平台實作，使用Python實作網路爬蟲，打造自動化分析工具 2/15
https://www.techbang.com/tags/19419

資安事件新聞週報 2020/2/3 ~ 2020/2/7

1.重大弱點漏洞/後門/Exploit/Zero Day
思科交換器多個漏洞
https://tools.cisco.com/security/center/publicationListing.x

可取國際(icatch)DVR攝影主機遭網路惡意入侵，煩請儘速確認並進行韌體更新
https://cert.tanet.edu.tw/prog/showrpt.php?id=3566

IBM WebSphere Application Server 阻斷服務狀況漏洞
https://www.ibm.com/support/pages/node/1285372

Fortinet 產品多個漏洞
https://fortiguard.com/psirt/FG-IR-19-013

Critical OpenSMTPD Bug Opens Linux and OpenBSD Mail Servers to Hackers
https://thehackernews.com/2020/01/openbsd-opensmtpd-hacking.html

Cisco 驚爆重大 CDP 安全漏洞，全球數以百萬計網路裝置拉警報
https://technews.tw/2020/02/06/cisco-flaws-put-millions-of-workplace-devices-at-risk/

思科私有協定CDP遭爆含有5個零時差漏洞，危及數千萬裝置
https://www.ithome.com.tw/news/135697

5 High Impact Flaws Affect Cisco Routers, Switches, IP Phones and Cameras
https://thehackernews.com/2020/02/cisco-cdp-vulnerabilities.html

Webtareas 2.0 - 'id' SQL Injection
https://www.exploit-db.com/exploits/47959

資安事件新聞週報 2020/1/27 ~ 2020/1/31

1.重大弱點漏洞/後門/Exploit/Zero Day
AMD官方驅動疑似包含礦機漏洞，遭Cisco安全檢測系統監控
https://kknews.cc/tech/pvzraxz.html

ASUS SmartHome Gateway HG100拒絕服務漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11060

D-Link DIR-601認證繞過漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16327

IoC Scanner shows if Citrix appliances have been compromised via CVE-2019-19781
https://www.helpnetsecurity.com/2020/01/23/cve-2019-19781-ioc-scanner/

Citrix Application Delivery Controller 嚴重漏洞（CVE-2019-19781）警報
https://www.hkcert.org/my_url/zh/blog/20011702

修補CVE-2020-0601 漏洞了嗎?別讓 Vulnera-Bullies 得逞，快用免費工具檢測
https://blog.trendmicro.com.tw/?p=63228

JIRA plugin ScriptRunner安全漏洞SRPLAT-876
https://blog.51cto.com/13851865/2468436

Patching the Citrix ADC Bug Doesn't Mean You Weren't Hacked
https://www.bleepingcomputer.com/news/security/patching-the-citrix-adc-bug-doesnt-mean-you-werent-hacked/

資安事件新聞週報 2020/1/20 ~ 2020/1/24
1.重大弱點漏洞/後門/Exploit/Zero Day
Google Chrome新版本可防止Windows CryptoAPI驗證漏洞攻擊
https://www.ithome.com.tw/news/135418

Google Chrome Adds Protection for NSA's Windows CryptoAPI Flaw
https://www.bleepingcomputer.com/news/security/google-chrome-adds-protection-for-nsas-windows-cryptoapi-flaw/

Google Chrome 多個漏洞
https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop_16.html

瀏覽網頁更有隱私！Google預計兩年內慢慢淘汰Chrome第三方Cookie
https://n.yam.com/Article/20200117690204

盤點並分析 2019 年發現的 Chromium IPC 漏洞
https://www.chainnews.com/zh-hant/articles/918550449231.htm

Oracle Virtualization VM VirtualBox 安全漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2698

甲骨文修補334個安全漏洞，Oracle MySQL亦有19個漏洞
https://www.insoler.com/forum/topic/15792446180636.htm

關於Oracle WebLogic多個安全漏洞的預警通知
http://zuits.zju.edu.cn/2020/0117/c7943a1957336/pagem.htm

WebLogic遠程代碼執行漏洞預警（CVE-2020-2551、CVE-2020-2546）
https://www.huaweicloud.com/notice/2018/20200116115654037.html

資安事件新聞週報 2020/1/13 ~ 2020/1/17
1.重大弱點漏洞/後門/Exploit/Zero Day
研究人員揭露纜線數據機漏洞Cable Haunt：光在歐洲就波及2億台數據機
https://www.ithome.com.tw/news/135306

可取國際(icatch)DVR攝影主機遭網路惡意入侵，煩請儘速確認並進行韌體更新
http://www.idsmag.com.tw/ids/new_article.asp?ar_id=30954

Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting
https://www.exploit-db.com/exploits/47927

Critical Firefox 0-Day Under Active Attacks – Update Your Browser Now
https://thehackernews.com/2020/01/firefox-cyberattack.html

Symantec Endpoint Detection and Response XSS
https://support.symantec.com/us/en/article.SYMSA1502.html

甲骨文修補334個安全漏洞，平歷史紀錄
https://www.ithome.com.tw/news/135411

F5 BIG-IP Engineering Hotfix 安全漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5851

Juniper 產品多個漏洞
https://www.hkcert.org/my_url/zh/alert/20011001