2020年 12 月份資安、社群活動分享

 

2020年 12 月份資安、社群活動分享

物聯網資安標章成果發表會 2020/12/01
https://www.taics.org.tw/RecentACTForm.aspx?ACTCat_id=1&ACT_id=11148

從Python到TensorFlow線上讀書會-首部曲(4) -文字字串 12/1
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/274522516

Taipei Rails Meetup 12/1
https://www.meetup.com/rails-taiwan/events/274804079

Badminton Time, come to join us!! Sign up for limited spots. 12/1
https://www.meetup.com/Taipei-Doubles-Badminton-Meetup/events/272208391

資安社 - 大學之道WebSec 12/2
https://nsysuisc.kktix.cc/events/2020websec

比特幣的重要性 12/2
https://www.meetup.com/Taiwan-Bitcoin-Only-Meetup/events/274363177

Taipei Creative Coders Meetup #3 12/2
https://www.meetup.com/tpecreativecoders/events/274688379

國家高速網路與計算中心 教育訓練 【資安中階課程】弱點掃描分析 12/3 (報名到12/1截止)
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3932&from_course_list_url=course_index

資安事件新聞週報 2020/11/23 ~ 2020/11/27

 

 

資安事件新聞週報 2020/11/23  ~  2020/11/27

1.重大弱點漏洞/後門/Exploit/Zero Day
兩中國製路由器被指有「後門」漏洞　沃爾瑪亞馬遜有售
https://reurl.cc/2gGExn

近五萬台 Fortinet VPN 登入資訊遭竊，全球多家金融機構與政府機關被駭
https://www.twcert.org.tw/tw/cp-104-4175-96cb7-1.html

Fortinet 社製 FortiOS の SSL VPN 機能の脆弱性 (CVE-2018-13379)
https://www.jpcert.or.jp/newsflash/2020112701.html

玩家用蘋果 T2 晶片漏洞　將 Mac 開機聲改成歷代 PlayStation 開機音樂
https://m.eprice.com.tw/tech/talk/1184/5588869/1

Red Hat ceph-ansible 安全漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25677

VMWare 產品多個漏洞
https://www.vmware.com/security/advisories/VMSA-2020-0026.html
https://www.auscert.org.au/bulletins/ESB-2020.4160/

VMware Security Advisory - VMSA-2020-0027
https://www.vmware.com/security/advisories/VMSA-2020-0027.html
https://kb.cert.org/vuls/id/724367

VMWare管理平臺產品Workspace One爆重大指令注入漏洞
https://www.ithome.com.tw/news/141292

資安事件新聞週報 2020/11/16 ~ 2020/11/20

 

資安事件新聞週報 2020/11/16  ~  2020/11/20

1.重大弱點漏洞/後門/Exploit/Zero Day
臺灣未修補SMBGhost漏洞電腦全球最多，存在漏洞的電腦每5臺就有1臺在臺灣
https://www.ithome.com.tw/news/141225

Apple Lets Some of its Big Sur macOS Apps Bypass Firewall and VPNs
https://thehackernews.com/2020/11/apple-lets-some-of-its-big-sur-macos.html

Researcher Discloses Critical RCE Flaws In Cisco Security Manager
https://thehackernews.com/2020/11/researcher-discloses-critical-rce-flaws.html

英特爾CPU曝出漏洞：監視功耗就能輕鬆獲取數據
https://www.techbang.com/posts/82581-intel-cpu-platypus-attack

Intel Security Advisories
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00439.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00446.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00447.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00449.html

PrestaShop 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26224

SAP Security Patch Day – November 2020
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571

IBM Security Family PAM Content Update 4011.06142
https://exchange.xforce.ibmcloud.com/collection/9a90489777df83e8b915bab3f75d39fd

資安事件新聞週報 2020/11/9 ~ 2020/11/13

 

資安事件新聞週報 2020/11/9  ~  2020/11/13

1.重大弱點漏洞/後門/Exploit/Zero Day

拒絕展延修補寬限期，Google準時公布GitHub高風險漏洞

https://www.ithome.com.tw/news/140965

【漏洞預警】Google Chrome瀏覽器存在安全漏洞(CVE-2020-16009)，允許攻擊者遠端執行任意程式碼，請儘速確認並進行更新

https://www.tcrc.edu.tw/new/new-list/google-chrome-cve-2020-16009

WordPress 擴充套件 wp-file-manager 漏洞，遭大規模用於駭侵攻擊

https://www.twcert.org.tw/tw/cp-104-4125-20090-1.html

Apple Watch Series 輸入驗證錯誤漏洞

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10017

VMware ESXi 高危漏洞的補丁被指不完整

https://blog.csdn.net/smellycat000/article/details/109523748

安全預警- Netlogon提權安全漏洞

https://www.huawei.com/cn/psirt/security-advisories/2020/huawei-sa-20201105-01-netlogon-cn

資安事件新聞週報 2020/11/2 ~ 2020/11/6

 

資安事件新聞週報 2020/11/2  ~  2020/11/6

1.重大弱點漏洞/後門/Exploit/Zero Day
Apache Tomcat WebSocket拒絕服務漏洞（CVE-2020-13935）EXP公開，黑客攻擊正迫在眉睫
https://s.tencent.com/research/report/1172.html

Trend Micro InterScan Messaging Security Virtual Appliance 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27019

Tomcat WebSocket拒絕服務漏洞（CVE-2020-13935）利用代碼公開預警
https://www.huaweicloud.com/notice/2018/20201106173340446.html

Fortinet FortiMail 授權問題漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15933

CloudBees Jenkins Active Directory Plugin 授權問題漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2302

Fedora 33 : yubihsm-shell (2020-8afd443d46)
https://www.tenable.com/plugins/nessus/142040

Cisco IP Phone 8800 Series和Cisco IP Phone 7800 Series 安全漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3574

思科揭露已有攻擊程式問世的AnyConnect零時差漏洞
https://www.ithome.com.tw/news/140945