1月9日每日安全热点 - Git服务器导致Nissan源代码泄露

360安全客 安全资讯 1686 4

漏洞 Vulnerability
lanproxy 目录遍历漏洞（CVE-2020-3019）
https://help.aliyun.com/noticelist/articleid/1060779015.html?spm=a2c4g.789213612.n2.6.76086141ycZsKG
致远OA 文件上传漏洞
https://cert.360.cn/warning/detail?id=dd60abf4d293b5031d11e17a38a6b547
CVE-2020-11800 zabbix RCE漏洞细节披露
https://xz.aliyun.com/t/8991
安全事件 Security Incident
由于暴露的Git服务器而导致Nissan源代码泄露
https://www.ehackingnews.com/2021/01/nissan-source-code-compromised-online.html?utm_source=dlvr.it&utm_medium=twitter
挖矿僵尸网络现在正在窃取Docker和AWS凭证
https://www.zdnet.com/article/a-crypto-mining-botnet-is-now-stealing-docker-and-aws-credentials/
安全研究 Security Research
浅析开源蜜罐识别与全网测绘
https://mp.weixin.qq.com/s/hq-z2HBGz3nehnCVg_H-RQ
Apache Flink 多个漏洞分析
https://mp.weixin.qq.com/s/RN-cr1wT-5_xwnkZgwa5gg
对 SolarWinds 事件更深的思考：如何防御供应链攻击
https://mp.weixin.qq.com/s/GdER32Z7K86boHVc-Kic3g
ThinkPHP v3.2.* （SQL注入&文件读取）反序列化POP链
https://mp.weixin.qq.com/s/S3Un1EM-cftFXr8hxG4qfA
MQTT安全初探
https://mp.weixin.qq.com/s?__biz=MzUzMjcxMzg5Mg==&mid=2247487921&idx=1&sn=dabc68501c368eef0434bc16bd01dfa4
Kubernetes中使用Helm2的安全风险
http://rui0.cn/archives/1573
（完）