12月5日每日安全热点 - 安全团队发现两个窃取密钥的Python库

2019-12-05 10:15:23 360安全客安全资讯 86249 4

漏洞 Vulnerability

CVE-2019-5096：GoAhead 存在远程代码执行漏洞

https://securityaffairs.co/wordpress/94692/hacking/goahead-rce.html

CVE-2019-3990：Harbor用户枚举漏洞；CVE-2019-19023：Harbor权限提升漏洞

https://github.com/goharbor/harbor/security/advisories

CVE-2019-5083，CVE-2019-5076：Accusoft ImageGear多个远程代码执行漏洞

https://www.securityweek.com/code-execution-vulnerabilities-patched-accusoft-imagegear?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Securityweek+%28SecurityWeek+RSS+Feed%29

恶意软件 Malware

ZeroCleare：针对中东能源和工业部门的新型恶意软件

https://www.ibm.com/downloads/cas/OAJ4VZNJ?_ga=2.14679415.131279418.1575508386-1462884372.1575508386&cm_mc_uid=02634860646115755083868&cm_mc_sid_50200000=61019311575508386902

研究人员发现了一个新的macOS恶意软件样本

https://www.bleepingcomputer.com/news/security/new-macos-threat-served-from-cryptocurrency-trading-platform/

PyXie: 基于Python的新型远程访问木马（RAT）

http://feedproxy.google.com/~r/Securityweek/~3/CsbIvha8wC4/new-pyxie-rat-used-against-multiple-industries

安全事件 Security Incident

Python 安全团队发现两个窃取SSH和GPG密钥的Python库

https://securityaffairs.co/wordpress/94715/hacking/malicious-python-libraries.html

安全研究 Security Research

一篇文章带你读懂 HTTP Smuggling 攻击

https://xz.aliyun.com/t/6878

将MITRE ATT＆CK模型应用于网络设备

https://www.freebuf.com/articles/es/220628.html

FreeIPA安全研究第二部分–枚举

https://posts.specterops.io/attacking-freeipa-part-ii-enumeration-ad27224371e1?source=rss—-f05f8696e3cc—4

（完）