5月30日每日安全热点 - Apple 多项服务拒绝服务漏洞

360安全客 安全资讯 90007 4

漏洞 Vulnerability
CVE-2020-10977: GitLab任意文件读取漏洞
https://www.freebuf.com/vuls/235982.html
CNVD-2020-30751: Apple 多项服务拒绝服务漏洞
https://www.cnvd.org.cn/flaw/show/CNVD-2020-30751
CNVD-2020-30753: Apple CUPS 打印机系统缓冲区溢出漏洞
https://www.cnvd.org.cn/flaw/show/CNVD-2020-30753
CNVD-2020-30762: NETGEAR网件多款路由器缓冲区溢出漏洞
https://www.cnvd.org.cn/flaw/show/CNVD-2020-30762
安全研究 Security Research
挖洞经验 | 一次性验证密码（OTP）的简单绕过
https://www.freebuf.com/vuls/234844.html
phpmyadmin<4.8.3 XSS挖掘
https://xz.aliyun.com/t/7797
NoSQL注入以及如何避免
https://www.netsparker.com/blog/web-security/what-is-nosql-injection/
安全报告 Security Report
卡巴斯基： WizardOpium APT利用漏洞分析
https://securelist.com/the-zero-day-exploits-of-operation-wizardopium/97086/
paloalto: 实现端侧零信任模型
https://blog.paloaltonetworks.com/2020/05/network-end-to-end-zero-trust/
安全工具 Security Tools
MemoryMapper – 轻量级内存注入工具
https://www.kitploit.com/2020/05/memorymapper-lightweight-library-which.html
Purify – 漏洞管理流程平台
https://www.kitploit.com/2020/05/purify-all-in-one-tool-for-managing.html
（完）