Tencent Security Xuanwu Lab Daily News

• CVE-2023-42753: New Linux Kernel Flaw Allows Code Execution:
https://securityonline.info/cve-2023-42753-new-linux-kernel-flaw-allows-code-execution/

   ・ CVE-2023-42753：新的 Linux 内核缺陷允许代码执行  – SecTodayBot

• Critical Authentication Bypass in JetBrains TeamCity CI/CD Servers:
https://blog.rapid7.com/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/

   ・ JetBrains TeamCity CI/CD 服务器远程代码执行漏洞  – SecTodayBot

• ShellSweep:
https://github.com/MHaggis/ShellSweep

   ・ ShellSweep 是一个 PowerShell/Python/Lua 工具，旨在检测指定目录中潜在的 webshell 文件。ShellSheep 及其工具套件计算文件内容的熵，以估计文件是 Webshell 文件的可能性  – SecTodayBot

• Deep Dive into Reverse Engineering on Android:
https://bit.ly/3EMTiHt

   ・ 深入了解 Android 上的逆向工程 – SecTodayBot

• Rooting Xiaomi WiFi Routers:
https://blog.thalium.re/posts/rooting-xiaomi-wifi-routers/

   ・ 小米AIoT路由器通过OpenWrt的luci Lua包远程代码执行漏洞披露  – SecTodayBot

• GitHub - avogabos/ai_security_starterkit:
https://github.com/avogabos/ai_security_starterkit

   ・ AI SecurityStarterkit - 一个脚本存储库，旨在通过 AI 实现安全各个方面的自动化。该存储库旨在帮助您测试和迭代，然后扩展并合并到更广泛的安全自动化工作流程中。 – SecTodayBot

• CVE-2023-40477 Root Cause Analysis:
https://www.richardosgood.com/posts/cve---2023---4047-root-cause-analysis/

   ・ CVE-2023-40477 WinRAR 版本 6.22 及更低版本中RCE漏洞的根本原因分析 – SecTodayBot

• [P2O Vancouver 2023] SharePoint Pre-Auth RCE chain (CVE-2023–29357 & CVE-2023–24955):
https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/

   ・ Pwn2Own 温哥华 2023 - SharePoint RCE利用链分析 – SecTodayBot

• Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980):
https://pwning.tech/ksmsbd/

   ・ ZDI-22-1690，Linux内核ksmbd子系统中未经身份验证的RCE漏洞 – SecTodayBot

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab