Tencent Security Xuanwu Lab Daily News

• SLAM: Spectre based on Linear Address Masking:
https://seclists.org/oss-sec/2023/q4/260

   ・ 该文章揭示了基于Linear Address Masking的Spectre漏洞，涉及CPU安全技术的核心漏洞披露与分析。  – SecTodayBot

• TinyDir 1.2.5 Buffer Overflow:
https://packetstormsecurity.com/files/176060

   ・ TinyDir软件1.2.5及以下版本的缓冲区溢出漏洞，提供了详细的分析和漏洞利用的概念验证 – SecTodayBot

• Nikto Web Scanner 2.5.0:
https://packetstormsecurity.com/files/176057

   ・ Nikto是一个开源的Web服务器扫描工具，可以全面测试Web服务器的多个项目，包括3500多个潜在危险的文件/CGI、900多个服务器的版本以及250多个服务器的特定问题。该工具可用于模糊测试。 – SecTodayBot

• CVE-2023-49070: Critical Pre-auth RCE Vulnerability Discovered in Apache OFBiz:
https://securityonline.info/cve-2023-49070-rce-vulnerability-apache-ofbiz/

   ・ Apache OFBiz被发现存在关键的CVE-2023-49070漏洞，允许远程代码执行，攻击者可无需身份验证即可控制服务器 – SecTodayBot

• Exposed Hugging Face API tokens offered full access to Meta's Llama 2:
https://www.theregister.com/2023/12/04/exposed_hugging_face_api_tokens

   ・ Hugging Face平台上API令牌的曝光引发了AI和ML供应链中潜在的安全威胁，包括数据中毒攻击和模型窃取。研究人员发现超过1500个API令牌的曝光，给723个组织的帐户提供了访问权限。这个漏洞的严重性在于可以操纵现有模型，潜在影响数百万依赖这些基础模型的用户。  – SecTodayBot

• Attack Surface of the Ubiquiti Connect EV Station:
https://www.thezdi.com/blog/2023/12/5/attack-surface-of-the-ubiquiti-connect-ev-station

   ・ 详细分析了Ubiquiti Connect EV Station存在的潜在攻击面和硬件组 – SecTodayBot

• Abusing Microsoft Access "Linked Table" Feature to Perform NTLM Forced Authentication Attacks - Check Point Research:
https://research.checkpoint.com/2023/abusing-microsoft-access-linked-table-feature-to-perform-ntlm-forced-authentication-attacks/

   ・ 本文介绍了一种新的绕过端口阻断的方法，通过滥用MS-Access应用程序中的“Access Link Tables”功能来针对NTLM协议进行攻击。 – SecTodayBot

• www.bleepingcomputer.com:
https://www.bleepingcomputer.com/news/security/fake-wordpress-security-advisory-pushes-backdoor-plugin/

   ・ 讨论了针对WordPress的虚假安全公告和恶意插件，揭示了如何利用虚假漏洞通告来传播恶意插件的详细操作过程。 – SecTodayBot

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab