Vulnerability Description On February 25, security updates were released for Google Chrome and Microsoft Edge. The open-source JavaScript and WebAssembly engines in V8 in Google Chrome before 80.0.3987.122 and Microsoft Edge browser before 80.0.361.62 are prone to a type confusion vulnerability (CVE-2020-6418), which allows attackers to access data in an...
Blog
jackson-databind/Fastjson Remote Code Execution Vulnerability Threat Alert
Overview Recently, two remote code execution vulnerabilities (CVE-2020-9547 and CVE-2020-9548) were fixed in jackson-databind. By using two components (ibatis-sqlmap and anteros-core) to bypass the blacklist restriction, attackers could exploit these vulnerabilities to cause remote code execution on the victim's machine. (mais…)
IP Reputation Report-03152020
Top 10 countries in attack counts: The above diagram shows the top 10 regions with the most malicious IP addresses from the NSFOCUS IP Reputation databases at March 15, 2020. (mais…)
Oracle Coherence Deserialization Remote Code Execution Vulnerability (CVE-2020-2555) Threat Alert
Vulnerability Description On January 15, 2020, Oracle released Critical Patch Update (CPU) for January 2020 that fixes 334 vulnerabilities of different risk levels, including a remote code execution vulnerability (CVE-2020-2555) with the CVSS score of 9.8 in the deserialization by Oracle Coherence deserialization. This vulnerability allows an unauthenticated attacker to...
OpenSMTPD Remote Code Execution Vulnerability (CVE-2020-8794) Threat Alert
Overview On February 24, local time, researchers from Qualys released a remote code execution vulnerability (CVE-2020-8794) existing in OpenSMTPD. As part of the OpenBSD part, OpenSMTPD (also known as OpenBSD's mail server) is a free implementation of the server-side SMTP protocol as defined by RFC 5321. CVE-2020-8794 is an out-of-bounds...
ICS Information Security Assurance Framework 21
What to Expect for ICS Security in the Coming Years With the policy guidance of various ministries and commissions under the State Council, related financial support, and the increased emphasis on ICS security by ICS enterprises, the ICS information security will get on the fast track of development. With the...
