CVE-2021-26855、CVE-2021-26857、CVE-2021-26858、CVE-2021-27065: Microsoft Exchange Server のゼロデイ脆弱性 4 件が攻撃に使われている
Four zero-day vulnerabilities in Microsoft Exchange servers have been used in chained attacks in the wild.Update March 8, 2021: The Identifying Affected Systems section has been updated with information about the availability of additional plugins as well as a link to our blog post that details them...
CVE-2020-14882: Oracle WebLogic のリモートコード実行脆弱性を利用した攻撃が確認される
A remote code execution vulnerability in Oracle WebLogic Server has been actively exploited in the wild just one week after a patch was released and one day after a proof of concept was published.Update October 30, 2020: The solutions section has been updated to reflect the disclosure of a potential...
CodeMeter に発見された複数の脆弱性が産業制御システムを攻撃にさらしている
Six vulnerabilities in a popular license management product put industrial control systems at risk for remote attacks. Background On September 8, researchers at Claroty published their detailed analysis, dubbed “License to Kill,” covering several vulnerabilities they discovered in CodeMeter. Coder...
CVE-2020-1938: Ghostcat - Apache Tomcat AJP における実行ファイル読み込み・インクルージョンに関する脆弱性 (CNVD-2020-10487)
Several proof-of-concept exploit scripts for recently patched flaw in Apache Tomcat are now available.BackgroundOn February 20, China National Vulnerability Database (CNVD) published a security advisory for CNVD-2020-10487, a severe vulnerability in Apache Tomcat’s Apache JServ Protocol (or AJP). AJ...