Tencent Security Xuanwu Lab Daily News
• Hades: basic Command & Control server built using Python:
https://securityonline.info/hades-basic-command-control-server-built-using-python/
・ Hades 是一个使用 Python 构建的基本命令和控制服务器。
– SecTodayBot
• Cisco squashes critical bugs in small biz switches:
https://go.theregister.com/feed/www.theregister.com/2023/05/18/cisco_patches_small_biz_switches/
・ 思科为小型企业的几个网络交换机中的四个关键安全漏洞推出了补丁，这些漏洞可被利用来远程劫持设备。具体来说，Web 用户界面中的缺陷可用于以 root 权限运行任意代码
– SecTodayBot
• Dumpulator – An Easy-To-Use Library For Emulating Memory Dumps. Useful For Malware Analysis (Config Extraction, Unpacking) And Dynamic Analysis In General (Sandboxing):
https://ift.tt/31fqTZj
・ Dumpulator – 一个易于使用的库，用于模拟内存转储。可用于恶意软件分析（配置提取、解包）和一般动态分析
– SecTodayBot
• HPHardwareDiagnostics-PoC:
https://github.com/alfarom256/HPHardwareDiagnostics-PoC
・ HP Hardware Diagnostics 的 EtdSupp 驱动程序的 漏洞利用 CVE-2023-32673/PSR-2022-0209
– SecTodayBot
• RustChain – Hide Memory Artifacts Using ROP And Hardware Breakpoints:
https://ift.tt/2hoNPk9
・ 使用 ROP 链结合硬件断点的内存扫描规避技术
– SecTodayBot
• CVE-2023-20883, CVE-2023-20873: Two High Severity Vulnerabilities in Spring Boot:
https://securityonline.info/cve-2023-20883-cve-2023-20873-two-high-severity-vulnerabilities-in-spring-boot/
・ Spring Boot欢迎页面拒绝服务漏洞（CVE-2023-20883）和Cloud Foundry通配符匹配导致的安全绕过漏洞
– SecTodayBot
• CVE-2023-31062: Apache InLong: Privilege escalation vulnerability for InLong:
https://seclists.org/oss-sec/2023/q2/177
・ CVE-2023-31062：Apache InLong中的权限提升漏洞 – Apache 软件基金会 – 受影响的版本：1.2.0 到 1.6.0
– SecTodayBot
• Bludit CMS 3.14.1 Cross Site Scripting:
https://packetstormsecurity.com/files/172462
・ Bludit CMS v3.14.1 – 存储型跨站脚本 (XSS)（已验证）
– SecTodayBot
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(5-24)
