Tencent Security Xuanwu Lab Daily News
• Unrar Path Traversal Vulnerability affects Zimbra Mail:
https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/
・ 企业邮箱服务 Zimbra 被发现 rar 解压导致的路径穿越漏洞
– Jett
• Abusing Cloudflare Workers – Christophe Tafani-Dereeper:
https://blog.christophetd.fr/abusing-cloudflare-workers/
・ MITM at the Edge: Abusing Cloudflare Workers
– Jett
• De-anonymizing ransomware domains on the dark web:
https://blog.talosintelligence.com/2022/06/de-anonymizing-ransomware-domains-on.html
・ Talos 对如何检测勒索软件攻击者在公网 IP 上架设的暗网网站的研究
– Jett
• The Open Cloud Vulnerability & Security Issue Database:
https://www.cloudvulndb.org/results?q=
・ 云安全相关漏洞（issue）数据库
– Jett
• FabricScape: Escaping Service Fabric and Taking Over the Cluster:
https://unit42.paloaltonetworks.com/fabricscape-cve-2022-30137/
・ Unit 42 研究员在微软 Azure Service Fabric 微服务发现 Linux 容器 root 提权漏洞
– Jett
• code white | Blog: Bypassing .NET Serialization Binders:
https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html
・ Bypassing .NET Serialization Binders，实现 RCE（CVE-2022-28684、CVE-2022-23277）
– Jett
• DCSync 技术的攻击和检测:
https://tttang.com/archive/1634/
・ DCSync 技术的攻击和检测
– lanying37
• Novel Exploit in Mitel VOIP Appliance | CrowdStrike:
https://www.crowdstrike.com/blog/novel-exploit-detected-in-mitel-voip-appliance/
・ Mitel VOIP 产品被发现 CVE-2022-29499 漏洞利用攻击
– Jett
• CVE-2022-30522 – Apache httpd Denial of Service (DoS) vulnerability:
https://jfrog.com/blog/cve-2022-30522-denial-of-service-dos-vulnerability-in-apache-httpd-mod_sed-filter/
・ Apache httpd “mod_sed” filter 拒绝服务漏洞分析（CVE-2022-30522）
– Jett
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(06-29)
