酷应用

【安全日记】Weblogic任意文件上传漏洞

百家作者：绿盟科技 2018-07-24 10:20:21

焦点漏洞

◆ 焦点漏洞

Weblogic任意文件上传漏洞CVE-2018-2894

◆ NSFOCUS ID

40480

◆ CVE ID

CVE-2018-2894

◆ 受影响版本

Weblogic 10.3.6.0

Weblogic 12.1.3.0

Weblogic 12.2.1.2

Weblogic 12.2.1.3

◆ 漏洞点评

北京时间7月18日凌晨，Oracle官方发布了季度补丁更新，其中修复了一个 Oracle WebLogic Server 任意文件上传漏洞CVE-2018-2894。通过此漏洞攻击者可以在未经身份验证的情况下对WebLogic进行攻击，目前相关PoC已经公开，建议相关用户尽快进行安全升级。

互联网安全威胁态势

CVE统计

最近一周CVE公告总数与前期相比有明显增长。

每日简报回顾

标题：Hackers Breach Russian Bank and Steal $1 Million Due to Outdated Router

时间：2018-07-23

简介：A notorious hacker group known as MoneyTaker has stolen roughly $1 million from a Russian bank after breaching its network via an outdated router.The victim of the hack is PIR Bank, which lost at least $920,000 in money it had stored in a corresponding account at the Bank of Russia.

链接：

https://www.bleepingcomputer.com/news/security/hackers-breach-russian-bank-and-steal-1-million-due-to-outdated-router/

标题：Russia Targeted by Almost 25 Million Cyber-Attacks During World Cup

时间：2018-07-17

简介：Russia was the target of almost 25 million cyber-attacks during the World Cup, President Vladimir Putin said, though he did not indicate who may have been behind the attacks.

链接：

https://www.securityweek.com/russia-targeted-almost-25-million-cyber-attacks-during-world-cup-putin

标题：EU Fines Google Record $5 Billion in Android Antitrust Case

时间：2018-07-19

简介：Google has been hit by a record-breaking $5 billion antitrust fine by the European Union regulators for abusing the dominance of its Android mobile operating system and thwarting competitors.

链接：

https://thehackernews.com/2018/07/google-android-antitrust-fine.html

标题：US Biggest Blood Testing Laboratories LabCorp suffered a security breach

时间：2018-07-20

简介：Hackers have breached the network at LabCorp, one of the largest diagnostic blood testing laboratories in the US, millions of Americans potentially at risk.

链接：

https://securityaffairs.co/wordpress/74536/data-breach/labcorp-security-breach.html

......

漏洞研究

漏洞库统计

截止到2018年7月20日，绿盟科技漏洞库已收录总条目达到40502条。本周新增漏洞记录68条，其中高危漏洞数量21条，中危漏洞数量29条，低危漏洞数量18条。