admin/wxvl
1
0
Fork 0
mirror of https://github.com/gelusus/wxvl.git synced 2025-08-13 11:28:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Mozilla修复了在Pwn2Own Berlin 2025上公开演示的零日漏洞、安全动态回顾|65款违法违规收集使用个人信息的移动应用被通报 微软5月补丁星期二修复72个漏洞、2025攻防演练必修高危漏洞集合（1.0版）、

Browse Source
This commit is contained in:
test 2025-05-20 08:27:01 +00:00
parent 0aeba05551
commit 0cd4b42817
4 changed files with 158 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
data.json
View File

@ -14267,5 +14267,8 @@
"https://mp.weixin.qq.com/s?__biz=MzUyODkwNDIyMg==&mid=2247550119&idx=1&sn=c25a8b23e5ef7622e645d208c419b59f": "EDUSRC | 两个证书站小程序漏洞挖掘思路及方法",
"https://mp.weixin.qq.com/s?__biz=MzkyNzIxMjM3Mg==&mid=2247490386&idx=1&sn=69a3eb83c41266c5d0ebd2e3c0558e2e": "IDOR_detect_tool【API越权漏洞检测工具】",
"https://mp.weixin.qq.com/s?__biz=MzAxMjE3ODU3MQ==&mid=2650610809&idx=3&sn=d60cac29d0d8c32877b922b55df29182": "高危WordPress插件漏洞威胁超1万个网站安全",
"https://mp.weixin.qq.com/s?__biz=MzU3MDg2NDI4OA==&mid=2247491153&idx=1&sn=b45e5f6c7bba1d0d1d9a973478640211": "CNVD-2023-04620 金和 OA XXE 漏洞分析复现"
"https://mp.weixin.qq.com/s?__biz=MzU3MDg2NDI4OA==&mid=2247491153&idx=1&sn=b45e5f6c7bba1d0d1d9a973478640211": "CNVD-2023-04620 金和 OA XXE 漏洞分析复现",
"https://mp.weixin.qq.com/s?__biz=Mzg3OTc0NDcyNQ==&mid=2247493874&idx=1&sn=66206ef8b1b21a6d4d0f75b5f2bb1e87": "Mozilla修复了在Pwn2Own Berlin 2025上公开演示的零日漏洞",
"https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247582421&idx=2&sn=4d652cfed9e7b0c3f05bb935d717f71f": "安全动态回顾|65款违法违规收集使用个人信息的移动应用被通报 微软5月补丁星期二修复72个漏洞",
"https://mp.weixin.qq.com/s?__biz=MzIwMjcyNzA5Mw==&mid=2247495058&idx=1&sn=9ba60513d1aedc46385f088671127de5": "2025攻防演练必修高危漏洞集合（1.0版）"
}

80
doc/2025-05/2025攻防演练必修高危漏洞集合（1.0版）.md Normal file
View File

File diff suppressed because one or more lines are too long

34
doc/2025-05/Mozilla修复了在Pwn2Own Berlin 2025上公开演示的零日漏洞.md Normal file
View File

@ -0,0 +1,34 @@
# Mozilla修复了在Pwn2Own Berlin 2025上公开演示的零日漏洞
鹏鹏同学 黑猫安全 2025-05-20 01:54
![](https://mmbiz.qpic.cn/sz_mmbiz_png/8dBEfDPEceibPwRoxKuUntZ4pLJpcyUGzged4VkfaPR9OrklicsWFfiaCwtYPPpCczypsaTV6YFia70x33wXRMO5gg/640?wx_fmt=png&from=appmsg "")
Mozilla发布安全更新修复Firefox浏览器两处高危漏洞 攻击者可窃取敏感数据或执行任意代码
"在本周举行的Pwn2Own安全黑客大赛上，研究人员演示了两种针对Firefox内容进程的新型攻击手段。虽然这些攻击均未能突破我们的沙箱防护（获取系统控制权的必要前提），但出于谨慎考虑，我们已在第二起漏洞披露当天紧急发布新版Firefox。"Mozilla安全博客发文称，"更新版本包括Firefox 138.0.4、Firefox ESR 128.10.1、Firefox ESR 115.23.1及安卓版Firefox。尽管攻击实际影响有限，仍建议所有用户和管理员立即升级。"
这两处漏洞在近期Pwn2Own Berlin 2025黑客大赛中均作为零日漏洞被公开演示。
漏洞详情如下：
**CVE-2025-4918**
- 类型：处理Promise对象时的越界访问漏洞
- 描述："攻击者能够对JavaScript Promise对象执行越界读写操作"
- 发现者：Palo Alto Networks公司Edouard Bochin与Tao Yan（通过趋势科技零日计划提交）
**CVE-2025-4919**
- 类型：优化线性求和时的越界访问漏洞
- 描述："攻击者通过混淆数组索引大小，可对JavaScript对象执行越界读写"
- 发现者：Manfred Paul（通过趋势科技零日计划提交）
受影响版本包括：
- Firefox 138.0.4之前所有版本（含安卓版）
- Firefox ESR 128.10.1之前所有扩展支持版
- Firefox ESR 115.23.1之前所有版本

40
doc/2025-05/安全动态回顾65款违法违规收集使用个人信息的移动应用被通报 微软5月补丁星期二修复72个漏洞.md Normal file
View File

@ -0,0 +1,40 @@
# 安全动态回顾|65款违法违规收集使用个人信息的移动应用被通报 微软5月补丁星期二修复72个漏洞
胡金鱼 嘶吼专业版 2025-05-20 06:20
![](https://mmbiz.qpic.cn/mmbiz_gif/wpkib3J60o297rwgIksvLibPOwR24tqI8dGRUah80YoBLjTBJgws2n0ibdvfvv3CCm0MIOHTAgKicmOB4UHUJ1hH5g/640?wx_fmt=gif "")
![](https://mmbiz.qpic.cn/sz_mmbiz_jpg/wpkib3J60o2ibUhsEAWibibsM0jM13b5pAegy0C5AL5CJWNRhJGgN1QUpUnYKnsibaY5mwBXSeXnD7nlVLb31bl4Lew/640?wx_fmt=jpeg&from=appmsg "")
![](https://mmbiz.qpic.cn/sz_mmbiz_png/wpkib3J60o28aFfuZruyyNsXXFicoZZDSFMtP1joY4aUw7jx32FUd26h9RwhDuQFk7m7Z0cH4ww6gvqLktib4wUWA/640?wx_fmt=png&from=appmsg "")
[2025.5.5—5.11安全动态周回顾](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247582297&idx=2&sn=8d4569e11b758e555b6a2940e619d0e2&scene=21#wechat_redirect)
[2025.4.21—4.27安全动态周回顾](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247582167&idx=2&sn=9118e919e74cfe65375cf71142b941b8&scene=21#wechat_redirect)
[2025.4.14—4.20安全动态周回顾](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247582062&idx=3&sn=9272f215924def481a6cc32cf376b140&scene=21#wechat_redirect)
[2025.4.7—4.13安全动态周回顾](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247581970&idx=3&sn=0b16520d4f9cef2c19dd082e120a17f7&scene=21#wechat_redirect)
[2025.3.31—4.6安全动态周回顾](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247581851&idx=3&sn=1d2e375a885dc0ad1dc3c3d239a7b65a&scene=21#wechat_redirect)
[2025.3.24—3.30安全动态周回顾](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247581756&idx=3&sn=37df7697c8d05b7a0af80b3a6d6861c8&scene=21#wechat_redirect)
![](https://mmbiz.qpic.cn/mmbiz_png/wpkib3J60o287jwk8LWD9icmgWlahS21WBibH0Iz3x2kLShrmHpicmyoLLZjhkG6s61yDMgXpJ74WhrDYlWupFxzKg/640?wx_fmt=png "")
![](https://mmbiz.qpic.cn/sz_mmbiz_png/wpkib3J60o2icEjy5ZrpCcgr4BicXicPv08DSsrgibDcJQpvwkZoO4OqdIpJNhj6TO5xV0ic0AnVf7f2kcPnNevQlTtQ/640?wx_fmt=png "")