威胁通告 – 第 98 页 – 绿盟科技技术博客

Apache Struts2 远程代码执行漏洞（S2-045）技术分析与防护方案

2017-03-07苏少博Apache Struts2 远程代码执行漏洞, Struts2 漏洞, Struts2 远程代码执行漏洞, Struts2漏洞范围分布图, 技术防护方案, 绿盟威胁情报中心NTI, 绿盟科技, 远程代码执行漏洞

Apache Struts2的Jakarta Multipart parser插件存在远程代码执行漏洞，漏洞编号为CNNVD-201703-152。攻击者可以在使用该插件上传文件时，修改HTTP请求头中的Content-Type值来触发该漏洞，导致远程执行代码。

【预警通告】Apache Struts2 远程代码执行漏洞绿盟科技发布免费扫描工具及产品升级包

2017-03-07绿盟科技Apache Struts2, Apache Struts2 漏洞, Apache Struts2 远程代码执行漏洞, S2-045, 绿盟科技, 绿盟科技威胁事件定级标准, 远程代码执行漏洞

Apache Structs2的Jakarta Multipart parser插件存在远程代码执行漏洞，漏洞编号为CVE-2017-5638。攻击者可以在使用该插件上传文件时，修改HTTP请求头中的Content-Type值来触发该漏洞，导致远程执行代码。

【威胁通告】WordPress多个插件存在漏洞

2017-03-02绿盟科技NextGEN Gallery插件, SQL注入, WordPress 插件漏洞, WordPress多个插件存在漏洞, WordPress漏洞, 括跨站脚本, 绿盟科技, 规避方案

近日，WordPress的多个插件曝出漏洞，漏洞类型包括跨站脚本，SQL注入等。其中NextGEN Gallery插件的SQL注入影响上百万用户，允许未经身份认证的攻击者获取数据库中包括用户信息在内的敏感数据，NextGEN Gallary插件已经发布修复补丁。

【威胁通告】谷歌曝光IE和Edge漏洞

2017-02-28绿盟科技CNNVD-201702-882, IE Edge漏洞, JavaScript代码, 微软漏洞, 绿盟科技

近日，谷歌再一次曝出微软未及时修补的漏洞，漏洞编号为CNNVD-201702-882，影响IE 11和Edge浏览器，该漏洞会导致浏览器崩溃并且可能导致远程代码执行。

ElasticSearch Hit by Ransom Attack

2017-02-24刘鹏ElasticSearch, ElasticSearch Hit by Ransom Attack, ElasticSearch Server Deployment, EnglishVersion, lasticSearch Risk, Protection Measures, Reference Links

Over 34,000 vulnerable MongoDB databases were hit by a ransom attack. Data were erased from these databases and ransoms were requested for returning data. Then on Jan 18th 2017, several hundreds of ElasticSearch servers were hit by a ransom attack within a few hours.

Power Outage Caused by the Cyber Attack on Ukrenergo Technical Analysis and Solution

2017-02-24刘鹏Attack Location, EnglishVersion, Historical Attacks on Ukrenergo, NSFOCUS, Power Outage, Sample Execution Flow, Sample Structure, Ukrenergo Technical Analysis and Solution

Ukrenergo, a major energy provider in Ukraine, experienced a power failure on the night of December 17, 2016, which involved the automatic control system of the “North” substation in New Petrivtsi close to Kiev. The blackout affected the northern part of Kiev, the country’s capital, and surrounding areas.