RISK: High Risk
TYPE: Clients - Productivity Products
A vulnerability was identified in Adobe ColdFusion. A remote attacker could exploit this vulnerability to trigger sensitive information disclosure and data manipulation on the targeted system.
Note:
Proof Of Concept Exploit Code Is Publicly Available for CVE-2024-53961.
Before installation of the software, please visit the vendor web-site for more details.
風險: 中度風險
類型: 保安軟件及應用設備 - 保安軟件及應用設備
於 Sophos 防火牆發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼及繞過保安限制。
Sophos Firewall v21.0 GA (21.0.0) 及之前的版本
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
注意：已啟用了“允許自動安裝修補程序”功能的 Sophos Firewall 客戶無需執行任何操作。預設設置是已啟用。
RISK: Medium Risk
TYPE: Security software and application - Security Software & Appliance
Multiple vulnerabilities were identified in Sophos Firewall. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution and security restriction bypass on the targeted system.
Sophos Firewall version prior to v21.0 GA (21.0.0)
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
Note: There is no action required for Sophos Firewall customers with the "Allow automatic installation of hotfixes" feature enabled. Enabled is the default setting.
風險: 中度風險
類型: 伺服器 - 其他伺服器
於 NetApp 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、洩露敏感資料及資料篡改。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Servers - Other Servers
Multiple vulnerabilities were identified in NetApp Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure and data manipulation on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
最近，mickmick.net 發現有騙子創建一個冒充香港郵政的釣魚網站。這些網站利用用戶急切想要收到包裹的心理，誘騙他們提供個人資料以重新安排包裹投遞或支付額外的投遞費用。收到報告後，mickmick.net 迅速識別出這些詐欺網站，並向公眾發出保安警報和防禦策略，敦促他們採取預防措施。騙子經常使用「包裹重新派送請求」或「額外投遞費支付」等短語，並採用具有欺騙性的、外觀相似的網址來掩蓋釣魚網站的合法性。
以下是近期mickmick.net報告的釣魚網址的例子：
用戶一旦點擊詐騙網站，會收到「交付失敗通知」。詐騙者通知他們包裹將被重新發貨，並提示用戶點擊「繼續」更新地址。
在下一頁，用戶被要求輸入個人信息，例如姓名、地址、城市、郵遞編碼、電子郵箱和電話號碼。
用戶輸入這些詳細資訊並點擊「立即更新」後，詐騙者會要求他們在線支付重新配送的服務費。然後，他們要求用戶提供銀行卡號、持卡人姓名、到期日期和安全碼（CVV），從而欺騙用戶，非法轉移資金。
HKCERT 呼籲公眾提高網絡安全意識，並採取以下措施防範假冒網站：
Recently, mickmick.net has discovered that scammers are creating phishing websites that impersonate Hongkong Post. These sites exploit users' eagerness to receive parcels by tricking them into providing personal information for parcel redelivery or paying additional delivery fees. Upon receiving these reports, mickmick.net identified the fraudulent websites and promptly issued alerts and defensive strategies to the public, urging them to take preventive measures. Scammers often use phrases such as 'parcel redelivery request' or 'additional delivery fee payment' and employ deceptive, similar-looking URLs to obscure the legitimacy of their sites.
The following is recent examples of phishing URLs reported by mickmick.net：
Once users click on the fraudulent website, they receive a 'payment failure notification.' The scammers then inform them that the parcel will be resent and prompt users to click 'continue.'
On the next page, users are asked to enter personal information, such as their name, address, city, postcode, email, and phone number.
After entering these details and clicking 'update now,' the scammers request an online payment for the redelivery service fee. They then ask users to provide their bank card number, cardholder's name, expiration date, and security code (CVV), thereby attempting to deceive users into transferring their funds illicitly.
mickmick.net urges the public to increase their awareness of cybersecurity and recommends that Internet users should::
風險: 中度風險
類型: 操作系統 - Network
於 Fortinet FortiManager發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Operating Systems - Networks OS
A vulnerability was identified in Fortinet FortiManager. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發資料篡改、阻斷服務狀況及遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger data manipulation, denial of service condition and remote code execution on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、阻斷服務狀況及資料篡改。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, denial of service condition and data manipulation on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於 Mozilla Thunderbird 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行任意程式碼、繞過保安限制及資料篡改。
以下版本之前的版本﹕
在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。
更新至版本:
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Mozilla Thunderbird. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, security restriction bypass and data manipulation on the targeted system.
Versions prior to:
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 伺服器 - 網站伺服器
於 Apache Tomcat 發現多個漏洞，遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況及遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Servers - Web Servers
Multiple vulnerabilities were identified in Apache Tomcat, a remote attacker could exploit some of these vulnerabilities to trigger denial of service condition and remote code execution on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 高度風險
類型: 操作系統 - Network
於 F5 產品發現一個漏洞。遠端攻擊者可利用這漏洞，於目標系統觸發阻斷服務狀況。
注意：
受影響之系統或技術暫無可修補 CVE-2024-7592 的修補程式。因此，風險等級由中度風險升為高度風險。
BIG-IP Next SPK
BIG-IP Next CNF
請先瀏覽供應商之網站，以獲得更多詳細資料。。
應用供應商提供的臨時處理方法：
臨時處理方法：
從以下臨時處理方法以減輕攻擊：
RISK: High Risk
TYPE: Operating Systems - Networks OS
A vulnerability was identified in F5 Products. A remote attacker could exploit this vulnerability to trigger denial of service condition on the targeted system.
Note:
No patch is currently available for CVE-2024-7592 of the affected products. Hence, the risk level is rated from Medium Risk to High Risk.
BIG-IP Next SPK
BIG-IP Next CNF
Please visit the vendor web-site for more details.
Apply workarounds issued by the vendor:
Workaround:
Mitigate the vulnerability of attacks by following workaround:
風險: 中度風險
類型: 操作系統 - 其他操作系統
於 ChromeOS 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制、阻斷服務狀況及遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式，詳情請參閱以下連結：
RISK: Medium Risk
TYPE: Operating Systems - Others OS
Multiple vulnerabilities were identified in ChromeOS. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass, denial of service condition and remote code execution on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor. For detail, please refer to the link below:
風險: 中度風險
類型: 伺服器 - 網站伺服器
於 Apache Struts 發現一個漏洞。遠端使用者可利用此漏洞，於目標系統觸發遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽軟體供應商之網站，以獲得更多詳細資料。
RISK: Medium Risk
TYPE: Servers - Web Servers
A vulnerability has been identified in Apache Struts. A remote attacker can exploit this vulnerability to trigger remote code execution on the targeted system.
Before installation of the software, please visit the software manufacturer web-site for more details.
風險: 中度風險
類型: 操作系統 - LINUX
於 Ubuntu Linux核心發現多個漏洞。攻擊者可利用這些漏洞，於目標系統觸發洩露敏感資料、阻斷服務狀況及遠端執行任意程式碼。
Ubuntu 14.04 ESM
Ubuntu 16.04 ESM
Ubuntu 18.04 ESM
Ubuntu 20.04 LTS
在安裝軟件之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
