風險: 中度風險
類型: 伺服器 - 其他伺服器
於 GitLab 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務、洩露敏感資料及繞過保安限制。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Servers - Other Servers
Multiple vulnerabilities were identified in GitLab. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure and security restriction bypass on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 操作系統 - Network
於ASUS 路由器發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、阻斷服務狀況、權限提升、洩露敏感資料、資料篡改、及繞過保安限制。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Operating Systems - Networks OS
Multiple vulnerabilities were identified in ASUS Router. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, denial of service condition, elevation of privilege, sensitive information disclosure, data manipulation, and security restriction bypass on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 操作系統 - Network
於 SonicWall Products 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行任意程式碼、洩露敏感資料及資料篡改。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Operating Systems - Networks OS
Multiple vulnerabilities were identified in SonicWall Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, sensitive information disclosure and data manipulation on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 保安軟件及應用設備 - 保安軟件及應用設備
在Aruba產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、繞過保安限制、洩露敏感資料、資料篡改及遠端執行任意程式碼。
HPE Aruba Networking AOS-CX Software 版本：
HPE Aruba Networking 100 Series Cellular Bridge 版本：
HPE Aruba Networking Management Software (AirWave)：
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Security software and application - Security Software & Appliance
Multiple vulnerabilities were identified in Aruba Products. A remote attacker could exploit these vulnerabilities to trigger denial of service condition, security restriction bypass, sensitive information disclosure, data manipulation and remote code execution on the targeted system.
HPE Aruba Networking AOS-CX Software Version(s):
HPE Aruba Networking 100 Series Cellular Bridge Version(s):
HPE Aruba Networking Management Software (AirWave):
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 用戶端 - IM、聊天及VoIP
於 WhatsApp 發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發繞過保安限制。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Medium Risk
TYPE: Clients - Im, Chat & Voip
A vulnerability has been identified in in WhatsApp. A remote attacker could exploit this vulnerability to trigger security restriction bypass on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 高度風險
類型: 操作系統 - Network
於 Fortinet 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、洩露敏感資料及權限提升。
注意:
CVE-2025-58034 正在被廣泛利用。此漏洞存在於 FortiWeb 並可能允許經過驗證的攻擊者透過精心設計的 HTTP 請求或 CLI 命令在底層系統上執行未經授權的程式碼。因此，風險等級被評為高度風險。
FortiOS
FortiProxy
FortiWeb
FortiMail
FortiClientWindows
FortiSASE
FortiPAM
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: High Risk
TYPE: Operating Systems - Networks OS
Multiple vulnerabilities were identified in Fortinet Products. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, sensitive information disclosure and elevation of privilege on the targeted system.
Note:
CVE-2025-58034 is being exploited in the wild. This vulnerability in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Hence, the risk level is rated as High Risk.
FortiOS
FortiProxy
FortiWeb
FortiMail
FortiClientWindows
FortiSASE
FortiPAM
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 極高度風險
類型: 用戶端 - 瀏覽器
於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼。
注意:
CVE-2025-13223 正在被廣泛利用。該漏洞是由 Chrome V8 JavaScript 引擎中引起，可以導致在目標裝置上遠端執行程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Extremely High Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution on the targeted system.
Note:
CVE-2025-13223 is being exploited in the wild. The vulnerability is caused by a type confusion weakness in the Chrome V8 JavaScript engine and can lead to remote code execution on targeted device.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 極高度風險
類型: 用戶端 - 瀏覽器
於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼。
注意:
CVE-2025-13223 正在被廣泛利用。該漏洞是由 Chrome V8 JavaScript 引擎中引起，可以導致在目標裝置上遠端執行程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Extremely High Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution on the targeted system.
Note:
CVE-2025-13223 is being exploited in the wild. The vulnerability is caused by a type confusion weakness in the Chrome V8 JavaScript engine and can lead to remote code execution on targeted device.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於 Mozilla Thunderbird 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、彷冒、遠端執行任意程式碼及繞過保安限制。
以下版本之前的版本﹕
在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。
更新至版本:
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Mozilla Thunderbird. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, spoofing, remote code execution and security restriction bypass on the targeted system.
Versions prior to:
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 操作系統 - Network
在 ASUS 路由器發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發繞過保安限制。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Operating Systems - Networks OS
A vulnerability has been identified in ASUS Router. A remote attacker could exploit this vulnerability to trigger security restriction bypass on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 極高度風險
類型: 操作系統 - Network
於 Fortinet FortiWeb發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發遠端執行任意程式碼。
注意：
CVE-2025-64446 正在被廣泛利用。FortiWeb 中的這個相對路徑遍歷漏洞可能允許未經身份驗證的攻擊者透過精心建構的 HTTP 或 HTTPS 請求在系統上執行管理程式碼。
FortiWeb
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Extremely High Risk
TYPE: Operating Systems - Networks OS
A vulnerability was identified in Fortinet FortiWeb. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.
Note:
FortiWeb
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於微軟 Edge 發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發阻斷服務狀況及遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Medium Risk
TYPE: Clients - Browsers
A vulnerability was identified in Microsoft Edge. A remote attacker could exploit this vulnerability to trigger denial of service condition and remote code execution on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
近日，mickmick.net 發現有騙徒設立釣魚網站，假扮政府平台，包括「電子交通告票平台」及「HKeToll易通行」。這些釣魚網站採用與官方網站外觀相似的頁面，令市民誤以為是合法平台，誘騙用戶輸入個人資料及信用卡資訊。
請注意政府平台官方網站域名必須以 .gov.hk 結尾：
以下是近期 mickmick.net 報告的釣魚網址的例子：
假冒「電子交通告票平台」：
假冒「HKeToll易通行」網站：
mickmick.net 呼籲公眾提高網絡安全意識，並採取以下措施防範假冒網站：
若曾向上述假冒網站提供個人資料：請致電香港警務處反詐騙協調中心「防騙易18222」熱線向警方求助。
如對「電子交通告票平台」有任何查詢，可致電181 181。
如對「HKeToll易通行」有任何查詢，可致電3853 7333。
Recently, mickmick.net has identified phishing websites impersonating government platforms, including the eTraffic Ticket Platform and HKeToll. These phishing websites use pages that closely resemble official websites, tricking citizens into believing they are legitimate platforms and deceiving users into entering personal information and credit card details.
Important: Official Government Website Domains Must End with .gov.hk
The following is recent examples of phishing URLs reported by mickmick.net：
Fake eTraffic Ticket Platform:
Fake HKeToll Website:
mickmick.net urges the public to increase their awareness of cybersecurity and recommends that Internet users should:
風險: 中度風險
類型: 用戶端 - 辦公室應用
於Apache OpenOffice 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、彷冒及洩露敏感資料。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Clients - Productivity Products
Multiple vulnerabilities were identified in Apache OpenOffice. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, spoofing and sensitive information disclosure on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於 ChromeOS 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制、遠端執行任意程式碼、阻斷服務狀況及敏感資料洩露。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式，詳情請參閱以下連結：
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in ChromeOS. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass, remote code execution, denial of service condition and sensitive information disclosure on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor. For detail, please refer to the link below:
