安全性相關News

CVEMicrosoft Security Response Center資安新聞(TWCERT)TVN 漏洞公告(TWCERT)TVN List(TWCERT)

• CVE-2025-3866 - Google Plus One Social Share Button CSRF Vulnerability

, 2025/04/25 15:15:48

• CVE-2025-3867 - WordPress Ajax Comment Form CST CSRF

, 2025/04/25 15:15:48

• CVE-2025-3868 - WordPress Custom Admin-Bar Favorites Reflected Cross-Site Scripting

, 2025/04/25 15:15:48

• CVE-2025-46616 - Quantum StorNext Web GUI API RCE

, 2025/04/25 15:15:48

• CVE-2025-46617 - Quantum StorNext Web GUI API Unauthorized Configuration Access and Modification

, 2025/04/25 15:15:48

• CVE-2025-2238 - Vikinger WordPress Privilege Escalation Vulnerability

, 2025/04/25 15:15:47

• CVE-2025-3743 - WooCommerce Upsell Funnel Builder Order Manipulation Vulnerability

, 2025/04/25 15:15:47

• CVE-2025-3923 - WordPress Prevent Direct Access - Sensitive Information Exposure

, 2025/04/25 14:15:46

• CVE-2025-46613 - OpenPLC Server Memory Corruption

, 2025/04/25 14:15:46

• CVE-2025-2580 - Bit Form WordPress Contact Form Stored Cross-Site Scripting Vulnerability

, 2025/04/25 14:15:45

• CVE-2025-3511 - Mitsubishi Electric Corporation CC-Link IE TSN Denial of Service Remote Buffer Overflow

, 2025/04/25 14:15:45

• CVE-2025-3861 - WordPress Prevent Direct Access Unauthorized Access Vulnerability

, 2025/04/25 14:15:45

• CVE-2025-0671 - Icegram Express WordPress Stored Cross-Site Scripting Vulnerability

, 2025/04/25 14:15:44

• CVE-2025-3775 - ShopLentor WooCommerce Builder SSRF Vulnerability

, 2025/04/25 13:15:33

• CVE-2025-46599 - K3s Kubernetes Kubelet ReadWritePort Remote Authentication Bypass

, 2025/04/25 13:15:33

• CVE-2025-3752 - Able Player WordPress Stored Cross-Site Scripting Vulnerability

, 2025/04/25 13:15:32

• CVE-2025-46545 - Sherpa Orchestrator Stored Cross-Site Scripting (XSS) Vulnerability

, 2025/04/25 11:15:20

• CVE-2025-46546 - Sherpa Orchestrator Blind SQL Injection Vulnerability

, 2025/04/25 11:15:20

• CVE-2025-46547 - Sherpa Orchestrator Cross-Site Request Forgery (XSS, SQL Injection) Vulnerability

, 2025/04/25 11:15:20

• CVE-2025-46595 - Backdrop CMS Flag Module Cross-Site Scripting Vulnerability

, 2025/04/25 11:15:20

• CVE-2025-46544 - Sherpa Orchestrator Privilege Escalation Vulnerability

, 2025/04/25 11:15:19

• CVE-2025-43864 - React Router Cache Poisoning Vulnerability

, 2025/04/25 09:15:43

• CVE-2025-43865 - React Router HTTP Header Injection Vulnerability

, 2025/04/25 09:15:43

• CVE-2025-2185 - ALBEDO Telecom Net.Time PTP/NTP Clock Authentication Bypass

, 2025/04/25 08:15:15

• CVE-2025-3606 - Vestel AC Charger Information Disclosure Vulnerability

, 2025/04/25 08:15:15

• Zero Day Quest 2025: $1.6 million awarded for vulnerability research

, 2025/04/21 15:00:00

• Announcing the winners of the Adaptive Prompt Injection Challenge (LLMail-Inject)

, 2025/03/14 15:00:00

• Jailbreaking is (mostly) simpler than you think

, 2025/03/13 15:00:00

• Exciting updates to the Copilot (AI) Bounty Program: Enhancing security and incentivizing innovation

, 2025/02/07 16:00:00

• Scaling Dynamic Application Security Testing (DAST)

, 2025/01/21 16:00:00

• Congratulations to the Top MSRC 2024 Q4 Security Researchers!

, 2025/01/15 16:00:00

• Mitigating NTLM Relay Attacks by Default

, 2024/12/09 16:00:00

• Announcing the Adaptive Prompt Injection Challenge (LLMail-Inject)

, 2024/12/06 16:00:00

• Securing AI and Cloud with the Zero Day Quest

, 2024/11/19 16:00:00

• Toward greater transparency: Publishing machine-readable CSAF files

, 2024/11/12 16:00:00

• Congratulations to the Top MSRC 2024 Q3 Security Researchers!

, 2024/10/23 15:00:00

• Announcing the BlueHat 2024 Sessions

, 2024/10/22 15:00:00

• Announcing BlueHat 2024: Call for Papers now open

, 2024/08/07 15:00:00

• Congratulations to the MSRC 2024 Most Valuable Security Researchers!

, 2024/08/06 15:00:00

• Microsoft Bounty Program Year in Review: $16.6M in Rewards 

, 2024/08/05 15:00:00

• Introducing the MSRC Researcher Resource Center

, 2024/07/31 15:00:00

• Congratulations to the Top MSRC 2024 Q2 Security Researchers!

, 2024/07/24 15:00:00

• Announcing the CVRF API 3.0 upgrade

, 2024/07/11 15:00:00

• What’s new in the MSRC Report Abuse Portal and API

, 2024/07/03 15:00:00

• Toward greater transparency: Unveiling Cloud Service CVEs

, 2024/06/27 15:00:00

• Mitigating SSRF Vulnerabilities Impacting Azure Machine Learning

, 2024/06/17 15:00:00

• Improved Guidance for Azure Network Service Tags

, 2024/06/03 15:00:00

• Congratulations to the Top MSRC 2024 Q1 Security Researchers! 

, 2024/04/17 15:00:00

• Toward greater transparency: Adopting the CWE standard for Microsoft CVEs

, 2024/04/08 15:00:00

• Embracing innovation: Derrick’s transition from banking to Microsoft’s Threat Intelligence team

, 2024/04/02 15:00:00

• Update on Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard

, 2024/03/08 16:00:00

• Faye’s Journey: From Security PM to Diversity Advocate at Microsoft

, 2024/02/29 16:00:00

• Microsoft boosts its Microsoft 365 Insider Builds on Windows Bounty Program with higher awards and an expanded scope

, 2024/02/27 16:00:00

• From Indiana Jones to Cybersecurity: The Inspiring Journey of Devin

, 2024/02/26 16:00:00

• An Obsession With Impact: The Inspiring Journey of a Dreamer That Led to a Career at Microsoft

, 2024/02/20 16:00:00

• New Security Advisory Tab Added to the Microsoft Security Update Guide

, 2024/02/15 16:00:00

• Congratulations to the Top MSRC 2023 Q4 Security Researchers!

, 2024/01/30 16:00:00

• Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard

, 2024/01/19 16:00:00

• BlueHat India Call for Papers is Now Open!

, 2024/01/08 16:00:00

• Microsoft addresses App Installer abuse

, 2023/12/28 16:00:00

• Azure Serial Console Attack and Defense - Part 2

, 2023/12/19 16:00:00

• Introducing the Microsoft Defender Bounty Program

, 2023/11/21 16:00:00

• Celebrating ten years of the Microsoft Bug Bounty program and more than $60M awarded

, 2023/11/20 16:00:00

• Reflecting on 20 years of Patch Tuesday

, 2023/11/17 16:00:00

• Microsoft guidance regarding credentials leaked to GitHub Actions Logs through Azure CLI

, 2023/11/14 16:00:00

• Congratulations to the Top MSRC 2023 Q3 Security Researchers!

, 2023/10/16 15:00:00

• Introducing the Microsoft AI Bug Bounty Program featuring the AI-powered Bing experience

, 2023/10/12 15:00:00

• Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2

, 2023/10/10 15:00:00

• Cybersecurity Awareness Month 2023: Elevating Security Together

, 2023/10/05 15:00:00

• Microsoft’s Response to Open-Source Vulnerabilities - CVE-2023-4863 and CVE-2023-5217

, 2023/10/02 15:00:00

• Journey Down Under: How Rocco Became Australia’s Premier Hacker

, 2023/09/25 15:00:00

• Microsoft mitigated exposure of internal information in a storage account due to overly-permissive SAS token

, 2023/09/18 15:00:00

• Results of Major Technical Investigations for Storm-0558 Key Acquisition

, 2023/09/06 15:00:00

• Azure Serial Console Attack and Defense - Part 1

, 2023/08/10 15:00:00

• Updating our Vulnerability Severity Classification for AI Systems

, 2023/08/08 15:00:00

• Congratulations to the MSRC 2023 Most Valuable Security Researchers!

, 2023/08/08 15:00:00

• Microsoft Bug Bounty Program Year in Review: $13.8M in Rewards

, 2023/08/07 15:00:00

• Microsoft mitigates Power Platform Custom Code information disclosure vulnerability

, 2023/08/04 15:00:00

• BlueHat October 2023 Call for Papers is Now Open!

, 2023/07/27 15:00:00

• Updated Researcher Portal Submission Form: Discover the New Fields in the Submission Form

, 2023/07/20 15:00:00

• From Bounty Leaderboards to Microsoft Security Researcher, Meet Cameron Vincent!

, 2023/07/17 15:00:00

• What to expect when reporting vulnerabilities to Microsoft

, 2023/07/14 17:00:00

• Congratulations to the Top MSRC 2023 Q2 Security Researchers!

, 2023/07/14 15:00:00

• Microsoft mitigates China-based threat actor Storm-0558 targeting of customer email

, 2023/07/11 15:00:00

• Breaking Barriers: Aditi’s Journey Through Sight Loss to Microsoft AI Innovator

, 2023/06/28 15:00:00

• Oracle雲端服務驚傳資料外洩，疑似使用舊漏洞CVE-2021-35587

, 2025/04/15 11:19:00

• 開源 GitHub 專案 ChatGPT 漏洞遭大規模濫用，美國為主要攻擊目標

, 2025/04/08 14:10:00

• 勒索軟體威脅升溫，攻擊手法日趨複雜

, 2025/03/28 10:08:00

• FBI發出安全警示，駭客利用免費轉檔網站散佈惡意軟體

, 2025/03/27 09:29:00

• 惡意AI模型潛伏Hugging Face，駭客陰謀大揭秘

, 2025/03/20 10:08:00

• 防範社交工程！駭客利用網站假冒手法進行攻擊

, 2025/03/17 17:00:00

• DeepSeek-R1 LLM 安全性崩潰？超過一半越獄攻擊輕鬆突破

, 2025/02/14 14:19:00

• 近日勒索軟體攻擊頻繁，企業與個人應加強網路安全防護

, 2025/02/13 09:36:00

• ChatGPT 爬蟲漏洞：AI 武器化，你的網站恐成攻擊目標

, 2025/02/08 09:50:00

• 駭客偽冒財政部發動社交工程郵件攻擊

, 2025/01/30 08:00:00

• npm惡意套件隱藏Quasar RAT遠端木馬

, 2025/01/27 10:00:00

• APT 命名標準新視界：國際駭客命名規範

, 2025/01/23 13:37:00

• Hail Cock：新型Mirai變種殭屍網路

, 2025/01/23 09:54:00

• 利用SEO中毒(SEO Poisoning)導向使用者到詐騙網站

, 2025/01/13 14:21:00

• 駭客對Google日曆釣魚手法的調整

, 2025/01/06 14:30:00

• 2025年資安趨勢與供應鏈安全挑戰

, 2024/12/25 10:25:00

• 揭露！中國警方操控的 Android 間諜軟體曝光

, 2024/12/23 14:46:00

• Venom Spider利用 MaaS平台部署的新型惡意程式

, 2024/12/17 15:09:00

• 2023年最常被利用的漏洞

, 2024/12/05 09:55:00

• 新型惡意軟體SteelFox偽裝破解工具竊取使用者敏感資料

, 2024/11/20 10:12:00

• INTUMIT SmartRobot - Server-Side Request Forgery

, 2025/04/14 09:27:00

• HGiga PowerStation - Chroot Escape

, 2025/04/07 12:00:00

• HGiga iSherlock - OS Command Injection

, 2025/04/07 11:52:00

• HGiga iSherlock - OS Command Injection

, 2025/04/07 11:49:00

• HGiga iSherlock - OS Command Injection

, 2025/04/07 11:24:00

• PiExtract SOOP-CLM - SQL Injection

, 2025/03/31 10:45:00

• EBM Technologies EBM Maintenance Center - SQL injection

, 2025/03/21 09:54:00

• e-Excellence U-Office Force - Arbitrary File Upload

, 2025/03/17 13:54:00

• e-Excellence U-Office Force - Improper Authentication

, 2025/03/17 13:47:00

• HGiga C&Cm@il - Stored Cross-Site Scripting

, 2025/03/10 14:55:00

• Learning Digital Orca HCM - SQL Injection

, 2025/02/17 12:01:00

• Learning Digital Orca HCM - Arbitrary File Upload

, 2025/02/17 11:52:00

• Learning Digital Orca HCM - Improper Authentication

, 2025/02/17 11:35:00

• Learning Digital Orca HCM - Missing Authentication

, 2025/02/17 11:20:00

• NetVision Information ISOinsight - Reflected Cross-site Scripting

, 2025/02/10 13:59:00

• Quanxun School Affairs System - Exposure of Sensitive Information

, 2025/02/10 13:51:00

• Billion Electric Router - Use of Hard-coded Credentials

, 2025/02/10 10:02:00

• aEnrich Technology a+HRD - Insecure Deserialization

, 2025/01/20 10:23:00

• aEnrich Technology a+HRD - SQL Injection

, 2025/01/20 10:08:00

• aEnrich Technology a+HRD - Server-Side Request Forgery (SSRF)

, 2025/01/20 09:55:00

• 碩網資訊 智能客服 SmartRobot - Server-Side Request Forgery

, 2025/04/14 09:23:00

• 桓基科技 PowerStation - Chroot Escape

, 2025/04/07 11:56:00

• 桓基科技 iSherlock - OS Command Injection

, 2025/04/07 11:47:00

• 桓基科技 iSherlock - OS Command Injection

, 2025/04/07 11:36:00

• 桓基科技 iSherlock - OS Command Injection

, 2025/04/07 11:20:00

• 信研科技 SOOP-CLM - SQL Injection

, 2025/03/31 10:36:00

• 商之器科技 EBM Maintenance Center - SQL injection

, 2025/03/21 09:50:00

• 一等一科技 U-Office Force - Arbitrary File Upload

, 2025/03/17 13:51:00

• 一等一科技 U-Office Force - Improper Authentication

, 2025/03/17 13:37:00

• 桓基科技 C&Cm@il - Stored Cross-Site Scripting

, 2025/03/10 14:52:00

• 一宇數位科技 Orca HCM - SQL Injection

, 2025/02/17 11:59:00

• 一宇數位科技 Orca HCM - Arbitrary File Upload

, 2025/02/17 11:42:00

• 一宇數位科技 Orca HCM - Improper Authentication

, 2025/02/17 11:32:00

• 一宇數位科技 Orca HCM - Missing Authentication

, 2025/02/17 11:18:00

• 正邦資訊 ISOinsight - Reflected Cross-site Scripting

, 2025/02/10 13:55:00

• 全訊電腦 校務行政系統 - Exposure of Sensitive Information

, 2025/02/10 11:34:00

• 盛達電業路由器 - Use of Hard-coded Credentials

, 2025/02/10 09:49:00

• 育碁數位科技 aEnrich a+HRD - Insecure Deserialization

, 2025/01/20 10:20:00

• 育碁數位科技 aEnrich a+HRD - SQL Injection

, 2025/01/20 10:06:00

• 育碁數位科技 a+HRD - Server-Side Request Forgery (SSRF)

, 2025/01/20 09:52:00