每日安全动态推送(4-26)

Tencent Security Xuanwu Lab Daily News

• 新型瞬态执行侧信道攻击能从英特尔处理器中窃取数据 – FreeBuf网络安全行业门户:

https://www.freebuf.com/news/364747.html

   ・ 一种针对多代英特尔CPU新的侧信道攻手法，让数据通过 EFLAGS 寄存器泄露。 – SecTodayBot

• TP-Link WAN-side Vulnerability CVE-2023-1389 Added to the Mirai Botnet Arsenal:
https://www.thezdi.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal

   ・ TP-Link WAN 端命令注入漏洞 CVE-2023-1389被添加到 Mirai 僵尸网络 – SecTodayBot

• CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions.:
https://seclists.org/oss-sec/2023/q2/102

   ・ CVE-2023-22665：Apache Jena 脚本引擎表达式中的存在任意代码执行漏洞 – SecTodayBot

• Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991:
https://qriousec.github.io/post/vbox-pwn2own-2023/

   ・ Pwn2Own Vancouver 2023 – VirtualBox 逃逸漏洞分析 – SecTodayBot

• PaperCut CVE-2023-27350 Deep Dive and Indicators of Compromise – Horizon3.ai:
https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/

   ・ PaperCut 为其企业打印管理软件发布了新版本，其中包含两个漏洞的补丁：CVE-2023-27350 和 CVE-2023-27351 – 这两个漏洞可能允许攻击者实现远程代码执行以破坏 papercut 应用程序服务  – SecTodayBot

• CVE-2023-27524: Apache Superset: Session validation vulnerability when using provided default SECRET_KEY:
https://seclists.org/oss-sec/2023/q2/100

   ・ CVE-2023-27524：Apache Superset：使用提供的默认 SECRET_KEY 时存在会话验证漏洞 – SecTodayBot

• Release of a Technical Report into Intel Trust Domain Extensions:
https://googleprojectzero.blogspot.com/2023/04/technical-report-into-intel-tdx.html

   ・ Intel 的 Trust Domain Extensions (TDX) – 通过保护敏感资源（例如访客物理内存）在运行时提供虚拟机访客的硬件隔离来支持机密计算而引入的功能  – SecTodayBot

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(4-26)