漏洞 Vulnerability CVE-2020-15012：Nexus Repository Manager 2 目录遍历漏洞通告 https://cert.360.cn/warning/detail?id=9f81fbb91113f1ed461a5fc725ce5be0 安全工具 Security Tools CSRFER-基于请求生成CSRF payload的工具 https://www.kitploit.com/2020/10/csrfer-tool-to-generate-csrf-payloads.html SB-Actuator https://github.com/rabbitmask/SB-Actuator 安全事件 Security Incident Fitbit gallery可用于分发恶意应用程序 https://www.bleepingcomputer.com/news/security/fitbit-gallery-can-be-used-to-distribute-malicious-apps/ 安全资讯 Security Information 国土安全部：不明黑客袭击了美国人口普查局网络 https://www.bleepingcomputer.com/news/security/dhs-unknown-hackers-targeted-the-us-census-bureau-network/ Facebook首次推出漏洞赏金 https://threatpost.com/facebook-bug-bounty-loyalty-program/159993/ 安全研究 Security Research 在IBM WEBSPHERE中利用其他远程协议 https://www.thezdi.com/blog/2020/9/29/exploiting-other-remote-protocols-in-ibm-websphere Ryuk 勒索事件分析 https://thedfirreport.com/2020/10/08/ryuks-return/ 深入挖掘.NET注入 https://xz.aliyun.com/t/8331 CVE-2020-14386: Linux内核中的特权升级漏洞 https://unit42.paloaltonetworks.com/cve-2020-14386/ 在拥有+20000用户的网站中利用LFI到RCE https://medium.com/bugbountywriteup/leveraging-lfi-to-rce-in-a-website-with-20000-users-129050f9982b