漏洞 Vulnerability Silver Peak Unity Orchestrator 远程代码执行漏洞 https://medium.com/realmodelabs/silver-peak-unity-orchestrator-rce-2928d65ef749 CVE-2020-16009：存在在野利用的一个chrome类型混淆漏洞 https://bugs.chromium.org/p/project-zero/issues/detail?id=2106 CVE-2020-17051：NFSv3 Windows Server中的远程内核堆溢出漏洞 https://www.mcafee.com/blogs/other-blogs/mcafee-labs/cve-2020-17051-remote-kernel-heap-overflow-in-nfsv3-windows-server/ ZDI发布的Adobe和微软11月安全补丁说明 https://www.zerodayinitiative.com/blog/2020/11/10/the-november-2020-security-update-review 安全工具 Security Tools XAPKDetector：Windows, Linux 和MacOS平台上的Android/APK/DEX 探测器 https://github.com/horsicq/XAPKDetector 安全资讯 Security Information 信安标委：《网络安全态势感知技术标准化白皮书（2020版）》发布 https://mp.weixin.qq.com/s/lqairM5j_CqqGOkAblHV4Q 安全研究 Security Research 对UEFI固件进行基于反馈的fuzz https://labs.sentinelone.com/moving-from-dynamic-emulation-of-uefi-modules-to-coverage-guided-fuzzing-of-uefi-firmware/ JavaScriptCore 分析 Part I：追踪jsc如何将源码转化成Bytecode https://zon8.re/posts/jsc-internals-part1-tracing-js-source-to-bytecode/ 利用 gdm3 和账户服务在Ubuntu 20.04中本地提权 https://securitylab.github.com/research/Ubuntu-gdm3-accountsservice-LPE Bitdefender反病毒引擎中的十个漏洞分析 https://landave.io/2020/11/bitdefender-upx-unpacking-featuring-ten-memory-corruptions/ 利用符号链接来root TP-Link AC1750 https://medium.com/tenable-techblog/tp-link-takeover-with-a-flash-drive-d493666f6b39 恶意软件 Malware 蠕虫僵尸网络Gitpaste-12分析 https://blog.sonatype.com/gitpaste-12 银行木马Ghimob的分析 https://securelist.com/ghimob-tetrade-threat-mobile-devices/99228/ 意大利遭受到 Ursif/Gozi 网络犯罪组织的持续攻击 https://www.difesaesicurezza.com/en/restrictedareacat/cybercrime-italy-hit-by-a-continous-ursif-gozi-offensive/