本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.27026。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41880]:Venom代理工具连接建立
2. 攻击[25497]:Microsoft Azure OMI认证绕过漏洞(CVE-2021-38647)
3. 攻击[25498]:D-Link DNS-320 命令注入漏洞 (CVE-2020-25506)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.27026. This package include changed rules:

new rules:
1. threat[41880]:Venom proxy tool connection establishment
2. threat[25497]:Microsoft Azure Open Management Infrastructure Authentication Bypass Vulnerability(CVE-2021-38647)
3. threat[25498]:D-Link DNS-320 Command Injection Vulnerability (CVE-2020-25506)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.27013。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25494]:Yealink Device Management 命令注入漏洞(CVE-2021-27561)
2. 攻击[25495]:用友NC6.5任意文件上传漏洞
3. 攻击[41879]:OneForAll资产收集工具子域名扫描
4. 攻击[41878]:恶意软件Windows/Aspxor_general网络通信
5. 攻击[25496]:WordPress Query SQL注入漏洞(CVE-2022-21661)

更新规则:
1. 攻击[30784]:Atlassian Confluence Server S端点信息泄露漏洞(CVE-2021-26085)
2. 攻击[49009]:可疑僵尸网络通信


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.27013. This package include changed rules:


new rules:
1. threat[25494]:Yealink Device Management Command Injection Vulnerability(CVE-2021-27561)
2. threat[25495]:Yonyou NC6.5 Arbitrary File Upload Vulnerability
3. threat[41879]:OneForAll Asset Collection Tool Scanning Subdomains
4. threat[41878]:Malware Windows/Aspxor_general Network Communication
5. threat[25496]:WordPress Query SQL Injection Vulnerability(CVE-2022-21661)

update rules:
1. threat[30784]:Atlassian Confluence Server S Endpoint Information Disclosure Vulnerability(CVE-2021-26085)
2. threat[49009]:Suspicious Botnet Communication


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26975。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41876]:恶意软件Windows/Trojan.BlackRev_general网络通信
2. 攻击[41875]:恶意软件Windows/BotnetKernel.BlackEnergy_o网络通信
3. 攻击[50617]:协议隧道工具splitBrain连接
4. 攻击[50618]:内网隧道工具Privotnacci连接
5. 攻击[41877]:恶意软件Windows/Fakocan_a网络通信
6. 攻击[25493]:Windows HTTP协议栈远程代码执行漏洞(CVE-2022-21907)

更新规则:
1. 攻击[50616]:DNS隧道通信建立SSH连接
2. 攻击[49009]:可疑僵尸网络通信


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26975. This package include changed rules:

new rules:
1. threat[41876]:Malware Windows/Trojan.BlackRev_general Network Communication
2. threat[41875]:Malware Windows/BotnetKernel.BlackEnergy_o Network Communication
3. threat[50617]:Protocol Tunnel Tool splitBrain Connect
4. threat[50618]:Intranet tunneling tool Privotnacci connection
5. threat[41877]:Malware Windows/Fakocan_a Network Communication
6. threat[25493]:HTTP Protocol Stack Remote Code Execution Vulnerability(CVE-2022-21907)

update rules:
1. threat[50616]:DNS tunnel communication is established through SSH connection
2. threat[49009]:Suspicious Botnet Communication


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26941。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25490]:go-http-tunnel隧道工具通信
2. 攻击[50616]:DNS隧道通信建立SSH连接
3. 攻击[25491]:MeterSphere远程代码执行漏洞
4. 攻击[41870]:恶意软件LifeCalendarWorm挖矿程序连接DNS服务器
5. 攻击[41873]:恶意软件Windows/Rukap_o网络通信
6. 攻击[41872]:恶意软件Windows/Prometei_o网络通信
7. 攻击[41871]:恶意软件Linux/Momentum_a网络通信
8. 攻击[25492]:Genexis Platinum 4410 远程代码执行漏洞 (CVE-2021-29003)
9. 攻击[41874]:firepass代理连接建立

更新规则:
1. 攻击[25475]:Apache Log4j2 远程代码执行漏洞(CVE-2021-44228)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26941. This package include changed rules:

new rules:
1. threat[25490]:go-http-tunnel Tunnel Communication
2. threat[50616]:DNS tunnel communication is established through SSH connection
3. threat[25491]:MeterSphere Remote Code Execution Vulnerability
4. threat[41870]:The Malware LifeCalendarWorm Mining Program Connects To DNS Server
5. threat[41873]:Malware Windows/Rukap_o Network Communication
6. threat[41872]:Malware Windows/Prometei_o Network Communication
7. threat[41871]:Malware Linux/Momentum_a Network Communication
8. threat[25492]:Genexis Platinum 4410 Remote Code Execution Vulnerability (CVE-2021-29003)
9. threat[41874]:Firepass proxy connection establishment

update rules:
1. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability(CVE-2021-44228)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26897。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25488]:Netgear NETGEAR 命令注入漏洞(CVE-2021-33514)
2. 攻击[25489]:Apache httpd mod_proxy Unix Socket 服务器端请求伪造漏洞 (CVE-2021-40438)
3. 应用:TRDP

更新规则:
1. 应用:opcua
2. 应用:sip
3. 应用:mqtt
4. 应用:rssp


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26897. This package include changed rules:

new rules:
1. threat[25488]:Netgear NETGEAR Command Injection Vulnerability(CVE-2021-33514)
2. threat[25489]:Apache httpd mod_proxy Unix Socket Server-Side Request Forgery Vulnerability (CVE-2021-40438)
3. app:TRDP

update rules:
1. app:opcua
2. app:sip
3. app:mqtt
4. app:rssp


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26861。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25485]:Persistent Systems Radia Client Automation命令执行漏洞(CVE-2015-1497)
2. 攻击[25487]:IBM Tivoli Storage Manager FastBack Server Opcode命令注入漏洞(CVE-2015-1949)
3. 攻击[30784]:Atlassian Confluence Server S端点信息泄露漏洞(CVE-2021-26085)
4. 应用:Yaskawa Robot
5. 应用:beckhoff_ads
6. 应用:codesys2
7. 应用:ANKONG500
8. 应用:Fanuc-CNC
9. 应用:vertx-edge
10. 应用:GIOP

更新规则:
1. 攻击[66200]:Microsoft Windows 远程桌面代码执行漏洞
2. 攻击[49014]:挖矿程序查询DNS矿池服务器域名
3. 应用:MODBUS
4. 应用:UMAS
5. 应用:MELSECQ


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26861. This package include changed rules:

new rules:
1. threat[25485]:Persistent Systems Radia Client Automation Command Execution Vulnerability(CVE-2015-1497)
2. threat[25487]:IBM Tivoli Storage Manager FastBack Server Opcode Command Injection Vulnerability(CVE-2015-1949)
3. threat[30784]:Atlassian Confluence Server S Endpoint Information Disclosure Vulnerability(CVE-2021-26085)
4. app:Yaskawa Robot
5. app:beckhoff_ads
6. app:codesys2
7. app:ANKONG500
8. app:Fanuc-CNC
9. app:vertx-edge
10. app:GIOP

update rules:
1. threat[66200]:Microsoft Windows Remote Desktop Code Execution Vulnerability
2. threat[49014]:Mining program query DNS mine pool server domain name
3. app:MODBUS
4. app:UMAS
5. app:MELSECQ


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26805。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25479]:Adobe Acrobat and Acrobat Reader DC AcroForm Field Format Action释放后重用漏洞(CVE-2021-39840)
2. 攻击[25480]:Delta Industrial Automation DIAEnergie HandlerAlarmGroup.aspx SQL注入漏洞(CVE-2021-38393)
3. 攻击[25481]:Adobe Acrobat and Acrobat Reader DC AcroForm buttonGetCaption释放后重用漏洞(CVE-2021-39838)
4. 攻击[25482]:GitLab Community and Enterprise Edition Branch Name 跨站脚本漏洞(CVE-2021-22241)
5. 攻击[25483]:HAProxy HTTP 头处理整数溢出漏洞(CVE-2021-40346)
6. 攻击[25484]:Grafana跨站脚本漏洞(CVE-2021-41174)
7. 攻击[41868]:恶意软件windows/ZeuS.ZbotCQJ_a僵尸网络通信

更新规则:
1. 攻击[25405]:Atlassian Confluence远程代码执行漏洞(CVE-2021-26084)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26805. This package include changed rules:

new rules:
1. threat[25479]:Adobe Acrobat and Acrobat Reader DC AcroForm Field Format Action Use After Free Vulnerability(CVE-2021-39840)
2. threat[25480]:Delta Industrial Automation DIAEnergie HandlerAlarmGroup.aspx SQL Injection(CVE-2021-38393)
3. threat[25481]:Adobe Acrobat and Acrobat Reader DC AcroForm buttonGetCaption Use After Free Vulnerability(CVE-2021-39838)
4. threat[25482]:GitLab Community and Enterprise Edition Branch Name Stored Cross-Site Scripting Vulnerability(CVE-2021-22241)
5. threat[25483]:HAProxy HTTP Header Handling Integer Overflow Vulnerability(CVE-2021-40346)
6. threat[25484]:Grafana Labs Grafana Cross-Site Scripting Vulnerability(CVE-2021-41174)
7. threat[41868]:Malware windows/ZeuS.ZbotCQJ_a Botnet Communication

update rules:
1. threat[25405]:Atlassian Confluence Remote Code Execution Vulnerability(CVE-2021-26084)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26749。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41867]:冰蝎 3.0 beta 9 Webshell 连接(PHP)
2. 攻击[25477]:WordPress LearnPress Plugin存储型跨站脚本漏洞(CVE-2021-39348)
3. 攻击[41866]:恶意软件Trojan.MSIL.Antiresys.A僵尸网络上线通信
4. 应用:ADB

更新规则:
1. 攻击[49014]:挖矿程序查询DNS矿池服务器域名
2. 攻击[25435]:Apache HTTP Server 目录遍历漏洞(CVE-2021-41773)(CVE-2021-42013)
3. 攻击[25475]:Apache Log4j2 远程代码执行漏洞(CVE-2021-44228)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26749. This package include changed rules:

new rules:
1. threat[41867]:Behinder 3.0 beta 9 Webshell Connect(PHP)
2. threat[25477]:WordPress LearnPress Plugin Profile Settings Stored Cross-Site Scripting Vulnerability(CVE-2021-39348)
3. threat[41866]:Malware Trojan.MSIL.Antiresys.A Botnet Network Communication
4. app:ADB

update rules:
1. threat[49014]:Mining program query DNS mine pool server domain name
2. threat[25435]:Apache HTTP Server Directory Traversal Vulnerability(CVE-2021-41773)(CVE-2021-42013)
3. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability(CVE-2021-44228)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26706。该升级包新增/改进的规则有:


更新规则:
1. 攻击[25475]:Apache Log4j2 远程代码执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26706. This package include changed rules:


update rules:
1. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26697。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25475]:Apache Log4j2 远程代码执行漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26697. This package include changed rules:

new rules:
1. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26681。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25471]:VMware vCenter Server目录遍历漏洞 (CVE-2021-22013)
2. 攻击[25472]:VMware vCenter Server服务器端请求伪造(SSRF)漏洞(CVE-2021-21993)
3. 攻击[41864]:恶意软件Trojan.Linux.Orbiteibot.A僵尸网络上线通信
4. 攻击[41865]:恶意软件Trojan.MSIL.Ratblamik.A僵尸网络上线通信
5. 攻击[25473]:泛微e-office 9任意文件上传漏洞
6. 攻击[25474]:Centreon componentTemplates.php SQL注入漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26681. This package include changed rules:

new rules:
1. threat[25471]:VMware vCenter Server Directory Traversal Vulnerability (CVE-2021-22013)
2. threat[25472]:VMware vCenter Server Server-Side Request Forgery(SSRF) Vulnerability(CVE-2021-21993)
3. threat[41864]:Malware Trojan.Linux.Orbiteibot.A Botnet Network Communication
4. threat[41865]:Malware Trojan.MSIL.Ratblamik.A Botnet Network Communication
5. threat[25473]:Weaver e-office 9 Arbitrary File Upload Vulnerability
6. threat[25474]:Centreon componentTemplates.php SQL Injection Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26660。该升级包新增/改进的规则有:


新增规则:
1. 攻击[41848]:Earthworm内网穿透工具SSH/Telnet通信
2. 攻击[41859]:恶意软件“匿影”挖矿程序DNS请求连接
3. 攻击[41860]:恶意软件ThanatosMiner挖矿程序DNS请求连接
4. 攻击[41849]:恶意软件MrbMiner挖矿程序DNS请求连接
5. 攻击[41850]:恶意软件Mykings挖矿程序DNS请求连接
6. 攻击[41852]:恶意软件Prometei挖矿程序DNS请求连接
7. 攻击[41853]:恶意软件TeamTNT挖矿程序DNS请求连接
8. 攻击[41851]:恶意软件z0Miner挖矿程序连接DNS服务器
9. 攻击[41854]:恶意软件Cleanfda挖矿程序连接DNS服务器
10. 攻击[41855]:Freakout挖矿程序连接DNS服务器
11. 攻击[41857]:恶意软件GuardMiner挖矿程序连接DNS服务器
12. 攻击[41858]:恶意软件LoggerMiner挖矿程序连接DNS服务器
13. 攻击[41861]:恶意程序DemonBot僵尸网络上线通信
14. 攻击[25470]:恶意挖矿程序ETHMiner获取挖矿任务
15. 攻击[41863]:恶意挖矿程序ETHMiner提交挖矿任务

更新规则:
1. 攻击[49040]:驱动人生下载器木马恶意域名DNS查询


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26660. This package include changed rules:


new rules:
1. threat[41848]:Earthworm Intranet Penetration Tool SSH/Telnet Communication
2. threat[41859]:Malware Blackout Mining Program DNS Request Connection
3. threat[41860]:Malware ThanatosMiner Mining Program DNS Request Connection
4. threat[41849]:Malware MrbMiner Mining Program DNS Request Connection
5. threat[41850]:Malware Mykings Mining Program DNS Request Connection
6. threat[41852]:Malware Prometei Mining Program DNS Request Connection
7. threat[41853]:Malware TeamTNT Mining Program DNS Request Connection
8. threat[41851]:Malware z0Miner mining program connects to DNS server
9. threat[41854]:Malware Cleanfda mining program connects to DNS server
10. threat[41855]:Freakout mining program connects to DNS server
11. threat[41857]:Malware GuardMiner mining program connects to DNS server
12. threat[41858]:Malware LoggerMiner mining program connects to DNS server
13. threat[41861]:Malware DemonBot Botnet Network Communication
14. threat[25470]:Malware Mining ETHMiner Obtains Mining Tasks
15. threat[41863]:Malware Mining ETHMiner Submits Mining Task

update rules:
1. threat[49040]:Driver Talent Downloader Trojan Malicious Domain Name Query


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26613。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25463]:Hikvision Web Server 命令注入漏洞(CVE-2021-36260)
2. 攻击[25465]:Cisco UCS Director AMF 外部实体注入漏洞
3. 攻击[25464]:天擎终端安全管理系统SQL注入漏洞
4. 攻击[30783]:Schneider Electric C-Bus Toolkit PROJECT RESTORE信息泄露漏洞(CVE-2021-22720)
5. 攻击[25466]:Apache Druid LoadData 任意文件读取漏洞(CVE-2021-36749)

更新规则:
1. 攻击[23853]:Microsoft Edge Remote内存破坏漏洞(CVE-2016-3294)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26613. This package include changed rules:

new rules:
1. threat[25463]:Hikvision Web Server Command Injection Vulnerability(CVE-2021-36260)
2. threat[25465]:Cisco UCS Director AMF External Entity Injection Vulnerability
3. threat[25464]:Tianqing Terminal Security Management System SQL Injection Vulnerability
4. threat[30783]:Schneider Electric C-Bus Toolkit PROJECT RESTORE Information Disclosure Vulnerability(CVE-2021-22720)
5. threat[25466]:Apache Druid LoadData Arbitrary File Read Vulnerability (CVE-2021-36749)

update rules:
1. threat[23853]:Microsoft Edge Remote Memory Corruption Vulnerability(CVE-2016-3294)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26553。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25458]:AndroRAT隧道工具通信
2. 攻击[25459]:Microsoft Edge 内存破坏漏洞(CVE-2016-3386)
3. 攻击[25460]:Edge浏览器Chakra引擎prototype_concat类型混乱漏洞(CVE-2016-7242)
4. 攻击[25461]:Microsoft Edge Browser Chakra Engine Array.join 类型混乱漏洞(CVE-2016-7189)
5. 攻击[25462]:Microsoft Excel安全特征绕过漏洞(CVE-2021-42292)

更新规则:
1. 攻击[25403]:Jenkins Generic Webhook Trigger 插件外部实体注入漏洞(CVE-2021-21669)
2. 攻击[23961]:Microsoft Internet Explorer/Edge远程内存破坏漏洞(CVE-2016-3382)(MS16-118)
3. 攻击[49014]:挖矿程序查询DNS矿池服务器域名
4. 攻击[25213]:Apache Shiro身份验证绕过漏洞(CVE-2020-11989)
5. 应用:Stratum Mining Protocol
6. 应用:MELSEC-Q


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26553. This package include changed rules:


new rules:
1. threat[25458]:AndroRAT Tunnel Communication
2. threat[25459]:Microsoft Edge Memory Corruption Vulnerability(CVE-2016-3386)
3. threat[25460]:Edge_Chakra__array_prototype_concat_Type_Confusion Vulnerability(CVE-2016-7242)
4. threat[25461]:Microsoft Edge Browser Chakra Engine Array.join Type Confusion(CVE-2016-7189)
5. threat[25462]:Microsoft Excel Security Feature Bypass Vulnerability(CVE-2021-42292)

update rules:
1. threat[25403]:Jenkins Generic Webhook Trigger Plugin External Entity Injection Vulnerability(CVE-2021-21669)
2. threat[23961]:Microsoft Internet Explorer/Edge Remote Memory Corruption Vulnerability(CVE-2016-3382)(MS16-118)
3. threat[49014]:Mining program query DNS mine pool server domain name
4. threat[25213]:Apache Shiro Authentication Bypass Vulnerability(CVE-2020-11989)
5. app:Stratum Mining Protocol
6. app:MELSEC-Q


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26523。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25455]:Dell EMC VMAX目录遍历漏洞(CVE-2018-1215)
2. 攻击[30782]:Microsoft Internet Explorer和Edge信息泄露漏洞(CVE-2016-7195)
3. 攻击[25457]:Microsoft Internet Explorer远程内存破坏漏洞(CVE-2016-7283) (MS16-144)
4. 攻击[25446]:Nagios XI Bulk Modification Tool bulkmodifications.inc.php SQL注入漏洞(CVE-2021-37350)

更新规则:
1. 攻击[25105]:Apache SkyWalking GraphQL 协议 SQL注入漏洞(CVE-2020-9483)
2. 攻击[22796]:Apache Struts远程代码执行漏洞 (CVE-2013-2251)
3. 攻击[23991]:Fastjson远程代码执行漏洞
4. 攻击[23904]:Microsoft Edge远程内存破坏漏洞(CVE-2016-7201)(MS16-129)
5. 攻击[23875]:IE vb脚本 VbsStrComp类型混乱漏洞(CVE-2016-3385)
6. 攻击[23888]:Microsoft Edge远程内存破坏漏洞(CVE-2016-7190)(MS16-119)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26523. This package include changed rules:


new rules:
1. threat[25455]:Dell EMC VMAX Directory Traversal Vulnerability(CVE-2018-1215)
2. threat[30782]:Microsoft Internet Explorer and Edge Information Disclosure Vulnerability(CVE-2016-7195)
3. threat[25457]:Microsoft Internet Explorer Remote Memory Corruption Vulnerability(CVE-2016-7283) (MS16-144)
4. threat[25446]:Nagios XI Bulk Modification Tool bulkmodifications.inc.php SQL Injection Vulnerability(CVE-2021-37350)
update rules:
1. threat[25105]:Apache SkyWalking GraphQL Protocol SQL Injection Vulnerability(CVE-2020-9483)
2. threat[22796]:Apache Struts Remote Code Execution(CVE-2013-2251)
3. threat[23991]:Fastjson Remote Code Execution Vulnerability
4. threat[23904]:Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2016-7201)(MS16-129)
5. threat[23875]:IE_vbscript_VbsStrComp_Type_Confusion Vulnerability(CVE-2016-3385)
6. threat[23888]:Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2016-7190)(MS16-119)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26476。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25450]:GitLab远程命令执行漏洞(CVE-2021-22205)
2. 攻击[25451]:Adobe Acrobat DC SMask越界写漏洞(CVE-2021-39843)
3. 攻击[25452]:Delta Industrial Automation DIAEnergie Handler_CFG.aspx SQL注入漏洞(CVE-2021-32983)
4. 攻击[25453]:Quest NetVault Backup 认证绕过漏洞(CVE-2018-1163)
5. 攻击[25454]:Google Golang Get命令注入漏洞(CVE-2018-7187)

更新规则:
1. 攻击[41473]:HTTP/2 HEADERS和CONTINUATION帧连接


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26476. This package include changed rules:


new rules:
1. threat[25450]:GitLab Remote Command Execution Vulnerability(CVE-2021-22205)
2. threat[25451]:Adobe Acrobat DC SMask Out of Bounds Write Vulnerability(CVE-2021-39843)
3. threat[25452]:Delta Industrial Automation DIAEnergie Handler_CFG.aspx SQL Injection Vulnerability(CVE-2021-32983)
4. threat[25453]:Quest NetVault Backup Authentication Bypass Vulnerability(CVE-2018-1163)
5. threat[25454]:Google Golang Get Command Injection Vulnerability(CVE-2018-7187)

update rules:
1. threat[41473]:HTTP/2 HEADERS and CONTINUATION connection


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26440。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25443]:Microsoft SharePoint Server 远程代码执行漏洞(CVE-2021-40487)
2. 攻击[25444]:Flarum存储型跨站脚本漏洞(CVE-2021-32671)
3. 攻击[25445]:Flarum反射型跨站脚本漏洞(CVE-2021-32671)
4. 攻击[25447]:Nagios XI Manage My Dashboards Page存储型跨站脚本漏洞(CVE-2021-38156)
5. 攻击[25448]:Advantech R-SeeNet 反射型跨站脚本漏洞(CVE-2021-21799)
6. 攻击[25449]:XXL-JOB（REST接口）未授权远程执行漏洞

更新规则:
1. 攻击[25189]:SolarWinds Orion Platform身份验证绕过漏洞(CVE-2020-10148)
2. 攻击[25442]:Schneider Electric C-Bus Toolkit 文件上传漏洞(CVE-2021-22719)
3. 应用:MODBUS


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26440. This package include changed rules:

new rules:
1. threat[25443]:Microsoft SharePoint Server Remote Code Execution Vulnerability(CVE-2021-40487)
2. threat[25444]:Flarum Stored Core Cross-Site Scripting Vulnerability(CVE-2021-32671)
3. threat[25445]:Flarum Reflected Core Cross-Site Scripting Vulnerability(CVE-2021-32671)
4. threat[25447]:Nagios XI Manage My Dashboards Page Stored Cross-Site Scripting Vulnerability(CVE-2021-38156)
5. threat[25448]:Advantech R-SeeNet Reflected Cross-Site Scripting Vulnerability(CVE-2021-21799)
6. threat[25449]:XXL-JOB (REST API) Unauthorized Remote Code Execution Vulnerability

update rules:
1. threat[25189]:SolarWinds Orion Platform Authentication Bypass Vulnerability(CVE-2020-10148)
2. threat[25442]:Schneider Electric C-Bus Toolkit FILE UPLOAD Unrestricted File Upload Vulnerability(CVE-2021-22719)
3. app:MODBUS


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26408。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25435]:Apache HTTP Server 目录遍历漏洞(CVE-2021-41773)(CVE-2021-42013)
2. 攻击[25436]:Adobe Acrobat Reader DC EScript.api Thermometer Object释放后重用漏洞(CVE-2021-28640)
3. 攻击[25437]:WordPress Automattic WooCommerce Blocks插件SQL注入漏洞(CVE-2021-32789)
4. 攻击[25438]:Adobe Acrobat Reader DC Window Procedure WM_SETFOCUS释放后重用漏洞(CVE-2021-28639)
5. 攻击[25439]:Eaton IPM removeBackground任意文件删除漏洞(CVE-2021-23278)
6. 攻击[25440]:Eaton IPM removeFirmware任意文件删除漏洞(CVE-2021-23278)
7. 攻击[25441]:Schneider Electric C-Bus Toolkit 目录遍历漏洞(CVE-2021-22717)
8. 攻击[25442]:Schneider Electric C-Bus Toolkit 文件上传漏洞(CVE-2021-22719)

更新规则:
1. 攻击[24610]:Drupal Database Abstraction API SQL注入漏洞(CVE-2014-3704)
2. 攻击[10139]:Linux Kernel SNMP NAT Helper远程拒绝服务攻击


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26408. This package include changed rules:

new rules:
1. threat[25435]:Apache HTTP Server Directory Traversal Vulnerability(CVE-2021-41773)(CVE-2021-42013)
2. threat[25436]:Adobe Acrobat Reader DC EScript.api Thermometer Object Use After Free Vulnerability(CVE-2021-28640)
3. threat[25437]:WordPress Automattic WooCommerce Blocks Plugin SQL Injection Vulnerability(CVE-2021-32789)
4. threat[25438]:Adobe Acrobat Reader DC Window Procedure WM_SETFOCUS Use After Free Vulnerability(CVE-2021-28639)
5. threat[25439]:Eaton IPM removeBackground Arbitrary File Deletion Vulnerability(CVE-2021-23278)
6. threat[25440]:Eaton IPM removeFirmware Arbitrary File Deletion Vulnerability(CVE-2021-23278)
7. threat[25441]:Schneider Electric C-Bus Toolkit ACCESS SAVE Command Directory Traversal Vulnerability(CVE-2021-22717)
8. threat[25442]:Schneider Electric C-Bus Toolkit FILE UPLOAD Unrestricted File Upload Vulnerability(CVE-2021-22719)

update rules:
1. threat[24610]:Drupal Database Abstraction API SQL Injection Vulnerability(CVE-2014-3704)
2. threat[10139]:Linux Kernel SNMP NAT Helper Remote Denial of Service


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26362。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25428]:Microsoft Windows Print Spooler远程代码执行漏洞(CVE-2021-34527)
2. 攻击[25429]:Nagios XI Switch Wizard Switch.inc.php命令注入漏洞(CVE-2021-37344)
3. 攻击[25430]:Netgear ProSAFE NMS300 MibController realName 目录遍历漏洞(CVE-2021-27276)
4. 攻击[25431]:Oracle Business Intelligence AMF反序列化漏洞(CVE-2021-2456)
5. 攻击[30780]:Oracle Business Intelligence XML外部实体注入漏洞(CVE-2021-2401)
6. 攻击[25432]:Atlassian JIRA Data Center不安全反序列化漏洞(CVE-2020-36239)
7. 攻击[25433]:Nagios Log Server Audit Log And Alert History 反射型跨站脚本漏洞(CVE-2021-35478)

更新规则:
1. 攻击[50593]:Redis认证失败
2. 攻击[24610]:Drupal Database Abstraction API SQL注入漏洞(CVE-2014-3704)
3. 攻击[25427]:Advantech R-SeeNet跨站脚本漏洞(CVE-2021-21800)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26362. This package include changed rules:

new rules:
1. threat[25428]:Microsoft Windows Print Spooler Code Execution Vulnerability(CVE-2021-34527)
2. threat[25429]:Nagios XI Switch Wizard Switch.inc.php Command Injection Vulnerability(CVE-2021-37344)
3. threat[25430]:Netgear ProSAFE NMS300 MibController realName Directory Traversal Vulnerability(CVE-2021-27276)
4. threat[25431]:Oracle Business Intelligence BIRemotingServlet AMF Insecure Deserialization Vulnerability(CVE-2021-2456)
5. threat[30780]:Oracle Business Intelligence Publisher XDO XML External Entity Injection Vulnerability(CVE-2021-2401)
6. threat[25432]:Atlassian JIRA Data Center Insecure Deserialization Vulnerability(CVE-2020-36239)
7. threat[25433]:Nagios Log Server Audit Log And Alert History Reflected Cross-Site Scripting Vulnerability(CVE-2021-35478)

update rules:
1. threat[50593]:Redis Authenticated Failed
2. threat[24610]:Drupal Database Abstraction API SQL Injection Vulnerability(CVE-2014-3704)
3. threat[25427]:Advantech R-SeeNet Cross-Site Scripting Vulnerability(CVE-2021-21800)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26316。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25426]:Advantech R-SeeNet 命令注入漏洞(CVE-2021-21805)
2. 攻击[25427]:Advantech R-SeeNet跨站脚本漏洞(CVE-2021-21800)

更新规则:
1. 攻击[25425]:Microsoft MSHTML 远程代码执行漏洞(CVE-2021-40444)
2. 攻击[25424]:Netgear ProSAFE NMS300命令注入漏洞(CVE-2021-27273)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26316. This package include changed rules:

new rules:
1. threat[25426]:Advantech R-SeeNet Command Injection Vulnerability(CVE-2021-21805)
2. threat[25427]:Advantech R-SeeNet Cross-Site Scripting Vulnerability(CVE-2021-21800)

update rules:
1. threat[25425]:Microsoft MSHTML Remote Code Execution Vulnerability(CVE-2021-40444)
2. threat[25424]:Netgear ProSAFE NMS300 Command Injection Vulnerability(CVE-2021-27273)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26306。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25422]:Microsoft Visual Studio Code 扩展命令注入漏洞(CVE-2021-28472)
2. 攻击[25424]:Netgear ProSAFE NMS300命令注入漏洞(CVE-2021-27273)
3. 攻击[25423]:Adobe Acrobat and Acrobat Reader DC AcroForm addField释放后重用漏洞(CVE-2021-28635)
4. 攻击[25425]:Microsoft MSHTML 远程代码执行漏洞(CVE-2021-40444)

更新规则:
1. 攻击[25222]:Nagios XI 5.7.5 HTTP Request cloud-vm.inc.php系统命令注入漏洞(CVE-2021-25298)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26306. This package include changed rules:

new rules:
1. threat[25422]:Microsoft Visual Studio Code Extension Command Injection Vulnerability(CVE-2021-28472)
2. threat[25424]:Netgear ProSAFE NMS300 Command Injection Vulnerability(CVE-2021-27273)
3. threat[25423]:Adobe Acrobat and Acrobat Reader DC AcroForm addField Use After Free Vulnerability(CVE-2021-28635)
4. threat[25425]:Microsoft MSHTML Remote Code Execution Vulnerability(CVE-2021-40444)

update rules:
1. threat[25222]:Nagios XI 5.7.5 HTTP Request cloud-vm.inc.php OS Command Injection Vulnerability(CVE-2021-25298)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26278。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25416]:phpMyAdmin跨站点请求伪造漏洞(CVE-2019-12922)
2. 攻击[25415]:Nginx越界读取缓存漏洞(CVE-2017-7529)
3. 攻击[25417]:Apache Struts OGNL 远程代码执行漏洞
4. 攻击[25418]:Python PIL/Pillow远程命令执行漏洞（Ghostscript）（CVE-2018-16509）
5. 攻击[25420]:phpMyAdmin lint.php本地文件包含漏洞(CVE-2018-12613)
6. 攻击[25419]:Advantech iView getPSInventoryInfo SQL注入漏洞(CVE-2021-32932)
7. 攻击[25421]:Advantech R-SeeNet device_graph_page.php跨站脚本漏洞(CVE-2021-21801)

更新规则:
1. 攻击[24497]:Python PIL 远程命令执行漏洞(CVE-2017-8291)
2. 攻击[24849]:通达OA任意文件上传漏洞
3. 攻击[24794]:通达OA任意文件包含漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26278. This package include changed rules:

new rules:
1. threat[25416]:phpMyAdmin Cross Site Request Forgery Vulnerability(CVE-2019-12922)
2. threat[25415]:Nginx Out-of-bounds Read Cache Vulnerability(CVE-2017-7529)
3. threat[25417]:Apache Struts OGNL Remote Code Execution Vulnerability
4. threat[25418]:Python PIL/Pillow Remote Code Execution Vulnerability(Ghostscript)(CVE-2018-16509)
5. threat[25420]:phpMyAdmin lint.php Local File Inclusion Vulnerability(CVE-2018-12613)
6. threat[25419]:Advantech iView getPSInventoryInfo SQL Injection Vulnerability(CVE-2021-32932)
7. threat[25421]:Advantech R-SeeNet device_graph_page.php Cross-Site Scripting Vulnerability(CVE-2021-21801)

update rules:
1. threat[24497]:Python PIL Remote Command Execution Vulnerability (CVE-2017-8291)
2. threat[24849]:TongDa OA arbitrary file upload vulnerability
3. threat[24794]:Tongda OA Arbitrary File Contains Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26245。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25410]:Apache ActiveMQ 反序列化漏洞(CVE-2015-5254)
2. 攻击[25411]:Weblogic 二次序列化漏洞(CVE-2021-2135)
3. 攻击[25412]:Jenkins Extra Columns 插件存储型跨站脚本漏洞(CVE-2021-21630)
4. 攻击[25413]:Apache Tomcat Session远程代码执行漏洞（CVE-2020-9484）
5. 攻击[25414]:Jenkins Scriptler 插件存储型跨站点脚本漏洞(CVE-2021-21667)
6. 应用:达梦数据库

更新规则:
1. 攻击[25409]:Zoho ManageEngine ServiceDesk Plus远程命令执行漏洞(CVE-2021-20081)
2. 攻击[41843]:Zgrab 扫描攻击探测
3. 攻击[25145]:Weblogic Server远程代码执行漏洞(CVE-2021-2109)
4. 攻击[66200]:Microsoft Windows 远程桌面代码执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26245. This package include changed rules:


new rules:
1. threat[25410]:Apache ActiveMQ Deserialization Vulnerability (CVE-2015-5254)
2. threat[25411]:Weblogic Secondary Serialization Vulnerability(CVE-2021-2135)
3. threat[25412]:Jenkins Extra Columns Plugin Stored Cross-Site Scripting Vulnerability(CVE-2021-21630)
4. threat[25413]:Apache Tomcat Session Remote Code Execution Vulnerability(CVE-2020-9484)
5. threat[25414]:Jenkins Scriptler Plugin Stored Cross-Site Scripting Vulnerability(CVE-2021-21667)
6. app:add

update rules:
1. threat[25409]:Zoho ManageEngine ServiceDesk Plus Custom Schedules Arbitrary Command Execution Vulnerability(CVE-2021-20081)
2. threat[41843]:Zgrab scan attack detection
3. threat[25145]:Weblogic Server Remote Code Execution Vulnerability(CVE-2021-2109)
4. threat[66200]:Microsoft Windows Remote Desktop Code Execution Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26200。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25404]:Zoho ManageEngine Applications Manager跨站脚本漏洞(CVE-2021-31813)
2. 攻击[41843]:Zgrab 扫描攻击探测
3. 攻击[25406]:Spring 框架反射型文件下载漏洞(CVE-2020-5421)
4. 攻击[25407]:Oracle Weblogic WLS组件远程代码执行漏洞（CVE-2018-3191）
5. 攻击[25408]:Oracle Weblogic远程代码执行漏洞（CVE-2018-3245）
6. 攻击[25409]:Zoho ManageEngine ServiceDesk Plus远程命令执行漏洞(CVE-2021-20081)

更新规则:
1. 攻击[24851]:Spring Security OAuth 远程代码执行漏洞(CVE-2016-4977)
2. 攻击[41842]:Mozi 僵尸网络通信
3. 攻击[25213]:Apache Shiro身份验证绕过漏洞(CVE-2020-11989)
4. 攻击[23783]:nginx文件类型错误解析漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26200. This package include changed rules:

new rules:
1. threat[25404]:Zoho ManageEngine Applications Manager UserConfigurationAction Cross-Site Scripting(CVE-2021-31813)
2. threat[41843]:Zgrab scan attack detection
3. threat[25406]:Spring Framework Reflective File Download Vulnerability(CVE-2020-5421)
4. threat[25407]:Oracle Weblogic WLS Core Components Remote Code Execution Vulnerability(CVE-2018-3191)
5. threat[25408]:Oracle Weblogic Remote Code Execution Vulnerability(CVE-2018-3245)
6. threat[25409]:Zoho ManageEngine ServiceDesk Plus Custom Schedules Arbitrary Command Execution Vulnerability(CVE-2021-20081)

update rules:
1. threat[24851]:Spring Security OAuth remote code execution vulnerability (CVE-2016-4977)
2. threat[41842]:Mozi Botnet Communication
3. threat[25213]:Apache Shiro Authentication Bypass Vulnerability(CVE-2020-11989)
4. threat[23783]:nginx Incorrect File Type Parse Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26154。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25400]:Jenkins Config File Provider 组件外部实体注入漏洞(CVE-2021-21642)
2. 攻击[25401]:SolarWinds Network Performance Monitor反序列化漏洞(CVE-2021-31474)
3. 攻击[25402]:Zoho ManageEngine ADSelfService Plus命令注入漏洞(CVE-2021-28958)
4. 攻击[25403]:Jenkins Generic Webhook Trigger 插件外部实体注入漏洞(CVE-2021-21669)
5. 攻击[25404]:Zoho ManageEngine Applications Manager跨站脚本漏洞(CVE-2021-31813)
6. 攻击[25405]:Atlassian Confluence远程代码执行漏洞(CVE-2021-26084)
7. 应用:OPC DA
8. 应用:OPC AE

更新规则:
1. 攻击[24276]:Apache HTTP Server远程安全限制绕过漏洞（CVE-2017-15715）
2. 攻击[66200]:Microsoft Windows 远程桌面代码执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26154. This package include changed rules:

new rules:
1. threat[25400]:Jenkins Config File Provider Plugin External Entity Injection Vulnerability(CVE-2021-21642)
2. threat[25401]:SolarWinds Network Performance Monitor FromJson Insecure Deserialization(CVE-2021-31474)
3. threat[25402]:Zoho ManageEngine ADSelfService Plus Password Command Injection(CVE-2021-28958)
4. threat[25403]:Jenkins Generic Webhook Trigger Plugin External Entity Injection Vulnerability(CVE-2021-21669)
5. threat[25404]:Zoho ManageEngine Applications Manager UserConfigurationAction Cross-Site Scripting(CVE-2021-31813)
6. threat[25405]:Atlassian Confluence Remote Code Execution Vulnerability(CVE-2021-26084)
7. app:OPC DA
8. app:OPC AE

update rules:
1. threat[24276]:Apache HTTP Server Remote Security Limit Bypass Vulnerability (CVE-2017-15715)
2. threat[66200]:Microsoft Windows Remote Desktop Code Execution Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26127。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25395]:JBoss Application Server EJBInvokerServlet 远程代码执行漏洞(CVE-2013-4810)
2. 攻击[25396]:JBoss Application Server JMXInvokerServlet 反序列化漏洞(CVE-2015-7501)
3. 攻击[25397]:Adobe ColdFusion 反序列化漏洞(CVE-2017-3066)
4. 攻击[41842]:WorkMiner 僵尸网络通信

更新规则:
1. 攻击[24141]:Apache CouchDB权限提升漏洞(CVE-2017-12635)
2. 攻击[24109]:Apache Solr/LuceneXML实体扩展漏洞（XXE）(CVE-2017-12629)
3. 攻击[41660]:疑似通过PostgreSQL的COPY FROM PROGRAM功能运行系统命令(CVE-2019-9193)
4. 攻击[22038]:HTTPDX h_handlepeer() Function缓冲区溢出漏洞
5. 攻击[30779]:Netgear ProSAFE NMS300 ConfigFileController 任意文件读取(CVE-2021-27275)
6. 攻击[25391]:Netgear ProSAFE NMS300M FileUploadController 任意文件上传(CVE-2021-27274)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26127. This package include changed rules:

new rules:
1. threat[25395]:Boss Application Server EJBInvokerServlet Remote Code Execution Vulnerability(CVE-2013-4810)
2. threat[25396]:JBoss Application Server JMXInvokerServlet Deserialization Vulnerability(CVE-2015-7501)
3. threat[25397]:Adobe ColdFusion Deserialization Vulnerability(CVE-2017-3066)
4. threat[41842]:WorkMiner Botnet Communication

update rules:
1. threat[24141]:Apache CouchDB Privilege Escalation Vulnerability(CVE-2017-12635)
2. threat[24109]:Apache Solr/LuceneXML Entity Extension Vulnerability (XXE) (CVE-2017-12629)
3. threat[41660]:Suspected to run system commands via PostgreSQL's COPY FROM PROGRAM function(CVE-2019-9193)
4. threat[22038]:HTTPDX h_handlepeer() Function Buffer Overflow Vulnerability
5. threat[30779]:Netgear ProSAFE NMS300 ConfigFileController getFileContext Arbitrary File Read(CVE-2021-27275)
6. threat[25391]:Netgear ProSAFE NMS300M FileUploadController Unrestricted File Upload(CVE-2021-27274)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26067。该升级包新增/改进的规则有:

新增规则:
1. 攻击[10529]:OpenLDAP slapd Search断言失败拒绝服务漏洞(CVE-2021-27212)
2. 攻击[25384]:Schneider Electric C-Bus Toolkit 目录遍历漏洞(CVE-2021-22718)
3. 攻击[25385]:Ruby Net::FTP 命令注入漏洞(CVE-2017-17405)
4. 攻击[25383]:Apache OFBiz任意文件上传漏洞(CVE-2021-37608)
5. 攻击[25388]:VMware vCenter Server 远程代码执行漏洞(CVE-2021-21985)
6. 攻击[25386]:Nagios XI email地址存储型跨站脚本漏洞
7. 攻击[25387]:Nagios XI Custom-includes Manage.php目录遍历(CVE-2021-3277)
8. 攻击[30779]:Netgear ProSAFE NMS300 ConfigFileController 任意文件读取(CVE-2021-27275)
9. 攻击[25390]:Netgear ProSAFE NMS300 FileUploadUtils目录遍历
10. 攻击[25391]:Netgear ProSAFE NMS300M FileUploadController 无限制文件上传(CVE-2021-27274)
11. 攻击[25392]:Apache Spark未授权远程代码执行漏洞(REST方式)
12. 攻击[25393]:Fortinet FortiWeb 远程命令执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26067. This package include changed rules:

new rules:
1. threat[10529]:OpenLDAP slapd Search Assertion Failure Denial of Service Vulnerability(CVE-2021-27212)
2. threat[25384]:Schneider Electric C-Bus Toolkit Directory Traversal(CVE-2021-22718)
3. threat[25385]:Ruby Net::FTP Command Injection Vulnerability(CVE-2017-17405)
4. threat[25383]:Apache OFBiz Arbitrary File Upload Vulnerability(CVE-2021-37608)
5. threat[25388]:VMware vCenter Server Remote Code Execution Vulnerability(CVE-2021-21985)
6. threat[25386]:Nagios XI Account Email Address Stored Cross-Site Scripting
7. threat[25387]:Nagios XI Custom-includes Manage.php Rename_file Directory Traversal(CVE-2021-3277)
8. threat[30779]:Netgear ProSAFE NMS300 ConfigFileController getFileContext Arbitrary File Read(CVE-2021-27275)
9. threat[25390]:Netgear ProSAFE NMS300 FileUploadUtils Directory Traversal
10. threat[25391]:Netgear ProSAFE NMS300M FileUploadController Unrestricted File Upload(CVE-2021-27274)
11. threat[25392]:Apache Spark Unauthorized Remote Code Execution Vulnerability (REST)
12. threat[25393]:Fortinet FortiWeb OS Command Injection Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26038。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25379]:Zoho ManageEngine Applications Manager Displayname 存储型跨站脚本漏洞
2. 攻击[25381]:Zoho ManageEngine Applications Manager URL monitor SQL注入漏洞
3. 攻击[25382]:OpenEMR phpGACL edit_group.php SQL注入漏洞(CVE-2020-13568)

更新规则:
1. 攻击[25378]:Jenkins 多个插件外部实体注入漏洞(CVE-2021-21659)(CVE-2021-21658)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26038. This package include changed rules:

new rules:
1. threat[25379]:Zoho ManageEngine Applications Manager Displayname Stored Cross-Site Scripting Vulnerability
2. threat[25381]:Zoho ManageEngine Applications Manager URL monitor SQL Injection Vulnerability
3. threat[25382]:OpenEMR phpGACL edit_group.php SQL Injection Vulnerability(CVE-2020-13568)

update rules:
1. threat[25378]:Jenkins Multiple Plugins External Entity Injection Vulnerability(CVE-2021-21659)(CVE-2021-21658)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.26005。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25374]:ThinkPHP 2.x/3.0 远程代码执行漏洞
2. 攻击[25375]:SEO Panel反射型跨站脚本漏洞(CVE-2021-3002)
3. 攻击[25376]:TamronOS IPTV系统任意命令执行漏洞
4. 攻击[25377]:Gitlab服务器端请求伪造(SSRF)漏洞(CVE-2021-22214)
5. 攻击[25371]:Jenkins Active Choices 组件存储型跨站脚本漏洞(CVE-2021-21616)
6. 攻击[25372]:Jenkins Claim组件存储型跨站脚本漏洞(CVE-2021-21619)

更新规则:
1. 攻击[41702]:Nmap扫描攻击探测
2. 攻击[41060]:木马后门程序PHP一句话木马


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.26005. This package include changed rules:

new rules:
1. threat[25374]:ThinkPHP 2.x/3.0 Remote Code Execution Vulnerability
2. threat[25375]:SEO Panel Reflected Cross-Site Scripting Vulnerability(CVE-2021-3002)
3. threat[25376]:TamronOS IPTV System Arbitrary Command Execution Vulnerability
4. threat[25377]:Gitlab Server-Side Request Forgery(SSRF) Vulnerability(CVE-2021-22214)
5. threat[25371]:Jenkins Active Choices Plugin Stored Cross-Site Scripting Vulnerability(CVE-2021-21616)
6. threat[25372]:Jenkins Claim Plugin Stored Cross-Site Scripting Vulnerability(CVE-2021-21619)

update rules:
1. threat[41702]:Nmap scan attack detection
2. threat[41060]:Trojan/Backdoor General PHP trojan


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25946。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25363]:Netgate pfSense services_wol_edit.php 存储型跨站脚本漏洞(CVE-2021-27933)
2. 攻击[25364]:Cisco HyperFlex HX Auth远程代码执行漏洞(CVE-2021-1497)
3. 攻击[25366]:GitLab Graphql信息泄露漏洞(CVE-2020-26413)
4. 攻击[25367]:Citrix XenMobile 任意文件读取漏洞(CVE-2020-8209)
5. 攻击[25370]:Apache Pulsar JSON Web Token 认证绕过漏洞(CVE-2021-22160)
6. 攻击[25368]:IceWarp WebClient 跨站脚本漏洞(CVE-2020-25925)
7. 攻击[25369]:IceWarp WebClient basic 远程命令执行漏洞
8. 攻击[25365]:Cisco HyperFlex HX storfs-asup远程代码执行漏洞(CVE-2021-1498)

更新规则:
1. 攻击[63144]:Microsoft Windows注册表写入尝试
2. 攻击[63143]:Microsoft Windows注册表读取尝试


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25946. This package include changed rules:

new rules:
1. threat[25363]:Netgate pfSense services_wol_edit.php Stored Cross-Site Scripting Vulnerability(CVE-2021-27933)
2. threat[25364]:Cisco HyperFlex HX Auth Remote Command Execution Vulnerability(CVE-2021-1497)
3. threat[25366]:GitLab Graphql Information Disclosure Vulnerability(CVE-2020-26413)
4. threat[25367]:Citrix XenMobile Arbitrary File Read Vulnerability(CVE-2020-8209)
5. threat[25370]:Apache Pulsar JSON Web Token Authentication Bypass Vulnerability(CVE-2021-22160)
6. threat[25368]:IceWarp WebClient Cross Site Scripting Vulnerability(CVE-2020-25925)
7. threat[25369]:IceWarp WebClient basic Remote Command Execution Vulnerability
8. threat[25365]:Cisco HyperFlex HX storfs-asup Remote Command Execution Vulnerability(CVE-2021-1498)

update rules:
1. threat[63144]:Microsoft Windows Registry Write Attempt
2. threat[63143]:Microsoft Windows Registry Read Attempt


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25909。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25354]:phpMyadmin Scripts/setup.php反序列化漏洞
2. 攻击[25355]:Siemens SINEC NMS目录遍历漏洞(CVE-2020-25237)
3. 攻击[25356]:Adobe ColdFusion管理控制台目录遍历漏洞(CVE-2010-2861 )
4. 攻击[25357]:VMware vRealize Operations任意文件写入漏洞(CVE-2021-21983)
5. 攻击[25358]:WordPress 外部实体注入漏洞(CVE-2021-29447)
6. 攻击[25353]:Zoho ManageEngine应用管理器存储型跨站点脚本漏洞
7. 攻击[25359]:Jenkins Credentials Plugin 反射型跨站脚本漏洞(CVE-2021-21648)
8. 攻击[25361]:Apache Dubbo YAML不安全反序列化漏洞(CVE-2021-30180)
9. 攻击[25362]:Apache Dubbo Script Routing 远程代码执行漏洞(CVE-2021-30181)
10. 攻击[25360]:Jenkins Dashboard View Plugin 存储型跨站脚本漏洞(CVE-2021-21649)

更新规则:
1. 攻击[25122]:XStream任意文件删除漏洞（CVE-2020-26259）
2. 攻击[25336]:Microsoft Internet Explorer 内存破坏漏洞(CVE-2021-26411)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25909. This package include changed rules:

new rules:
1. threat[25354]:phpMyadmin Scripts/setup.php Deserialization Vulnerability
2. threat[25355]:Siemens SINEC NMS Directory Traversal Vulnerability(CVE-2020-25237)
3. threat[25356]:Adobe ColdFusion Administrator Console Directory Traversal Vulnerability(CVE-2010-2861 )
4. threat[25357]:VMware vRealize Operations Arbitrary File Write Vulnerability(CVE-2021-21983)
5. threat[25358]:WordPress External Entity Injection Vulnerability(CVE-2021-29447)
6. threat[25353]:Zoho ManageEngine Applications Manager Program Stored Cross-Site Scripting Vulnerability
7. threat[25359]:Jenkins Credentials Plugin Reflected Cross-Site Scripting Vulnerability(CVE-2021-21648)
8. threat[25361]:Apache Dubbo Unsafe YAML Unmarshalling Vulnerability(CVE-2021-30180)
9. threat[25362]:Apache Dubbo Script Routing Remote Code Execution Vulnerability(CVE-2021-30181)
10. threat[25360]:Jenkins Dashboard View Plugin Stored Cross-Site Scripting Vulnerability(CVE-2021-21649)

update rules:
1. threat[25122]:XStream Arbitrary File Deletion Vulnerability (CVE-2020-26259)
2. threat[25336]:Microsoft Internet Explorer Memory Corruption Vulnerability(CVE-2021-26411)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25836。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25347]:Nexus Repository Manager 3 远程命令执行漏洞(CVE-2020-10204)
2. 攻击[25352]:Struts2远程命令执行漏洞(CVE-2017-12611)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25836. This package include changed rules:

new rules:
1. threat[25347]:Nexus Repository Manager 3 Remote Command Execution Vulnerability(CVE-2020-10204)
2. threat[25352]:Struts2 Remote Command Execution Vulnerability (CVE-2017-12611)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25814。该升级包新增/改进的规则有:

新增规则:
1. 攻击[30778]:Oracle E-Business电子商务套件iStore跨站脚本注入漏洞(CVE-2021-2182)
2. 攻击[25341]:Saltstack SaltStack Salt 目录遍历漏洞(CVE-2021-25282)
3. 攻击[25342]:Gitea 1.4.0 目录穿越漏洞
4. 攻击[25343]:YAPI Mock功能远程代码执行漏洞
5. 攻击[25340]:Apache Dubbo反序列化漏洞(CVE-2021-25641)
6. 攻击[25339]:Websvn 2.6.0 - 远程代码执行漏洞(CVE-2021-32305)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25814. This package include changed rules:

new rules:
1. threat[30778]:Oracle E-Business Suite iStore Cross-Site Scripting Vulnerability(CVE-2021-2182)
2. threat[25341]:Saltstack SaltStack Salt Directory Traversal Vulnerability(CVE-2021-25282)
3. threat[25342]:Gitea 1.4.0 Directory Traversal Vulnerability
4. threat[25343]:YAPI Mock Script Remote Code Execution Vulnerability
5. threat[25340]:Apache Dubbo Unsafe Deserialization Vulnerability(CVE-2021-25641)
6. threat[25339]:Websvn 2.6.0 - Remote Code Execution Vulnerability(CVE-2021-32305)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25788。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25335]:Apache Airflow 1.10.10 远程代码执行漏洞(CVE-2020-11978)
2. 攻击[25337]:VMware vCenter Server Tar 目录遍历漏洞(CVE-2021-21972)
3. 攻击[25338]:Umbraco CMS 存储型跨站脚本漏洞(CVE-2020-5810)

更新规则:
1. 攻击[25326]:Microsoft Windows Print Spooler权限提升漏洞(CVE-2021-1675,CVE-2021-34527)
2. 攻击[21374]:Apache Struts远程命令执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25788. This package include changed rules:

new rules:
1. threat[25335]:Apache Airflow 1.10.10 Remote Code Execution Vulnerability(CVE-2020-11978)
2. threat[25337]:VMware vCenter Server Tar Directory Traversal Vulnerabilty(CVE-2021-21972)
3. threat[25338]:Umbraco CMS Stored Cross-Site Scripting(CVE-2020-5810)

update rules:
1. threat[25326]:Microsoft Windows Print Spooler Privilege Escalation Vulnerability(CVE-2021-1675,CVE-2021-34527)
2. threat[21374]:Apache Struts Remote Command Execution Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25753。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25326]:Microsoft Windows Print Spooler权限提升漏洞(CVE-2021-1675)
2. 攻击[25327]:OpenEMR Usergroup_admin.php存储型跨站脚本漏洞
3. 攻击[25328]:Oracle商务组件Common Applications Calendar跨站脚本漏洞(CVE-2021-2114)
4. 攻击[25330]:OpenEMR patient_report.php 存储型跨站脚本漏洞(CVE-2021-25921)
5. 攻击[25331]:phpGACL acl_admin.php反射型跨站脚本漏洞(CVE-2020-13562)
6. 攻击[25332]:AMD Gaming Evolved产品plays.tv远程命令执行漏洞(CVE-2018-6546)
7. 攻击[25333]:Microsoft Scripting Engine内存破坏漏洞(CVE-2021-31959)
8. 攻击[25329]:Netgear ProSAFE NMS300 SettingConfigController 命令注入漏洞(CVE-2021-27273)
9. 攻击[25325]:Netgear ProSAFE NMS300 ReportTemplateController 任意文件删除漏洞(CVE-2021-27272)

更新规则:
1. 攻击[24840]:jboss反序列化漏洞(CVE-2017-7504)
2. 攻击[25283]:Tenda USAC15 addWifiMacFilter缓冲区溢出(CVE-2018-18731)
3. 攻击[41768]:哥斯拉Godzilla Webshell PHP脚本上传
4. 攻击[25236]:致远OA远程命令执行漏洞 - post请求
5. 攻击[23966]:Microsoft Edge远程内存破坏漏洞(CVE-2016-7288)(MS16-145)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25753. This package include changed rules:

new rules:
1. threat[25326]:Microsoft Windows Print Spooler Privilege Escalation Vulnerability(CVE-2021-1675)
2. threat[25327]:OpenEMR Usergroup_admin.php Stored Cross-Site Scripting
3. threat[25328]:Oracle E-Business Suite Common Applications Calendar Cross-Site Scripting Vulnerability(CVE-2021-2114)
4. threat[25330]:OpenEMR patient_report.php Stored Cross-Site Scripting Vulnerability(CVE-2021-25921)
5. threat[25331]:phpGACL acl_admin.php Reflected Cross-Site Scripting Vulnerability(CVE-2020-13562)
6. threat[25332]:AMD Gaming Evolved plays.tv Remote Command Execution Vulnerability(CVE-2018-6546)
7. threat[25333]:Microsoft Scripting Engine Memory Corruption Vulnerability(CVE-2021-31959)
8. threat[25329]:Netgear ProSAFE NMS300 SettingConfigController Command Injection Vulnerability(CVE-2021-27273)
9. threat[25325]:Netgear ProSAFE NMS300 ReportTemplateController Arbitrary File Deletion Vulnerability(CVE-2021-27272)

update rules:
1. threat[24840]:jboss deserialization vulnerability(CVE-2017-7504)
2. threat[25283]:Tenda USAC15 addWifiMacFilter Buffer Overflow Vulnerability(CVE-2018-18731)
3. threat[41768]:Godzilla Webshell PHP Scripts Upload
4. threat[25236]:Seeyon OA Remote Command Execution Vulnerability - post request
5. threat[23966]:Microsoft Edge Remote Memory Corruption Vulnerability(CVE-2016-7288)(MS16-145)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25687。该升级包新增/改进的规则有:

更新规则:
1. 攻击[29001]:Web服务远程SQL注入攻击可疑行为(startracker)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25687. This package include changed rules:

update rules:
1. threat[29001]:Web Service Remote SQL Injection Suspicious Behavior(startracker)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25623。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25311]:伊顿智能电源管理器任意文件删除漏洞(CVE-2021-23279)
2. 攻击[25312]:用友NC6.5 bsh.servlet.BshServlet 远程命令执行漏洞
3. 攻击[25313]:Microsoft Exchange 服务器端请求伪造(SSRF)漏洞(CVE-2021-26855)
4. 攻击[25314]:Jenkins参数插件存储型跨站点脚本漏洞(CVE-2021-21622)
5. 攻击[25317]:Foxit Reader and PhantomPDF Field Format Event 释放后重用漏洞(CVE-2020-13560)
6. 攻击[25319]:OpenEMR Backup.php命令注入漏洞(CVE-2020-36243)
7. 攻击[25320]:PHP 8.1.0-dev 后门远程命令执行漏洞
8. 攻击[25315]:F5 BIG-IP 认证绕过漏洞(CVE-2021-22986)

更新规则:
1. 攻击[24567]:泛微e-cology/用友NC OA系统BeanShell远程代码执行漏洞
2. 攻击[25314]:Jenkins Artifact Repository参数插件存储型跨站点脚本漏洞(CVE-2021-21622)
3. 攻击[25150]:Microsoft Exchange Server EWS UserConfiguration 不安全的反序列化漏洞（CVE-2020-17144）
4. 攻击[24539]:Drupal Core远程代码执行漏洞(CVE-2019-6339)
5. 应用:向日葵远控


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25623. This package include changed rules:

new rules:
1. threat[25311]:Eaton Intelligent Power Management Arbitrary File Deletion Vulnerability(CVE-2021-23279)
2. threat[25312]:Yonyou NC6.5 bsh.servlet.BshServlet Remote Command Execution Vulnerability
3. threat[25313]:Microsoft Exchange Server Side Request Forgery(SSRF) Vulnerability(CVE-2021-26855)
4. threat[25314]:Jenkins Parameter Plugin Stored Cross-Site Scripting Vulnerability(CVE-2021-21622)
5. threat[25317]:Foxit Reader and PhantomPDF Field Format Event Use After Free(CVE-2020-13560)
6. threat[25319]:OpenEMR Backup.php Command Injection Vulnerability(CVE-2020-36243)
7. threat[25320]:PHP 8.1.0-dev Backdoor Remote Command Execution Vulnerability
8. threat[25315]:F5 BIG-IP Authentication Bypass Vulnerabilities(CVE-2021-22986)

update rules:
1. threat[24567]:Weaver e-cology/Yonyou NC OA System BeanShell Remote Code Execution Vulnerability
2. threat[25314]:Jenkins Artifact Repository Parameter Plugin Stored Cross Site Scripting Vulnerability(CVE-2021-21622)
3. threat[25150]:Microsoft Exchange Server EWS UserConfiguration Insecure Deserialization Vulnerability (CVE-2020-17144)
4. threat[24539]:Drupal Core Remote Code Execution Vulnerability(CVE-2019-6339)
5. app:sunlogin


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25571。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25310]:Apache Druid JDBC连接属性远程代码执行漏洞(CVE-2021-26919)
2. 攻击[30776]:Apache Tapestry 信息泄漏漏洞(CVE-2021-27850)
3. 攻击[41821]:ABPTTS隧道工具通信

更新规则:
1. 攻击[41817]:Cobalt Strike渗透攻击工具EXE感染程序传播
2. 攻击[25206]:Advantech iView 目录遍历漏洞(CVE-2020-16245)
3. 攻击[25308]:H3C IMC智能管理中心远程代码执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25571. This package include changed rules:

new rules:
1. threat[25310]:Apache Druid JDBC connection properties Remote Code Execution Vulnerability(CVE-2021-26919)
2. threat[30776]:Apache Tapestry Information Disclosure Vulnerablity(CVE-2021-27850)
3. threat[41821]:ABPTTS Tunnel Communication

update rules:
1. threat[41817]:Penetration Test Tool Cobalt Strike EXE Infection Program Spread
2. threat[25206]:Advantech iView Directory Traversal Vulnerability(CVE-2020-16245)
3. threat[25308]:H3C IMC Intelligent Management Center Remote Code Execution Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25537。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25301]:WordPress Plugin Stop Spammers 'log' 反射型跨站脚本漏洞(CVE-2021-24245)
2. 攻击[25303]:Apache Cocoon XML外部实体注入漏洞(CVE-2020-11991)
3. 攻击[25300]:CMS Made Simple Smarty 服务端模板注入漏洞(CVE-2021-26120)
4. 攻击[25304]:Tenda USAC15 WriteFacMac远程代码执行漏洞(CVE-2018-16334)
5. 攻击[25306]:Microsoft Visual Studio Code Maven For Java Extension远程代码执行漏洞(CVE-2021-27084)
6. 攻击[41820]:HTTP CRLF注入攻击
7. 攻击[25307]:FreePBX 1314文件名命令注入漏洞

更新规则:
1. 攻击[23817]:wget下载重定向任意文件写入漏洞(CVE-2016-4971)
2. 攻击[24173]:Magento 2.0.6反序列化远程代码执行漏洞(CVE-2016-4010)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25537. This package include changed rules:

new rules:
1. threat[25301]:WordPress Plugin Stop Spammers 'log' Reflected Cross-site Scripting Vulnerability(CVE-2021-24245)
2. threat[25303]:Apache Cocoon XML External Entity Injection Vulnerability (CVE-2020-11991)
3. threat[25300]:CMS Made Simple Smarty Serverside Template Injection Vulnerability(CVE-2021-26120)
4. threat[25304]:Tenda USAC15 WriteFacMac Remote Code Execution Vulnerability(CVE-2018-16334)
5. threat[25306]:Microsoft Visual Studio Code Maven For Java Extension Remote Code Execution Vulnerability(CVE-2021-27084)
6. threat[41820]:HTTP CRLF Injection Attack
7. threat[25307]:Freepbx 1314 Filename Command Injection Vulnerability

update rules:
1. threat[23817]:wget Download Redirection Arbitrary Files Written Vulnerability(CVE-2016-4971)
2. threat[24173]:Magento 2.0.6 Unserialize Remote Code Execution Vulnerability(CVE-2016-4010)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25506。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25294]:Advantech iView ZTPConfigTable SQL注入漏洞(CVE-2021-22654)
2. 攻击[25295]:Jenkins Repository Connector Plugin 存储型跨站脚本漏洞(CVE-2021-21618)
3. 攻击[25296]:Apache Superset Markdown Component存储型XSS漏洞(CVE-2021-27907)
4. 攻击[25297]:Microsoft SharePoint远程代码执行漏洞(CVE-2021-31181)
5. 攻击[25298]:金山V8 终端安全系统任意文件读取漏洞
6. 攻击[25299]:XStream反序列化远程代码执行漏洞(CVE-2021-29505)

更新规则:
1. 攻击[25292]:Adobe Magento DownloadCss跨站脚本漏洞(CVE-2021-21029)
2. 攻击[25294]:Advantech iView ZTPConfigTable SQL注入漏洞(CVE-2021-22654)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25506. This package include changed rules:

new rules:
1. threat[25294]:Advantech iView ZTPConfigTable SQL Injection(CVE-2021-22654)
2. threat[25295]:Jenkins Repository Connector Plugin Stored Cross-Site Scripting Vulnerability(CVE-2021-21618)
3. threat[25296]:Apache Superset Markdown Component Stored Cross Site Scripting Vulnerability(CVE-2021-27907)
4. threat[25297]:Microsoft SharePoint Remote Code Execution Vulnerability(CVE-2021-31181)
5. threat[25298]:Kingsoft V8 Terminal Security System Arbitrary File Read Vulnerability
6. threat[25299]:XStream Deserializable Remote Code Execution Vulnerability(CVE-2021-29505)

update rules:
1. threat[25292]:Adobe Magento DownloadCss Cross Site Scripting Vulnerability(CVE-2021-21029)
2. threat[25294]:Advantech iView ZTPConfigTable SQL Injection Vulnerability(CVE-2021-22654)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25483。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25293]:ExifTool远程代码执行漏洞(CVE-2021-22204)
2. 攻击[25291]:Microsoft IIS HTTP协议栈远程代码执行漏洞(CVE-2021-31166)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25483. This package include changed rules:

new rules:
1. threat[25293]:ExifTool Remote Code Execution Vulnerability(CVE-2021-22204)
2. threat[25291]:Microsoft IIS HTTP Protocol Stack Remote Code Execution Vulnerability(CVE-2021-31166)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25433。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25277]:Linksys远程代码执行漏洞(CNVD-2014-01260)
2. 攻击[25275]:HUAWEI HG532e 命令注入漏洞(CVE-2017-17215)
3. 攻击[25282]:Tenda USAC15 SetSambaCfg命令注入漏洞(CVE-2018-18728)
4. 攻击[25280]:Tenda AC15 Cookie远程代码执行漏洞(CVE-2018-5767)
5. 攻击[10521]:Tenda USAC15 setMacFilterCfg远程代码执行(CVE-2018-18708)
6. 攻击[25283]:Tenda USAC15 addWifiMacFilter缓冲区溢出(CVE-2018-18731)
7. 攻击[25278]: Linksys wap54gv3远程代码执行漏洞
8. 攻击[25279]:Tenda USAC9 setUsbUnload远程命令注入漏洞(CVE-2018-14558、CVE-2020-10987)
9. 攻击[25286]:VMware View Planner logupload 目录遍历漏洞(CVE-2021-21978)

更新规则:
1. 攻击[10520]:OpenSSL服务重协商处理空指针引用漏洞(CVE-2021-3449)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25433. This package include changed rules:


new rules:
1. threat[25277]:Linksys Remote Code Execution Vulnerability(CNVD-2014-01260)
2. threat[25275]:HUAWEI HG532e Command Injection Vulnerability
3. threat[25282]:Tenda USAC15 SetSambaCfg Command Injection Vulnerability
4. threat[25280]:Tenda AC15 Cookie Remote Code Execution Vulnerability
5. threat[10521]:Tenda USAC15 setMacFilterCfg Remote Code Execution Vulnerability
6. threat[25283]:Tenda USAC15 addWifiMacFilter Buffer Overflow Vulnerability
7. threat[25278]:Linksys wap54gv3 Remote Code Execution Vulnerability
8. threat[25279]:Tenda USAC9 setUsbUnload Remote Command Injection Vulnerability
9. threat[25286]:VMware View Planner logupload Directory Traversal Vulnerability(CVE-2021-21978)

update rules:
1. threat[10520]:OpenSSL Server Renegotiation Handling NULL Pointer Dereference Vulnerability(CVE-2021-3449)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25418。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41818]:DarkSide勒索软件与C2服务器通信


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25418. This package include changed rules:

new rules:
1. threat[41818]:Ransomware DarkSide Communication with C2 Server


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25365。该升级包新增/改进的规则有:

新增规则:
1. 攻击[50605]:Weblogic T3协议连接
2. 攻击[10520]:OpenSSL服务重协商处理空指针引用漏洞(CVE-2021-3449)
3. 攻击[50606]:Weblogic GIOP/IIOP协议连接

更新规则:
1. 攻击[25272]:D-Link DIR645敏感信息泄露漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25365. This package include changed rules:

new rules:
1. threat[50605]:Weblogic T3 Protocol Connection
2. threat[10520]:OpenSSL Server Renegotiation Handling NULL Pointer Dereference Vulnerability(CVE-2021-3449)
3. threat[50606]:Weblogic GIOP/IIOP Protocol Connection

update rules:
1. threat[25272]:D-Link DIR645 Sensitive Information Disclosure Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25343。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25268]:电信网关配置管理系统默认弱口令登录
2. 攻击[41816]:Reverse DNS Shell隧道通信
3. 攻击[41817]:Cobalt Strike渗透攻击工具EXE感染程序传播
4. 攻击[25270]:NETGEAR WND930远程代码执行漏洞
5. 攻击[25271]:NETGEAR WND930 mfgwrite.php远程代码执行漏洞
6. 攻击[25272]:D-Link DIR645敏感信息泄露漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25343. This package include changed rules:

new rules:
1. threat[25268]:Telecom Gateway Configuration Management System default weak password login
2. threat[41816]:Reverse DNS Shell Tunnel Communication
3. threat[41817]:Penetration Test Tool Cobalt Strike EXE Infection Program Spread
4. threat[25270]:NETGEAR WND930 Remote Code Execution Vulnerability
5. threat[25271]:NETGEAR WND930 mfgwrite.php Remote Code Execution Vulnerability
6. threat[25272]:D-Link DIR645 Sensitive Information Disclosure Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25307。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25263]:亿邮电子邮件系统远程命令执行漏洞
2. 攻击[25264]:Google Chrome远程代码执行漏洞(CVE-2021-21220)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25307. This package include changed rules:

new rules:
1. threat[25263]:eyou Email System Remote Command Execution Vulnerability
2. threat[25264]:Google Chrome Remote Code Execution Vulnerability(CVE-2021-21220)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25296。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25262]:泛微OA9任意文件上传漏洞
2. 攻击[25260]:哥斯拉Godzilla ASP_AES_BASE64 Webshell 连接
3. 攻击[25261]:哥斯拉Godzilla ASP_AES_RAW Webshell 连接



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25296. This package include changed rules:

new rules:
1. threat[25262]:Weaver OA9 Arbitrary File Upload Vulnerability
2. threat[25260]:Godzilla ASP_AES_BASE64 Webshell Connect
3. threat[25261]:Godzilla ASP_AES_RAW Webshell Connect



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25280。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25253]:锐捷NBR路由器EWEB网管系统远程命令执行漏洞(CNVD-2021-09650)
2. 攻击[25255]:联软IT运维安全管理系统任意文件上传漏洞
3. 攻击[25256]:哥斯拉Godzilla JAVA_AES_RAW Webshell 连接
4. 攻击[25257]:冰蝎 3.0 beta 3 Webshell 连接(PHP)
5. 攻击[25258]:TongWeb隐藏控制接口



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25280. This package include changed rules:

new rules:
1. threat[25253]:Ruijie NBR Routers EWEB Remote Command Execution Vulnerability(CNVD-2021-09650)
2. threat[25255]:Leagsoft IT Security Management System Arbitrary File Upload Vulnerability
3. threat[25256]:Godzilla JAVA_AES_RAW Webshell Connect
4. threat[25257]:Behinder 3.0 beta 3 Webshell Connect(PHP)
5. threat[25258]:TongWeb Hidden Control Interface



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25263。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25251]:Jira SSRF 跳转漏洞(CVE-2017-9506)
2. 攻击[25252]:哥斯拉Godzilla JAVA_AES_BASE64 Webshell 连接
3. 攻击[41814]:敏感脚本文件上传

更新规则:
1. 攻击[25236]:致远OA远程命令执行漏洞 - post请求
2. 攻击[41700]:Sqlmap扫描攻击探测


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25263. This package include changed rules:

new rules:
1. threat[25251]:Jira SSRF Vulnerability(CVE-2017-9506)
2. threat[25252]:Godzilla JAVA_AES_BASE64 Webshell Connect
3. threat[41814]:Upload of sensitive script files

update rules:
1. threat[25236]:Seeyon OA Remote Command Execution Vulnerability - post request
2. threat[41700]:Sqlmap scan attack detection


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25241。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25242]:三星路由器远程命令执行漏洞
2. 攻击[25243]:ShopXO任意文件读取漏洞
3. 攻击[25245]:金山终端安全系统V8/V9任意文件上传漏洞
4. 攻击[25246]:银澎云计算 好视通视频会议系统 任意文件下载漏洞
5. 攻击[25247]:银澎云计算 好视通视频会议系统 任意文件下载漏洞
6. 攻击[25248]:爱快路由任意文件读取漏洞
7. 攻击[30771]:海康威视流媒体管理服务器任意文件读取(CNVD-2021-14544)
8. 攻击[25249]:禅道 8.2.6 SQL注入漏洞
9. 攻击[25250]:锐捷Smartweb管理系统信息泄露漏洞

更新规则:
1. 攻击[68654]:可疑Webshell脚本文件上传行为
2. 攻击[41700]:Sqlmap扫描攻击探测


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25241. This package include changed rules:

new rules:
1. threat[25242]:Samsung WLAN AP Remote Command Execution Vulnerability
2. threat[25243]:ShopXO Arbitrarily File Read Vulnerability
3. threat[25245]:Kingsoft Terminal Security System V8/V9 File Upload Vulnerability
4. threat[25246]:Yinpeng cloud computing FastMeeting Arbitary file download vulnerability
5. threat[25247]:Yonyou ERP-NC directory traversal vulnerability
6. threat[25248]:iKuai Router Arbitrarily File Read Vulnerability
7. threat[30771]:Hikvision Streaming Media Management Server Arbitrary File Reading (CNVD-2021-14544)
8. threat[25249]:Zentao 8.2.6 SQL Injection Vulnerability
9. threat[25250]:Ruijie SmartWeb Management System Information Leak Vulnerability

update rules:
1. threat[68654]:Suspicious Webshell Script Files Upload Behavior
2. threat[41700]:Sqlmap scan attack detection


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25209。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25239]:用友NC6.5 未授权反序列化漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25209. This package include changed rules:

new rules:
1. threat[25239]:Yonyou NC6.5 Unauthorized Deserialization Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25201。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25235]:Apache OFBiz RMI 反序列化漏洞(CVE-2021-26295)
2. 攻击[25236]:致远OA远程命令执行漏洞 - post请求

更新规则:
1. 攻击[25189]:SolarWinds Orion Platform身份验证绕过漏洞(CVE-2020-10148)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25201. This package include changed rules:

new rules:
1. threat[25235]:Apache OFBiz RMI Deserialization Vulnerability(CVE-2021-26295)
2. threat[25236]:Seeyon OA Remote Command Execution Vulnerability - post request

update rules:
1. threat[25189]:SolarWinds Orion Platform Authentication Bypass Vulnerability(CVE-2020-10148)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25193。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25220]:Nagios XI 5.7.5 HTTP Request Windowswmi.inc.ph系统命令注入漏洞(CVE-2021-25296)
2. 攻击[25221]:Nagios XI 5.7.5 HTTP Request switch.inc.php 系统命令注入漏洞(CVE-2021-25297)
3. 攻击[25222]:Nagios XI 5.7.5 HTTP Request cloud-vm.inc.php系统命令注入漏洞(CVE-2021-25298)
4. 攻击[25223]:Nagios XI 5.7.5 sshterm.php跨站脚本漏洞(CVE-2021-25299)
5. 攻击[25224]:QuarkMail远程命令执行漏洞
6. 攻击[25225]:Nagios XI 5.5.10 跨站脚本漏洞
7. 攻击[25226]:帆软报表Remote Command Execution漏洞
8. 攻击[25228]:Vanderbilt IP Camera 远程凭据泄露漏洞
9. 攻击[25229]:帆软 V9getshell FineReport - 任意文件上传
10. 攻击[25231]:和信创天云桌面文件上传漏洞
11. 攻击[25232]:Zabbix 2.2 - 3.0.3 远程代码执行漏洞
12. 攻击[25233]:泛微OA任意文件上传漏洞

更新规则:
1. 攻击[25078]:禅道项目管理系统远程文件包含漏洞
2. 攻击[25079]:Oracle WebLogic Server远程代码执行漏洞(CVE-2020-14882)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25193. This package include changed rules:

new rules:
1. threat[25220]:Nagios XI 5.7.5 HTTP Request Windowswmi.inc.php OS Command Injection Vulnerability(CVE-2021-25296)
2. threat[25221]:Nagios XI 5.7.5 HTTP Request switch.inc.php OS Command Injection Vulnerability(CVE-2021-25297)
3. threat[25222]:Nagios XI 5.7.5 HTTP Request cloud-vm.inc.php OS Command Injection Vulnerability(CVE-2021-25298)
4. threat[25223]:Nagios XI 5.7.5 sshterm.php Cross Site Scripting Vulnerability(CVE-2021-25299)
5. threat[25224]:QuarkMail Remote Command Execution Vulnerability
6. threat[25225]:Nagios XI 5.5.10 XSS vulnerability
7. threat[25226]:Fine Report Remote Command Execution Vulnerability
8. threat[25228]:Vanderbilt IP Camera Remote Credential Vulnerability
9. threat[25229]:FineReport V9 getshell - Arbitrary File Upload
10. threat[25231]:Hexinchuang Tianyun Desktop File Upload Vulnerability
11. threat[25232]:Zabbix 2.2-3.0.3 Remote Code Execution Vulnerability
12. threat[25233]:Weaver OA Arbitrary File Upload

update rules:
1. threat[25078]:Zentao PMS Remote File Inclusion Vulnerability
2. threat[25079]:Oracle WebLogic Server Remote Code Execution Vulnerability(CVE-2020-14882)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25157。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25214]:泛微OA系统keywordid SQL注入漏洞
2. 攻击[25215]:Zabbix远程代码执行漏洞(CVE-2020-11800)
3. 攻击[25217]:泛微OA sysinterface/codeEdit.jsp任意文件上传漏洞
4. 攻击[25218]:JBoss 5.x和6.x 反序列化漏洞(CVE-2017-12149)
5. 攻击[25219]:GitLab 12.9.0 任意文件读取漏洞(CVE-2020-10977)

更新规则:
1. 攻击[25213]:Apache Shiro身份验证绕过漏洞(CVE-2020-11989)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25157. This package include changed rules:

new rules:
1. threat[25214]:Weaver OA system keywordid SQL injection vulnerability
2. threat[25215]:Zabbix Remote Code Execution Vulnerability(CVE-2020-11800)
3. threat[25217]:Weaver OA sysinterface/codeEdit.jsp Arbitrary File Upload Vulnerability
4. threat[25218]:JBoss 5.x and 6.x Deserialization Vulnerabilities (CVE-2017-12149)
5. threat[25219]:GitLab 12.9.0 Read Arbitrary Files Vulnerability(CVE-2020-10977)

update rules:
1. threat[25213]:Apache Shiro Authentication Bypass Vulnerability(CVE-2020-11989)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.25113。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25205]:趋势科技InterScan Web安全网关DecryptPasswd缓冲区溢出漏洞(CVE-2020-28578)
2. 攻击[25203]:DLink 远程代码执行漏洞 - 任意文件上传(CVE-2021-27249)
3. 攻击[25206]:Advantech iView 目录遍历漏洞(CVE-2020-16245)
4. 攻击[25208]:Apache ActiveMQ任意代码执行漏洞(CVE-2020-11998)
5. 攻击[25211]:Adobe Acrobat Reader DC堆缓冲区溢出漏洞(CVE-2021-21017)
6. 攻击[25212]:Apache ActiveMQ message.jsp跨站脚本XSS漏洞(CVE-2020-13947)
7. 攻击[25210]:趋势科技 InterScan Web Security Virtual Appliance ManageVLANSettings 命令注入漏洞 (CWE-2020-28581)
8. 攻击[25209]:趋势科技 InterScan Web Security Virtual Appliance Password 字段命令注入漏洞 (CVE-2020-8466)
9. 攻击[25213]:Apache Shiro身份验证绕过漏洞(CVE-2020-11989)

更新规则:
1. 攻击[25207]:Advantech WebAccess/NMS 任意文件上传漏洞(CVE-2020-10621)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.25113. This package include changed rules:

new rules:
1. threat[25205]:Trend Micro InterScan Web Security Virtual Appliance DecryptPasswd Buffer Overflow Vulnerability (CVE-2020-28578)
2. threat[25203]:DLink Remote Code Execution - Arbitrary File Upload(CVE-2021-27249)
3. threat[25206]:Advantech iView Directory Traversal Vulnerability(CVE-2020-16245)
4. threat[25208]:Apache ActiveMQ Remote Code Execution Vulnerability(CVE-2020-11998)
5. threat[25211]:Adobe Acrobat Reader DC Heap Buffer Overflow Vulnerability(CVE-2021-21017)
6. threat[25212]:Apache ActiveMQ message.jsp Cross-Site Scripting Vulnerability(CVE-2020-13947)
7. threat[25210]:Trend Micro InterScan Web Security Virtual Appliance ManageVLANSettings Command Injections Vulnerability (CWE-2020-28581)
8. threat[25209]:Trend Micro InterScan Web Security Virtual Appliance Password Command Injection Vulnerability (CVE-2020-8466)
9. threat[25213]:Apache Shiro Authentication Bypass Vulnerability(CVE-2020-11989)

update rules:
1. threat[25207]:Advantech WebAccess/NMS Arbitrary File Upload Vulnerability(CVE-2020-10621)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24993。该升级包新增/改进的规则有:


更新规则:
1. 攻击[41781]:FRP内网穿透工具通信
2. 攻击[21906]:VSFTPD v2.3.4后门命令执行
3. 攻击[68654]:可疑Webshell脚本文件上传行为
4. 攻击[24174]:WebLogic WLS 组件远程命令执行漏洞
5. 攻击[25189]:SolarWinds Orion Platform身份验证绕过漏洞(CVE-2020-10148)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24993. This package include changed rules:


update rules:
1. threat[41781]:Communication of FRP Intranet Penetration Tool
2. threat[21906]:VSFTPD v2.3.4 Backdoor Command Execution
3. threat[68654]:Suspicious Webshell Script Files Upload Behavior
4. threat[24174]:WebLogic WLS Component Remote Command Execution Vulnerability
5. threat[25189]:SolarWinds Orion Platform Authentication Bypass Vulnerability(CVE-2020-10148)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24806。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25181]:Tunna http隧道内网代理连接
2. 攻击[25182]:nps http内网代理连接

更新规则:
1. 攻击[41805]:Chisel 内网通信工具特征


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24806. This package include changed rules:

new rules:
1. threat[25181]:Tunna http tunnel proxy connection
2. threat[25182]:nps http proxy connection

update rules:
1. threat[41805]:Chisel Intranet Communication Tool Features


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24768。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25177]:NEC ExpressCluster ApplyConfig XML外部实体注入漏洞(CVE-2020-17408)
2. 攻击[25179]:Twitter TwitterServer HistogramQueryHandler XSS 漏洞 (CVE-2020-35774)
3. 攻击[25180]:Webmin Package Updates update.cgi 命令注入漏洞 (CVE-2020-35606)

更新规则:
1. 攻击[41802]:Nemty勒索病毒URI特征


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24768. This package include changed rules:

new rules:
1. threat[25177]:NEC ExpressCluster ApplyConfig XML External Entity Injection Vulnerability(CVE-2020-17408)
2. threat[25179]:Twitter TwitterServer HistogramQueryHandler Cross-Site Scripting Vulnerability (CVE-2020-35774)
3. threat[25180]:Webmin Package Updates update.cgi Command Injection Vulnerability (CVE-2020-35606)

update rules:
1. threat[41802]:Nemty ransomware URI characteristics


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24719。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41802]:Nemty勒索病毒URI特征
2. 攻击[41803]:Nemty勒索病毒DNS特征

更新规则:
1. 攻击[25119]:Struts2远程代码执行漏洞(S2-061)(CVE-2020-17530)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24719. This package include changed rules:

new rules:
1. threat[41802]:Nemty ransomware URI characteristics
2. threat[41803]:Nemty Ransomware DNS Features

update rules:
1. threat[25119]:Struts2 Remote Code Execution Vulnerability(S2-061)(CVE-2020-17530)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24659。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41801]:磊科NR286-GE路由器telnet服务暴露
2. 攻击[25173]:NUUO NVRmini 2 远程代码执行漏洞(CVE-2016-5674)
3. 攻击[25174]:NUUO NVRsolo 远程代码执行漏洞(CVE-2016-5675)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24659. This package include changed rules:

new rules:
1. threat[41801]:Netcore NR286-GE Router telnet Service Exposure
2. threat[25173]:NUUO NVRmini 2 Remote Code Execution Vulnerability(CVE-2016-5674)
3. threat[25174]:NUUO NVRsolo Remote Code Execution Vulnerability(CVE-2016-5675)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24649。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25171]:WordPress 5.0.0 - Image远程代码执行漏洞(CVE-2019-89242)
2. 攻击[25172]:Zeroshell cgi-bin/kerbynet远程代码执行漏洞(CVE-2009-0545/CVE-2019-12725/CVE-2020-29390)
3. 攻击[41800]:艾泰进取1200W无线路由器默认telnet服务暴露
4. 攻击[25175]:Mi Casa Verde VeraLite 目录遍历漏洞 (CVE-2013-4861)
5. 攻击[30768]:华硕路由器未授权信息泄露漏洞
6. 攻击[25176]:艾泰进取1200W无线路由器/goform/formTraceRoute远程命令执行漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24649. This package include changed rules:

new rules:
1. threat[25171]:WordPress 5.0.0 - Image Remote Code Execution Vulnerability(CVE-2019-89242)
2. threat[25172]:Zeroshell cgi-bin/kerbynet Remote Code Execution Vulnerability(CVE-2009-0545/CVE-2019-12725/CVE-2020-29390)
3. threat[41800]:UTT 1200W Wireless Router telnet Service Exposure
4. threat[25175]:Mi Casa Verde VeraLite Directory Traversal Vulnerability (CVE-2013-4861)
5. threat[30768]:ASUS Routers Unauthorized Information Disclosure Vulnerability
6. threat[25176]:UTT 1200W Wireless Router /goform/formTraceRoute Remote Command Execution Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24629。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25158]:FasterXML jackson-databind远程代码执行漏洞(CVE-2020-36183)
2. 攻击[25159]:FasterXML jackson-databind远程代码执行漏洞(CVE-2020-36184/CVE-2020-36186)
3. 攻击[25160]:FasterXML jackson-databind远程代码执行漏洞(CVE-2020-36185/CVE-2020-36187)
4. 攻击[25161]:Nagios Log Server Create_Snapshot 存储性跨站脚本漏洞
5. 攻击[25162]:Nagios Log Server Mail Settings 存储性跨站脚本漏洞
6. 攻击[41799]:恶意程序windows/njRAT_a网络通信
7. 攻击[25164]:Ctek SkyRouter cfg_ethping.cgi任意命令执行漏洞(CVE-2011-5010)
8. 攻击[25165]:Linksys WRT110 远程命令执行漏洞(CVE-2013-3568)
9. 攻击[25166]:AirLink101 SkyIPCam1620W远程命令执行漏洞(CVE-2015-2280)
10. 攻击[25163]:Jumpserver v2.6.1 远程命令执行漏洞
11. 攻击[25167]:Quick.CMS 6.7 - 远程代码执行漏洞(CVE-2020-35754)
12. 攻击[25168]:Linksys WAG54G2 远程命令执行漏洞(CVE-2009-5157)
13. 攻击[25169]:LINK-NET LW-N605R远程代码执行漏洞(CVE-2018-16752)

更新规则:
1. 攻击[25128]:Ruijie 路由器Shell注入 - 获取文件
2. 攻击[25153]:Ruijie 路由器Shell注入 - 文件写入
3. 攻击[25154]:Ruijie 路由器Shell注入 - 命令注入
4. 攻击[25150]:Microsoft Exchange Server EWS UserConfiguration 不安全的反序列化漏洞(CVE-2020-17144)
5. 攻击[25151]:IBM QRadar SIEM RemoteJavaScript 不安全的反序列化漏洞 (CVE-2020-4280)
6. 攻击[25156]:Microsoft Exchange Server ExportExhangeCertificate任意文件写入漏洞(CVE-2020-17083)
7. 攻击[41775]:冰蝎 Webshell 连接(PHP)
8. 攻击[24553]:冰蝎 Webshell 连接(JSP)
9. 攻击[41776]:.冰蝎 Webshell 连接(ASP)
10. 攻击[25090]:Nagios XI CCM admin_views.inc.php任意文件覆盖漏洞
11. 攻击[24535]:Jackson-databind远程代码执行漏洞(CVE-2019-12384/CVE-2020-36189)

注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24629. This package include changed rules:

new rules:
1. threat[25158]:FasterXML jackson-databind Remote Code Execution Vulnerability(CVE-2020-36183)
2. threat[25159]:FasterXML jackson-databind Remote Code Execution Vulnerability(CVE-2020-36184/CVE-2020-36186)
3. threat[25160]:FasterXML jackson-databind Remote Code Execution Vulnerability(CVE-2020-36185/CVE-2020-36187)
4. threat[25161]:Nagios Log Server Create_Snapshot Stored Cross-Site Scripting Vulnerability
5. threat[25162]:Nagios Log Server Mail Settings Stored Cross-Site Scripting Vulnerability
6. threat[41799]:Malicious program windows/njRAT_a network communication
7. threat[25164]:Ctek SkyRouter cfg_ethping.cgi Remote Command Execution Vulnerability(CVE-2011-5010)
8. threat[25165]:Linksys WRT110 Remote Command Execution Vulnerability(CVE-2013-3568)
9. threat[25166]:AirLink101 SkyIPCam1620W Remote Command Execution Vulnerability(CVE-2015-2280)
10. threat[25163]:Jumpserver v2.6.1 Remote Command Execution Vulnerability
11. threat[25167]:Quick.CMS 6.7 - Remote Code Execution Vulnerability(CVE-2020-35754)
12. threat[25168]:Linksys WAG54G2 Remote Command Execution Vulnerability(CVE-2009-5157)
13. threat[25169]:LINK-NET LW-N605R Remote Code Execution Vulnerability(CVE-2018-16752)

update rules:
1. threat[25128]:Ruijie Router shell injection - Getfile
2. threat[25153]:Ruijie Router shell injection - WriteIn
3. threat[25154]:Ruijie Router shell injection - Command Injection
4. threat[25150]:Microsoft Exchange Server EWS UserConfiguration Insecure Deserialization Vulnerability (CVE-2020-17144)
5. threat[25151]:IBM QRadar SIEM RemoteJavaScript Insecure Deserialization Vulnerability (CVE-2020-4280)
6. threat[25156]:Microsoft Exchange Server ExportExhangeCertificate Arbitrary File Write Vulnerability (CVE-2020-17083)
7. threat[41775]:Behinder Webshell Connect(PHP)
8. threat[24553]:Behinder Webshell Connect(JSP)
9. threat[41776]:.Behinder Webshell Connect(ASP)
10. threat[25090]:Nagios XI CCM admin_views.inc.php Arbitrary File Overwrite Vulnerability
11. threat[24535]:Jackson-databind Remote Code Execution Vulnerability(CVE-2019-12384/CVE-2020-36189)

Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24551。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25148]:FasterXML jackson-databind远程代码执行漏洞(CVE-2020-36179/CVE-2020-36180/CVE-2020-36181/CVE-2020-36182)
2. 攻击[25146]:Nagios XI 5.7.5 - 存储型跨站脚本漏洞
3. 攻击[25147]:Trend Micro InterScan Messaging PolicyWSAction 外部实体注入漏洞(CVE-2020-27017)
4. 攻击[25155]:Zoho ManageEngine应用程序管理器showMonitorGroupView SQL注入漏洞
5. 攻击[25128]:Ruijie 路由器Shell注入 - 获取文件
6. 攻击[25153]:Ruijie 路由器Shell注入 - 文件写入
7. 攻击[25154]:Ruijie 路由器Shell注入 - 命令注入
8. 攻击[25149]:ImageMagick身份验证命令注入漏洞
9. 攻击[25150]:Microsoft Exchange Server EWS UserConfiguration 不安全的反序列化漏洞(CVE-2020-17144)
10. 攻击[25151]:IBM QRadar SIEM RemoteJavaScript 不安全的反序列化漏洞 (CVE-2020-4280)
11. 攻击[25156]:Microsoft Exchange Server ExportExhangeCertificate任意文件写入漏洞(CVE-2020-17083)
12. 攻击[25157]:PEAR Archive Tar PHAR协议处理反序列化代码执行漏洞
13. 攻击[25145]:Weblogic Server远程代码执行漏洞(CVE-2021-2109)

更新规则:
1. 攻击[24736]:NETGEAR DGN2200 10.0.0.50 授权命令执行漏洞（CVE-2017-6334）
2. 攻击[24772]:ASUS RT-N10+/RT56U 无线路由器代码执行漏洞(CVE-2013-5948)
3. 攻击[24445]:WordPress插件DZS-VideoGallery - 跨站点脚本攻击漏洞(CVE-2014-9094)
4. 攻击[23320]:Fritz!Box Webcm 未认证命令注入漏洞(CVE-2014-9727)
5. 攻击[24735]:NETGEAR DGN2200v1/v2/v3/v4 授权命令注入漏洞（CVE-2017-6077）
6. 攻击[24634]:Zyxel EMG2926家庭路由器命令注入漏洞(CVE-2017-6884)
7. 攻击[22702]:DLink DIR-645 / DIR-815 diagnostic.php 命令注入漏洞
8. 攻击[24745]:Linear eMerge E3访问控制器命令注入（CVE-2019-7256）
9. 攻击[22799]:D-Link Devices UPnP SOAP命令注入
10. 攻击[23733]:D-Link DCS-930L Authenticated 远程命令执行漏洞
11. 攻击[24743]:Netis WF2419 V1.2.31805/V2.2.36123授权命令注入漏洞（CVE-2019-19356）
12. 攻击[24701]:Xfinity Gateway 命令注入漏洞
13. 攻击[50603]:Web服务登录请求


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24551. This package include changed rules:

new rules:
1. threat[25148]:FasterXML jackson-databind Remote Code Execution Vulnerability(CVE-2020-36179/CVE-2020-36180/CVE-2020-36181/CVE-2020-36182)
2. threat[25146]:Nagios XI 5.7.5 - Persistent Cross-Site Scripting Vulnerability
3. threat[25147]:Trend Micro InterScan Messaging PolicyWSAction External Entity Injection Vulnerability(CVE-2020-27017)
4. threat[25155]:Zoho ManageEngine Applications Manager showMonitorGroupView SQL Injection Vulnerability
5. threat[25128]:Ruijie Router shell injection - Getfile
6. threat[25153]:Ruijie Router shell injection - WriteIn
7. threat[25154]:Ruijie Router shell injection - Command Injection
8. threat[25149]:ImageMagick Authenticate Command Injection Vulnerability
9. threat[25150]:Microsoft Exchange Server EWS UserConfiguration Insecure Deserialization Vulnerability (CVE-2020-17144)
10. threat[25151]:IBM QRadar SIEM RemoteJavaScript Insecure Deserialization Vulnerability (CVE-2020-4280)
11. threat[25156]:Microsoft Exchange Server ExportExhangeCertificate Arbitrary File Write Vulnerability (CVE-2020-17083)
12. threat[25157]:PEAR Archive Tar PHAR Protocol Handling Deserialization Code Execution Vulnerability
13. threat[25145]:Weblogic Server Remote Code Execution Vulnerability(CVE-2021-2109)

update rules:
1. threat[24736]:NETGEAR DGN2200 10.0.0.50 Authorized Command Execution Vulnerability (CVE-2017-6334)
2. threat[24772]:ASUS RT-N10+/RT56U Command Execution Vulnerability(CVE-2013-5948)
3. threat[24445]:WordPress Plugin DZS-VideoGallery - Cross-Site Scripting Vulnerability(CVE-2014-9094)
4. threat[23320]:Fritz!Box Webcm Unauthenticated Command Injection(CVE-2014-9727)
5. threat[24735]:NETGEAR DGN2200v1 / v2 / v3 / v4 Authorized Command Injection Vulnerability (CVE-2017-6077)
6. threat[24634]:Zyxel EMG2926 Router Command Injection Vulnerability(CVE-2017-6884)
7. threat[22702]:DLink DIR-645 / DIR-815 diagnostic.php Command Execution
8. threat[24745]:Linear eMerge E3 Access Controller Command Injection(CVE-2019-7256)
9. threat[22799]:D-Link Devices UPnP SOAP Command Execution
10. threat[23733]:D-Link DCS-930L Authenticated Remote Command Execution Vulnerability
11. threat[24743]:Netis WF2419 V1.2.31805/V2.2.36123 Authorized Command Injection Vulnerability (CVE-2019-19356)
12. threat[24701]:Xfinity Gateway command injection vulnerability
13. threat[50603]:Web Service Login Request


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24451。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25137]:Anchor CMS 0.12.7 - 'markdown' 存储型跨站脚本漏洞
2. 攻击[25138]:Arcserve D2D getNews外部实体注入漏洞(CVE-2020-27858)
3. 攻击[30767]:Adobe Acrobat/Reader 信息泄露漏洞(CVE-2020-29075)
4. 攻击[25139]:Microsoft SharePoint Server远程代码执行漏洞(CVE-2021-1707)
5. 攻击[25140]:Apache CXF跨站脚本执行漏洞(CVE-2020-13954)
6. 攻击[25141]:Apache Solr远程代码执行漏洞(CVE-2020-13957)
7. 攻击[25142]:飞鱼星VM2100网关远程命令执行漏洞
8. 攻击[25143]:Fatek Automation PLC WinProladder SPF堆栈缓冲区溢出(CVE-2020-16234)
9. 攻击[25144]:FasterXML jackson-databind远程代码执行漏洞(CVE-2019-14361/CVE-2019-14439)

更新规则:
1. 攻击[10405]:ISC BIND named拒绝服务漏洞(CVE-2015-5477)
2. 攻击[25119]:Struts2远程代码执行漏洞(S2-061)(CVE-2020-17530)
3. 攻击[23881]:Apache Jetspeed跨站脚本漏洞(CVE-2016-0712)
4. 攻击[24335]:Apache Pluto PortletV3AnnotatedDemo MultipartPortlet任意文件上传(CVE-2018-1306)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24451. This package include changed rules:

new rules:
1. threat[25137]:Anchor CMS 0.12.7 - 'markdown' Stored Cross-Site Scripting Vulnerability
2. threat[25138]:Arcserve D2D getNews External Entity Injection Vulnerability(CVE-2020-27858)
3. threat[30767]:Adobe Acrobat and Acrobat Reader Information Disclosure Vulnerability(CVE-2020-29075)
4. threat[25139]:Microsoft SharePoint Server Remote Code Execution Vulnerability(CVE-2021-1707)
5. threat[25140]:Apache CXF Cross-Site Scripting Vulnerability(CVE-2020-13954)
6. threat[25141]:Apache Solr Remote Code Execution Vulnerability(CVE-2020-13957)
7. threat[25142]:Adslr Gateway VM2100 Remote Command Execution Vulnerability
8. threat[25143]:Fatek Automation PLC WinProladder SPF Stack Buffer Overflow(CVE-2020-16234)
9. threat[25144]:FasterXML jackson-databind Remote Code Execution Vulnerability(CVE-2019-14361/CVE-2019-14439)

update rules:
1. threat[10405]:ISC BIND named Denial of Service Vulnerability(CVE-2015-5477)
2. threat[25119]:Struts2 Remote Code Execution Vulnerability(S2-061)(CVE-2020-17530)
3. threat[23881]:Apache Jetspeed Portal URI Path XSS(CVE-2016-0712)
4. threat[24335]:Apache Pluto PortletV3AnnotatedDemo MultipartPortlet Arbitrary File Upload(CVE-2018-1306)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24359。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25134]:JavaMelody XXE漏洞 (CVE-2018-15531)
2. 攻击[25135]:艾泰upnp命令注入漏洞
3. 攻击[25136]:艾泰 http formDiagnose命令注入漏洞
4. 攻击[30766]:飞鱼星网关tftp敏感信息泄露漏洞
5. 攻击[50603]:Web服务登录请求

更新规则:
1. 攻击[24365]:ThinkPHP 5.x远程命令执行漏洞
2. 攻击[50591]:RDP远程桌面服务登录成功
3. 攻击[41785]:SolarWinds Orion后门SUNBURST上线


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24359. This package include changed rules:

new rules:
1. threat[25134]:JavaMelody XXE Vulnerability (CVE-2018-15531)
2. threat[25135]:UTT upnp Command Injection Vulnerability
3. threat[25136]:Aitai http formDiagnose Command Injection Vulnerability
4. threat[30766]:Adslr Gateway tftp Information Disclosure Vulnerability
5. threat[50603]:Web Service Login Request

update rules:
1. threat[24365]:ThinkPHP 5.x Remote Command Execution Vulnerability
2. threat[50591]:RDP Remote Desktop Protocol Service Login
3. threat[41785]:SolarWinds Orion Backdoor SUNBURST Online


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24311。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25130]:WordPress Plugin Adning Advertising 1.5.5 - 任意文件上传漏洞
2. 攻击[25131]:Advanced Comment System 1.0 - 'ACS_path'路径遍历漏洞(CVE-2020-35598)
3. 攻击[25132]:Apache Flink目录遍历漏洞 (CVE-2020-17518)
4. 攻击[25133]:Apache Flink jobmanager/logs目录遍历漏洞(CVE-2020-17519)

更新规则:
1. 攻击[23695]:Apache Struts2 多个安全漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24311. This package include changed rules:

new rules:
1. threat[25130]:WordPress Plugin Adning Advertising 1.5.5 - Arbitrary File Upload Vulnerability
2. threat[25131]:Advanced Comment System 1.0 - 'ACS_path' Path Traversal Vulnerability(CVE-2020-35598)
3. threat[25132]:Apache Flink Upload Path Traversal Vulnerability(CVE-2020-17518)
4. threat[25133]:Apache Flink jobmanager/logs Path Traversal Vulnerability(CVE-2020-17519)

update rules:
1. threat[23695]:Apache Struts2 Multiple Security Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24277。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41785]:SolarWinds Orion后门SUNBURST上线
2. 攻击[41786]:SolarWinds Orion后门SUNBURST通信
3. 攻击[41787]:SolarWinds Orion后门SUNBURST_CS.BEACON通信
4. 攻击[41788]:SolarWinds Orion后门SUNBURST POST通信
5. 攻击[30765]:Atlassian Jira Server and Data Center ViewUserHover.jspa 信息泄露漏洞(CVE-2020-14181)
6. 攻击[25129]:Apache Unomi 远程代码执行漏洞(CVE-2020-13942)
7. 攻击[41797]:ikuai路由器固件 - 任意文件删除漏洞
8. 攻击[41798]:ikuai路由器固件 - 任意文件命名漏洞

更新规则:
1. 攻击[25128]:Ruijie 路由器newcli.php远程代码执行漏洞
2. 攻击[41781]:FRP内网穿透工具SSH通信


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24277. This package include changed rules:

new rules:
1. threat[41785]:SolarWinds Orion Backdoor SUNBURST Online
2. threat[41786]:SolarWinds Orion Backdoor SUNBURST Communication
3. threat[41787]:SolarWinds Orion Backdoor SUNBURST_CS.BEACON Communication
4. threat[41788]:SolarWinds Orion Backdoor SUNBURST POST Communication
5. threat[30765]:Atlassian Jira Server and Data Center ViewUserHover.jspa Information Disclosure Vulnerability(CVE-2020-14181)
6. threat[25129]:Apache Unomi Remote Code Execution Vulnerability(CVE-2020-13942)
7. threat[41797]:Arbitrary file deletion vulnerability in Ikuai router
8. threat[41798]:Arbitrary file renaming vulnerability in Ikuai router

update rules:
1. threat[25128]:Ruijie Router newcli.php RCE Vulnerability
2. threat[41781]:SSH Communication of FRP Intranet Penetration Tool


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24232。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25122]:XStream任意文件删除漏洞(CVE-2020-26259)
2. 攻击[25123]:XStream服务器端请求伪造(SSRF)漏洞(CVE-2020-26258)
3. 攻击[25124]:PHPJabbers Appointment Scheduler 2.3 - 反射型跨站脚本漏洞(CVE-2020-35416)
4. 攻击[25125]:WECON LeviStudioU HFT文件解析堆栈缓冲区溢出漏洞(CVE-2020-16243)
5. 攻击[25126]:Nagios XI ajaxhelper.php cmdsubsys命令注入漏洞(CVE-2020-15901)
6. 攻击[10512]:Windows网络文件系统RPCSEC_GSS拒绝服务漏洞(CVE-2020-17047)
7. 攻击[41784]:艾泰路由器web服务弱口令密码登录漏洞
8. 攻击[25128]:Ruijie 路由器newcli.php远程代码执行漏洞
9. 攻击[25127]:Jenkins 2.251 跨站脚本漏洞(CVE-2020-2231)

更新规则:
1. 攻击[23283]:vtiger CRM validateSession() 身份验证绕过漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24232. This package include changed rules:

new rules:
1. threat[25122]:XStream Arbitrary File Deletion Vulnerability (CVE-2020-26259)
2. threat[25123]:XStream Server-Side Request Forgery(SSRF) Vulnerability(CVE-2020-26258)
3. threat[25124]:PHPJabbers Appointment Scheduler 2.3 - Reflected XSS Vulnerability(CVE-2020-35416)
4. threat[25125]:WECON LeviStudioU HFT File Parsing Stack Buffer Overflow Vulnerability(CVE-2020-16243)
5. threat[25126]:Nagios XI ajaxhelper.php Cmdsubsys command injection vulnerability(CVE-2020-15901)
6. threat[10512]:Windows Network file system RPCSEC_GSS denial of service vulnerability(CVE-2020-17047)
7. threat[41784]:Aitai router web service weak password password login vulnerability
8. threat[25128]:Ruijie Router newcli.php RCE Vulnerability
9. threat[25127]:Jenkins 2.251 Cross Site Scripting Vulnerability(CVE-2020-2231)

update rules:
1. threat[23283]:vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24189。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25121]:SaltStack Salt API SSH客户端命令注入漏洞 (CVE-2020-16846)
2. 攻击[25110]:Advantech R-SeeNet device_position device_id SQL注入漏洞(CVE-2020-25157)

更新规则:
1. 攻击[41781]:FRP内网穿透工具SSH通信


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24189. This package include changed rules:

new rules:
1. threat[25121]:SaltStack Salt API SSH Client Command Injection Vunlerability (CVE-2020-16846)
2. threat[25110]:Advantech R-SeeNet device_position device_id SQL Injection Vulnerability(CVE-2020-25157)

update rules:
1. threat[41781]:SSH Communication of FRP Intranet Penetration Tool


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24166。该升级包新增/改进的规则有:

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6R10F00 and engine version 5.6R10F00. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.10.24166. This package include changed rules:

new rules:
1. threat[41782]:FRP intranet penetration tool - Access via domain name
2. threat[41783]:FRP intranet penetration tool - forward DNS query request
3. threat[25104]:Adobe Acrobat and Reader form Field Format Use After Free Vulnerability(CVE-2020-24437)
4. threat[25105]:Apache SkyWalking GraphQL Protocol SQL Injection Vulnerability(CVE-2020-9483)
5. threat[25107]:Adobe Acrobat Pro DC FDF Object Use After Free Vulnerability(CVE-2020-24430)
6. threat[25106]:Zoho ManageEngine Applications Manager RulesConstructor.jsp SQL Injection Vulnerability(CVE-2020-16267)
7. threat[25109]:Adobe Acrobat Pro DC Javascript Out of Bounds Read Vulnerability(CVE-2020-24435)
8. threat[25108]:Zoho ManageEngine Applications Manager MyPage.do SQL Injection Vulnerability(CVE-2020-27995)
9. threat[25113]:Apache Tapestry ContextAssetRequestHandler Information Disclosure Vulnerability(CVE-2020-13953)
10. threat[25114]:Artica Proxy fw.login.php apikey SQL Injection Vulnerability(CVE-2020-17506)
11. threat[25117]:Adobe ColdFusion CKEditor upload.cfm Unrestricted File Upload Vulnerability(CVE-2018-15961)
12. threat[25112]:Zoho ManageEngine Applications Manager Buffer.jsp resourceid SQL Injection Vulnerability(CVE-2020-15927)
13. threat[25118]:Atlassian Crowd Remote Code Execution Vulnerability(CVE-2019-11580)
14. threat[25119]:Struts2 Remote Code Execution Vulnerability(S2-061)(CVE-2020-17530)
15. threat[25116]:Confluence Path Traversal Vulnerability(CVE-2019-3398)

update rules:
1. threat[25102]:Apache SkyWalking SQL Injection Vulnerability(CVE-2020-13921)
2. threat[41781]:SSH Communication of FRP Intranet Penetration Tool
3. threat[25063]:Artica Proxy cyrus.php Command Injection(CVE-2020-17505)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.24042。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25102]:Apache SkyWalking SQL注入漏洞(CVE-2020-13921)
2. 攻击[25103]:医疗中心管理系统 1.0-SQL注入漏洞
3. 攻击[41781]:FRP内网穿透工具SSH通信
4. 攻击[50602]:Burp Suite Web攻击工具启动
5. 攻击[41780]:DNSLog查询请求
6. 攻击[25101]:Microsoft SharePoint远程代码执行漏洞(CVE-2020-16952)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.24042. This package include changed rules:

new rules:
1. threat[25102]:Apache SkyWalking SQL Injection Vulnerability(CVE-2020-13921)
2. threat[25103]:Medical Center Portal Management System 1.0 - SQL Injection Vulnerability
3. threat[41781]:SSH Communication of FRP Intranet Penetration Tool
4. threat[50602]:Burp Suite Web Attack Tool Startup
5. threat[41780]:DNSLog Query Request
6. threat[25101]:Microsoft SharePoint Remote Code Execution Vulnerability(CVE-2020-16952)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23995。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25096]:TestBox CFML Test Framework 4.1.0 - 目录穿越漏洞
2. 攻击[25097]:Apache Airflow 跨站脚本漏洞(CVE-2020-13944)
3. 攻击[25098]:AppWeb认证绕过漏洞(CVE-2018-8715)
4. 攻击[25099]:用友ERP-NC系统/NCFindWeb文件包含漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23995. This package include changed rules:

new rules:
1. threat[25096]:TestBox CFML Test Framework 4.1.0 - Directory Traversal Vulnerability
2. threat[25097]:Apache Airflow Cross Site Scripting Vulnerability(CVE-2020-13944)
3. threat[25098]:AppWeb Authentication Bypass vulnerability (CVE-2018-8715)
4. threat[25099]:Yonyou ERP-NC System/NCFindWeb File Inclusion Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23968。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25088]:Nagios XI mibs.php 命令注入漏洞(CVE-2020-5791)
2. 攻击[25092]:ShoreTel Conferencing 19.46.1802.0 - 反射型跨站脚本攻击(CVE-2020-28351)
3. 攻击[25093]:WordPress文件管理器 connector.minimal.php 访问控制漏洞（CVE-2020-25213)
4. 攻击[25094]:Windows NFS网络文件系统远程代码执行漏洞(CVE-2020-17051)
5. 攻击[25095]:Windows NFS网络文件系统信息泄露漏洞(CVE-2020-17056)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23968. This package include changed rules:

new rules:
1. threat[25088]:Nagios XI mibs.php Command Injection Vulnerability(CVE-2020-5791)
2. threat[25092]:ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting Vulnerability(CVE-2020-28351)
3. threat[25093]:WordPress File Manager connector.minimal.php Improper Access Control Vulnerability (CVE-2020-25213)
4. threat[25094]:Windows Network File System Remote Code Execution Vulnerability(CVE-2020-17051)
5. threat[25095]:Windows Network File System Information Disclosure Vulnerability(CVE-2020-17056)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23938。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25086]:Processwire CMS 2.4.0本地文件包含漏洞
2. 攻击[25087]:Microsoft Malware Protection Engine远程代码执行漏洞(CVE-2017-8558)
3. 攻击[30760]:Microsoft图形设备接口(GDI)信息泄露漏洞(CVE-2019-1010)
4. 攻击[25089]:Ruckus IoT Controller Web UI 身份验证绕过漏洞
5. 攻击[25091]:Adobe Acrobat Reader ESObject释放后重用漏洞(CVE-2020-9715)
6. 攻击[25090]:Nagios XI CCM admin_views.inc.php任意文件覆盖漏洞

更新规则:
1. 攻击[24854]:Jenkins远程命令执行漏洞(CVE-2018-1000861)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23938. This package include changed rules:

new rules:
1. threat[25086]:Processwire CMS 2.4.0 - 'download' Local File Inclusion Vulnerability
2. threat[25087]:Microsoft Malware Protection Engine Remote Code Execution Vulnerability(CVE-2017-8558)
3. threat[30760]:Microsoft Graphics Device Interface Information Disclosure Vulnerability(CVE-2019-1010)
4. threat[25089]:Ruckus IoT Controller Web UI Authentication Bypass Vulnerability
5. threat[25091]:Adobe Acrobat Reader ESObject Use After Free Vulnerability(CVE-2020-9715)
6. threat[25090]:Nagios XI CCM admin_views.inc.php Arbitrary File Overwrite Vulnerability

update rules:
1. threat[24854]:Jenkins Remote Command Execution Vulnerability(CVE-2018-1000861)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23901。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25083]:Online Examination System 1.0 - 存储型跨站脚本漏洞
2. 攻击[25084]:Elasticsearch未授权访问漏洞
3. 攻击[25085]:Monitor 1.7.6m - 权限绕过漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23901. This package include changed rules:

new rules:
1. threat[25083]:Online Examination System 1.0 - Stored Cross Site Scripting Vulnerability
2. threat[25084]:Elasticsearch Unauthorized Access Vulnerability
3. threat[25085]:Monitorr 1.7.6m - Authorization Bypass Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23834。该升级包新增/改进的规则有:

更新规则:
1. 攻击[25079]:Oracle WebLogic Server远程代码执行漏洞(CVE-2020-14882)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23834. This package include changed rules:

update rules:
1. threat[25079]:Oracle WebLogic Server Remote Code Execution Vulnerability(CVE-2020-14882)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23813。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25080]:Gym Management System 1.0 - 身份验证绕过漏洞
2. 攻击[25077]:HooToo TripMate Titan HT-TM05 远程命令执行漏洞(CVE-2018-20841)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23813. This package include changed rules:


new rules:
1. threat[25080]:Gym Management System 1.0 - Authentication Bypass Vulnerability
2. threat[25077]:HooToo TripMate Titan HT-TM05 Remote Code Execution Vulnerability(CVE-2018-20841)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23802。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25078]:禅道项目管理系统远程文件包含漏洞
2. 攻击[25079]:Oracle WebLogic Server远程代码执行漏洞(CVE-2020-14882)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23802. This package include changed rules:

new rules:
1. threat[25078]:Zentao PMS Remote File Inclusion Vulnerability
2. threat[25079]:Oracle WebLogic Server Remote Code Execution Vulnerability(CVE-2020-14882)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23787。该升级包新增/改进的规则有:

新增规则:
1. 攻击[30758]:Way-Board远程文件泄露漏洞(CVE-2001-0214)
2. 攻击[25074]:Cacti Group Cacti color.php SQL注入漏洞
3. 攻击[25075]:访客管理系统（CVMS）1.0-认证绕过漏洞
4. 攻击[25076]:Wireless IP Camera (P2P) WIFICAM远程代码执行漏洞(CVE-2017-8225)

更新规则:
1. 攻击[24300]:GPON Home Gateway 远程命令执行漏洞(CVE-2018-10561/CVE-2018-10562)
2. 攻击[30759]:Zoho ManageEngine Applications Manager UploadAction任意文件上传漏洞 (CVE-2020-14008)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23787. This package include changed rules:

new rules:
1. threat[30758]:Way-Board Remote File Disclosure Vulnerability(CVE-2001-0214)
2. threat[25074]:Cacti Group Cacti color.php SQL Injection Vulnerability
3. threat[25075]:Company Visitor Management System (CVMS) 1.0 - Authentication Bypass Vulnerability
4. threat[25076]:Wireless IP Camera (P2P) WIFICAM Remote Code Execution Vulnerability(CVE-2017-8225)

update rules:
1. threat[24300]:Remote command execution vulnerability of GPON Home Gateway (cve-2018-10561/cve-2018-10562)
2. threat[30759]:Zoho ManageEngine Applications Manager UploadAction Arbitrary File Upload Vulnerability (CVE-2020-14008)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23760。该升级包新增/改进的规则有:

更新规则:
1. 攻击[25040]:fastadmin前台目录穿越漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23760. This package include changed rules:

update rules:
1. threat[25040]:Fastadmin front-end directory traversal vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23691。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25064]:BigTree CMS 4.4.10 SQL注入漏洞
2. 攻击[25066]:Bigviktor bot 网络C&C通信
3. 攻击[25067]:Flatpress Add Blog 1.0.3- 存储型跨站脚本漏洞
4. 攻击[25068]:Cisco UCS Director saveStaticConfig目录遍历漏洞(CVE-2020-3248)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23691. This package include changed rules:

new rules:
1. threat[25064]:BigTree CMS 4.4.10 SQL Injection Vulnerability
2. threat[25066]:Bigviktor bot Network C&C Connection
3. threat[25067]:Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting Vulnerability
4. threat[25068]:Cisco UCS Director saveStaticConfig Directory Traversal Vulnerability(CVE-2020-3248)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23620。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25044]:WebSphere Application Server XXE漏洞(CVE-2020-4634)
2. 攻击[25045]:研华WebAccess NMS ConfigRestoreAction 任意文件上传漏洞(CVE-2020-10621)

更新规则:
1. 攻击[25040]:fastadmin前台目录穿越漏洞
2. 攻击[25041]:fastadmin前台getshell漏洞-上传shell


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23620. This package include changed rules:

new rules:
1. threat[25044]:WebSphere Application Server XXE Vulnerability(CVE-2020-4634)
2. threat[25045]:Advantech WebAccess NMS ConfigRestoreAction Arbitrary File Upload Vulnerability(CVE-2020-10621)

update rules:
1. threat[25040]:Fastadmin front-end directory traversal vulnerability
2. threat[25041]:Fastadmin front-end getshell vulnerability - upload shell


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23606。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25039]:Nagios XI account main.php存储型跨站脚本漏洞(CVE-2020-10821)
2. 攻击[50593]:Redis认证失败
3. 攻击[25040]:fastadmin前台目录穿越漏洞
4. 攻击[25041]:fastadmin前台getshell漏洞 - 上传shell
5. 攻击[25042]:Fastadmin前台登录成功
6. 攻击[41774]:Fastadmin后台登录成功

更新规则:
1. 攻击[41543]:木马后门程序ASP一句话木马


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23606. This package include changed rules:

new rules:
1. threat[25039]:Nagios XI account main.php Stored Cross-Site Scripting Vulnerability(CVE-2020-10821)
2. threat[50593]:Redis Authenticated Failed
3. threat[25040]:Fastadmin front-end directory traversal vulnerability
4. threat[25041]:Fastadmin front-end getshell vulnerability - upload shell
5. threat[25042]:Fastadmin foreground login succeeded
6. threat[41774]:Fastadmin background login succeeded

update rules:
1. threat[41543]:Trojan/Backdoor General ASP trojan


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23586。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25038]:rConfig 未授权远程代码执行漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23586. This package include changed rules:

new rules:
1. threat[25038]:rConfig Unauthenticated Remote Code Execution Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23576。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25032]:ThinkAdmin 6 - 任意文件读取漏洞(CVE-2020-25540)
2. 攻击[25037]:PHP Yii 框架反序列化漏洞(CVE-2020-15148)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23576. This package include changed rules:

new rules:
1. threat[25032]:ThinkAdmin 6 - Arbitrarily File Read Vulnerability(CVE-2020-25540)
2. threat[25037]:PHP Yii Framework Deserialization Vulnerability(CVE-2020-15148)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23569。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25035]:Coremail XT5 远程代码执行漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23569. This package include changed rules:

new rules:
1. threat[25035]:Coremail XT5 Remote Code Execution Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23542。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25031]:Netlogon 特权提升漏洞（CVE-2020-1472

更新规则:
1. 攻击[25010]:哥斯拉Godzilla PHP_XOR_BASE64 Webshell 连接


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23542. This package include changed rules:


new rules:
1. threat[25031]:Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472)

update rules:
1. threat[25010]:Godzilla PHP_XOR_BASE64 Webshell Connect


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23523。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25029]:通达OA v11.7后台SQL注入漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23523. This package include changed rules:

new rules:
1. threat[25029]:Office Anywhere OA v11.7 SQL injection Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23519。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25024]:联软科技网络准入控制系统任意文件上传漏洞
2. 攻击[25025]:泛微E-cology OA getdata.jsp SQL注入漏洞
3. 攻击[25026]:网瑞达资源访问控制系统命令执行漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23519. This package include changed rules:

new rules:
1. threat[25024]:Leagsoft UniNAC Arbitrary File Upload Vulnerability
2. threat[25025]:Weaver E-cology OA getdata.jsp SQL Injection Vulnerability
3. threat[25026]:WRDTech WebVPN Command Execution Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23511。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25023]:泛微云桥任意文件读取漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23511. This package include changed rules:

new rules:
1. threat[25023]:Weaver E-bridge Arbitrary File Reading vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23507。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25018]:Weblogic UniversalExtractor 反序列化漏洞(CVE-2020-14645)
2. 攻击[30752]:Tailor 管理系统-'id'SQL注入漏洞
3. 攻击[25019]:Mara CMS 7.5 - 反射型跨站脚本漏洞(CVE-2020-24223)
4. 攻击[25021]:Apache DolphinScheduler远程代码执行漏洞(CVE-2020-11974)
5. 攻击[25022]:用友GRP-u8系统远程命令执行漏洞
6. 应用:HTTP2



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23507. This package include changed rules:

new rules:
1. threat[25018]:Weblogic UniversalExtractor Deserialization Vulnerability(CVE-2020-14645)
2. threat[30752]:Tailor Management System - 'id' SQL Injection Vulnerability
3. threat[25019]:Mara CMS 7.5 - Reflective Cross-Site Scripting Vulnerability(CVE-2020-24223)
4. threat[25021]:Apache DolphinScheduler Remote Code Execution Vulnerability(CVE-2020-11974)
5. threat[25022]:Yonyou GRP-u8 Remote Command Execution Vulnerability
6. app:HTTP2



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23476。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25015]:grocy 2.7.1- 存储型XSS漏洞
2. 攻击[25014]:BloodX CMS 1.0 - 身份验证绕过漏洞
3. 攻击[25017]:mozilo CMS 2.0-存储型XSS漏洞

更新规则:
1. 攻击[25012]:Daily Tracker System 1.0 身份验证绕过漏洞(CVE-2020-24193)
2. 攻击[25013]:Savsoft Quiz Enterprise Version 5.5 -存储型跨站脚本漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23476. This package include changed rules:

new rules:
1. threat[25015]:grocy 2.7.1 - Persistent Cross-Site Scripting Vulnerability
2. threat[25014]:BloodX CMS 1.0 - Authentication Bypass Vulnerability
3. threat[25017]:moziloCMS 2.0 - Persistent Cross-Site Scripting Vunlerability

update rules:
1. threat[25012]:Daily Tracker System 1.0 Authentication Bypass Vulnerability(CVE-2020-24193)
2. threat[25013]:Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23419。该升级包新增/改进的规则有:

新增规则:
1. 攻击[25009]:Microsoft .NET Framework/SharePoint Server/Visual Studio远程代码执行漏洞(CVE-2020-1147)
2. 攻击[25010]:哥斯拉Godzilla PHP_XOR_BASE64 Webshell 连接
3. 攻击[25011]:哥斯拉Godzilla PHP_XOR_RAW Webshell 连接
4. 攻击[25002]:vBulletin 5.6.2 'widget_tabbedContainer_tab_panel'远程执行代码漏洞
5. 攻击[25004]:ElkarBackup 1.3.3- 存储型跨站点脚本漏洞
6. 攻击[25006]:Apache Shiro 1.5.1 身份验证绕过漏洞(CVE-2020-1957)

更新规则:
1. 攻击[22933]:网络蠕虫Nimda攻击


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23419. This package include changed rules:

new rules:
1. threat[25009]:Microsoft .NET Framework/SharePoint Server/Visual Studio Remote Code Execution(CVE-2020-1147)
2. threat[25010]:Godzilla PHP_XOR_BASE64 Webshell Connect
3. threat[25011]:Godzilla PHP_XOR_RAW Webshell Connect
4. threat[25002]:vBulletin 5.6.2 'widget_tabbedContainer_tab_panel' Remote Code Execution Vulnerability
5. threat[25004]:ElkarBackup 1.3.3 - Persistent Cross-Site Scripting Vulnerability
6. threat[25006]:Apache Shiro Authentication Bypass Vulnerability (CVE-2020-1957)

update rules:
1. threat[22933]:Network Worm Nimda Attack


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23384。该升级包新增/改进的规则有:


新增规则:
1. 攻击[25003]:Fuel CMS 1.4.7 - 'col' SQL注入漏洞
2. 攻击[30749]:锐捷网络交换机eWeb S29_RGOS 11.4目录遍历漏洞
3. 攻击[25000]:Seowon SlC 130路由器远程执行代码漏洞
4. 攻击[41771]:远程控制木马大灰狼受控端上线
5. 攻击[24999]:Spring Boot Actuator未授权访问
6. 攻击[41770]:恶意代码利用ADB调试接口传播
7. 攻击[25005]:宝塔面板phpMyAdmin未授权访问漏洞

更新规则:
1. 攻击[24553]:冰蝎 Webshell 连接
2. 攻击[23991]:Fastjson远程代码执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23384. This package include changed rules:


new rules:
1. threat[25003]:Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated) Vulnerability
2. threat[30749]:Ruijie Networks Switch eWeb S29_RGOS 11.4 Directory Traversal Vulnerability
3. threat[25000]:Seowon SlC 130 Router Remote Code Execution Vulnerability
4. threat[41771]:Remote Control Trojan DaHuiLang Client Startup
5. threat[24999]:Spring Boot Actuator Unauthorized Access
6. threat[41770]:Malicious code spreads using ADB debugging interface
7. threat[25005]:BaoTa Panel phpMyAdmin Unauthorized Access Vulnerability

update rules:
1. threat[24553]:Behinder Webshell Connect
2. threat[23991]:Fastjson Remote Code Execution Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23321。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24997]:通达OA 11.6 任意文件删除漏洞
2. 攻击[24998]:通达OA 11.6 任意文件上传漏洞
3. 攻击[41766]:哥斯拉Godzilla Webshell JSP脚本上传
4. 攻击[41767]:哥斯拉Godzilla Webshell ASPX脚本上传
5. 攻击[41768]:哥斯拉Godzilla Webshell PHP脚本上传



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23321. This package include changed rules:

new rules:
1. threat[24997]:Office Anywhere OA 11.6 Arbitrary File Deletion Vulnerability
2. threat[24998]:Office Anywhere OA 11.6 Arbitrary File Upload Vulnerability
3. threat[41766]:Godzilla Webshell JSP Scripts Upload
4. threat[41767]:Godzilla Webshell ASPX Scripts Upload
5. threat[41768]:Godzilla Webshell PHP Scripts Upload



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23275。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24993]:通达OA前台SQL注入漏洞
2. 攻击[24994]:通达OA 2015-2017版本任意文件上传漏洞
3. 攻击[24995]:通达OA任意文件删除漏洞

更新规则:
1. 攻击[24553]:冰蝎 Webshell 连接
2. 攻击[41699]:冰蝎加密JSP Webshell文件上传
3. 攻击[41697]:冰蝎加密ASP Webshell文件上传
4. 攻击[41696]:冰蝎加密PHP Webshell文件上传


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23275. This package include changed rules:

new rules:
1. threat[24993]:TongDa OA FrontEnd injection vulnerability
2. threat[24994]:Tongda OA 2015-2017 version arbitrary file upload vulnerability
3. threat[24995]:Tongda OA Arbitrary deletion Vulnerability

update rules:
1. threat[24553]:Behinder Webshell Connect
2. threat[41699]:Behinder Encrypted JSP Webshell File Upload
3. threat[41697]:Behinder Encrypted ASP Webshell File Upload
4. threat[41696]:Behinder Encrypted PHP Webshell File Upload


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23223。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24983]:Oracle E-Business Suite Advanced Outbound Telephony Calendar跨站脚本漏洞(CVE-2020-2852)
2. 攻击[24984]:Oracle E-Business Suite Advanced Outbound Telephony 跨站脚本漏洞(CVE-2020-2871)
3. 攻击[24986]:Cisco Unified Contact Center Express RMI 不安全的反序列化漏洞(CVE-2020-3280)
4. 攻击[24987]:Oracle E-Business Suite Advanced Outbound Telephony 跨站脚本漏洞(CVE-2020-2854)
5. 攻击[24988]:Oracle E-Business Suite Advanced Outbound Telephony 跨站脚本漏洞(CVE-2020-2856)
6. 攻击[24989]:Apache Kylin REST API migrateCube命令注入漏洞(CVE-2020-1956)
7. 攻击[24990]:Apache Spark未授权远程代码执行漏洞(CVE-2020-9480)
8. 应用:egd
9. 应用:eyou
10. 应用:postgres field

更新规则:
1. 攻击[66229]:ISC BIND内存泄露漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23223. This package include changed rules:

new rules:
1. threat[24983]:Oracle E-Business Suite Advanced Outbound Telephony Calendar Cross-Site Scripting Vulnerability(CVE-2020-2852)
2. threat[24984]:Oracle E-Business Suite Advanced Outbound Telephony Cross-Site Scripting Vulnerability(CVE-2020-2871)
3. threat[24986]:Cisco Unified Contact Center Express RMI Insecure Deserialization Vulnerability(CVE-2020-3280)
4. threat[24987]:Oracle E-Business Suite Advanced Outbound Telephony Cross-Site Scripting Vulnerability(CVE-2020-2854)
5. threat[24988]:Oracle E-Business Suite Advanced Outbound Telephony Cross-Site Scripting Vulnerability(CVE-2020-2856)
6. threat[24989]:Apache Kylin REST API migrateCube Command Injection Vulnerability(CVE-2020-1956)
7. threat[24990]:Apache Spark Unauthorized Remote Code Execution Vulnerability(CVE-2020-9480)
8. app:egd
9. app:eyou
10. app:postgres field

update rules:
1. threat[66229]:ISC BIND Internal Memory Disclosure Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23150。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24979]:禅道Pro远程代码执行漏洞(CVE-2020-7361)
2. 攻击[24980]:WebSphere远程代码执行漏洞(CVE-2020-4450)
3. 攻击[24981]:WebSphere远程代码执行漏洞(CVE-2020-4534)
4. 攻击[24982]:研华WebAccess SCADA IOCTL 10001 BwPSLink.exe任意文件删除漏洞

更新规则:
1. 攻击[24863]:SaltStack目录遍历漏洞(CVE-2020-11652)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23150. This package include changed rules:

new rules:
1. threat[24979]:ZenTao Pro Remote Code Execution Vulnerability(CVE-2020-7361)
2. threat[24980]:WebSphere Remote Code Execution Vulnerability(CVE-2020-4450)
3. threat[24981]:WebSphere Remote Code Execution Vulnerability(CVE-2020-4534)
4. threat[24982]:Advantech WebAccess SCADA IOCTL 10001 BwPSLink.exe Arbitrary File Delete Vulnerability

update rules:
1. threat[24863]:SaltStack Directory Traversal Vulnerability(CVE-2020-11652)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23127。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24974]:泛微网络E-office OA管理系统任意文件读取漏洞
2. 攻击[24975]:Foxit Reader和PhantomPDF释放后重用漏洞(CVE-2020-8845)
3. 攻击[24976]:Microsoft Windows SMBv1 NT_TRANSACT_IOCTL远程执行代码(CVE-2020-1301)
4. 攻击[24977]:Microsoft Windows CAB文件分析目录遍历漏洞(CVE-2020-1300)
5. 攻击[24978]:Microsoft Windows SMBv3压缩信息披露（CVE-2020-1206）

更新规则:
1. 攻击[50519]:远程控制工具NetWire连接
2. 攻击[24101]:Apache Tomcat 远程代码执行漏洞(CVE-2017-12615)(CVE-2017-12617)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23127. This package include changed rules:

new rules:
1. threat[24974]:Weaver Network E-office OA Management System Arbitrary File Download Vulnerability
2. threat[24975]:Foxit Reader and PhantomPDF Use After Free Vulnerability(CVE-2020-8845)
3. threat[24976]:Microsoft Windows SMBv1 NT_TRANSACT_IOCTL Remote Code Execution(CVE-2020-1301)
4. threat[24977]:Microsoft Windows CAB File Parsing Directory Traversal Vulnerability(CVE-2020-1300)
5. threat[24978]:Microsoft Windows SMBv3 Compression Information Disclosure(CVE-2020-1206)

update rules:
1. threat[50519]:Remote Control tool NetWire
2. threat[24101]:Apache Tomcat Remote Code Execution Vulnerability(CVE-2017-12615)(CVE-2017-12617)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23076。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24970]:用友致远A8协同管理软件任意文件读取漏洞
2. 攻击[24971]:禅道项目管理系统11.6任意文件读取漏洞
3. 攻击[24972]:禅道项目管理系统11.6 SQL注入漏洞
4. 攻击[24973]:禅道项目管理系统11.6 文件上传漏洞
5. 攻击[24969]:ThinkPHP 6.0任意文件创建上传漏洞
6. 攻击[24965]:laravel框架序列化远程代码执行漏洞(CVE-2019-9081)
7. 攻击[41764]:nginx服务器后门连接尝试
8. 应用:sinec-h1
9. 应用:hart-ip
10. 应用:gryphon

更新规则:
1. 攻击[41588]:PHP Webshell脚本上传
2. 攻击[24962]:Microsoft Windows DNS服务器整数溢出(CVE-2020-1350)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23076. This package include changed rules:

new rules:
1. threat[24970]:Seeyon A8 collaborative management software Arbitrary file reading vulnerability
2. threat[24971]:Zentao PMS 11.6 Arbitrary File Read Vulnerability
3. threat[24972]:Zentao PMS 11.6 SQL Injection Vulnerability
4. threat[24973]:Zentao PMS 11.6 File Upload Vulnerability
5. threat[24969]:ThinkPHP 6.0 Arbitrary File Creation and Upload Vulnerability
6. threat[24965]:Laravel framework serialization remote code execution vulnerability (CVE-2019-9081)
7. threat[41764]:nginx Server Backdoor Connection Attempt
8. app:sinec-h1
9. app:hart-ip
10. app:gryphon

update rules:
1. threat[41588]:PHP Webshell Script Upload
2. threat[24962]:Microsoft Windows DNS Server Integer Overflow Vulnerability(CVE-2020-1350)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.23040。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24936]:Microsoft Edge Chakra脚本引擎远程内存破坏漏洞（CVE-2019-0568）
2. 攻击[24958]:EFS Easy File Sharing Web Server 缓冲区错误漏洞(CVE-2018-9059)
3. 攻击[24938]:DNN DNNarticle Module 配置文件泄露漏洞(CVE-2018-9126)
4. 攻击[24939]:Microsoft SharePoint Server远程代码执行漏洞（CVE-2019-0604)
5. 攻击[24941]:Nagios XI Chained 远程代码执行漏洞(CVE-2018-8735)
6. 攻击[24942]:Roland Gruber Softwareentwicklung LDAP Account Manager 跨站脚本漏洞(CVE-2018-8763)
7. 攻击[24943]:Square 9 GlobalForms SQL注入漏洞(CVE-2018-8820)
8. 攻击[24959]:Aviosoft DVD X Player Standar 缓冲区错误漏洞(CVE-2018-9128)
9. 攻击[24945]:Microsoft Edge Chakra InlineArrayPush 类型混淆漏洞(CVE-2018-8617)
10. 攻击[24947]:Drupal avatar_uploader v7.x-1.0-beta8 目录遍历漏洞(CVE-2018-9205)
11. 攻击[24948]:Windows VBScript 引擎远程执行代码漏洞(CVE-2018-8625)
12. 攻击[24950]:LibreOffice 输入验证错误漏洞(CVE-2019-9848)
13. 攻击[24951]:Microsoft Windows和Windows Server 输入验证错误漏洞(CVE-2020-0938)
14. 攻击[30746]:Microsoft Windows Modules Installer Service 信息泄露漏洞(CVE-2020-0859)
15. 攻击[24952]:Microsoft Windows Installer 远程代码执行漏洞(CVE-2020-0814)
16. 攻击[24961]:SQL Server Reporting Services RCE漏洞(CVE-2010-0618)
17. 攻击[24954]:Microsoft Media Foundation 缓冲区错误漏洞(CVE-2020-0738)
18. 攻击[24505]:Apache Axis 1.4 远程代码执行(CVE-2019-0227)
19. 攻击[24955]:Windows LNK快捷方式文件远程代码执行漏洞(CVE-2020-0729)
20. 攻击[30747]:Microsoft Windows Modules Installer Service信息泄露漏洞(CVE-2020-0728)
21. 攻击[24956]:Windows Installer权限提升漏洞(CVE-2020-0683)
22. 攻击[24957]:Windows Kernel Service Tracing权限提升漏洞(CVE-2020-0668)
23. 攻击[24962]:Microsoft Windows DNS服务器整数溢出(CVE-2020-1350)
24. 攻击[24964]:Zoho ManageEngine OpManager cachestart目录遍历（CVE-2020-13818）
25. 应用:人人直播


更新规则:
1. 攻击[24189]:Realtek rtl81xx SDK远程代码执行漏洞(CVE-2014-8361)
2. 攻击[50591]:RDP远程桌面服务登录成功
3. 攻击[24119]:FasterXML Jackson-databind反序列化代码执行漏洞(CVE-2017-15095)
4. 应用:百度云管家
5. 应用:华西证券


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.23040. This package include changed rules:

new rules:
1. threat[24936]:Microsoft Edge Chakra Scripting Engine Remote Memory corruption vulnerability (CVE-2019-0568
2. threat[24958]:EFS Easy File Sharing Web Server Buffer Error Vulnerability (CVE-2018-9059)
3. threat[24938]:DNN DNNarticle Module Config File Leak Vulnerability(CVE-2018-9126)
4. threat[24939]:Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2019-0604)
5. threat[24941]:Nagios XI Chained Remote Code Execution Vulnerability(CVE-2018-8735)
6. threat[24942]:Roland Gruber Softwareentwicklung LDAP Account Manager CROSS-site Scripting Vulnerability(CVE-2018-8763)
7. threat[24943]:Square 9 GlobalForms SQL Injection Vulnerability(CVE-2018-8820)
8. threat[24959]:Aviosoft DVD X Player Standar Buffer Error Vulnerability (CVE-2018-9128)
9. threat[24945]:Microsoft Edge Chakra InlineArrayPush Type Confusion Vulnerability(CVE-2018-8617)
10. threat[24947]:Drupal avatar_uploader v7.x-1.0-beta8 Directory Traversal Vulnerability(CVE-2018-9205)
11. threat[24948]:Windows VBScript Engine Remote Execution Code Vulnerability(CVE-2018-8625)
12. threat[24950]:LibreOffice input validation error vulnerability(CVE-2019-9848)
13. threat[24951]:Microsoft Windows和Windows Server Input Validation Vulnerability(CVE-2020-0938)
14. threat[30746]:Microsoft Windows Modules Installer Service Information Disclosure Vulnerability(CVE-2020-0859)
15. threat[24952]:Microsoft Windows Installer Remote Code Execution Vulnerability(CVE-2020-0814)
16. threat[24961]:SQL Server Reporting Services RCE Vulnerability (CVE-2010-0618)
17. threat[24954]:Microsoft Media Foundation Buffer Error Vulnerability(CVE-2020-0738)
18. threat[24505]:Apache Axis 1.4 Remote Code Execution(CVE-2019-0227)
19. threat[24955]:Windows LNK Remote Code Execution Vulnerability(CVE-2020-0729)
20. threat[30747]:Microsoft Windows Modules Installer Service Information Disclosure Vulnerability (CVE-2020-0728)
21. threat[24956]:Windows Installer Privilege Elevation Vulnerability (CVE-2020-0683)
22. threat[24957]:Windows Kernel Service Tracing Privilege Elevation Vulnerability (CVE-2020-0668)
23. threat[24962]:Microsoft Windows DNS Server Integer Overflow Vulnerability(CVE-2020-1350)
24. threat[24964]:Zoho ManageEngine OpManager cachestart Directory Traversal(CVE-2020-13818)
25. app:renrenzhibo

update rules:
1. threat[24189]:Realtek rtl81xx SDK Remote Code Execution Vulnerability(CVE-2014-8361)
2. threat[50591]:RDP Remote Desktop Protocol Service Login
3. threat[24119]:FasterXML Jackson-databind Deserialization Remote Code Execution Vulnerability(CVE-2017-15095)
4. app:baiduyunguanjia
5. app:Market Quotes Stie - Huaxi Securities


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22935。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24935]:Microsoft Edge Chakra脚本引擎远程内存破坏漏洞（CVE-2019-0567）
2. 攻击[24930]:思科数据中心网络管理器installSwitchLicense目录遍历漏洞(CVE-2019-15980)
3. 攻击[24931]:Foxit PhantomPDF文本字段对象释放后重用漏洞(CVE-2020-8846)
4. 攻击[24932]:Cisco UCS Director isEnableRestKeyAccessCheckForUser身份验证绕过漏洞(CVE-2020-3243)
5. 攻击[41763]:Cobalt Strike渗透攻击工具Beacon DNS通信
6. 攻击[24933]:Cisco Data Center Network Manager storeFileContentInFS 目录遍历漏洞(CVE-2019-15981)
7. 攻击[24934]:Microsoft .NET Framework XPS文件解析远程代码执行漏洞(CVE-2020-0605)


更新规则:
1. 攻击[49003]:Mirai僵尸连接服务器
2. 攻击[24770]:Cisco Data Center Network Manager getLicenses SQL 注入漏洞(CVE-2019-15984)
3. 攻击[50181]:HTTP协议CONNECT遂道功能(http proxy)连接访问


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22935. This package include changed rules:

new rules:
1. threat[24935]:Microsoft Edge Chakra Scripting Engine Remote Memory corruption vulnerability (CVE-2019-0567)
2. threat[24930]:Cisco Data Center Network Manager installSwitchLicense Directory Traversal Vulnerability(CVE-2019-15980)
3. threat[24931]:Foxit PhantomPDF text Field Object Use After Free Vulnerability(CVE-2020-8846)
4. threat[24932]:Cisco UCS Director isEnableRestKeyAccessCheckForUser Authentication Bypass Vulnerability(CVE-2020-3243)
5. threat[41763]:Penetration Test Tool Cobalt Strike Beacon DNS Communication
6. threat[24933]:Cisco Data Center Network Manager storeFileContentInFS Directory Traversal Vulnerability(CVE-2019-15981)
7. threat[24934]:Microsoft .NET Framework XPS File Parsing Remote Code Execution Vulnerability(CVE-2020-0605)

update rules:
1. threat[49003]:Mirai Botnet Connecting to the Server
2. threat[24770]:Cisco Data Center Network Manager getLicenses SQL Injection Vulnerability(CVE-2019-15984)
3. threat[50181]:HTTP Protocol CONNECT Tunnel Feature (http proxy) Connection Access


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22885。该升级包新增/改进的规则有:

新增规则:
1. 攻击[10506]:Microsoft Windows TLS Key Exchange拒绝服务漏洞(CVE-2020-1118)
2. 攻击[24928]:Zoho ManageEngine DataSecurity Plus认证绕过漏洞(CVE-2020-11532)
3. 攻击[10507]:ISC BIND TSIG 验证拒绝服务漏洞(CVE-2020-8617)
4. 攻击[41762]:Tomato路由器默认口令扫描

更新规则:
1. 攻击[24893]:Microsoft Internet Explorer Jscript JSONStringifyObject 释放后重利用漏洞(CVE-2017-11793)
2. 攻击[50453]:协议隧道工具dns2tcp连接
3. 攻击[24919]:Zoho ManageEngine DataSecurity Plus目录遍历漏洞(CVE-2020-11531)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22885. This package include changed rules:

new rules:
1. threat[10506]:Microsoft Windows TLS Key Exchange Denial of Service Vulnerability(CVE-2020-1118)
2. threat[24928]:Zoho ManageEngine DataSecurity Plus Authentication Bypass Vulnerability(CVE-2020-11532)
3. threat[10507]:ISC BIND TSIG Validation Denial of Service Vulnerability(CVE-2020-8617)
4. threat[41762]:Tomato router Default Credentials Scan

update rules:
1. threat[24893]:Microsoft Internet Explorer Jscript JSONStringifyObject Use After Free (CVE-2017-11793)
2. threat[50453]:Protocol Tunnel Tool dns2tcp Connect
3. threat[24919]:Zoho ManageEngine DataSecurity Plus Directory Traversal Vulnerability(CVE-2020-11531)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22865。该升级包新增/改进的规则有:

新增规则:
1. 攻击[30744]:帆软报表v8.0认证账号密码信息泄露漏洞
2. 攻击[24925]:Winmail邮箱管理系统viewsharenetdisk.php任意文件下载漏洞
3. 攻击[41761]:WMIC命令执行
4. 攻击[24926]:泛微ecology8 任意文件上传漏洞
5. 攻击[24927]:Apache Dubbo Provider 反序列化漏洞(CVE-2020-1948)
6. 应用:腾讯会议
7. 应用:Zoho
8. 应用:企业微信
9. 应用:WPS
10. 应用:WeLink
11. 应用:Webex Meetings
12. 应用:泛微
13. 应用:腾讯文档
14. 应用:好视通视频会议
15. 应用:飞书

更新规则:
1. 攻击[24879]:winmail邮箱管理系统任意文件下载漏洞
2. 攻击[24878]:Winmail邮件管理系统任意文件上传漏洞
3. 攻击[24255]:Web服务远程命令执行攻击
4. 攻击[24918]:Zoho ManageEngine OpManager fluidicv2 UI目录遍历漏洞(CVE-2020-12116)
5. 攻击[41718]:内网隧道工具reGeorg连接
6. 应用:Zoom


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22865. This package include changed rules:

new rules:
1. threat[30744]:FineReport v8.0 Authentication Account Password Information Disclosure Vulnerability
2. threat[24925]:Winmail Mailbox Management System viewsharenetdisk.php Abitrary Download Vulnerability
3. threat[41761]:WMIC Command Execation
4. threat[24926]:Weaver Ecology8 Arbitrary File Upload Vulnerability
5. threat[24927]:Apache Dubbo Provider Deserialization Vulnerability(CVE-2020-1948)
6. app:Tencent Meeting
7. app:Zoho
8. app:WeWork
9. app:WPS
10. app:WeLink
11. app:Webex Meetings
12. app:eteams
13. app:腾讯文档
14. app:好视通视频会议
15. app:飞书

update rules:
1. threat[24879]:winmail mailbox management system abitrary download vulnerability
2. threat[24878]:winmail mail management system arbitrary upload vulnerability
3. threat[24255]:Web Service Remote Command Execution Attack
4. threat[24918]:Zoho ManageEngine OpManager fluidicv2 UI Directory Traversal Vulnerability(CVE-2020-12116)
5. threat[41718]:Intranet tunneling tool reGeorg connection
6. app:Zoom


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22840。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24921]:Advantech WebAccess SCADA BwFLApp.exe任意文件删除漏洞
2. 攻击[24922]:Advantech WebAccess SCADA BwPFile.exe任意文件删除漏洞
3. 攻击[24923]:Apache Shiro RememberMe反序列化漏洞(CVE-2016-4437)
4. 攻击[50591]:RDP远程桌面服务登录成功
5. 攻击[30743]:泛微ecology OA数据库配置信息泄露
6. 攻击[24924]:Apache Commons Configuration加载YAML文件反序列化漏洞(CVE-2020-1953)

更新规则:
1. 攻击[68655]:可疑Webshell后门访问控制
2. 攻击[24858]:通达OA 任意用户远程代码执行漏洞
3. 攻击[23533]:TRS WCM任意文件上传漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22840. This package include changed rules:

new rules:
1. threat[24921]:Advantech WebAccess SCADA BwFLApp.exe Arbitrary File Deletion Vulnerability
2. threat[24922]:Advantech WebAccess SCADA BwPFile.exe Arbitrary File Deletion Vulnerability
3. threat[24923]:Apache Shiro RememberMe Deserialization Vulnerability(CVE-2016-4437)
4. threat[50591]:RDP Remote Desktop Protocol Service Login
5. threat[30743]:Weaver ecology OA Database Configuration Information Leakage Vulnerability
6. threat[24924]:Apache Commons Configuration Loading YAML Files Deserialization Vulnerability(CVE-2020-1953)

update rules:
1. threat[68655]:Suspicious Webshell Backdoor Access and Control
2. threat[24858]:TongDa OA Remote Code Execution Vulnerability
3. threat[23533]:TRS WCM Arbitrary File Upload Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22809。该升级包新增/改进的规则有:


新增规则:
1. 攻击[41760]:Victor CMS 1.0 远程Shell 上传漏洞
2. 攻击[24912]:i-doit Open Source CMDB 1.14.1任意文件删除漏洞
3. 攻击[24914]:OpenMRSReference应用程序sessionLocation参数反射型跨站点脚本漏洞
4. 攻击[24915]:Oracle商业智能BIRemotingServlet AMF不安全反序列化(CVE-2020-2950)
5. 攻击[24916]:Rockwell Automation FactoryTalk RNADiagnosticsSrv反序列化漏洞(CVE-2020-6967)
6. 攻击[30742]:Adobe Acrobat及Reader 越界读取信息泄露漏洞(CVE-2020-3804)
7. 应用:KNXIP

更新规则:
1. 攻击[24895]:dotCMS CMSFilter assets 访问控制漏洞(CVE-2020-6754)
2. 攻击[24861]:Trend Micro Apex One and OfficeScan目录遍历漏洞(CVE-2020-8470)
3. 攻击[24309]:Apache ActiveMQ Fileserver文件上传目录遍历漏洞(CVE-2016-3088)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22809. This package include changed rules:


new rules:
1. threat[41760]:Victor CMS 1.0 Shell Upload
2. threat[24912]:i-doit Open Source CMDB 1.14.1 Arbitrary File Deletion
3. threat[24914]:OpenMRS Reference Application sessionLocation Reflected Cross-Site Scripting
4. threat[24915]:Oracle Business Intelligence BIRemotingServlet AMF Insecure Deserialization(CVE-2020-2950)
5. threat[24916]:Rockwell Automation FactoryTalk RNADiagnosticsSrv Insecure Deserialization Vulnerability(CVE-2020-6967)
6. threat[30742]:Adobe Acrobat and Reader Out of Bounds Read Information Disclosure Vulnerability(CVE-2020-3804)
7. app:KNXIP

update rules:
1. threat[24895]:dotCMS CMSFilter assets Access Control Weakness Vulnerability (CVE-2020-6754)
2. threat[24861]:Trend Micro Apex One and OfficeScan Directory Traversal Vulnerability(CVE-2020-8470)
3. threat[24309]:Apache ActiveMQ Fileserver File Upload Directory Traversal Vulnerability(CVE-2016-3088)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22767。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24905]:Webtateas 2.0 任意文件读取漏洞
2. 攻击[41758]:i-doit开源CMDB 1.14.1任意文件删除
3. 攻击[24904]:HP LinuxKI 6.01-远程命令注入漏洞(CVE-2020-7209)
4. 攻击[24906]:Cisco SD-WAN Solution vManage SQL注入漏洞(CVE-2019-16012)
5. 攻击[24907]:施耐德电气 IGSS IGSSupdateservice 目录遍历漏洞(CVE-2020-7478)
6. 攻击[24908]:Mikrotik路由器监控系统1.2.3 SQL注入（CVE-2020-13118）
7. 攻击[24909]:JDWP远程命令执行

更新规则:
1. 攻击[49003]:Mirai僵尸连接服务器
2. 攻击[41381]:恶意勒索软件传输
3. 攻击[24883]:Zabbix jsrpc.php SQL注入漏洞(CVE-2016-10134)
4. 攻击[23991]:Fastjson远程代码执行漏洞
5. 攻击[24106]:Apache Tomcat远程代码执行漏洞（CVE-2017-12617）
6. 攻击[24771]:PHPStudy Backdoor 远程代码执行漏洞
7. 应用:微信


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22767. This package include changed rules:

new rules:
1. threat[24905]:Webtateas version 2.0 suffers from an arbitrary file read vulnerability.
2. threat[41758]:i-doit Open Source CMDB 1.14.1 Arbitrary File Deletion
3. threat[24904]:HP LinuxKI 6.01Remote Command Injection Vulnerability(CVE-2020-7209)
4. threat[24906]:Cisco SD-WAN Solution vManage SQL Injection Vulnerability(CVE-2019-16012)
5. threat[24907]:Schneider Electric IGSS IGSSupdateservice Directory Traversal Vulnerability(CVE-2020-7478)
6. threat[24908]:Mikrotik Router Monitoring System 1.2.3 SQL Injection(CVE-2020-13118)
7. threat[24909]:JDWP Remote Command Execution

update rules:
1. threat[49003]:Mirai Botnet Connecting to the Server
2. threat[41381]:Malicious Ransomware Transmission
3. threat[24883]:Zabbix jsrpc.php SQL injection vulnerability (CVE-2016-10134)
4. threat[23991]:Fastjson Remote Code Execution Vulnerability
5. threat[24106]:Apache Tomcat remote Code Execution Vulnerability（CVE-2017-12617）
6. threat[24771]:PHPStudy Backdoor Remote Code Execution Vulnerability
7. app:wechat


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22729。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24901]:D-Link DSL-2780B DLink_1.01.14-远程DNS更改漏洞
2. 攻击[24902]:Nagios XI未经身份验证的存储的跨站点脚本漏洞(CVE-2018-15712)
3. 攻击[10505]:NTP ntpd monlist Query Reflection 拒绝服务漏洞(CVE-2013-5211)
4. 攻击[24899]:Oracle 电子商务套件人力资源SQL注入（CVE-2020-2956）(CVE-2020-2882)
5. 应用:IEC-61850-GOOSE
6. 应用:IEC-61850-SV

更新规则:
1. 攻击[23614]:Oracle Weblogic Server Java反序列化漏洞
2. 攻击[68655]:可疑Webshell后门访问控制
3. 攻击[24897]:WordPress ChopSlider 3 SQL注入漏洞(CVE-2020-11530)
4. 应用:IEC-61850-MMS


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22729. This package include changed rules:

new rules:
1. threat[24901]:D-Link DSL-2780B DLink_1.01.14 - Remote DNS Change vulnerability
2. threat[24902]:Nagios XI Unauthenticated Stored Cross-site Scripting Vulnerability(CVE-2018-15712)
3. threat[10505]:NTP ntpd monlist Query Reflection Denial of Service Vulnerability(CVE-2013-5211)
4. threat[24899]:Oracle E-Business Suite Human Resources SQL Injection (CVE-2020-2956)(CVE-2020-2882)
5. app:IEC-61850-GOOSE
6. app:IEC-61850-SV

update rules:
1. threat[23614]:Oracle Weblogic Server Java Unserialization Vulnerability
2. threat[68655]:Suspicious Webshell Backdoor Access and Control
3. threat[24897]:WordPress ChopSlider 3 SQL injection vulnerability (CVE-2020-11530)
4. app:IEC-61850-MMS


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22680。该升级包新增/改进的规则有:


新增规则:
1. 攻击[24891]:Advantech WISE-PaaS/RMM SQL注入漏洞(CVE-2019-18229)
2. 攻击[24894]:Microsoft Edge ChakraCore类型混淆信息披露（CVE-2017-0134）
3. 攻击[24892]:Oracle WebLogic Server FileDistributionServlet信息泄露漏(CVE-2019-2625)
4. 攻击[24896]:Nagios日志服务器用户配置文件存储型跨站脚本攻击(CVE-2020-6586)
5. 攻击[41757]:网络中发现可疑DNS行为(动态随机域名)
6. 攻击[24897]:WordPress ChopSlider 3 SQL注入漏洞(CVE-2020-11530)



更新规则:
1. 应用:iec-60870-5-104


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22680. This package include changed rules:


new rules:
1. threat[24891]:Advantech WISE-PaaS/RMM SQL Injection Vulnerability(CVE-2019-18229)
2. threat[24894]:Microsoft Edge ChakraCore Type Confusion Information Disclosure (CVE-2017-0134)
3. threat[24892]:Oracle WebLogic Server FileDistributionServlet Information Disclosure Vulnerability (CVE-2019-2625)
4. threat[24896]:Nagios Log Server User Profile Stored Cross-Site Scripting(CVE-2020-6586)
5. threat[41757]:Suspicious DNS behavior found in the network (Dynamic Random Domain Name)
6. threat[24897]:WordPress ChopSlider 3 SQL injection vulnerability (CVE-2020-11530)


update rules:
1. app:iec-60870-5-104


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22638。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24890]:Grandstream UCM6200 远程代码执行漏洞(CVE-2020-5722)
2. 攻击[24889]:Draytek Vigor远程代码执行漏洞(CVE-2020-8515)
3. 攻击[24888]:Netlink GPON路由器远程代码执行漏洞
4. 攻击[24865]:Nagios XI Two Reflected 跨站脚本攻击漏洞(CVE-2020-10819)
5. 攻击[24864]:AVTECH 视频监控设备未授权命令执行漏洞
6. 攻击[24883]:Zabbix jsrpc.php SQL注入漏洞(CVE-2016-10134)
7. 攻击[24881]:Zabbix latest.php SQL注入漏洞(CVE-2016-10134)
8. 攻击[24866]:Edimax EW-7438RPn 1.13 远程代码执行漏洞
9. 攻击[24879]:winmail邮箱管理系统任意文件下载漏洞
10. 攻击[24878]:Winmail邮件管理系统任意文件上传漏洞
11. 攻击[24877]:eYou list_userinfo.php SQL注入漏洞
12. 攻击[24876]:eYou action_help.class.php SQL注入漏洞
13. 攻击[24868]:TP-LINK Cloud Cameras NCXXX Bonjour 命令注入漏洞(CVE-2020-12109)
14. 攻击[24873]:eYou v4 邮件系统 domain_logo.php 命令执行漏洞
15. 攻击[24871]:Microsoft Windows SMB Server远程代码执行漏洞(CVE-2017-0143)(ms17-010)
16. 攻击[24872]:ELTEX NTP-RG-1402G命令注入漏洞(CVE-2020-9026)
17. 攻击[24869]:School ERP Pro 1.0任意文件读取漏洞
18. 攻击[24880]:FasterXML jackson-databind 远程代码执行漏洞(CVE-2020-11113)
19. 攻击[24870]:School ERP Pro 1.0 任意文件上传漏洞
20. 攻击[24887]:GhostScript 沙箱绕过(命令执行)漏洞(CVE-2019-6116)


更新规则:
1. 攻击[24770]:Cisco Data Center Network Manager getLicenses SQL 注入漏洞(CVE-2019-15984)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22638. This package include changed rules:

new rules:
1. threat[24890]:Grandstream UCM6200 Remote Code Execution Vulnerability (CVE-2020-5722)
2. threat[24889]:Draytek Vigor Remote Code Execution Vulnerability (CVE-2020-8515)
3. threat[24888]:Netlink GPON router remote code execution vulnerability
4. threat[24865]:Nagios XI Two Reflected Cross-Site Scripting Vulnerability(CVE-2020-10819)
5. threat[24864]:Unauthorized command execution vulnerability in AVTECH video surveillance equipment
6. threat[24883]:Zabbix jsrpc.php SQL injection vulnerability (CVE-2016-10134)
7. threat[24881]:Zabbix latest.php SQL injection vulnerability (CVE-2016-10134)
8. threat[24866]:Edimax EW-7438RPn 1.13 Remote Code Execution
9. threat[24879]:winmail mailbox management system abitrary download vulnerability
10. threat[24878]:winmail mail management system arbitrary upload vulnerability
11. threat[24877]:eYou list_userinfo.php SQL injection vulnerability
12. threat[24876]:eYou action_help.class.php SQL injection vulnerability
13. threat[24868]:TP-LINK Cloud Cameras NCXXX Bonjour Command Injection(CVE-2020-12109)
14. threat[24873]:eYou v4 mail system domain_logo.php command execution vulnerability
15. threat[24871]:Microsoft Windows SMB Server Remote Code Execution Vulnerability(CVE-2017-0143)(ms17-010)
16. threat[24872]:ELTEX NTP-RG-1402G command injection vulnerability (CVE-2020-9026)
17. threat[24869]:School ERP Pro 1.0 Arbitrary File Read
18. threat[24880]:FasterXML jackson-databind Remote Code Execution Vulnerability(CVE-2020-11113)
19. threat[24870]:School ERP Pro 1.0 arbitrary file upload vulnerability
20. threat[24887]:GhostScript Sandbox Bypass (Command Execution) Vulnerability(CVE-2019-6116)


update rules:
1. threat[24770]:Cisco Data Center Network Manager getLicenses SQL Injection Vulnerability(CVE-2019-15984)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22624。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24885]:Adobe LiveCycle Data Services XML外部实体注入(XXE)漏洞(CVE-2015-3269)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22624. This package include changed rules:

new rules:
1. threat[24885]:Adobe LiveCycle Data Services XML External Entity Injection(XXE) Vulnerability(CVE-2015-3269)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22577。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24849]:通达OA任意文件上传漏洞
2. 攻击[24851]:Spring Security OAuth 远程代码执行漏洞(CVE-2016-4977)
3. 攻击[24850]:Jenkins CLI-RMI 反序列化远程代码执行漏洞(CVE-2015-8103)
4. 攻击[24852]:Jenkins-CI 远程代码执行漏洞(CVE-2016-9299,CVE-2017-1000353)
5. 攻击[24854]:Jenkins远程命令执行漏洞(CVE-2018-1000861)
6. 攻击[24855]:Sonatype Nexus Repository Manager EL表达式注入漏洞(CVE-2018-16621)
7. 攻击[24856]:Sonatype Nexus Repository Manager EL表达式注入漏洞(CVE-2020-10199)
8. 攻击[24821]:WSO2 3.1.0 任意文件删除
9. 攻击[24826]:Edimax Technology EW-7438RPn-v3 Mini 1.27 远程代码执行漏洞
10. 攻击[24859]:Jenkins Script Security Plugin沙箱绕过/远程代码执行(CVE-2019-1003005)(CVE-2019-1003029)
11. 攻击[30741]：通达OA无登录获取敏感信息
12. 攻击[24857]: ElasticSearch 动态脚本任意java执行(CVE-2014-3120)
13. 攻击[24860]: Trend Micro Apex One and OfficeScan目录遍历漏洞(CVE-2020-8599)
14. 攻击[24861]: Trend Micro Apex One and OfficeScan目录遍历漏洞(CVE-2020-8470)
15. 攻击[24862]:SaltStack远程命令执行漏洞(CVE-2020-11651)
16. 攻击[24863]:SaltStack目录遍历漏洞(CVE-2020-11652)
17. 应用:eyou-mail


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22577. This package include changed rules:

new rules:
1. threat[24849]:TongDa OA arbitrary file upload vulnerability
2. threat[24851]:Spring Security OAuth remote code execution vulnerability (CVE-2016-4977)
3. threat[24850]:Jenkins CLI-RMI Java Deserialization(CVE-2015-8103)
4. threat[24852]:Jenkins-CI Remote Code Execution Vulnerability(CVE-2016-9299,CVE-2017-1000353)
5. threat[24854]:Jenkins Remote Command Execution Vulnerability(CVE-2018-1000861)
6. threat[24855]:Sonatype Nexus Repository Manager EL Expression Injection Vulnerability (CVE-2018-16621)
7. threat[24856]:Sonatype Nexus Repository Manager EL Expression Injection Vulnerability (CVE-2020-10199)
8. threat[24821]:WSO2 3.1.0 Arbitrary File Delete
9. threat[24826]:Edimax Technology EW-7438RPn-v3 Mini 1.27 Remote Code Execution Vulnerability
10. threat[24859]:Jenkins ACL Bypass and Metaprogramming RCE(CVE-2019-1003005)(CVE-2019-1003029)
11. threat[30741]:Access OA Without Login To Obtain Sensitive Information
12. threat[24857]:ElasticSearch Dynamic Script Arbitrary Java Execution(CVE-2014-3120)
13. threat[24860]:Trend Micro Apex One and OfficeScan Directory Traversal Vulnerability(CVE-2020-8599)
14. threat[24861]:Trend Micro Apex One and OfficeScan Directory Traversal Vulnerability(CVE-2020-8470)
15. threat[24862]:SaltStack Remote Command Execution Vulnerability(CVE-2020-11651)
16. threat[24863]:SaltStack Directory Traversal Vulnerability(CVE-2020-11652)
17. app:eyou-mail


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22558。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24831]:Subex ROC Partner Settlement 不安全的直接对象引用漏洞(CVE-2020-9384)
2. 攻击[24668]:Citrix ADC&NetScaler远程命令执行漏洞(CVE-2019-19781)
3. 攻击[24833]:CentOS web面板认证系统命令注入漏洞（CVE-2018-18322）
4. 攻击[30740]:CentOS Web Panel 0.9.8.480 本地文件包含(CVE-2018-18223)
5. 攻击[24834]:Discuz7.x discuzcode.func.php远程代码执行漏洞
6. 攻击[24835]:Discuz! ML远程代码执行漏洞(CVE-2019-13956)
7. 攻击[24836]:Drupal RESTWS Module 7.x PHP 远程代码执行漏洞
8. 攻击[24837]:Drupal CODER Module 远程代码执行漏洞
9. 攻击[24839]:php上传文件绕过
10. 攻击[24840]:jboss反序列化漏洞(CVE-2017-7504)
11. 攻击[24838]:Discuz!X /utility/convert/index.php远程代码执行漏洞
12. 攻击[24841]:Jboss未授权访问漏洞(CVE-2010-0738)
13. 攻击[24843]:phpcms 2008远程代码执行漏洞
14. 攻击[24844]:Dell SonicWALL Scrutinizer q参数SQL注入漏洞
15. 攻击[24845]:Oxwall1.7.0代码执行漏洞
16. 攻击[24846]:phpcms2008 代码注入漏洞


更新规则:
1. 攻击[24255]:Web服务远程命令执行攻击
2. 攻击[24627]:dedecms sys_verifies.php远程代码执行漏洞(CVE-2018-9174)
3. 攻击[24375]:ThinkPHP5 5.0.23 远程代码执行漏洞
4. 攻击[41704]:Windows CMD命令行反向连接
5. 应用:ftp



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22558. This package include changed rules:

new rules:
1. threat[24831]:Subex ROC Partner Settlement Insecure Direct Object Reference (IDOR) Vulnerability(CVE-2020-9384)
2. threat[24668]:Citrix ADC & NetScaler Remote Command Execution Vulnerability (CVE-2019-19781)
3. threat[24833]:CentOS Web Panel Authenticated OS Command Injection
4. threat[30740]:CentOS Web Panel 0.9.8.480 Local File Inclusion(CVE-2018-18223)
5. threat[24834]:Discuz7.x discuzcode.func.php RCE Vulnerability
6. threat[24835]:Discuz! ML RCE Vulnerability (CVE-2019-13956)
7. threat[24836]:Drupal RESTWS Module 7.x PHP Remote Code Execution Vulnerability
8. threat[24837]:Drupal CODER Module Remote Command Execution Vulnerability
9. threat[24839]:php upload file bypass
10. threat[24840]:jboss deserialization vulnerability(CVE-2017-7504)
11. threat[24838]:Discuz!X /utility/convert/index.php Remote Code Execution Vulnerability
12. threat[24841]:Jboss Unauthorized Access Vulnerability (CVE-2010-0738)
13. threat[24843]:phpcms 2008 remote code execution vulnerability
14. threat[24844]:Dell SonicWALL Scrutinizer q parameter SQL injection vulnerability
15. threat[24845]:Oxwall 1.7.0 code execution vulnerability
16. threat[24846]:phpcms2008 code injection vulnerability


update rules:
1. threat[24255]:Web Service Remote Command Execution Attack
2. threat[24627]:dedecms sys_verifies.php Remote Code Execution Vulnerability (CVE-2018-9174)
3. threat[24375]:ThinkPHP5 5.0.23 Remote Code Execution Vulnerability
4. threat[41704]:Windows CMD Command Line Reverse Connect
5. app:ftp



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22459。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24824]:Oracle WebLogic Server 服务器端请求伪造(SSRF)漏洞(CVE-2014-4210)
2. 攻击[41753]:恶意程序linux/nemesis_a网络通信
3. 攻击[41755]:恶意程序Windows/Mozart网络通信
4. 攻击[24825]:Exim base64d()函数缓冲区溢出漏洞(CVE-2018-6789)
5. 攻击[24822]:Wordpress Plugin Media Library Assistant 2.81 本地文件包含

更新规则:
1. 攻击[62960]:phpLDAPadmin "functions.php"远程PHP代码注入漏洞
2. 攻击[24671]:Weblogic WLS 组件 IIOP 协议远程代码执行漏洞(CVE-2020-2551)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22459. This package include changed rules:

new rules:
1. threat[24824]:Oracle WebLogic Server Server-Side Request Forgery(SSRF) Vulnerability(CVE-2014-4210)
2. threat[41753]:Malicious program linux / nemesis_a network communication
3. threat[41755]:Malicious program Windows / Mozart network communication
4. threat[24825]:Exim base64d() Function Buffer Overflow(CVE-2018-6789)
5. threat[24822]:Wordpress Plugin Media Library Assistant 2.81 Local File Inclusion

update rules:
1. threat[62960]:phpLDAPadmin PHP Code Injection Vulnerability
2. threat[24671]:Weblogic WLS component IIOP protocol remote code execution vulnerability(CVE-2020-2551)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22420。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41739]:WannaRen勒索病毒传输通信
2. 攻击[41740]:恶意木马劫持深信服SSL VPN升级程序SangforUD.exe
3. 攻击[41741]:Cobalt Strike渗透攻击工具Beacon HTTPS通信
4. 攻击[30738]:Jinfornet Jreport 15.6 无需认证的目录遍历漏洞
5. 攻击[24812]:NVMS-9000 camera 远程代码执行漏洞
6. 攻击[24813]:Eir D1000路由器远程代码执行漏洞
7. 攻击[24814]:HPE智能管理中心ViewBatchTaskResultDetailBean语言注入漏洞(CVE-2019-5386)
8. 攻击[41742]:恶意程序Windows/VIDAR_a窃密木马网络通信
9. 攻击[24816]:rConfig Network Device Configuration Tool ajaxAddTemplate.php命令注入(CVE-2020-10221)
10. 攻击[41743]:恶意程序Windows/RevengeRAT远控木马网络通信
11. 攻击[41744]:恶意程序Windows/ParasiteStealer窃密木马网络通信
12. 攻击[41745]:恶意程序Windows/VTFLOODER远控木马网络通信
13. 攻击[41747]:恶意程序Raudotek僵尸木马上线通信
14. 攻击[41748]:恶意程序Windows/NanoCore远控木马网络通信
15. 攻击[41746]:恶意程序Dark_Nexus僵尸网络上线通信
16. 攻击[41750]:恶意程序GoBrut僵尸网络上线通信
17. 攻击[41751]:恶意程序AutoitPredator僵尸网络上线通信
18. 攻击[24817]:NagiosXI 5.6.11 address 远程代码执行漏洞
19. 攻击[24818]:Symantec Web Gateway 5.0.2.8 远程代码执行漏洞
20. 攻击[30739]:Cisco Small Business RV320和RV325信息泄露漏洞(CVE-2019-1653)
21. 攻击[24819]:Zen Load Balancer 3.10.1 目录遍历漏洞
22. 攻击[41752]:恶意程序FYHHOS僵尸网络上线通信
23. 攻击[24820]:Webtateas 2.0 任意文件读取
24. 攻击[24822]:Wordpress Plugin Media Library Assistant 2.81 本地文件包含
25. 攻击[24823]:MVPower DVR Shell未授权远程命令执行漏洞

更新规则:
1. 攻击[21374]:Apache Struts远程命令执行漏洞
2. 攻击[24745]:Linear eMerge E3访问控制器命令注入（CVE-2019-7256）
3. 攻击[24203]:ESF pfSense system_groupmanager.php命令注入漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22420. This package include changed rules:

new rules:
1. threat[41739]:WannaRen ransomware transmission communication
2. threat[41740]:Malicious Trojan Hijacking Sangfor SSL VPN Update Program SangforUD.exe
3. threat[41741]:Penetration Test Tool Cobalt Strike Beacon HTTPS Communication
4. threat[30738]:Jinfornet Jreport 15.6 Unauthenticated Directory Traversal Vulnerability
5. threat[24812]:NVMS-9000 camera remote code execution vulnerability
6. threat[24813]:Eir D1000 router remote code execution vulnerability
7. threat[24814]:HPE Intelligent Management Center ViewBatchTaskResultDetailBean Language Injection Vulnerability(CVE-2019-5386)
8. threat[41742]:Malware Windows/VIDAR_a Stealth Trojan Network Communication
9. threat[24816]:rConfig Network Device Configuration Tool ajaxAddTemplate.php Command Injection(CVE-2020-10221)
10. threat[41743]:Malware Windows/RevengeRAT Remote Control Trojan Network Communication
11. threat[41744]:Malware Windows/ParasiteStealer Trojan Network Communication
12. threat[41745]:MalwareWindows / VTFLOODER remote control Trojan network communication
13. threat[41747]:Malware Raudotek Zombie Trojan communication
14. threat[41748]:Malware Windows / NanoCore remote control Trojan network communication
15. threat[41746]:Malware Dark_Nexus Botnet Network Communication
16. threat[41750]:Malware GoBrut Botnet Network Communication
17. threat[41751]:Malware AutoitPredator Botnet Network Communication
18. threat[24817]:NagiosXI 5.6.11 address remote code execution vulnerability
19. threat[24818]:Symantec Web Gateway 5.0.2.8 Remote Code Execution
20. threat[30739]:Cisco Small Business RV320 and RV325 Information Disclosure Vulnerability(CVE-2019-1653)
21. threat[24819]:Zen Load Balancer 3.10.1 directory traversal vulnerability
22. threat[41752]:Malware FYHHOS Botnet Network Communication
23. threat[24820]:Webtateas 2.0 Arbitrary File Read
24. threat[24822]:Wordpress Plugin Media Library Assistant 2.81 Local File Inclusion
25. threat[24823]:MVPower DVR Shell Unauthenticated Command Execution

update rules:
1. threat[21374]:Apache Struts Remote Command Execution Vulnerability
2. threat[24745]:Linear eMerge E3 Access Controller Command Injection(CVE-2019-7256)
3. threat[24203]:ESF pfSense system_groupmanager.php Command Injection Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22340。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24802]:WiKID 2FA企业服务器 groups.js 跨站脚本攻击(CVE-2019-17116)
2. 攻击[24768]:Centreon formMibs.php 代码注入漏洞
3. 攻击[24803]:Cisco Data Center Network Manager importTS 命令注入漏洞(CVE-2019-15979)
4. 攻击[24804]:Cisco Data Center Network Manager createLanFabric 命令注入漏洞（CVE-2019-15978）
5. 攻击[24805]:HPE IMC ForwardRedirect表达式语言注入漏洞
6. 攻击[24806]:Microsoft SharePoint Server存储型跨站脚本攻击漏洞（CVE-2020-0693）
7. 攻击[24807]:WordPress 10Web Photo Gallery Plugin存储型跨站脚本攻击漏洞（CVE-2020-9335）
8. 攻击[50586]:网络爬虫头条抓取网页信息
9. 攻击[50587]:网络爬虫Bing抓取网页信息
10. 攻击[50588]:网络爬虫Moz抓取网页信息
11. 攻击[50589]:网络爬虫神马搜索抓取网页信息
12. 攻击[24808]:OpenDreamBox 2.0.0 Plugin WebAdmin 命令注入漏洞
13. 攻击[24809]:Joomla! com_fabrik 3.9.11目录遍历漏洞
14. 攻击[24810]:Zen Load Balancer 3.10.1 命令注入漏洞（CVE-2019-7301）
15. 攻击[24811]:Apache Solr Velocity远程代码执行漏洞（CVE-2019-17558）
16. 攻击[41738]:Cobalt Strike渗透攻击工具Beacon HTTP通信

更新规则:
1. 攻击[24309]:Apache ActiveMQ Fileserver文件上传目录遍历漏洞(CVE-2016-3088)
2. 攻击[23725]:应用服务器glassfish任意文件读取漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22340. This package include changed rules:

new rules:
1. threat[24802]:WiKID 2FA Enterprise Server groups.jsp Cross-Site Scripting(CVE-2019-17116)
2. threat[24768]:Centreon formMibs.php Command Injection Vulnerability
3. threat[24803]:Cisco Data Center Network Manager importTS Command Injection(CVE-2019-15979)
4. threat[24804]:Cisco Data Center Network Manager createLanFabric Command Injection Vulnerability (CVE-2019-15978)
5. threat[24805]:HPE IMC ForwardRedirect Expression Language Injection Vulnerability
6. threat[24806]:Microsoft SharePoint Server Stored Cross-Site Scripting Vulnerability(CVE-2020-0693)
7. threat[24807]:WordPress 10Web Photo Gallery Plugin Stored Cross-Site Scripting Vulnerability(CVE-2020-9335)
8. threat[50586]:Web Crawlers Toutiao Capture Page Information
9. threat[50587]:Web Crawlers Bing Capture Page Information
10. threat[50588]:Web Crawlers Moz Capture Page Information
11. threat[50589]:Web Crawlers Shenma Capture Page Information
12. threat[24808]:OpenDreamBox 2.0.0 Plugin WebAdmin command injection vulnerability
13. threat[24809]:Joomla! Com_fabrik 3.9.11 directory traversal vulnerability
14. threat[24810]:Zen Load Balancer 3.10.1 Command Injection Vulnerability (CVE-2019-7301)
15. threat[24811]:Apache Solr Velocity Remote Code Execution Vulnerability (CVE-2019-17558)
16. threat[41738]:Penetration Test Tool Cobalt Strike Beacon HTTP Communication

update rules:
1. threat[24309]:Apache ActiveMQ Fileserver File Upload Directory Traversal Vulnerability(CVE-2016-3088)
2. threat[23725]:Application server Glassfish Directory Traversal Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22284。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24797]:PHPUnit 远程代码执行漏洞(CVE-2017-9841)
2. 攻击[24798]:uftpd FTP服务器PORT命令处理栈缓冲区溢出漏洞(CVE-2020-5204)
3. 攻击[24799]:WiKID Systems 2FA Enterprise Server 跨站脚本漏洞(CVE-2019-17120)
4. 攻击[24800]:FIBARO System Home Center 5.021 远程文件包含漏洞
5. 攻击[24801]:Cisco Data Center Network Manager reportTemplateUploadPolicy 路径遍历漏洞(CVE-2019-15980)

更新规则:
1. 攻击[24757]:Oracle Coherence反序列化远程代码执行漏洞（CVE-2020-2555）


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22284. This package include changed rules:

new rules:
1. threat[24797]:PHPUnit Remote Code Execution Vulnerability(CVE-2017-9841)
2. threat[24798]:uftpd FTP Server PORT Command Handling Stack Buffer Overflow Vulnerability(CVE-2020-5204)
3. threat[24799]:WiKID 2FA Enterprise Server Cross-Site Scripting Vulnerability(CVE-2019-17120)
4. threat[24800]:FIBARO System Home Center 5.021 Remote File Include Vulnerability
5. threat[24801]:Cisco Data Center Network Manager reportTemplateUploadPolicy Directory Traversal Vulnerability(CVE-2019-15980)

update rules:
1. threat[24757]:Oracle Coherence Deserialization Remote Code Execution Vulnerability (CVE-2020-2555)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22245。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24769]:Sangoma Asterisk manager.c 命令执行漏洞(CVE-2019-18610)
2. 攻击[24770]:Cisco Data Center Network Manager getLicenses SQL 注入漏洞(CVE-2019-15984)
3. 攻击[30736]:Cisco Data Center Network Manager getRestoreLog 目录遍历漏洞(CVE-2019-15980)
4. 攻击[30737]:Cisco Data Center Network Manager saveLicenseFileToServer 目录遍历漏洞(CVE-2019-15980)
5. 攻击[24767]:Oracle E-Business Suite Human Resources SQL注入漏洞(CVE-2020-2586)
6. 攻击[24771]:PHPStudy Backdoor 远程代码执行漏洞
7. 攻击[24772]:ASUS RT-N10+ 2.0.3.4代码执行漏洞
8. 攻击[24773]:Gila CMS deleteAction本地文件包含漏洞（CVE-2020-5513）
9. 攻击[24774]:Advantech WISE-PaaS RMM WechatSignin wechattokenlogin 外部实体注入漏洞(CVE-2019-18227)
10. 攻击[24775]:HPE IMC TvxlanLegendBean表达式语言注入漏洞
11. 攻击[24777]:Squid Proxy HTTP Host缓冲区溢出漏洞(CVE-2020-8450)
12. 攻击[24778]:Netlink GPON Router 1.0.11 R远程代码执行漏洞
13. 攻击[24779]:Exploit Horde Groupware Webmail Edition 5.2.22 远程代码执行漏洞（CVE-2020-8518）
14. 攻击[24780]:Exploit Phoenix Contact TC Router / TC Cloud Client 命令注入漏洞 （CVE-2020-9436）
15. 攻击[24785]:PHPMoAdmin 1.1.2 远程代码执行漏洞（CVE-2015-2208）
16. 攻击[24786]:Joomla! SQL注入漏洞(CVE-2015-7297)
17. 攻击[24784]:Western Digital MyCloud PR4100 Web管理组件安全漏洞(CVE-2017-17560
18. 攻击[24787]:Axis网络摄像头 .srv 远程代码执行漏洞 (CVE-2018-10660)
19. 攻击[24788]:Drupal OpenID外部实体注入(CVE-2012-4554)
20. 攻击[24789]:Joomla未授权创建用户漏洞（CVE-2016-8870）
21. 攻击[41736]:隐藏眼镜蛇– Joanap后门木马通信
22. 攻击[50584]:网络爬虫抓取网页信息
23. 攻击[24790]:PHPKB Multi-Language 9 授权目录遍历漏洞（CVE-2020-10387）
24. 攻击[24791]:rConfig 3.9 SQL注入漏洞（CVE-2020-10220）
25. 攻击[24792]:PHPKB Standard Multi-Language 9 远程代码执行漏洞(CVE-2020-10386)
26. 攻击[24793]:Centreon Poller 授权远程代码执行漏洞
27. 攻击[24794]:通达OA任意文件包含漏洞

更新规则:
1. 攻击[24740]:OpenSMTPD 6.6.2远程执行代码（CVE-2020-7247）
2. 攻击[23695]:Apache Struts2 多个安全漏洞
3. 攻击[24250]:Drupal核心远程代码执行漏洞
4. 攻击[24671]:Weblogic WLS 组件 IIOP 协议远程代码执行漏洞(CVE-2020-2551
5. 攻击[22703]:phpMyAdmin preg_replace() 远程PHP代码执行


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22245. This package include changed rules:

new rules:
1. threat[24769]:Sangoma Asterisk manager.c Command Execution Vulnerability(CVE-2019-18610)
2. threat[24770]:Cisco Data Center Network Manager getLicenses SQL Injection Vulnerability(CVE-2019-15984)
3. threat[30736]:Cisco Data Center Network Manager getRestoreLog Directory Traversal Vulnerability(CVE-2019-15980)
4. threat[30737]:Cisco Data Center Network Manager saveLicenseFileToServer Directory Traversal(CVE-2019-15980)
5. threat[24767]:Oracle E-Business Suite Human Resources SQL Injection(CVE-2020-2586)
6. threat[24771]:PHPStudy Backdoor Remote Code Execution Vulnerability
7. threat[24772]:ASUS RT-N10+ 2.0.3.4 Command Execution Vulnerability
8. threat[24773]:Gila CMS deleteAction Local File InclusionVulnerability(CVE-2020-5513)
9. threat[24774]:Advantech WISE-PaaS RMM WechatSignin wechattokenlogin External Entity Injection(CVE-2019-18227)
10. threat[24775]:HPE IMC TvxlanLegendBean Expression Language Injection Vulnerability
11. threat[24777]:Squid Proxy HTTP Host Buffer Overflow Vulnerability(CVE-2020-8450)
12. threat[24778]:Netlink GPON Router 1.0.11 R Remote Code Execution Vulnerability
13. threat[24779]:Exploit Horde Groupware Webmail Edition 5.2.22 Remote Code Execution Vulnerability (CVE-2020-8518)
14. threat[24780]:Exploit Phoenix Contact TC Router / TC Cloud Client Command Injection Vulnerability (CVE-2020-9436)
15. threat[24785]:PHPMoAdmin 1.1.2 Remote Code Execution Vulnerability (CVE-2015-2208))
16. threat[24786]:Joomla! SQL Injection Vulnerability(CVE-2015-7297)
17. threat[24784]:Western Digital MyCloud PR4100 Web Management Component Security Vulnerability (CVE-2017-17560)
18. threat[24787]:Axis Network Camera - .srv to parhand Remote Code Execution(CVE-2018-10660)
19. threat[24788]:Drupal OpenID External Entity Injection(CVE-2012-4554)
20. threat[24789]:Joomla no authorized to create a user vulnerability (CVE-2016-8870)
21. threat[41736]:HIDDEN COBRA – Joanap Backdoor Trojan Connection
22. threat[50584]:Web crawler crawls web page information
23. threat[24790]:PHPKB Multi-Language 9 Authorized Directory Traversal Vulnerability (CVE-2020-10387)
24. threat[24791]:rConfig 3.9 SQL Injection Vulnerability (CVE-2020-10220)
25. threat[24792]:PHPKB Standard Multi-Language 9 Remote Code Execution Vulnerability(CVE-2020-10386)
26. threat[24793]:Centreon Poller Authorizes Remote Code Execution Vulnerability
27. threat[24794]:Tongda OA Arbitrary File Contains Vulnerability

update rules:
1. threat[24740]:OpenSMTPD 6.6.2 Remote Code Execution(CVE-2020-7247)
2. threat[23695]:Apache Struts2 Multiple Security Vulnerability
3. threat[24250]:Drupal Core Remote Code Execution Vulnerability
4. threat[24671]:Weblogic WLS component IIOP protocol remote code execution vulnerability(CVE-2020-2551)
5. threat[22703]:phpMyAdmin 3.5.8 and 4.0.0-RC2 -Remote Code Execution via preg_replace()


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22166。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24759]:Virtual Freer 1.58 远程代码执行漏洞
2. 攻击[24761]:HomeAutomation 3.3.2 远程代码执行漏洞
3. 攻击[24762]:Voyager 1.3.0 目录遍历漏洞
4. 攻击[24760]:Apache ShardingSphere UI YAML解析远程代码执行漏洞(CVE-2020-1947)
5. 攻击[24763]:Microsoft SMBv3远程代码执行漏洞(CVE-2020-0796)
6. 攻击[41735]:恶意程序恶性木马下载器“幽虫”网络通信
7. 攻击[24764]:Nagios XI 经过授权的任意文件上传漏洞
8. 攻击[24765]:Wordpress Plugin Search Meter 2.13.2 CSV 注入漏洞
9. 攻击[24766]:Sysaid 20.1.11 b26 未授权任意文件上传漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22166. This package include changed rules:

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22151. This package include changed rules:

new rules:
1. threat[24759]:Virtual Freer 1.58 Remote Code Execution Vulnerability
2. threat[24761]:HomeAutomation 3.3.2 Remote Code Execution Vulnerability
3. threat[24762]:Voyager 1.3.0 directory traversal vulnerability
4. threat[24760]:Apache ShardingSphere UI YAML Parse Remote Code Execution Vulnerability(CVE-2020-1947)
5. threat[24763]:Microsoft SMBv3 Remote Code Execution Vulnerability(CVE-2020-0796)
6. threat[41735]:Malicious program Trojan downloader "Phantom" network communication
7. threat[24764]:Nagios XI authorized arbitrary file upload vulnerability
8. threat[24765]:Wordpress Plugin Search Meter 2.13.2 CSV injection vulnerability
9. threat[24766]:Sysaid 20.1.11 b26 Unauthorized arbitrary file upload vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22154。该升级包新增/改进的规则有:


新增规则:
1. 攻击[24763]:Microsoft SMBv3远程代码执行漏洞(CVE-2020-0796)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22154. This package include changed rules:


new rules:
1. threat[24763]:Microsoft SMBv3 Remote Code Execution Vulnerability(CVE-2020-0796)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22137。该升级包新增/改进的规则有:

新增规则:
1. 攻击[10503]:Siemens Desigo PX 6.00 拒绝服务漏洞(CVE-2019-13927)
2. 攻击[30734]:东阳媒体DM-AP240T / W无线接入点远程配置泄漏
3. 攻击[24746]:eWON Flexy 13.0路由器身份验证绕过漏洞
4. 攻击[49039]:恶意程序LiquorBot网络通信
5. 攻击[41733]:恶意程序Oski Stealer网络通信
6. 攻击[30735]:iSee Hybrid QDVR WH-H4 1.03R / 2.0.0.P（get_jpeg）流泄漏漏洞
7. 攻击[24747]:LibreNMS Collected 命令注入漏洞(CVE-2019-10669)
8. 攻击[24748]:OctoberCMS上传保护绕过代码执行漏洞(CVE-2017-1000119)
9. 攻击[24750]:FreeSWITCH 1.10.1 命令执行漏洞
10. 攻击[41734]:Qakbot僵尸网络恶意行为通信
11. 攻击[24751]:TP-Link TL-WR849N 认证绕过漏洞(CVE-2019-19143)
12. 攻击[24752]:Net-SNMPd Write Access SNMP-EXTEND-MIB 任意代码执行漏洞
13. 攻击[24753]:Linear eMerge E3 1.00-06 目录遍历漏洞(CVE-2019-7254)
14. 攻击[24754]:UniSharp Laravel File Manager 2.0.0 任意文件读取漏洞
15. 攻击[24755]:RICOH Aficio SP 5200S HTML注入漏洞
16. 攻击[24756]:Google Chrome 80 JSCreate类型混淆漏洞（CVE-2020-6418）
17. 攻击[24757]:Oracle Coherence反序列化远程代码执行漏洞（CVE-2020-2555）
18. 攻击[24758]:ThinkCMF框架任意文件包含漏洞

更新规则:
1. 攻击[23833]:phpMyAdmin远程代码执行漏洞(CVE-2016-5734)
2. 攻击[24749]:医院管理系统4.0持久性跨站点脚本攻击漏洞(CVE-2020-5191)
3. 攻击[24741]:D-Link DIR-859未经身份验证的远程命令执行(CVE-2019-17621)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22137. This package include changed rules:

new rules:
1. threat[10503]:Siemens Desigo PX 6.00 Denial Of Service(CVE-2019-13927)
2. threat[30734]:Dongyoung Media DM-AP240T/W Wireless Access Point Remote Configuration Disclosure
3. threat[24746]:eWON Flexy 13.0 Router Authentication Bypass
4. threat[49039]:Malware LiquorBot Network Communication
5. threat[41733]:Malware Oski Stealer Network Communication
6. threat[30735]:iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure
7. threat[24747]:LibreNMS Collected Command Injection Vulnerability(CVE-2019-10669)
8. threat[24748]:OctoberCMS Upload Protection Bypass Code Execution Vulnerability(CVE-2017-1000119)
9. threat[24750]:FreeSWITCH 1.10.1Command Execution Vulnerability
10. threat[41734]:Qakbot Botnet Malicious Communicate Behavior
11. threat[24751]:TP-Link TL-WR849N Authentication Bypass Vulnerability(CVE-2019-19143)
12. threat[24752]:Net-SNMPd Write Access SNMP-EXTEND-MIB Arbitrary Code Execution Vulnerability
13. threat[24753]:Linear eMerge E3 1.00-06 Directory Traversal Vulnerability(CVE-2019-7254)
14. threat[24754]:UniSharp Laravel File Manager 2.0.0 Arbitrary File Read Vulnerability
15. threat[24755]:RICOH Aficio SP 5200S HTML Injection Vulnerability
16. threat[24756]:Google Chrome 80 JSCreate Side-effect Type Confusion Vulnerability(CVE-2020-6418)
17. threat[24757]:Oracle Coherence Deserialization Remote Code Execution Vulnerability (CVE-2020-2555)
18. threat[24758]:ThinkCMF Framework Arbitrary File Inclusion Vulnerability

update rules:
1. threat[23833]:phpMyAdmin Remote Code Execution Vulnerability(CVE-2016-5734)
2. threat[24749]:Hospital Management System 4.0 Persistent Cross-Site Scripting Vulnerability(CVE-2020-5191)
3. threat[24741]:D-Link DIR-859 Unauthenticated Remote Command Execution(CVE-2019-17621)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22068。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24730]:The ZyXEL P660HN-T1A v1未授权命令注入漏洞（CVE-2017-18368）
2. 攻击[24731]:The ZyXEL P660HN-T1A v2授权命令注入漏洞（CVE-2017-18370）
3. 攻击[24732]:TrueOnline Billion 5200W-T 1.02b未授权命令注入漏洞（CVE-2017-18369）
4. 攻击[24733]:The Billion 5200W-T TCLinux授权命令注入漏洞（CVE-2017-18372）
5. 攻击[24734]:Netgear Devices 3.5.5.0 之前版本未授权命令注入漏洞（CVE-2016-1555）
6. 攻击[24735]:NETGEAR DGN2200v1/v2/v3/v4 授权命令注入漏洞（CVE-2017-6077）
7. 攻击[24736]:NETGEAR DGN2200 10.0.0.50 授权命令执行漏洞（CVE-2017-6334）
8. 攻击[24737]:NUUO NVRMini2 3.9.1授权命令注入漏洞（CVE-2018-15716）
9. 攻击[24738]:Freelance Management App v1.0.0任意文件下载漏洞（CVE-2020-5505）
10. 攻击[24739]:Apache James Server 2.3.2不安全的用户创建/任意文件写入（CVE-2015-7611）
11. 攻击[24740]:OpenSMTPD 6.6.2远程执行代码（CVE-2020-7247）
12. 攻击[24742]:Liferay CE Portal 6.0.2 远程代码执行漏洞
13. 攻击[24743]:Netis WF2419 V1.2.31805，V2.2.36123授权命令注入漏洞（CVE-2019-19356）
14. 攻击[24744]:Comtrend VR-3033 授权命令执行漏洞

更新规则:
1. 攻击[24729]:Microsoft Exchange Server远程代码执行漏洞(CVE-2020-0688)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22068. This package include changed rules:

new rules:
1. threat[24730]:The ZyXEL P660HN-T1A v1 Unauthorized Command Injection Vulnerability (CVE-2017-18368)
2. threat[24731]:The ZyXEL P660HN-T1A v2 Authorized Command Injection Vulnerability (CVE-2017-18370)
3. threat[24732]:TrueOnline Billion 5200W-T 1.02b Unauthorized Command Injection Vulnerability (CVE-2017-18369)
4. threat[24733]:The Billion 5200W-T TCLinux Authorized Command Injection Vulnerability (CVE-2017-18372)
5. threat[24734]:Netgear Devices Prior to 3.5.5.0 Unauthorized Command Injection Vulnerability (CVE-2016-1555)
6. threat[24735]:NETGEAR DGN2200v1 / v2 / v3 / v4 Authorized Command Injection Vulnerability (CVE-2017-6077)
7. threat[24736]:NETGEAR DGN2200 10.0.0.50 Authorized Command Execution Vulnerability (CVE-2017-6334)
8. threat[24737]:NUUO NVRMini2 3.9.1 Authorized Command Injection Vulnerability (CVE-2018-15716)
9. threat[24738]:Freelance Management App v1.0.0 Arbitrary File Download Vulnerablity(CVE-2020-5505)
10. threat[24739]:Apache James Server 2.3.2 Insecure User Creation / Arbitrary File Write(CVE-2015-7611)
11. threat[24740]:OpenSMTPD 6.6.2 Remote Code Execution(CVE-2020-7247)
12. threat[24742]:Liferay CE Portal 6.0.2 Remote Code Execution Vulnerability
13. threat[24743]:Netis WF2419 V1.2.31805, V2.2.36123 Authorized Command Injection Vulnerability (CVE-2019-19356)
14. threat[24744]:Comtrend VR-3033 Authorized Command Execution Vulnerability

update rules:
1. threat[24729]:Microsoft Exchange Server Remote Code Execution Vulnerability(CVE-2020-0688)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.22014。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24721]:Axis SSI 远程代码执行漏洞
2. 攻击[24720]:Microsoft Office SharePoint存储型跨站脚本攻击(CVE-2019-1070)
3. 攻击[24722]:FLIR Thermal Camera FC-S/PT 命令注入漏洞
4. 攻击[24724]:D-Link DGS-1250 头部注入漏洞
5. 攻击[30733]:LabVantage 8.3 信息泄露漏洞
6. 攻击[24725]:jackson-databind JNDI注入远程代码执行漏洞(CVE-2020-8840)
7. 攻击[24708]:Prima Access Control 2.3.35经python脚本上传漏洞(CVE-2019-9189)
8. 攻击[24709]:IBM RICOH 6400 打印机代码注入漏洞
9. 攻击[24710]:OpenEMR New.php 命令注入漏洞(CVE-2019-3968)
10. 攻击[24713]:GilaCMS 认证用户本地文件包含漏洞(CVE-2019-16679)
11. 攻击[24712]:Netcore NW710 登录权限绕过
12. 攻击[24714]:ASUS DSL-N12E_C1 1.1.2.3_345 远程代码执行漏洞
13. 攻击[24715]:FusionPBX exec.php 文件命令执行漏洞
14. 攻击[24716]:Online Course Registration 2.0 远程代码执行漏洞
15. 攻击[24717]:EyesOfNetwork 5.3 SQL注入漏洞（CVE-2020-8656）
16. 攻击[24718]:EyesOfNetwork 5.3 远程代码执行漏洞（CVE-2020-8654）
17. 攻击[24726]:Cacti 1.2.8 任意os命令执行漏洞（CVE-2020-8813）
18. 攻击[24727]:Advantech WISE-PaaS RMM UpgradeMgmt upload_ota 任意文件上传漏洞
19. 攻击[24728]:Avaya Aura Communication Manager 5.2 远程代码执行漏洞
20. 攻击[24729]:Microsoft Exchange Server远程代码执行漏洞(CVE-2020-0688)

更新规则:
1. 攻击[24668]:Citrix ADC&NetScaler远程命令执行漏洞(CVE-2019-19781)
2. 攻击[24702]:LG SuperSign CMS 2.5 远程代码执行漏洞（CVE-2018-17173）
3. 攻击[24611]:Apache Flink Dashboard 未授权访问-远程代码命令执行
4. 攻击[24308]:Apache Solr/LuceneXML远程命令执行漏洞（RCE）(CVE-2017-12629)
5. 攻击[24599]:RConfig v3.9.2未授权RCE漏洞
6. 攻击[24654]:rConfig search.crud.php 命令注入漏洞(CVE-2019-16663)
7. 攻击[41604]:恶意程序windows/Ramnit_a网络通信
8. 攻击[30732]:HPE智能管理中心dbman命令信息泄露(CVE-2019-5392)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.22014. This package include changed rules:


new rules:
1. threat[24721]:Axis SSI Remote Code Execution Vulnerability
2. threat[24720]:Microsoft Office SharePoint Stored Cross-site Scripting(CVE-2019-1070)
3. threat[24722]:FLIR Thermal Camera FC-S / PT command injection vulnerability
4. threat[24724]:D-Link DGS-1250 Header Injection Vulnerability
5. threat[30733]:LabVantage 8.3 Information Disclosure
6. threat[24725]:jackson-databind JNDI Injection Remote Code Execution Vulnerability(CVE-2020-8840)
7. threat[24708]:Prima Access Control 2.3.35 Authenticated Python Script Upload Root RCE(CVE-2019-9189)
8. threat[24709]:IBM RICOH 6400 Printer Code Injection Vulnerability
9. threat[24710]:OpenEMR New.php Command Injection Vulnerability(CVE-2019-3968)
10. threat[24713]:GilaCMS Authenticated Local File Inclusion(LFI) (CVE-2019-16679)
11. threat[24712]:Netcore NW710 login permission bypass
12. threat[24714]:ASUS DSL-N12E_C1 1.1.2.3_345 remote code execution vulnerability
13. threat[24715]:FusionPBX Command exec.php Command Execution Vulnerability
14. threat[24716]:Online Course Registration 2.0 Remote Code Execution Vulnerability
15. threat[24717]:EyesOfNetwork 5.3 SQL Injection Vulnerability (CVE-2020-8656)
16. threat[24718]:EyesOfNetwork 5.3 Remote Code Execution Vulnerability (CVE-2020-8654)
17. threat[24726]:Cacti 1.2.8 Arbitrary OS Command Execution Vulnerability (CVE-2020-8813)
18. threat[24727]:Advantech WISE-PaaS RMM UpgradeMgmt upload_ota Arbitrary File Upload Vulnerability
19. threat[24728]:Avaya Aura Communication Manager 5.2 Remote Code Execution vulnerability
20. threat[24729]:Microsoft Exchange Server Remote Code Execution Vulnerability(CVE-2020-0688)

update rules:
1. threat[24668]:Citrix ADC & NetScaler Remote Command Execution Vulnerability (CVE-2019-19781)
2. threat[24702]:LG SuperSign CMS 2.5 Remote Code Execution Vulnerability (CVE-2018-17173)
3. threat[24611]:Apache Flink Dashboard Unauthorized Access - Remote Code Command Execution
4. threat[24308]:Apache Solr/LuceneXML Remote Command Execution Vulnerability (RCE) (CVE-2017-12629)
5. threat[24599]:RConfig v3.9.2 unauthorized RCE vulnerability
6. threat[24654]:rConfig search.crud.php Command Injection(CVE-2019-16663)
7. threat[41604]:Malicious program windows/Ramnit_a network communication
8. threat[30732]:HPE Intelligent Management Center dbman Command Information Disclosure(CVE-2019-5392)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21979。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24719]:Apache Tomcat AJP协议文件包含漏洞(CVE-2020-1938)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21979. This package include changed rules:

new rules:
1. threat[24719]:Apache Tomcat AJP Protocol File Inclusion Vulnerability(CVE-2020-1938)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21943。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24707]:LearnDash WordPress LMS Plugin 3.1.2 - Reflective 跨站脚本攻击漏洞（CVE-2020-7108）
2. 攻击[30728]:ELOG retrieve_url信息泄露漏洞(CVE-2019-3993)
3. 攻击[24706]:HIYU BF430 TCP IP Converter - Stored 跨站脚本攻击漏洞（CVE-2020-8839）
4. 攻击[30727]:Microsoft SharePoint 信息泄漏漏洞(CVE-2019-1443)
5. 攻击[41732]:勒索软件Maktub Locker恶意加密程序下载
6. 攻击[24701]:Xfinity Gateway 命令注入漏洞
7. 攻击[24703]:戴尔KACE K1000远程执行代码漏洞
8. 攻击[24704]:Apache Dubbo反序列化漏洞(CVE-2019-17564)
9. 攻击[24705]:Pandora FMS 7.0 Authenticated 远程代码执行漏洞（CVE-2020-8947）
10. 攻击[24692]:D-Link设备远程命令执行漏洞(CVE-2019-20215)
11. 攻击[30730]:Digitus DN-16048 摄像头远程配置泄露
12. 攻击[24693]:thinkcmf-5.0.190111后台任意文件写入漏洞（CVE-2019-7580）
13. 攻击[24694]:FlameCMS 3.3.5 SQL注入漏洞（CVE-2019-16309）
14. 攻击[24695]:OKLite v1.2.25 任意文件删除漏洞（CVE-2019-16132）
15. 攻击[30731]:Lexmark Services Monitor 2.27.4.0.39 目录遍历漏洞
16. 攻击[24687]:Citrix Application Delivery Controller和网关目录遍历（CVE-2020-19781）
17. 攻击[24696]:HomeAutomation v3.3.2 CSRF 远程命令执行漏洞
18. 攻击[24698]:HomeAutomation 3.3.2 打开重定向漏洞
19. 攻击[24699]:YouPHPTube 7.7 SQL 注入漏洞(CVE-2019-18662)



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21943. This package include changed rules:

new rules:
1. threat[24707]:LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting Vulnerability(CVE-2020-7108)
2. threat[30728]:ELOG retrieve_url Information Disclosure Vulnerability(CVE-2019-3993)
3. threat[24706]:HIYU BF430 TCP IP Converter - Stored Cross-Site Scripting Vulnerability(CVE-2020-8839)
4. threat[30727]:Microsoft SharePoint Information Disclosure Vulnerability(CVE-2019-1443)
5. threat[41732]:Ransomware Maktub Locker Downloading Malicious Encryption Program
6. threat[24701]:Xfinity Gateway command injection vulnerability
7. threat[24703]:Dell KACE K1000 Remote Code Execution Vulnerability
8. threat[24704]:Apache Dubbo Deserialization Vulnerability(CVE-2019-17564)
9. threat[24705]:APandora FMS 7.0 Authenticated Remote Code Execution Vulnerability(CVE-2020-8947)
10. threat[24692]:D-Link Devices Remote Command Execution Vulnerability(CVE-2019-20215)
11. threat[30730]:Digitus DN-16048 Camera Remote Configuration Disclosure
12. threat[24693]:thinkcmf-5.0.190111 background arbitrary file writing vulnerability (CVE-2019-7580)
13. threat[24694]:FlameCMS 3.3.5 SQL Injection Vulnerability (CVE-2019-16309)
14. threat[24695]:OKLite v1.2.25 Arbitrary File Deletion Vulnerability (CVE-2019-16132)
15. threat[30731]:Lexmark Services Monitor 2.27.4.0.39 Directory Traversal
16. threat[24687]:Citrix Application Delivery Controller and Gateway Directory Traversal(CVE-2020-19781)
17. threat[24696]:HomeAutomation v3.3.2 CSRF Remote Command Execution
18. threat[24698]:HomeAutomation 3.3.2 Open Redirect vulnerability
19. threat[24699]:YouPHPTube 7.7 SQL Injection Vulnerability(CVE-2019-18662)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21917。该升级包新增/改进的规则有:

新增规则:
1. 攻击[30729]:OwnCloud 8.1.8-用户名泄露漏洞
2. 攻击[41731]:雄迈摄像头固件后门漏洞通信
3. 攻击[24690]:Apache SSI注入远程代码执行漏洞
4. 攻击[24691]:Car Rental Project 1.0 文件上传漏洞（CVE-2020-5509）
5. 攻击[24689]:phpMyAdmin 4.x sql注入漏洞（CVE-2020-5504）
6. 攻击[24682]:IceWarp WebMail 11.4.4.1 XSS漏洞（CVE-2020-8512）
7. 攻击[24683]:基于REALTEK SDK的路由器（TOTOLINK和许多其他）代码执行漏洞(CVE-2019-19824)
8. 攻击[24684]:3Com OfficeConnect远程代码执行漏洞
9. 攻击[30726]:ASTPP 4.0.1 VoIP Billing - 数据库泄露漏洞
10. 攻击[24685]:Jira 8.3.4 信息披露漏洞（CVE-2019-8449）
11. 攻击[24688]:Heatmiser Netmonitor 3.03 -HTML注入漏洞

更新规则:
1. 攻击[24286]:WebLogic 任意文件上传远程代码执行漏洞(CVE-2018-2894)
2. 攻击[24678]:rConfig 3.9.3远程执行代码漏洞（CVE-2019-19509）
3. 攻击[68655]:可疑Webshell后门访问控制


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.

NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21917. This package include changed rules:

new rules:
1. threat[30729]:OwnCloud 8.1.8 - Username Disclosure Vulnerability
2. threat[41731]:Xiongmai Camera Firmware Backdoor Communication
3. threat[24690]:Apache SSI Injection Remote Code Execution Vulnerability
4. threat[24691]:Car Rental Project 1.0 File Upload Vulnerability (CVE-2020-5509)
5. threat[24689]:phpMyAdmin 4.x SQL Injection Vulnerability (CVE-2020-5504)
6. threat[24682]:IceWarp WebMail 11.4.4.1 XSS Vulnerability (CVE-2020-8512)
7. threat[24683]:REALTEK SDK based Routers (TOTOLINK and many Other) Code Execution Vulnerability(CVE-2019-19824)
8. threat[24684]:3Com OfficeConnect Remote Code Execution
9. threat[30726]:ASTPP 4.0.1 VoIP Billing - Database Disclosure Vulnerability
10. threat[24685]:Jira 8.3.4 Information Disclosure Vulnerability (CVE-2019-8449)
11. threat[24688]:Heatmiser Netmonitor 3.03 - HTML Injection

update rules:
1. threat[24286]:WebLogic Arbitrary File Upload Remote Code Execution Vulnerability(CVE-2018-2894)
2. threat[24678]:rConfig 3.9.3 Remote Code Execution Vulnerability (CVE-2019-19509)
3. threat[68655]:Suspicious Webshell Backdoor Access and Control


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21833。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24672]:Thomson Reuters Velocity Analytics 远程代码注入漏洞(CVE-2013-5912)
2. 攻击[24673]:Apache FreeMarker模板FusionAuth远程代码执行漏洞(CVE-2020-7799)
3. 攻击[24674]:ZOHO ManageEngine ServiceDeskPlus XSS漏洞（CVE-2020-6843）
4. 攻击[24676]:Satellian 1.1.2远程代码执行漏洞（CVE-2020-7980）
5. 攻击[24675]:Adive Framework跨站脚本攻击XSS/跨站请求伪造CSRF漏洞(CVE-2020-7991)
6. 攻击[24677]:Microsoft .NET Framework 远程代码执行漏洞(CVE-2020-0646)
7. 攻击[24678]:rConfig 3.9.3远程执行代码漏洞（CVE-2019-19509）
8. 攻击[24680]:Homematic CCU2 TCL脚本解释器远程代码执行漏洞(CVE-2018-7297)

更新规则:
1. 攻击[22656]:D-Link DIR-600 / DIR-300 非授权远程命令执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21833. This package include changed rules:

new rules:
1. threat[24672]:Thomson Reuters Velocity Analytics Remote Code Injection Vulnerability(CVE-2013-5912)
2. threat[24673]:Apache FreeMarker Template FusionAuth Remote Code Execution Vulnerability(CVE-2020-7799)
3. threat[24674]:ZOHO ManageEngine ServiceDeskPlus XSS Vulnerability (CVE-2020-6843)
4. threat[24676]:Satellian 1.1.2 remote code execution vulnerability(CVE-2020-7980)
5. threat[24675]:Adive Framework Cross-site Scripting/Cross-Site Request Forgery Vulnerability(CVE-2020-7991)
6. threat[24677]:Microsoft .NET Framework Remote Code Execution Vulnerability(CVE-2020-0646)
7. threat[24678]:rConfig 3.9.3 Remote Code Execution Vulnerability (CVE-2019-19509)
8. threat[24680]:Homematic CCU2 TCL Script Interpreter Remote Code Execution Vulnerability(CVE-2018-7297)

update rules:
1. threat[22656]:D-Link DIR-600 / DIR-300 Unauthenticated Remote Command Execution


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21799。该升级包新增/改进的规则有:


新增规则:
1. 攻击[24667]:Citrix NetScaler SD-WAN 远程命令执行漏洞(CVE-2017-6316)
2. 攻击[24668]:Citrix ADC&NetScaler远程命令执行漏洞(CVE-2019-19781)
3. 攻击[24669]:Job Portal 1.0 任意文件上传
4. 攻击[24670]:PandoraFMS v7.0NG 远程代码执行漏洞（CVE-2019-20224）

更新规则:
1. 攻击[24201]:NetGain Systems Enterprise Manager exec jsp 命令执行漏洞(CVE-2017-16602)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21799. This package include changed rules:


new rules:
1. threat[24667]:Citrix NetScaler SD-WAN Remote Command Execution Vulnerability(CVE-2017-6316)
2. threat[24668]:Citrix ADC & NetScaler Remote Command Execution Vulnerability (CVE-2019-19781)
3. threat[24669]:Job Portal 1.0 arbitrary file upload
4. threat[24670]:PandoraFMS v7.0NG Remote Code Execution Vulnerability (CVE-2019-20224)

update rules:
1. threat[24201]:NetGain Systems Enterprise Manager exec jsp Command Execution(CVE-2017-16602)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21798。该升级包新增/改进的规则有:


新增规则:
1. 攻击[24663]:Enigma NMS系统命令注入漏洞(CVE-2019-16072)
2. 攻击[24664]:三菱电子smartRTU和Inea ME-RTU 操作系统命令注入漏洞(CVE-2019-14931)
3. 攻击[24665]:PixelStor 5000 K：4.0.1580-20150629-远程执行代码漏洞（CVE-2020-6756）
4. 攻击[24666]:Sar2HTML 3.2.1 远程命令执行漏洞

更新规则:
1. 攻击[23766]:Dell KACE K1000文件上传漏洞
2. 攻击[66891]:PHP CGI查询字符串参数处理信息泄露及拒绝服务漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21798. This package include changed rules:

new rules:
1. threat[24663]:Enigma NMS OS Command Injection Vulnerability(CVE-2019-16072)
2. threat[24664]:Mitsubishi Electric smartRTU and Inea ME-RTU OS Command Injection Vulnerability(CVE-2019-14931)
3. threat[24665]:PixelStor 5000 K: 4.0.1580-20150629-Remote Code Execution Vulnerability (CVE-2020-6756)
4. threat[24666]:Sar2HTML 3.2.1 Remote Command Execution Vulnerability

update rules:
1. threat[23766]:Dell KACE K1000 File Upload Vulnerability
2. threat[66891]:PHP CGI Query String Parameter Handling Information Disclosure and DoS Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21797。该升级包新增/改进的规则有:


新增规则:
1. 攻击[24660]:Netgear R6400远程代码执行漏洞(CVE-2016-6277)
2. 攻击[24661]:SonicWall Global Management System 任意代码执行漏洞(CVE-2018-9866)
3. 攻击[24662]:Technicolor调制解调器命令注入漏洞(CVE-2017-14127)(CVE-2019-18396)
4. 攻击[24671]:Weblogic WLS 组件 IIOP 协议远程代码执行漏洞(CVE-2020-2551)

更新规则:
1. 攻击[21374]:Apache Struts远程命令执行漏洞
2. 攻击[24174]:WebLogic WLS 组件远程命令执行漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21797. This package include changed rules:


new rules:
1. threat[24660]:Netgear R6400 Remote Code Execution Vulnerability(CVE-2016-6277)
2. threat[24661]:SonicWall Global Management System Remote Code Execution Vulnerability(CVE-2018-9866)
3. threat[24662]:Technicolor Modem Command Injection Vulnerability(CVE-2017-14127)(CVE-2019-18396)
4. threat[24671]:Weblogic WLS component IIOP protocol remote code execution vulnerability(CVE-2020-2551)

update rules:
1. threat[21374]:Apache Struts Remote Command Execution Vulnerability
2. threat[24174]:WebLogic WLS Component Remote Command Execution Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21731。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24649]:joomla 3.7 SQL注入漏洞（CVE-2017-8917）
2. 攻击[24650]:Jetty web server 远程共享缓冲区泄漏（CVE-2015-2080）
3. 攻击[24651]:LiteSpeed Technologies LiteSpeed Web Server MIME种类文件代码注入漏洞(CVE-2007-5654)
4. 攻击[24652]:mongo-express远程代码执行漏洞(CVE-2019-10758)
5. 攻击[24653]:Jenkins CI Server build-metrics XSS漏洞
6. 攻击[24654]:rConfig search.crud.php 命令注入漏洞(CVE-2019-16663)
7. 攻击[24655]:Enigma NMS 65.0.0-跨站点请求伪造漏洞（CVE-2019-16068）
8. 攻击[24656]:Spring Web Flow远程代码执行漏洞(CVE-2017-4971)
9. 攻击[24657]:Squid Proxy URN响应处理堆缓冲区溢出
10. 攻击[24658]:Karakuzu ERP Management Web 5.7.0 SQL 注入
11. 攻击[24659]:IceWarp 12.2.0 / 12.1.x 跨站脚本攻击（CVE-2019-19266）

更新规则:
1. 攻击[24526]:PHP7 zip组件整型溢出漏洞(CVE-2016-3078)
2. 攻击[20266]:Oracle 9i应用服务器无需授权访问管理目录漏洞攻击
3. 攻击[24432]:Nexus Repository Manager 3 远程命令执行漏洞(CVE-2019-7238)
4. 攻击[21374]:Apache Struts远程命令执行漏洞
5. 攻击[24146]:JbossAS反序列化远程命令执行漏洞(CVE-2017-12149)
6. 攻击[10412]:Apache HTTP Server畸形Range和Range-Request选项处理远程拒绝服务漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21731. This package include changed rules:

new rules:
1. threat[24649]:joomla 3.7 SQL Injection Vulnerability (CVE-2017-8917)
2. threat[24650]:Jetty web server remote shared buffer leak (CVE-2015-2080)
3. threat[24651]:jLiteSpeed Technologies LiteSpeed Web Server MIME Kind File Code Injection Vulnerability (CVE-2007-5654)
4. threat[24652]:mongo-express Remote Code Execution Vulnerability(CVE-2019-10758)
5. threat[24653]:Jenkins CI Server build-metrics Cross-Site Scripting
6. threat[24654]:rConfig search.crud.php Command Injection(CVE-2019-16663)
7. threat[24655]:Enigma NMS 65.0.0-Cross-Site Request Forgery Vulnerability (CVE-2019-16068)
8. threat[24656]:Spring Web Flow Remote Code Execution Vulnerability(CVE-2017-4971)
9. threat[24657]:Squid Proxy URN Response Processing Heap Buffer Overflow
10. threat[24658]:Karakuzu ERP Management Web 5.7.0 SQL Injection
11. threat[24659]:IceWarp 12.2.0 / 12.1.x Cross-Site Scripting Attack (CVE-2019-19266)

update rules:
1. threat[24526]:PHP7 zip Component Integer Overflow Vulnerability(CVE-2016-3078)
2. threat[20266]:Oracle 9i Application Server Admin Directory Unauthorized Access
3. threat[24432]:Nexus Repository Manager 3 Remote Command Execution Vulnerability(CVE-2019-7238)
4. threat[21374]:Apache Struts Remote Command Execution Vulnerability
5. threat[24146]:JbossAS Serialized Object Remote Code Execution Vulnerability(CVE-2017-12149)
6. threat[10412]:Apache HTTP Server Denial Of Service Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21681。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24642]:phpMyChat-Plus 1.98 - 'pmc_username' 参数跨站脚本攻击漏洞
2. 攻击[24641]:Netgain Enterprise Manager PING操作命令注入漏洞
3. 攻击[24643]:Roxy Fileman 1.4.5 NET目录遍历漏洞
4. 攻击[24644]:NUOO NVRmini/NVRmini2/NVRTitan/Crystal/NVRSolo 远程命令执行漏洞
5. 攻击[24645]:AVTECH 视频监控设备 adcommand.cgi远程命令执行漏洞
6. 攻击[24646]:Cisco Security Manager RMI不安全反序列化漏洞(CVE-2019-12630)
7. 攻击[24647]:Apache Log4j 反序列化代码执行(CVE-2019-17571) 漏洞
8. 攻击[24648]:D-Link Routers操作系统命令注入漏洞(CVE-2015-2051)

更新规则:
1. 攻击[24613]:WiKID Systems 2FA EnterpriseSQL注入漏洞(CVE-2019-17117)
2. 攻击[23359]:ElasticSearch Groovy远程代码执行漏洞（CVE-2015-1427）
3. 攻击[24299]:D-Link DSL-2750B任意命令执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21681. This package include changed rules:

new rules:
1. threat[24642]:phpMyChat-Plus 1.98-'pmc_username' parameter cross-site scripting vulnerability
2. threat[24641]:NetGain Enterprise Manager Ping Command Injection Vulnerability
3. threat[24643]:Roxy Fileman 1.4.5 .NET directory traversal vulnerability
4. threat[24644]:NUOO NVRmini/NVRmini2/NVRTitan/Crystal/NVRSolo Remote Code Execution Vulnerability
5. threat[24645]:AVTECH video surveillance device adcommand.cgi remote command execution vulnerability
6. threat[24646]:Cisco Security Manager RMI Insecure Deserialization Vulnerability(CVE-2019-12630)
7. threat[24647]:Apache Log4j Deserialization Code Execution (CVE-2019-17571) Vulnerability
8. threat[24648]:D-Link Routers Operation System Command Injection Vulnerability(CVE-2015-2051)

update rules:
1. threat[24613]:WiKID Systems 2FA EnterpriseSQL Injection Vulnerability (CVE-2019-17117)
2. threat[23359]:ElasticSearch Groovy command exec Remote Code Execution Vulnerability (CVE-2015-1427)
3. threat[24299]:D-Link DSL-2750B Arbitrary Command Execution Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21636。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24629]:Xerox AltaLink 跨站请求伪造漏洞（CVE-2019-19832）
2. 攻击[24630]:Linksys多款路由器ttcp_ip参数远程命令执行漏洞
3. 攻击[24631]:Vacron网络视频录像设备远程命令执行漏洞
4. 攻击[41727]:Buran勒索病毒请求连接
5. 攻击[24632]:EnGenius EnShare IoT Gigabit Cloud Service远程命令执行漏洞
6. 攻击[41728]:Buran勒索病毒传输通信
7. 攻击[24633]:AVTECH 录像监控设备远程命令执行漏洞
8. 攻击[24634]:Zyxel EMG2926家庭路由器命令注入漏洞(CVE-2017-6884)
9. 攻击[24635]:AVTECH 视频监控设备未经身份验证的信息泄露漏洞
10. 攻击[41729]:木马后门程序Emotet网络
11. 攻击[24636]:AVTECH DVR设备未经身份验证的ssrf漏洞
12. 攻击[24637]:AVTECH 视频监控设备认证绕过漏洞
13. 攻击[41730]:APT组织Sednit攻击活动
14. 攻击[24638]:AVTECH 视频监控设备登录验证码绕过漏洞
15. 攻击[24639]:OPF OpenProject sortBy 跨站脚本攻击漏洞（CVE-2019-17092）
16. 攻击[24640]:YouPHPTube Encoder getImage.php命令注入漏洞（CVE-2019-5127）

更新规则:
1. 攻击[24255]:Web服务远程命令执行攻击
2. 攻击[22656]:D-Link DIR-600 / DIR-300 非授权远程命令执行漏洞
3. 攻击[23756]:多种安防监控系统存在远程代码执行漏洞



注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21636. This package include changed rules:

new rules:
1. threat[24629]:Xerox AltaLink Cross-Site Request Forgery Vulnerability (CVE-2019-19832)
2. threat[24630]:Linksys Routers ttcp_ip Parameter Remote Command Execution Vulnerability
3. threat[24631]:Vacron NVR Remote Command Execution Vulnerability
4. threat[41727]:Buran ransomware requests connection
5. threat[24632]:EnGenius EnShare IoT Gigabit Cloud Service Remote Command Execution Vulnerability
6. threat[41728]:Buran ransomware transmission communication
7. threat[24633]:AVTECH IP Camera/NVR/DVR Remote Command Execution Vulnerability
8. threat[24634]:Zyxel EMG2926 Router Command Injection Vulnerability(CVE-2017-6884)
9. threat[24635]:AVTECH Video Surveillance Device Unauthenticated Information Disclosure Vulnerability
10. threat[41729]:Trojan Backdoor Emotet Network
11. threat[24636]:AVTECH DVR device unauthenticated ssrf vulnerability
12. threat[24637]:AVTECH Video Surveillance Device Certification Bypass Vulnerability
13. threat[41730]:APT organizes Sednit attack
14. threat[24638]:AVTECH Video Surveillance Device Login Verification Code Bypass Vulnerability
15. threat[24639]:OPF OpenProject sortBy Cross-Site Scripting Vulnerability(CVE-2019-17092)
16. threat[24640]:YouPHPTube Encoder getImage.php Command Injection Vulnerability(CVE-2019-5127)

update rules:
1. threat[24255]:Web Service Remote Command Execution Attack
2. threat[22656]:D-Link DIR-600 / DIR-300 Unauthenticated Remote Command Execution
3. threat[23756]:Multiple CCTV-DVR Systems Remote Command Execution Vulnerability



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21583。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24618]:Centova Cast 3.2.11任意文件下载漏洞
2. 攻击[24619]:Mersive Technologies Solstice Pods 操作系统命令注入漏洞(CVE-2017-12945)
3. 攻击[24620]:Verot 2.0.3 - 文件上传漏洞(CVE-2019-19576)
4. 攻击[24621]:OkayCMS 2.3.4远程执行代码漏洞（CVE-2019-16885）
5. 攻击[24622]:VBScript远程执行代码漏洞(CVE-2019-1485)
6. 攻击[24624]:WordPress CSS Hero 4.0.3跨站脚本攻击（CVE-2019-19133）
7. 攻击[30725]:数据库文件.mdb文件尝试访问下载
8. 攻击[24625]:Apache php文件后缀解析漏洞
9. 攻击[24627]:dedecms sys_verifies.php远程代码执行漏洞(CVE-2018-9174)
10. 攻击[24626]:TemaTres 3.0跨站脚本攻击(CVE-2019-14343)
11. 攻击[24628]:Advantech WISE-PaaS RMM任意文件上传漏洞(CVE-2019-13551)

更新规则:
1. 攻击[24614]:Sahi Pro 7.x / 8.x目录遍历（CVE-2018-20470）
2. 攻击[24616]:Joomla JS Support Ticket 1.1.5任意文件下载
3. 攻击[41499]:HTTP请求敏感路径访问尝试
4. 攻击[41534]:网页包含挖矿脚本代码
5. 攻击[23309]:TWiki search功能任意SHELL命令执行漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21583. This package include changed rules:

new rules:
1. threat[24618]:Centova Cast 3.2.11 Arbitrary File Download
2. threat[24619]:Mersive Technologies Solstice Pods Operating System Command Injection Vulnerability(CVE-2017-12945)
3. threat[24620]:Verot 2.0.3-File Upload Vulnerability (CVE-2019-19576)
4. threat[24621]:OkayCMS 2.3.4 Remote Code Execution Vulnerability (CVE-2019-16885)
5. threat[24622]:VBScript Remote Code Execution Vulnerability(CVE-2019-1485)
6. threat[24624]:WordPress CSS Hero 4.0.3 Cross Site Scripting （CVE-2019-19133）
7. threat[30725]:try to access and download .mdb database file
8. threat[24625]:Apache php file suffix parsing vulnerability
9. threat[24627]:dedecms sys_verifies.php Remote Code Execution Vulnerability (CVE-2018-9174)
10. threat[24626]:TemaTres 3.0 Cross Site Scripting(CVE-2019-14343)
11. threat[24628]:Advantech WISE-PaaS RMM Arbitrary File Upload Vulnerability(CVE-2019-13551)

update rules:
1. threat[24614]:Sahi Pro 7.x / 8.x Directory Traversal(CVE-2018-20470)
2. threat[24616]:Joomla JS Support Ticket 1.1.5 Arbitrary File Download
3. threat[41499]:HTTP Request Sensitive Path Access Attempt
4. threat[41534]:Web Page Contains Mining Script Code
5. threat[23309]:TWiki Search Function Arbitrary Command Execution


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21512。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41726]:Lemon_Duck PowerShell 恶意软件C2服务器通信
2. 攻击[24613]:WiKID Systems 2FA EnterpriseSQL注入漏洞(CVE-2019-17117)
3. 攻击[24614]:Sahi Pro 7.x / 8.x目录遍历（CVE-2018-20470）
4. 攻击[24615]:FaceSentry访问控制系统6.4.8远程命令注入

更新规则:
1. 攻击[23811]:Apache APR_PSPrintf 内存破坏漏洞
2. 攻击[24457]:ElasticSearch远程任意代码执行漏洞(CVE-2014-3120)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21512. This package include changed rules:

new rules:
1. threat[41726]:Lemon_Duck PowerShell malware C2 server communication
2. threat[24613]:WiKID Systems 2FA EnterpriseSQL Injection Vulnerability (CVE-2019-17117)
3. threat[24614]:Sahi Pro 7.x / 8.x Directory Traversal(CVE-2018-20470)
4. threat[24615]:FaceSentry Access Control System 6.4.8 Remote Command Injection

update rules:
1. threat[23811]:Apache APR_PSPrintf Memory Corruption Vulnerability
2. threat[24457]:ElasticSearch Remote Arbitrary Code Execution Vulnerability (CVE-2014-3120)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21465。该升级包新增/改进的规则有:

新增规则:
1. 攻击[41725]:MyKings僵尸网络通信

更新规则:
1. 攻击[23997]:Jackson-Databind框架json反序列化代码执行漏洞(CVE-2017-7525)
2. 攻击[60192]:SMTP服务器命令格式串漏洞


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21465. This package include changed rules:

new rules:
1. threat[41725]:MyKings Botnet Communication

update rules:
1. threat[23997]:Jackson-Databind framework json deserialization code execution vulnerability(CVE-2017-7525)
2. threat[60192]:SMTP Server Command Format String Vulnerability


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21443。该升级包新增/改进的规则有:


更新规则:
1. 攻击[66892]:PHP CGI查询字符串参数处理代码注入漏洞（CVE-2012-1823）


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21443. This package include changed rules:


update rules:
1. threat[66892]:PHP CGI Query String Parameter Handling Code Injection Vulnerability（CVE-2012-1823）


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21434。该升级包新增/改进的规则有:


新增规则:
1. 攻击[41724]:APT组织TransparentTribe攻击活动

更新规则:
1. 攻击[24605]:HPE智能管理中心AMF3反序列化漏洞（CVE-2019-11944）
2. 攻击[24611]:Apache Flink Dashboard 未授权访问-远程代码命令执行
3. 攻击[23783]:nginx文件类型错误解析漏洞
4. 攻击[66892]:PHP CGI查询字符串参数处理代码注入漏洞（CVE-2012-1823）


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21434. This package include changed rules:


new rules:
1. threat[41724]:APT organizes the TransparentTribe attack

update rules:
1. threat[24605]:HPE Intelligent Management Center AMF3 Externalizable Deserialization Vulnerability(CVE-2019-11944)
2. threat[24611]:Apache Flink Dashboard Unauthorized Access - Remote Code Command Execution
3. threat[23783]:nginx Incorrect File Type Parse Vulnerability
4. threat[66892]:PHP CGI Query String Parameter Handling Code Injection Vulnerability（CVE-2012-1823）


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21411。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24602]:OpenEMR facility_admin.php跨站脚本漏洞(CVE-2019-8368)
2. 攻击[24603]:YouPHPTube远程代码执行漏洞(CVE-2019-16124)
3. 攻击[24604]:Windows NTLM认证篡改漏洞(CVE-2019-1166)
4. 攻击[24606]:Zoho ManageEngine Applications Manager MASRequestProcessor serverID SQL注入漏洞
5. 攻击[24607]:OpenEMR C_Document.class.php view_action doc_id 跨站脚本攻击(CVE-2019-3964)
6. 攻击[24608]:Zoho ManageEngine OpManager OPMDeviceDetailsServlet SQL注入
7. 攻击[24609]:Citrix StoreFront Server 7.15-XML外部实体注入
8. 攻击[24610]:Drupal Database Abstraction API SQL注入漏洞(CVE-2014-3704)
9. 攻击[24611]:Apache Flink Dashboard 未授权访问-远程代码命令执行
10. 攻击[41723]:APT组织"黑格莎"攻击活动

更新规则:
1. 攻击[49013]:挖矿程序连接矿池服务器通信


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21411. This package include changed rules:

new rules:
1. threat[24602]:OpenEMR facility_admin.php Cross-Site Scripting Vulnerability(CVE-2019-8368)
2. threat[24603]:YouPHPTube Remote Code Execution Vulnerability(CVE-2019-16124)
3. threat[24604]:Windows NTLM Message Integrity Check Tampering Vulnerability(CVE-2019-1166)
4. threat[24606]:Zoho ManageEngine Applications Manager MASRequestProcessor serverID SQL Injection Vulnerability
5. threat[24607]:OpenEMR C_Document.class.php view_action doc_id Cross-Site Scripting(CVE-2019-3964)
6. threat[24608]:Zoho ManageEngine OpManager OPMDeviceDetailsServlet category SQL Injection
7. threat[24609]:Citrix StoreFront Server 7.15 - XML External Entity Injection
8. threat[24610]:Drupal Database Abstraction API SQL Injection Vulnerability(CVE-2014-3704)
9. threat[24611]:Apache Flink Dashboard Unauthorized Access - Remote Code Command Execution
10. threat[41723]:APT Ognization Higaisa Attack Behavior

update rules:
1. threat[49013]:Mining program connects mine pool server communication


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

本升级包为入侵防护特征库升级包，仅支持在固件版本5.6.9.31之上，引擎版本5.6.9.41及以上升级。升级包为全量升级包。升级后固件版本和引擎版本不变，规则版本变为5.6.9.21357。该升级包新增/改进的规则有:

新增规则:
1. 攻击[24599]:RConfig未授权RCE漏洞
2. 攻击[24598]:Apache Solr远程代码执行漏洞
3. 攻击[24600]:rConfig v3.9.2 远程代码执行漏洞
4. 攻击[24597]:Joomla 远程代码执行漏洞
5. 攻击[24601]:ThinkcmfX php代码注入漏洞

更新规则:
1. 攻击[24308]:Apache Solr/LuceneXML远程命令执行漏洞（RCE）(CVE-2017-12629)
2. 攻击[24541]:Apache Solr DataImportHandler远程代码执行漏洞(CVE-2019-0193)
3. 攻击[24286]:WebLogic 任意文件上传远程代码执行漏洞(CVE-2018-2894)


注意事项:
1. 该升级包升级后引擎自动重启生效，不会造成会话中断，但ping包会丢3~5个，请选择合适的时间升级.


NSFOCUS NIDS/NIPS product signature upgrade package, depends on firmware version at least 5.6.9.31 and engine version 5.6.9.41. This is a total upgrade package. After upgrade package is imported, firemare version and engine version willnot change, signature version will change to 5.6.9.21357. This package include changed rules:

new rules:
1. threat[24599]:RConfig unauthorized RCE vulnerability
2. threat[24598]:Apache Solr Remote Code Execution Vulnerability
3. threat[24600]:rConfig v3.9.2 Remote Code Excution Vulnerability
4. threat[24597]:Joomla Remote Code Execution Vulnerability
5. threat[24601]:ThinkcmfX php Code Injection Vulnerability

update rules:
1. threat[24308]:Apache Solr/LuceneXML Remote Command Execution Vulnerability (RCE) (CVE-2017-12629)
2. threat[24541]:Apache Solr DataImportHandler remote code execution vulnerability (cve-2019-0193)
3. threat[24286]:WebLogic Arbitrary File Upload Remote Code Execution Vulnerability(CVE-2018-2894)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.