-
CVE-2019-9636 (Python) urlsplit does not handle NFKC normalization
Preface: Python is used quite a lot in robotics. Apply artificial intelligence to robots using Python . Why choose Python? Less Code: Python can implement the same logic with as much as 1/5th code as compared to other OOPs languages. Prebuilt Libraries: include Numpy for scientific computation, Scipy for advanced computing and Pybrain for machine…
-
Highly vulnerable – Moxa customer must be vigilant!
Preface: The MoxaEDS–405A/408A are entry-level 5 and 8-port managed Ethernet switches designed especially for industrial applications. Technical background: Turbo Ring is a self-healing technology that enables fast fault recovery under 20 ms. Moxa’s Turbo Ring and Turbo Chain Ethernet technologies maximize railway network availability with ideal redundancy technology. Security focus: CVE-2019-6563 (CVSS:10) – Moxa IKS…
-
CVE-2019-3778 Pivotal Spring Security OAuth Open Redirector Vulnerability (critical)
Preface: OAuth has become a standard for third-party applications to communicate with the APIs of popular web sites, such as Facebook, Twitter, and Foursquare, to name a few. Technical background: Currently, the two major versions of OAuth are 1.0(a) and 2.0. With Spring Security and its OAuth 2.0 support, the OAuth (Open Authorisation) is a…
-
Status update for the announcement on 6th Mar 2019 (Cisco NX-OS Software Unauthorized Filesystem Access Vulnerability) – 11th Mar 2019.
Preface: On 6th Mar, 2019, Cisco announcement that there are vulnerabilities found on Cisco FXOS and NX-OS Software. The total 26 of the vulnerabilities have a Security Impact Rating (SIR) of High. Successful exploitation of the vulnerabilities could allow an attacker to gain unauthorized access. Technical background: Cisco NX-OS based on Wind River Linux and…
-
Software tool can deep look into malware and design weakness – Ghidra
Preface: Ghidra is one such well-known software reverse engineering toolkit that the NSA agency has been using for a long time. Synopsis: He ensured the audience that there’s no backdoor in Ghidra, said Rob Joyce, the cybersecurity adviser to the NSA director. About installation: Quick and simple way Prerequisite: Since “Ghidra” relies on JDK 11+…
-
CVE-2019-0187: Apache JMeter Missing client auth for RMI connection when distributed test is used! Mar 2019
Preface: If your company hasn’t been performing load testing, it is hard to know the web application actual performance. Deploying JMeter will display the test results in a graph updated in real time. Synopsis: Perhaps software developers did not imagine that JMeter design weakness will be hazardous of web server. And therefore we might found…
-
Cisco confirm OCI flaw only affecting small group of items in their product line – 8th Mar 2019
Preface: Container Privilege Escalation Vulnerability Affecting Cisco Products status update Description: IT world is safe again, Cisco you are super again! There is only 3 items of Cisco product involves into the Container Privilege Escalation Vulnerability found on last month (Feb 2019). Remedy has been proceed. Further details in below: Network Management and Provisioning: Cisco…
-
Moody’s point of view – cyber attack
Preface: For companies that are experiencing cyber attacks. Moody said it has the potential to weaken its credit profile. Analytic result by Moody’s: About Moody’s findings. Ransomware attack against FedEx and Merck & Co in 2017. The total financial impact of all affected entities reached $10 billion. Question: Does Moody’s rating only focus on financial…
-
CVE-2018-11793: Apache Mesos JSON Payload Parsing DoS Vulnerability 5th Mar 2019
Preface: Apache Mesos is an open-source project to manage computer clusters. It was developed at the University of California, Berkeley. About Payload in Web services: Typically the term payload refers to JSON-formatted text that is either posted (via an http POST) to a web service when a user creates a resource or returned from a…
-
Cisco Event Response: March 2019 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. 6th Mar 2019
Preface: The urgent announcement by Cisco might scare the customer of Cisco. It is about the vulnerabilities found on Cisco FXOS and NX-OS Software. But no worries, Cisco managed it. Technical background: Cisco NX-OS based on Wind River Linux and is inter-operable with other Cisco operating systems. The command-line interface of NX-OS is similar to…