-
CVE-2022-43548 – An operating system command injection vulnerability exists in Node[.]js (possible attack scenario) 5th Dec 2022
Preface: When I read this CVE details. I found a gap between official “node JS” site announcements and security forums, including popular sites that post CVEs on a daily basis. In fact, if an attacker wants to trigger this vulnerability, it should meet the following requirements. That’s why I discuss this topic. Background: Node[.] js…
-
CVE-2022-23465 Fixes two design weaknesses in Swift Term where an attacker could store malicious code (4th Dec 2022)
Preface: Character combinations consisting of a backslash (\) followed by a letter or by a combination of digits are called “escape sequences.” Background: SwiftTerm uses the Swift Package Manager for its build, and you can add the library to your project by using the url for this project. SwiftTerm is a VT100/Xterm terminal emulator library…
-
About CVE-2022-24441: Something happens on “Snyk” when jump to this scenario (1st Dec 2022)
Preface: DevOps philosophy by practices, and tools that improve an organisation’s ability to deliver applications and services. This enables products to be developed and improved at a faster rate than organisations using traditional software development and infrastructure management processes. Efficiency, fast is the slogan of business. Step next phase after digital transformation. DevOps is important…
-
Soap Opera Scene: Vulnerability (CVE-2022-46338) Realized in Life – 1st Dec 2022
Preface: Logitech revenue worldwide 2016-2022, by segmentNews update in Aug 15, 2022.In 2022, the computer peripherals producer Logitech reported sales revenues of 5.48 billion U.S. dollars, of which 1.45 billion U.S. dollars was generated by its gaming segment. A further 967.3 million U.S. dollars in revenue was made from keyboard and keyboard-and-mouse combination (combo) sales.…
-
CVE-2022-46152 Design weakness causes SMC_Calling form cyber attack (29th Nov 2022)
Preface: In the ARM architecture, synchronous control is transferred between the normal Non-secure state to Secure state through System Monitor Call exceptions Background: TEE provides an isolated environment to ensure code/data integrity and confidentiality. A typical embedded system running Linux or Android has vulnerabilities in both the kernel and userspace. Vulnerabilities could allow attackers to…
-
About CVE-2022-43590: Understandable Views (28th Nov 2022)
Preface:For over two decades, developers at some of the world’s most prominent Fortune 500 and Global 2000 companies have trusted Callback Technologies’ components and system drivers to build secure file storage solutions and virtual filesystems. Some of our clients include Amazon, Microsoft, Adobe, Intel, LG, etc. Background: CBFS Filter allows you to intercept and react…
-
CVE-2022-45934 – Bug discovered in the Linux kernel. It seems to affect more devices including Android (28th Nov 2022)
Preface: For example, if an integer data type allows integers up to two bytes or 16 bits in length (or an unsigned number up to decimal 65,535), and two integers are to be added together that will exceed the value of 65,535, the result will be integer overflow. Background: L2CAP is used within the Bluetooth…
-
CVE-2022-45873 – Perhaps the design weakness is not limited to the current findings. (24th Nov 2022)
Preface: When looking at the systemd Git repository from system250 to system251, there were 79,853 lines of new code and 34,624 lines deleted over the past year. Background: You are able to use backtrace to track function call stack and locate segment fault under Linux. The (systemd-coredump) collects and displays core core dumps for analyzing…
-
CVE-2022-3910 An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. (22nd Nov 2022)
Preface: There are many ways to do file based IO in Linux. The oldest and most basic are the read(2) and write(2) system calls.io_uring is a system call interface for Linux. It was first introduced in upstream Linux Kernel version 5.1 in 2019 . It enables an application to initiate system calls that can be…
-
CVE-2022-41940 Interfering with the Engine[.]IO server by sending specially crafted HTTP requests (22nd Nov 2022)
Preface: Node[.]js has a built-in WebSocket module, but this module doesn’t provide the functionalities required to build complex real-time applications; this is why Socket[.]io exists.Socket[.]IO is quite popular and companies like Amazon, Zendesk,……and several others use it to develop robust real-time applications. It one of the most powerful JavaScript frameworks on GitHub, and most depended-upon…