-
FortiAnalyzer & FortiManager – bypass of client-side password change policy enforcement (1st Mar 2022)
Preface: The registration of CVE records is largely out of sync with the time of the event. Perhaps the new release of CVE record by today, however it was happened few weeks or months ago. But with reference of these vulnerabilities records. Vulnerability scanner can precisely provide a result to you after scan. Background: FortiAnalyzer…
-
CVE-2022-26181 Dropbox Lepton design weakness (1st Mar 2022)
Preface: The registration of CVE records is largely out of sync with the time of the event. Perhaps the new release of CVE record by today, however it was happened few weeks or months ago. But with reference of these vulnerabilities records. Vulnerability scanner can precisely provide a result to you after scan. Background: Dropbox…
-
The injustice invasion – Destructive Malware (28th Feb 2022)
Preface: No matter what your reasons are, children are victims! Human nature: Human desires are infinite. We may meet some of our needs, but new ones will soon emerge. Thus, scarcity explains the relationship between having unlimited demand and the problems within it. Security Focus: The malware, known as WhisperGate, has two stages that corrupts…
-
CVE-2022-25809 – Alexa versus Alexa (AvA) attack (24th Feb 2022)
Preface: Perhaps the risk of this vulnerability is not high. However, if attackers exploit specific design weaknesses. It’s hard to say if Lamda can’t direct the attack to the backend service cloud. Background: Alexa is able to play music, provide information, deliver news and sports scores, tell you the weather, control your smart home and…
-
CVE-2022-25335 – About RigoBlock Dragos design weakness (23rd Feb 2022)
Preface: Blockchain protocols are regulations and guidelines followed to achieve its decentralized and distributed nature, to ensure secure transactions, and more. There are three basic types of blockchain: public blockchain, consortium blockchain and private blockchain. Background: RigoBlock is a blockchain protocol that makes it possible for anyone to set up and run a digital token…
-
CVE-2022-23635 (Istio): Unauthenticated control plane denial of service attack.(22nd Feb 2022)
Preface: The registration of CVE records is largely out of sync with the time of the event. Perhaps the new release of CVE record by today, however it was happened few weeks or months ago. But with reference of these vulnerabilities records. Vulnerability scanner can precisely provide a result to you after scan. Background: Istio makes…
-
CVE-2022-25255 – Missing validation of binaries executed via Qprocess (21st Feb 2022)
Preface: The registration of CVE records is largely out of sync with the time of the event. Perhaps the new release of CVE record by today, however it was happened few weeks or months ago. But with reference of these vulnerabilities records. Vulnerability scanner can precisely provide a result to you after scan. Background: QProcess…
-
About CVE-2022-25375
Preface: In 2017, half of the world’s top 50 supercomputers used SUSE Enterprise Linux Server. Why does Linux dominate especially in supercomputer market? Linux is a free, open source operating system (OS), released under the GNU General Public License (GPL). Anyone can inspect or modify software “Source code”. Because of Linux cluster break the traditional…
-
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7 (17th Feb 2022)
Preface: The DOMParser interface provides the ability to parse XML or HTML source code from a string into a DOM Document .A module that parses a string as regular expression and returns the parsed value. it is the regular expression solution. Background: The “url-parse” was created in 2014 when the WHATWG URL API was not…
-
About CVE-2022-22945 – CLI shell injection vulnerability (16th Feb, 2022)
Preface: The registration of CVE records is largely out of sync with the time of the event. Perhaps the new release of CVE record by today, however it was happened few weeks or months ago. But with reference of these vulnerabilities records. Vulnerability scanner can precisely provide a result to you after scan. Background: NSX…