-
Some said “php echo call” potential risk (CVE-2022-23993) let small to medium enterprise firm headache? But now it’s fixed. (26th Jan, 2022)
Preface: If no open source software concept in our world, technology is hard to become common. Even though you concern cyber security. They can fixed it when there is vulnerability occurs. Background: pfSense is an open source firewall and routing platform based on FreeBSD. pfSense can be installed on physical computers or virtual machines, and…
-
OpenSUSE Backports SLE-15-SP3 watchman suffers from design flaw (26-01-2022)
Preface: What are backports in traditional Linux?“Backporting” is the process of making new software run on something old. A version of something new that’s been modified to run on something old is called a “backport”. The Backports Project develops tools to automate the backporting process for Linux drivers. These tools form the backports suite. Background:…
-
Does this concept like CVE-2022-23008? (26-01-2022)
Preface: NGINX Controller provides lightning-fast application delivery and API management for modern app teams. Background: What is a Data Plane? The data plane is a layer of service proxies that manage application-level network traffic. Data plane typically operate on Layer 7 (application) traffic, although they may also operate at Layer 4 (transport) traffic as well.…
-
CVE-2022-23852 – Prevent Expat (XML_GetBuffer) Signed integer overflow (24-01-2022)
Preface: Expat is free software. You may copy, distribute, and modify it under the terms of the License contained in the file COPYING distributed with this package. This license is the same as the MIT/X Consortium license. Background: As a open-source XML parser, Expat can be implemented by several programming languages, such as: Python, PHP,Perl,…etc.…
-
Are you worried when jerryscript has vulnerabilities? (24th Jan, 2022)
Preface: Samsung Electronics has started the development of IoT.js on 2015, a platform for IoT applications written in JavaScript, and JerryScript, a JavaScript engine for small, embedded devices. Background: JerryScript is an ultra-lightweight JavaScript engine for the Internet of things. It is capable of executing ECMAScript 5.1 source code on devices with less than 64…
-
Get rid of crafted Modbus traffic to bother your defense mechansim – 21st JAN 2022
Preface: Le Rouge et le Noir – Not a bad guy is good guy. If, the vulnerability is due to an integer overflow when handling Modbus traffic. Is it an early warning? Background: The reason Modbus was so successful was the fact that it could be so readily understood by non-programmers. Engineers who built glue…
-
Regarding to ManageEngine security announcement (CVE-2021-44757), do you have doubt on their design? (19-1-2022)
Preface: Asset scan is the key function to maintain the asset management integrity. If the company structure not operating standalone. In some circumstance, the system architect will formalize a distributed architecture. However, how to scan and collecting data is a important topic. Perhaps the file size is variable because of the data content. As a…
-
Oracle Releases January 2022 Critical Patch Update – Quick and easy understanding of CVE-2021-2351 (Oracle JDBC Native Network Encryption design limitation).
Preface: Even thought CVE-2021-2351 was announced on last year (21st July, 2021), however this topic still lure of my interest. As we know, web server and DB server is an important component in existing digital World. For example, Big data, IoT, automotive and mobility functions will working with front end web server. Whereby in between…
-
About CVE-2022-0240 Do not contempt low risk vulnerability (17th Jan,2022)
Preface: A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Background: MRuby is the lightweight implementation of the Ruby language complying to (part of) the ISO standard. Its syntax is Ruby 2[.]x compatible. MRuby is embeddable. Can be…
-
CVE-2022-23094 on Libreswan. Stay alert!
Preface: Pluto is an IKE (“IPsec Key Exchange”) daemon. Pluto is an implementation of IKE. It runs as a daemon on a network node. Currently, this network node must be a LINUX system running the KLIPSor NETKEY implementation of IPsec, or a FreeBSD/NetBSD/Mac OSX system running the KAME implementation of IPsec. Background: Libreswan is a…