-
U.S. Homeland Security Alert (CVE-2021-40444) – 7th Sep, 2021
Preface: Windows RCE vulnerabilities have targeted Office users, and Microsoft urgently provides mitigation instructions. Background: The MS web browser COM control adds browsing, document, viewing, and downloading capabilities to your applications. Parsing and rendering of HTML documents in the WebBrowser control is handled by the MSHTML component which is an Active Document Dynamic HTML (DHTML)…
-
Fortinet’s CVE makes you have questions? How many unknown vulnerabilities remain undiscovered in the REST API framework!(CVE-2021-2400 – 6th Sep 2021)
Preface: Dashboard, a popular design trend concept in the digital world.Dashboard, a popular design trend concept in the digital world.As the cloud and the Internet of Things force the network to evolve. Even operational work and network security can be managed in thesame dashboard. Background: Permission checks will typically use the authentication information in the…
-
Interested topic last week (AWS “AKIA” discussion) – 5th Sep, 2021
Preface: On 2014, Amazon Web Services (AWS) is asking those that write code and use GitHub to go back and check their work to make sure they didn’t forget to remove login credentials. The warning comes as news is circulating about the availability of nearly 10,000 AWS keys in plain sight on GitHub just by…
-
CVE-2020-13929: Apache Zeppelin: Notebook permissions bypass (2nd Sep, 2021)
Preface: Big data analysis can understand data by discovering trends and patterns. Machine learning can accelerate this process with the help of decision-making algorithms. It can classify incoming data, recognize patterns, and transform the data to do the technology development. In addition, it is a way to develop artificial intelligence. Background: What is Apache Zeppelin…
-
CyberArk – CVE-2021-31798 (Quick and dirty way to understand the details) – 1st Sep, 2021
Preface: Cyberark provides the perfect authentication solution for enterprises. Because of their solutions, traditional authentication methods have evolved. However, there is no absolute anti-hacking solution in the world. The following explanation is to let you quickly understand this vulnerability. Even if this is not the right way, you will find out what they are doing.…
-
Do you think CVE-2020-20486 (IEC104 v1.0) will impact your services? (31st Aug 2021)
Preface: IEC 60870-5-104 protocol (aka IEC 104) is a part of IEC Telecontrol Equipment and Systems Standard IEC 60870-5 that provides a communication profile for sending basic telecontrol messages between two systems in electrical engineering and power system automation. Background: IEC 104 enables communication between control station and a substation via a standard TCP/IP network.…
-
Not a critical flaw, but it is commonly found on web UI applications – VMware vRealize log Insight (CVE-2021-22021) – 24-8-2021
Preface: Log event collection without data normalization , it is hard to managed. And you will be crazy. If you do not have log event aggregation and correlation functions. Your IT life will become not easy. Background: vRealize Log Insight delivers indexing and machine learning based Intelligent Grouping, to enable searching, for faster troubleshooting across…
-
Another flaw prompted an urgent U.S. government warning and providing Guidance (Azure Cosmos DB) – 29th Aug 2021
Preface: Data scientists are big data wranglers, gathering and analyzing large sets of structured and unstructured data. Jupyter Notebooks allow data scientists to create and share their documents, from codes to full blown reports (Help them streamline their work). Background: Azure Cosmos DB built-in Jupyter Notebooks are directly integrated into the Azure portal and Azure…
-
VMware security update (25th AUg 2021)
Preface: VMware has released a security update on August 24, 2021 to address vulnerabilities in multiple products. In addition, the risk level of these vulnerabilities is between 4.4-8.6 (CVSS-V3). So it attracted my interest in reading it. Background: The vRealize Operations Manager API Programming Guide provides information about the vRealize Operations Manager REST APIs, including…
-
If you are the Open Source Platform (Istio) user, please stay alert! 24-9-2021
Preface: Today developers are using Docker to build modules called Microservices, which decentralize packages and divide tasks into separate, stand-alone apps that collaborate with each other. Background: A sidecar proxy is an application design pattern which abstracts certain features, such as inter-service communications, monitoring and security, away from the main architecture to ease the tracking…