-
Cisco product security alert (CVE-2020-26070). It may awaken other manufacturers require to focus on similar matters. (11th Nov 2020)
Preface: Our daily life is relies on Cloud computing system. Smart City, GPRS, mapping & spatial analytics technology their backend system are located on cloud. Apart of cloud system operation and architecture. The inter network empower its life. Background: In our digital world , networks packet processing functions are dynamically injected into the network. Each…
-
CVE-2020-27977 – Vendor not explicitly explain the vulnerability details, but most likely is fall into this scenario (9th Nov 2020)
Preface: Have you heard a terms, so called take Ownership of his Registry key? Background: CapaSystems helps businesses achieve greater efficiency through Device Management and Monitoring by using CapaInstaller and PerformanceGuard. The purpose for the CapaInstaller Agent Health Check is to maintain a healthy and up to date agent on every computer/server. Vulnerability details: A…
-
Shibboleth vulnerability cve-2020-27978 – 28th Oct 2020
Preface: This vulnerability disclosed one year ago. Perhaps the details of defect you require to know. Background: Shibboleth is a web-based Single Sign-On infrastructure. It is based on SAML. Shibboleth does not carry out authentication itself. SAML (Security Assertion Mark-up Language) is an umbrella standard that covers federation, identity management and single sign-on (SSO). Vulnerability…
-
Design limitation of iDS6 DSSPro Digital Signage System 6.2 – 6th Nov 2020
Preface: Digital signage’s content is powered by a media player or system-on-a-chip which pushes content to a display.Users can then manage the content with a content management system. Background: Design limitation of iDS6 DSSPro Digital Signage System 6.2 . The vulnerability cause by autoSave password function.Since it is a pure unencrypted http traffic, it let…
-
CVE-2020-10143 – Macrium Reflect :Vendor slogan claims that there are 12 million of devices had installed their software around the world.
Preface: Sometimes vulnerability causes by misconfiguration. Vulnerability details: MinGW (http://www.mingw.org/) provides a complete Open Source programming tool set which is suitable for the development of native MS-Windows applications, and which do not depend on any 3rd-party C-Runtime DLLs. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are…
-
New variant of the Zebrocy (smqft_exe & sespmw_exe). They are design to perform various functions on the compromised system, said USCERT (3rd Nov 2020)
Preface: Some expert comment that because of Go language programming file will be large than usual. It might have possibilities to evade virus scanning. So malware author like to use. Perhaps this is not the major factor. Background: In July 2019, a security researcher found nearly 10,700 unique samples of malware written in Go programming…
-
If you are Incorporating Oracle Business Intelligence Results into External Portals or Applications, you should stay alert! Oct 2020
Preface: Integrating Oracle BI Presentation Services into Corporate Environments Using HTTP and JavaScript. Java made business operation perfect. Meanwhile, it make people headache! Background: When called from within an Oracle BI Presentation Services screen, such as a dashboard or an HTML result view, the URL should begin with the following characters: saw.dll?Go When called from…
-
CVE-2020-15157 – Vulnerability in Containerd (before version 1.2.14 )
Preface: Cloud computing build civilization chain. The strongest of AI, Smart City technology will be according to the foundation of cloud. Technical background: Google Container Registry (GCR) is a service in Google Cloud Platform (GCP) to manage your own docker container repository. This is fully managed service and you can store your custom container images…
-
VMware Horizon Server and VMware Horizon Client updates address multiple security vulnerabilities (CVE-2020-3997 & CVE-2020-3998) 22-10-2020
Preface: Cross-site scripting (XSS), is a type of attack in which malicious scripts are injected into websites and web applications for the purpose of running on the end user’s device. Background: VMware Horizon provides virtual desktop and app capabilities to users utilizing VMware’s virtualization technology. A desktop operating system – typically Microsoft Windows – runs…
-
Closer look of CVE-2020-1953 – it was impact Oracle OHF Self Service Analytics (20th Oct 2020)
Preface: As healthcare organizations look to reduce cost, IT rationalization and process transformation is accelerating as providers adopt cloud strategies. Background: Oracle Healthcare Foundation is a feature-rich analytics platform that supports more than 35 subject areas relevant to health data analytics,giving healthcare providers more granular data regarding the requirements of individuals and populations. Vulnerability details:…