Preface: A set of unsafe default configurations for LDAP channel binding and LDAP signing exist on Active Directory domain controllers that let LDAP clients communicate with them without enforcing LDAP channel binding and LDAP signing. This can open Active Directory domain controllers to an elevation of privilege vulnerability, said Microsoft. Notice: If you are a…

Preface: Currently, there are no known workarounds or mitigations for these vulnerabilities. Thankfully, the Redmond adds that the flaws are not publicly disclosed and that there are no known exploits in the wild. The firm credits Trend Micro’s Zero Day Initiative for privately disclosing the bugs. Background:From security point of view, attacker who keen to…

Preface: SAML implements a secure method of passing user authentications and authorizations between the identity provider and service providers. When a user logs into a SAML enabled application, the service provider requests authorization from the appropriate identity provider. Design weakness: The design weakness of SAML was not XML edge cases nor attacker stealing your signing…

Preface: Dedicated to the specific industry, so called operation technology. Details: Schneider Electric announce to public that their Easergy T300 has design weakness. When you go through the document (see below url). It official inform that you have to trust your source and make use of your firewall or VPN enforcing the protection. Perhaps you…

Preface: As of June 2020, Apache is used by 37.7% of all the websites. Versions Affected:Apache Tomcat 10.0.0 – M1 to 10.0.0 – M5Apache Tomcat 9.0.0. M1 to 9.0.35Apache Tomcat 8.5.0 to 8.5.55 Impact: An attacker could exploit this vulnerability to cause a denial-of-service condition. Background: HTTP/2 uses header compression which requires a strict commitment…

Preface: If you don’t use the VMware 3D graphics feature. Perhaps the remedy solution this week by vendors in 3D features fixed will not your focus. But how about USB feature? Background: To enable PCI devices to interrupt the CPU, all PCI devices on the PCI bus are assigned an IRQ number. The VMkernel uses…

Background: Magento is an e-commerce platform written in PHP atop the zend-framework, available under both open-source and commercial licenses. It is written in an advanced object-oriented idiom that uses the MVC pattern and XML configuration files, aiming for flexibility and extensibility. Vulnerabilities announced this week – HintsVendor have the right to remain vulnerability details and…

Preface: On Jul 2019, found vulnerability in the Windows Spatial Data Service could allow file deletion in arbitrary locations on Windows system found The official announcement this week state that Windows Spatial Data Service improperly handles objects in memory causes elevation of Privilege Vulnerability. Background: The Spatial Data Service is running as NT AUTHORITY\LocalService in…