-
iot devices security alert – cve-2019-14379 Aug 2019
What is Jackson Databind used for? Data Binding API is used to convert JSON to and from POJO (Plain Old Java Object) using property accessor or using annotations. It is of two type. Simple Data Binding – Converts JSON to and from Java Maps, Lists, Strings, Numbers, Booleans and null objects. What is Ehcache? Ehcache…
-
VMware Releases Security Updates for Multiple Products – August 3, 2019
Preface: Are GPU vulnerable to hacker attacks? Background: On virtual machines running VMware Fusion provides support for OpenGL 2.1 to support 3D accelerated desktops. It is not enabled by default on ESXi and is enabled by default on Workstation and Fusion. Vulnerability details: CVE-2019-5521 – may lead to information disclosure or may allow attackers with…
-
Have you heard of the “Capital one” data leak! July 2019
Cyber criminal is under arrested. She is accused of breaking into a “Capital One” computer facility and gaining access to 140,000 Social Security numbers, 1 million Canadian Social Insurance numbers and 80,000 bank account numbers. Security Focus : Cyber criminal is under arrested. She is accused of breaking into a “Capital One” computer facility and…
-
CVE-2019-10142 Freescale hypervisor management driver integer overflow in ioctl – jul 2019
Preface: The Freescale hypervisor management driver provides several services to drivers and applications related to the Freescale hypervisor. About: Integer overflows and other integer manipulation vulnerabilities frequently result in buffer overflows. An integer overflow occurs when an arithmetic operation results in a number that is too large to be stored in the space allocated for…
-
Urgent 11-Tremendous design limitation jeopardizes RTOS industry
Prefect: Headlines new – Critical VxWorks flaws expose millions of devices to hacking. What is VxWorks? The VxWorks RTOS comprises the core capabilities of the wind microkernel(not monolithic) along with advanced networking support, powerful file system and I/O management, and C++ and other standard run-time support. Vulnerability details: The vulnerabilities found on Wind River VxWorks…
-
Mitsubishi electric fr configurator2 – When input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Jul 2019
Preface: Internet of Vehicles (IoV) growth rapidly, meanwhile they are also the potential target of the cyber attacker. About Mitsubishi Electric FR Configurator2: From inverter startup to maintenance, FR Configurator2 allows the user to specify settings easily at the computer. Vulnerability details: CVE-2019-10976 – This vulnerability is triggered when input passed to the XML parser…
-
CVE-2019-4415 IBM Cloud Private privilege escalation Jul 2019
Preface: Refer to market statistic on 2018, the growth in cloud revenues appear to be the strongest for Microsoft and weakest for IBM. Vulnerability details: In IBM Cloud Private on OpenShift icp-scc SecurityContextContraints is erroneously assigned to all pods in all namespaces Remedy: For IBM Cloud Private 3.1.1 or 3.1.2: To resolve the issue, run…
-
CVE-2019-1579 VPN solution impacts Uber, other enterprises may be at risk Jul 2019
Preface: The IoT will make the Taxi Industry change.The business concept of Uber is the industrial leader. Perhaps their concept and ideas are advanced and therefore cyber security are their major concerns. Vulnerability details: Palo Alto Networks PAN-SA-2019-0020 (CVE-2019-1579): Remote Code Execution vulnerability in GlobalProtect Portal/Gateway Interface, especially on SSL Web VPN Applications. Vendor do…
-
CVE-2019-13132 Zeromq libzmq Stack Buffer Overflow Arbitrary Code Execution Vulnerability Jul 2019
Preface: Message queues are unnecessary and cause a lot of overhead (setup such system cab be a lot of work). Product background: Zeromq libzmq A simple synchronous system will just receive a request from the client, perform an operation (anything from retrieving some data from the server to uploading an image) and return a response.…
-
Even though you deployed SSL, stay alert in Python Iot world (CVE-2018-18074)
Preface: The invention of the IoT sensor looks like a contingent driving a smart city. At the same time, the python programming language gives life to the Internet of Things. Security Focus: Even though IoT devices and their back-end facilities deploy SSL certification. It cannot prevent data leakage because of programming language flaw. Vulnerability details:…