Preface: Kiss O’Death Packet and Other NTP Vulnerabilities potentially turn back the Internet’s Clocks and causes unpredictable problem. NTP vulnerability – historical record: There was a loophole in 2013,, the attack relies on the exploitation of the ‘monlist’ feature of NTP, as described in CVE-2013-5211, which is enabled by default on older NTP-capable devices. This…

Preface: An IT ecosystem is “the network of organizations that drives the creation and delivery of information technology products and services. About urllib3: Much of the Python ecosystem already uses urllib. It brings additional features that are missing from the Python standard libraries. For instance – Client-side SSL/TLS verification, Helpers for retrying requests and dealing…

Preface: In general, Ruby is a good language for game development. Apart from that Ruby has been used by companies like Twitter, Airbnb, Shopify, Github, Slideshare, Basecamp and Shopify. Synopsis: RubyGems is a package manager for the Ruby programming language that provides a standard format for distributing Ruby programs and libraries (in a self-contained format…

Preface: When I was young, I am afraid for Injection therapy. Yes, is my butt. Perhaps such circumstance is also apply to software application system! Synopsis: Magento Commerce, providing end-to-end solutions that suit clients’ needs. Vulnerability details: A vulnerability in Magento could allow an unauthenticated, remote attacker to conduct an SQL Injection attack against a…

Preface: A browser engine is a core software component of every major web browser. Apart of “browser engine”, two other terms are in common use regarding related concepts: “layout engine” and “rendering engine” Synopsis: A rendering engine is used by a Web browser to eender HTML pages, by mail programs that render HTML email message,…

Preface: This advisory is part of the March 2019 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication, which includes 25 Cisco Security Advisories that describe 26 vulnerabilities. Synopsis: A digital signature (not digital certificate) is a mathematical technique used to validate the authenticity and integrity of a message, software or digital document. Vulnerability details:…

Preface: public class CGIServlet – extends javax.servlet.http.HttpServlet(CGI-invoking servlet for web applications, used to execute scripts which comply to the Common Gateway Interface (CGI) specification.) Synopsis: Tomcat implements several Java EE specifications including Java Servlet, JavaServer Pages (JSP), Java EL, and WebSocket, and provides a “pure Java” HTTP web server environment in which Java code can…