Preface: On April 17, 2019, the National Information Security Vulnerability Sharing Platform (CNVD) recorded the Oracle WebLogic wls9-async deserialization remote command execution vulnerability reported by China Minsheng Banking Co., Ltd. Synopsis: There are reports of this vulnerability being actively exploited in the wild in April 2019. Vulnerability details: CVE-2019-2725 – A vulnerability has been discovered…

Preface: Error handling in PHP is still primitive. However you can code your way around most problems. Synopsis: From technical point of view, a JPEG file with malicious EXIF data, and a PHP code that executes it. This PHP code can be easily inserted into any other PHP file found in the server, probably not…

Preface: Operating system · Linux, NetBSD, FreeBSD, OpenBSD, macOS, Windows · Type · DNS server · License · Mozilla Public License (ISC license before 9.11). Website, www.isc.org/downloads/bind. BIND is the most widely used Domain Name System (DNS). Alert: A design limitation of BIND let remote attacker could exploit these vulnerabilities to cause a denial-of-service condition.…

Preface: Kiss O’Death Packet and Other NTP Vulnerabilities potentially turn back the Internet’s Clocks and causes unpredictable problem. NTP vulnerability – historical record: There was a loophole in 2013,, the attack relies on the exploitation of the ‘monlist’ feature of NTP, as described in CVE-2013-5211, which is enabled by default on older NTP-capable devices. This…

Preface: An IT ecosystem is “the network of organizations that drives the creation and delivery of information technology products and services. About urllib3: Much of the Python ecosystem already uses urllib. It brings additional features that are missing from the Python standard libraries. For instance – Client-side SSL/TLS verification, Helpers for retrying requests and dealing…

Preface: In general, Ruby is a good language for game development. Apart from that Ruby has been used by companies like Twitter, Airbnb, Shopify, Github, Slideshare, Basecamp and Shopify. Synopsis: RubyGems is a package manager for the Ruby programming language that provides a standard format for distributing Ruby programs and libraries (in a self-contained format…

Preface: When I was young, I am afraid for Injection therapy. Yes, is my butt. Perhaps such circumstance is also apply to software application system! Synopsis: Magento Commerce, providing end-to-end solutions that suit clients’ needs. Vulnerability details: A vulnerability in Magento could allow an unauthenticated, remote attacker to conduct an SQL Injection attack against a…

Preface: A browser engine is a core software component of every major web browser. Apart of “browser engine”, two other terms are in common use regarding related concepts: “layout engine” and “rendering engine” Synopsis: A rendering engine is used by a Web browser to eender HTML pages, by mail programs that render HTML email message,…