-
CVE-2018-11793: Apache Mesos JSON Payload Parsing DoS Vulnerability 5th Mar 2019
Preface: Apache Mesos is an open-source project to manage computer clusters. It was developed at the University of California, Berkeley. About Payload in Web services: Typically the term payload refers to JSON-formatted text that is either posted (via an http POST) to a web service when a user creates a resource or returned from a…
-
Cisco Event Response: March 2019 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. 6th Mar 2019
Preface: The urgent announcement by Cisco might scare the customer of Cisco. It is about the vulnerabilities found on Cisco FXOS and NX-OS Software. But no worries, Cisco managed it. Technical background: Cisco NX-OS based on Wind River Linux and is inter-operable with other Cisco operating systems. The command-line interface of NX-OS is similar to…
-
Unknown vulnerability Found Affecting Intel CPUs – 5th Mar 2019
Preface: So called Spoilter, a vulnerability given by Intel CPU design limitation. If hacker successful exploit such vulnerability. They can conduct “Rowhammer” attack for privileges escalation. Vulnerability detail: The speculative execution function of Intel’s processors aim to increase the performance of a CPU. Meanwhile it caused Intel CPU vulnerability issues in the past. A new…
-
Former vulnerability (CVE-2018-20033 (flexnet_publisher) ) – But enterprise firm must be vigilant! vigilant!
Preface: FlexNet Publisher (formerly known as FLEXlm) is a software license manager from Flexera Software which implements license management and is intended to be used in corporate environments to provide floating licenses to multiple end users of computer software. Vulnerability background: The design weakness found on 2018. But the official announcement was release on 2019-01-28.…
-
About Node.js vulnerabilities – Mar 2019
Preface: Node.js is popular in technology world. No matter crypto or distributed ledger platform, Docker development, REST API…etc can deploy by node.js. About node.js? Node.js is a JavaScript runtime environment that processes incoming requests in a loop, called the event loop (initialization and callbacks) and offers a Worker Pool to handle expensive tasks like file…
-
CVE-2019-6690: Improper Input Validation in python-gnupg
Preface: Python provides the essential programming language for smart devices and solutions for the Internet of Things and Industry 4.0. Technical background: When you use AES128 encrypt string, if the encrypted string is too long. It will contain \r\n in it. Actually, the encryption output is an array of 8-bit bytes, not characters. The code…
-
The hospital and healthcare industry must be vigilant! vigilant! (CVE-2019-7816 – 2nd Mar 2019)
Preface: Medical software manufacturer uses Adobe ColdFusion to more securely collect electronic clinical outcome assessment (eCOA) data.Digital solutions company uses Adobe ColdFusion to help midmarket companies manage eCommerce more effectively. Some expert predicted that ColdFusion was losing the market but he is still alive. Critical statement of this vulnerability and remedy. This attack requires the…
-
Who is right, who is wrong. Who know?
Preface: Spy Chip Scandal Amplifies Concerns over Huawei’s 5G Equipment on last year (2018). Doubt – Is it safe to use Huawei phones and should the manufacturer be trusted to make 5G network equipment? Reality: A flaw discovered in an ASN.1 compiler, a widely used C/C++ development tool, could have propagated code vulnerable to heap…
-
CVE-2019-9020 PHP xmlrpc_decode() Function Invalid Memory Access Vulnerability – 27th Feb 2019
Preface: xmlrpc_decode — Decodes XML into native PHP types Vulnerability detail: The vulnerability is due to improper input validation by the xmlrpc_decode() function of the affected software. Impact: A successful exploit could cause a heap out-of-bounds read or read-after-free condition, which could result in a complete system compromise. Remedy: PHP has released software updates at…
-
CVE-2019-1663 Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability – 27th Feb 2019
Preface: Huge rise in hack attacks as cyber-criminals target small businesses. For the Average Hacker, Your Small Business Is an Ideal Target . Vulnerability detail: Improper Restriction of Operations within the Bounds of a Memory Buffer. And therefore causes vulnerability encounter on Management Interface to trigger Remote Command Execution. Don’t become a botnet soldier! Cisco…