-
July 2018 – CVE-2018-3754 All versions of query-mysql are vulnerable to SQL injection
As time goes by node.js and MYSQL database become another technology trend in IT world. Before Node.js, Javascript was only used for client-side development. It was necessary to use a different server-side programming language. Nowadays web applications deploy Javascript, making app deployment much easier and more efficient. But web application developer must staying alert. However…
-
Jul 2018 – PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file)
CVE-2018-12882 – PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) Use-After-Free vulnerabilities are a type of memory corruption flaw that can be leveraged by hackers to execute arbitrary code. Refer to statistic, PHP Version 5 is used by 82.0% of all the websites who use PHP. How about this vulnerable version?…
-
July 06, 2018 – Apple Releases Security Update for Boot Camp
WiFi connection seems secure when IT Department authenticating wifi users with windows active directory. A know issue told the world that WPA is not secure and therefore the WiFi authentication best practices jump to WPA2. From general point of view, we all focusing to WiFi access point, authentication protocol and encryption method. It looks that…
-
Sometimes he is your friend, but somtimes he is your enemy (CVE-2018-12907)
Have you been use Rclone? Rclone is an opensource tool for syncing to various forms of cloud storage. In Rclone 1.42, use of “rclone sync” to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL’s content to Google, because there is no validation of a URL…
-
TIBCO Security Advisory: June 26, 2018
The vulnerabilities that may allow for unauthorized information disclosure, remote code execution and allow for the disclosure of information looks a common topic in CVE list. Predictive models and analysis are typically used to forecast future probabilities. Applied to business, predictive models are used to analyze current data and historical facts in order to better…
-
Jun 2018 – SSL Forward Proxy vulnerability (CVE-2018-5527)
Since data privacy is the 1st pirority of objective in cyber world. We now internet connectivity heavy utilize of SSL cert. For instance SSL VPN, PKI, SSL web server,etc. Popular web portal receive large amount of connectiviies per second. And therefore the popluar solution is TCP offload. Install SSL server cert out of web server…
-
Jun 2018: Misbehaviour technique revealed (manipulate cryptocurrencies (ERC20 Tokens))
A liquidity trap is caused when people hoard cash, if the cryptocurrency exchange do the manipulation. As a result the suspect cryptocurrency exchange equivalent as a crook. The company headquartered in Hangzhou, China goal to identify cryptocurrency hidden vulnerabilities, expose zero-day exploits, and defend against emerging threats. On Jun 2018 two key misbehaviour techniques was…
-
Jun 2018 – ALL NIPPON Airways Security Advisories
ALL NIPPON Airways Security Advisories Airline application and protocol are proprietary in past 2 decades. The Airline terminal guarantee the reliability. Any counterfeit transaction or cyber attack no way to happen there. As times goes by, Airline industry react to develop mobile apps to expand the business function goal to cope with modern world. Japan airline…
-
Vault 7 re-engineering by hacker. They are aim to steal the cryptocurrency.
As far as we know, Notepad++ has been updated to version 7.3.3. It aim to remediate a vulnerability on notepad. Such vulnerability exploit by law enforcement to do the survillance. The specifics annoucement released by WikiLweaks on 2017 so called Vault 7. Wanna Cry Ransomware technology re-emngineering of Microsoft SMB weakness and jepodizing the world.…
-
30th Jun, 2018 – VMware releases security updates
VMware Releases Security Updates – June 30, 2018 VMware ESXi, Workstation, and Fusion contain multiple out-of-bounds read vulnerabilities in the shader translator. A local user can trigger an out-of-bounds memory read error in the shader translator to obtain potentially sensitive information or cause their virtual machine to crash. The browser’s built-in shader translation facilities, it…