-
CVE-2023-48105: Weakness in buffer boundary checks in wasm loader (23rd Nov 2023)
Preface: Decentralized AI is an approach to AI where the data and models are distributed across multiple devices, rather than being centralized in a single location. Such design benefits to AI infrastructure avoiding denial of service attack and let unknown technical matter occurs during this period. Background: Internet Computing aims to extend the capabilities of…
-
Do not contempt CVE-2023-6238: kernel: nvme: memory corruption via unprivileged user passthrough (22nd Nov 2023)
Preface: High-performance computing is a method of processing large amounts of data and performing complex calculations at high speed. HPC is well suited for AI, which uses large data sets and complex models. HPC and AI combined have use cases in the following areas: Predictive Analytics. Physics and Modeling. IO-Heavy HPC Computing: Requires systems that…
-
About CVE-2023-48223: Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. (20th Nov 2023)
Preface: How is JavaScript different from Java? · Java is an OOP programming language, and Javascript is an OOP description language. Background: JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and…
-
CVE-2023-20519 whether similar to CVE-2023-33250? (20th Nov 2023)
Preface: The term cloud native refers to the concept of building and running applications to take advantage of the distributed computing offered by the cloud delivery model. Cloud native involves cloud technologies like microservices, container orchestrators, and auto scaling. AMD 4th Gen EPYC CPU EPYC 97X4 processors, with up to 128 cores, deliver up to…
-
About PostgreSQL : CVE-2023-5869 (17th Nov 2023)
Preface: As a PostgreSQL database’s workload increases, the instance’s memory usage increases. Instances that consume lots of memory can create a performance bottleneck that can sometimes lead to out-of-memory issues. An integer overflow occurs when you attempt to store inside an integer variable a value that is larger than the maximum value the variable can…
-
The ins and outs of CVE-2023-23583 (16th Nov 2023)
Preface: The REP MOVSB/STOSB instruction can enhance fast strings attempts to move as much of the data with larger size load/stores as possible. So, a patch exposes ERMS feature to KVM guests in June 2011. Background: REP is a prefix that makes the processor repeat the following instruction. It decrements the RCX register each time…
-
CVE-2023-34060: Whether it hit this design weakness? (14th Nov 2023)
Preface: Before you start reading. Perhaps below two different url will lure your interest of this article. Please read 1 first, then 2 1:vCenter Server Appliance Web Console (VAMI) is removed from vCenter Server 6.0 – https://kb.vmware.com/s/article/2120477 2:Change VCSA 6.7 SSH port – https://communities.vmware.com/t5/VMware-vCenter-Discussions/Change-VCSA-6-7-SSH-port/td-p/1861744 Ref: The vCenter Server appliance is a preconfigured virtual machine that…
-
CVE-2023-47346: A vulnerability encountered on a 5G freeware. But do not contempt these technical factors. Perhaps it also encounter in other similar technology vendors.(14th Nov 2023)
Preface: The technology trend driven transformation in mobile communication world in global. Not only will mobile devices require more RAM to handle 5G-enabled multimedia applications and tasks, As a result, enhancing memory is key to unlocking the 5G future! Background: The free5GC is an open-source project for 5th generation (5G) mobile core networks. The ultimate…
-
The vendor did not provide details of CVE-2023-22107. Will similar vulnerabilities occur in the following scenarios? (13th Nov 2023)
Preface: When we see new vulnerability information posted on forums or NVD. According to market practice, suppliers have provided patches to customers in advance. Maybe they already received the patch earlier (few weeks ago). But a lot of vulnerability items not intend to disclose the details. Perhaps this is the way. It will reduce the…
-
CVE-2023-46604: Apache ActiveMQ is vulnerable to Remote Code Execution (10th Nov 2023)
Preface: While ActiveMQ is a traditional message broker, Apache Kafka is a distributed streaming platform designed to handle high-velocity, high-volume, and fault-tolerant data streams. It was originally developed at LinkedIn and later donated to the Apache Software Foundation. Background: ActiveMQ is open source, message-oriented middleware (MoM). It was written in Java with a full JMS…