-
About CVE-2023-33962 – JStachio fails to escape single quotes in HTML (31st May 2023)
Preface: About 20 years ago, people know java is unsafe. Perhaps of technology trend, so whatever the design appyling java language. The flexibility and easy to use will let people contempt about awareness of cyber security. While Java is considered relatively safe because it is a server side language, there are still multiple ways to…
-
CVE-2023-32067 – c-ares is vulnerable to denial of service (30th May 2023)
Preface: c-ares is a C language implementation of asynchronous request DNS. When using c-ares, you usually only need to reference the ares.h header file, and the related header files of the library are included. Background: For some asynchronous DNS requests, Node[.]js uses a C library called c-ares.So called Async DNS – This feature bypasses the…
-
About CVE-2023-32695 – A patch has been released in socket[.]io-parser version 4.2.3.
Preface: In technical aspect, a Socket[.]IO server can sustain 10,000 concurrent connections. Therefore you can build a chat experience and using Socket[.]IO as your realtime communication solution. But if you want chat users to receive push notifications when they’re not actively using the app, Socket[.]IO can’t help, as it relies on a persistent socket connection.…
-
CVE-2022-33302 – Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.(25th May 2023)
Preface: Perhaps you feeling that it’s not follow best practice when it is a zero-day matter. Seems this CVE was late published. The fact is that the impact look serious. So before vendor resolve the problem. Vendor do not intent disclose to public. But problem resolved now. Background: The User Identity Module may contain information…
-
About CVE-2023-21930, new CVE added on 16th May 2023 by Oracle (24th May 2023)
Preface: Oracle Linux is an optimized and secure operating environment for application development and deployment. Oracle Linux 9 with UEK R7 provides kernel, performance, and security enhancements.On 16th May 2023 Oracle added second revise on their bulletin which held on April 2023. In NVD CVE publications advisories, CVE-2023-21930 also provided lasted update on 27th April…
-
CVE-2023-32413 A race condition occurred in process state handling. It is very common in OS systems, be it Linux or Microsoft Windows. (23rd May 2023)
Preface: A race condition vulnerability typically occurs when your application has access to the same shared data and attempts to change variables within it simultaneously. Applications can become vulnerable to race conditions if they interact with other applications that use parallel processing or multiple threads. Background: A process describes an individual running instance of a program.…
-
About CVE-2023-33252 – Similar concern for cyber security today, it also apply to future digital world Artificial intelligence zone. (22nd May 2023)
Preface: Foreseeing the continuous development of artificial intelligence, use blockchain technology for network communication is a must.A blockchain is a distributed database or ledger shared among nodes in a computer network. They are known for their key role in maintaining a secure and decentralized record of transactions in cryptocurrency systems, but they are not limited…
-
CVE-2023-31655 Crash while running redis-7.0.10 with the redisraft-cd52ee4.(19th May 2023)
Preface: What does the ERROR: Segmentation violation mean?Traditionally, a “segmentation violation” is a signal sent by the kernel to a process when the system has detected that the process was attempting to access a memory address that does not belong to it. Typically, this results in the offending process being terminated. Background: A process describes an…
-
Dig out details on CVE-2023-20877 – VMware fixed this matter already. (18th May 2023)
Preface: If you have set “Read& Execute“ permission to everyone on parent folder, and not disable inheritance permission on the subfolder, in theory, subfolder permission should inherit the parent folder permission. Background: VMware Aria Operations is a unified, AI-powered self-driving IT operations management platform for private, hybrid & multi-cloud environments.You can execute scripts from the…
-
About Ryzen 6000 design weakness CVE-2021-26365, CVE-2021-26365 & CVE-2021-46765 (17th May 2023)
Preface: Based on limited details provided by CPU vendor. Based on the steps shown in the diagram, try to speculated that where the vulnerability is located. Background: With the introduction of the Ryzen 5000-series Zen 3, AMD leads in gaming performance (especially in single-threaded performance). Announced on January 4, 2022, the Ryzen 6000 mobile-specific series…