-
Node.js hits arbitrary command injection (CVE-2018-13797)
Node.js framework become popular today. Node.js can build the application on ethereum (cryptocurrency). Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript engine. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js’ package ecosystem, npm, is the largest ecosystem of open source libraries in the world. Meanwhile, npm is…
-
Integer overflow weakness similar kill the Ethereum. But SafeMath to protect from overflows.
Integer overflow weakness similar kill the Ethereum – for more details, please see below (url): Jul 2018 – Integer overflow may killed Ethereum! But SafeMath to protect from overflows. c >= a causes integer overflow happen arithmetic: c=a+b-M (where M = 2**256 is the max unit256 plus one) If c >=a replace to get a…
-
Jul 2018 – PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file)
CVE-2018-12882 – PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) Use-After-Free vulnerabilities are a type of memory corruption flaw that can be leveraged by hackers to execute arbitrary code. Refer to statistic, PHP Version 5 is used by 82.0% of all the websites who use PHP. How about this vulnerable version?…
-
See whether Bitcoin signatures do not comply with RFC 6979
Have you heard a song by Dinah Washington ? The song title is what a difference a day made? In crypto currency world, bitcoin is the big brother. However technology world still concerns Bitcore signatures is able to comply with RFC 6979 specification? Bitcoin owner must protect the private key. The conceptal idea is that…
-
Attention: Stay Alert – Multiple Vulnerabilities in PHP Could Allow for Arbitrary Code Execution
Preface: PHP is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. Security concern by security experts The security issues are typically exposed when PHP code makes use of system-level calls. Found critical security problem today! – Original release date: April 27, 2018 The…
-
Realistic threats exists in NFC. Are they all secure?
The mobile payment is aggressive in some sort of area. As seen, it fully utilized in China market. From the economey point of view, this new payment design driven the retail business in parallel. The traditional banknote concept convert to digitalization silently.Is this a prelude of digital currency? The people doubt of the NFC (near…
-
Why REST (API) is so popular? But how to hardening the API security features?
REST (API) is key component to building powerful, scalable web-based applications today. So how to enhance the security feature, since it is working with HTTP communication method. Thence: 1. We should ensure that the HTTP method is valid for the API key/session token and linked collection of resources, record, and action. 2. Authentication – It is better to…
-
Firebase Analytics – To be compliance or not to be compliance on personal privacy
Perhaps the scandal of Facebook and awaken people in the world concerning their personal privacy. Meanwhile web surfing behavior is a major element to do the behaviour analytic. Now we fully understand the influence power of social media platform. However the analytic function not only valid today. Firebase is a mobile and web application development…
-
Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions
Computer technology world vulnerability exposure can’t slow down. A design weakness on Bouncy Castle BKS-V1 keystore files found. If you are a java program developer. It is a alert signal. The Bouncy Castle APIs consist of the following: A lightweight cryptography API for Java and C#. A provider for the Java Cryptography Extension (JCE) and the…
-
Application security awareness – Before Html5 full cover up, we must stay alert of Html4
Preface: The bitcoin mining malware, cyber espionage program and malicious malware merely relies on iframe. Where are they from? Understanding Frame: The main advantage of frames is that it allows the user to view multiple documents within a single Web page. It is possible to load pages from different servers in a single frameset. iframe:…