Preface: An XML External Entity (XXE) attack is a type of attack against an application that parses XML input. Furthermore, SSRF is an attack in which an attacker can force a vulnerable server to trigger malicious requests to third-party servers and or to internal resources. Background: SAP Enterprise Portal is the Web front-end component for…

Preface: Vulnerability management is included in the security development life cycle. Maybe you’ll be concerned about vulnerabilities. In fact, computer products (software and hardware) are hard to avoid without design flaws. This is the reality. Background: Fastjson is Alibaba’s open source JSON parsing library, based on the Java language, which supports the conversion between JSON-formatted…

Preface: Hard to speculate that what is this technique (Ill-formed headers). Whether we can apply the following method that google experts exploited before. Background: Istio enables organizations to secure, connect, and monitor microservices, so they can modernize their enterprise apps more swiftly and securely. Istio manages traffic flows between services, enforces access policies, and aggregates…

Preface: It is not uncommon to rewrite the bootloader during a cyber attack, malicious code present in the bootloader will be executed after restart. After this, the code will hijack the Linux boot process in memory and then download and execute the malware with root privileges. Finally, the downloaded program attacks other devices through password…

Preface: According to the information provided by the supplier. This vulnerability was reported on April 5, 2022. But we didn’t see that record until this month. Background: Samsung Kies is the official tool from Samsung for Android devices. Using Samsung Kies, you can view apps in full screen on your Windows, no matter what network…

Preface: Packet filtering are divided into two categories : Stateless (Packet filtering) – Stateless is the polar opposite of stateful Stateful (Packet filtering)Stateless (Packet filtering): It is also known as an access control list (ACL), does not store information on the connection state. Stateless ACLs are applicable to the network and physical layers, and sometimes…

Preface: Move the TCP hashtable functions/structs to inet_hashtables.[ch] , it was happened 17 years ago.On April 27, 2022, in an unpublished paper, report that clients can be accurately identified by forcing them to issue 40 times more connections than the number of entries in table_perturb[ ] Table, indexed by hash-joined tuples.The current 2^8 setup allows…

Preface: The official release of the vulnerability did not elaborate. So we don’t know what happened? Maybe you can use speculation. Even if you can’t figure out the root cause, it will let you know more about your Edge browser. Background: The new Microsoft Edge is based on Chromium and was released on January 15,…

Preface: Login with key is safer than password login, and password login is easily intercepted. Background: Net Framework is a software development platform developed by Microsoft for building and running Windows applications. The . Net framework consists of developer tools, programming languages, and libraries to build desktop and web applications. It is also used to…

Preface: mruby or mruby/c, mruby / c is an implementation of mruby that inherits the features of Ruby and consumes less memory than the conventional mruby (lightweight Ruby for embedded systems developed in Fukuoka). Dassai｜Asahishuzo – (日本獺祭（旭酒造）) also uses mruby/c to develop winery-related monitoring equipment. Background: mruby is a Fukuoka-developed programming language for embedded software.…