-
Above CVE-2021-42252 (11th October, 2021)
Preface: Linux mainly uses a paging mechanism to achieve virtual memory management. The size of the memory page is PAGE_SIZE bytes instead of 4 KB. On different platforms, the page size can range from 4 KB to 64 KB. Background: The Aspeed BMC family which is what is used on OpenPOWER machines and a number…
-
About Apache HTTP Server 2.4.49 and 2.4.50 – CISA urges organizations to patch immediately if they haven’t already (7th Oct 2021)
Preface: the most famous UTF-8 attack was against unpatched web server. Background: The most common users of Apache HTTP Server are from Small Businesses and the Information Technology & Services industry. Perhaps How to Check the Apache Version? Open terminal application on your Linux, Windows/WSL or macOS desktop. Login to remote server using the ssh…
-
If your IoT development is based on Zigbee,perhaps Zephyr CVE will bring to your consideration. (6th Oct 2021)
Preface: Ensure that the JSON parser does not try to write a potentially unlimited number of elements into a C array of a fixed size. Background: Zephyr is a small real-time operating system (RTOS) for connected, resource-constrained and embedded devices (with an emphasis on microcontrollers) supporting multiple architectures and released under the Apache License 2.0.…
-
About CVE-2021-29249, IoT vendor should stay alert! (1st Oct, 2021)
Preface: BPF is available on most Unix-like operating systems and eBPF for Linux and for Microsoft Windows. In addition, if the driver for the network interface supports promiscuous mode, it allows the interface to be put into that mode so that all packets on the network can be received, even those destined to other hosts.…
-
About CVE-2021-20034 – (SMA 100 series) Unauthenticated SMA100 arbitrary file delete vulnerability – 27th Sep 2021
Point of view: More than 20 years ago, the firewall function was independent, excluding the firewall policy service and vpn function.The advantage is that when the firewall box is compromised. Nothing else will be found in the box by the attacker.Over time, the trend of unified threat management has grown. From a technical point of…
-
About BTCPayment server – CVE-2021-3830 (26th Sep, 2021)
Preface: Cryptocurrency look like myth. Someone avoid to use. But somebody like it. If Cryptocurrency only provide payment function. That is no investment value. Furthermore if someone going to transfer money will be know who is sender and recipient. If it come true, what is the result? Background: BTCPay Server is an open source, P2P…
-
It is not mystery. The findings address that an original function for CEIP feature is able to misuse (CVE-2021-22005) – 22nd Sep, 2021
Preface: Rapid7 Labs estimates there are over 2,700 vulnerable vCenter servers exposed to the public internet. Background: As of May 1 2020, the Pivotal Telemetry program is governed by VMware’s Customer Experience Improvement Program.Data and continuous feedback loops play an important role in shaping the way Pivotal builds software. VMware analytics service consists of components…
-
Closer look – CVE-2021-25751 (21-09-2021)
Preface: As we know that Kubernetes (K8s) is a container orchestration tool and Docker helps to create a container that is managed by us using Kubernetes. Background: What is subPath in volume mount?Subpath references files or directories that are controlled by the user, not the system. Volumes can be shared by containers that are brought…
-
CVE-2021-22941 – May be it is not related, or else was getting the User Enumeration incident waiting to happen (17-09-2021)
Preface: With storage zones controllers, the ShareFile Software-as-a-Service (SaaS) cloud storage also offers private storage for ShareFile data, which is known as storage zones. What is the difference between Dropbox and ShareFile?The goal of ShareFile is to help your team easily share, sync and store large files from any device without compromising important data. And…
-
IS there any related security matter of session (CVE-2021-37535)?
Preface: Did you check your JMS Security Authorization, fix your JMS application immediately. Background: The basic building blocks of a JMS application are: Administered objects: connection factories and destinations Connections Sessions Message producers Message consumers Messages The JMS Connector Service is an enterprise messaging system that provides a way for business applications to exchange datawithout…