-
Forcedentry vulnerability break through iPhone steel door 13th Sep 2021
Preface: These aren’t objects in the “ object-oriented programming” sense of the word; instead, they are the building blocks on which PDF stands. There are nine types of objects: null, Boolean, integer, real, name, string, array, dictionary, and stream. Background: The Pegasus spy program created by NSO uses a zero-day vulnerability in Apple’s operating system…
-
Security Focus, CVE-2021-28701 on Citrix Hypervisor (9th Sep, 2021)
Preface: You can use Citrix Hypervisor in an unlicensed state. However, you do not have access to some features. To access Citrix hypervisor is easy, go through XenCenter then input user ID and password. Background: Citrix Hypervisor is a high-performance hypervisor optimized for virtual app and desktop workloads and based on the Xen Project hypervisor.…
-
OpenStack Neutron (CVE-2021-40797) – 8th Sep, 2021
Preface: OpenStack Neutron is an SDN networking project focused on delivering networking-as-a-service (NaaS) in virtual compute environments. Neutron has replaced the original networking application program interface (API), called Quantum, in OpenStack. Background: The Web Server Gateway Interface (WSGI) is a simple calling convention for web servers to forward requests to web applications or frameworks written…
-
U.S. Homeland Security Alert (CVE-2021-40444) – 7th Sep, 2021
Preface: Windows RCE vulnerabilities have targeted Office users, and Microsoft urgently provides mitigation instructions. Background: The MS web browser COM control adds browsing, document, viewing, and downloading capabilities to your applications. Parsing and rendering of HTML documents in the WebBrowser control is handled by the MSHTML component which is an Active Document Dynamic HTML (DHTML)…
-
Fortinet’s CVE makes you have questions? How many unknown vulnerabilities remain undiscovered in the REST API framework!(CVE-2021-2400 – 6th Sep 2021)
Preface: Dashboard, a popular design trend concept in the digital world.Dashboard, a popular design trend concept in the digital world.As the cloud and the Internet of Things force the network to evolve. Even operational work and network security can be managed in thesame dashboard. Background: Permission checks will typically use the authentication information in the…
-
CVE-2020-13929: Apache Zeppelin: Notebook permissions bypass (2nd Sep, 2021)
Preface: Big data analysis can understand data by discovering trends and patterns. Machine learning can accelerate this process with the help of decision-making algorithms. It can classify incoming data, recognize patterns, and transform the data to do the technology development. In addition, it is a way to develop artificial intelligence. Background: What is Apache Zeppelin…
-
CyberArk – CVE-2021-31798 (Quick and dirty way to understand the details) – 1st Sep, 2021
Preface: Cyberark provides the perfect authentication solution for enterprises. Because of their solutions, traditional authentication methods have evolved. However, there is no absolute anti-hacking solution in the world. The following explanation is to let you quickly understand this vulnerability. Even if this is not the right way, you will find out what they are doing.…
-
Do you think CVE-2020-20486 (IEC104 v1.0) will impact your services? (31st Aug 2021)
Preface: IEC 60870-5-104 protocol (aka IEC 104) is a part of IEC Telecontrol Equipment and Systems Standard IEC 60870-5 that provides a communication profile for sending basic telecontrol messages between two systems in electrical engineering and power system automation. Background: IEC 104 enables communication between control station and a substation via a standard TCP/IP network.…
-
Not a critical flaw, but it is commonly found on web UI applications – VMware vRealize log Insight (CVE-2021-22021) – 24-8-2021
Preface: Log event collection without data normalization , it is hard to managed. And you will be crazy. If you do not have log event aggregation and correlation functions. Your IT life will become not easy. Background: vRealize Log Insight delivers indexing and machine learning based Intelligent Grouping, to enable searching, for faster troubleshooting across…
-
Another flaw prompted an urgent U.S. government warning and providing Guidance (Azure Cosmos DB) – 29th Aug 2021
Preface: Data scientists are big data wranglers, gathering and analyzing large sets of structured and unstructured data. Jupyter Notebooks allow data scientists to create and share their documents, from codes to full blown reports (Help them streamline their work). Background: Azure Cosmos DB built-in Jupyter Notebooks are directly integrated into the Azure portal and Azure…