-
Security Focus : CVE-2021-27610 – Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform (8th Jun, 2021)
Preface: The proof of concept for this vulnerability has been announced. As usual, vendors use their patch release cycle. Therefore, an announcement was issued today (June 8, 2021). Background: SAP NetWeaver is a software stack for many of SAP SE’s applications. It can be used for custom development and integration with other applications and systems,…
-
CVE-2021-20292 – Flaw found in Nouveau DRM subsystem (8th June 2021)
Preface: Nouveau is a free and open source graphics card driver. It is written for Nvidia’s graphics card and can also be used in the NVIDIA Tegra series of system chips. This driver is written by a group of independent software engineers. Nvidia sometimes will be assistance. Background: What is DRM subsystem? The Direct Rendering…
-
CVE-2021-28091 – Lasso incorrect assertion validation and verification – Published: 01 June 2021
Preface: This vulnerability affects other vendors’ use of this product for their single sign-on function. Background: Lasso is a free software C library aiming to implement the Liberty Alliance standards; it defines processes for federated identities, single sign-on and related protocols.Lasso is built on top of libxml2, XMLSec and OpenSSL and is licensed under the…
-
Strangers read your data silently, Smart City infrastructure no exception (VU#799380) 27thMay2021
Preface: Open data indeed is a foundation base of smart City. Since it is not only provide function. Meanwhile it also analyses the daily activities make the IoT function more efficiency. If no hacker in the world. We can living in world more comfortable because we do not need to concern about cyber security. As…
-
CVE-2021-23017 – Nginx DNS Resolver Off-by-One Heap Write Vulnerability (27-05-2021)
Synopsis: Retrospectively of 2019 Apache load balancer setup – Install Apache on the Load Balancer Server. Enable Proxy Server Modules. Configure Apache Load Balancing. The Apache server architecture includes the Apache Core and modules. Nginx found 2004, it is a performance-oriented HTTP server. Compared with Apache and lighttpd, it has the advantages of less memory…
-
VMware Releases Security Updates (CVE-2021-21985 & CVE-2021-21986) – May 26, 2021
Preface: There are plenty of astronomical events every year.In the evenings of 26 May 2021, it was total lunar eclipse. Do you believe rumours of super moon (astronomical phenomenon)? Background: Virtual SAN Health check plugin checks all aspects of a Virtual SAN configuration. It implements a number of checks on hardware compatibility, networking configuration and…
-
Exposes ring 0 code execution in the context of the driver, defense software perhaps will encounter this mistake (CVE-2021-31728 MalwareFox AntiMalware)
24th May, 2021 Preface: It let you avoid malware infection in your computer. MalwareFox can detect and remove malware in precise way. MalwareFox Antimalware at low cost comparing to other competitors. Background: In a computer, ioctl is a system call dedicated to the input and output operations of the device. The call receives a request…
-
Cyber Security Focus – use a Raspberry Pi for Windows 10 (17th May 2021)
Preface: Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display, and that runs on the Raspberry Pi 2 and 3. Background: ASP.NET Core is one of the best frameworks available to make cross-platform web applications. The free Windows 10 IoT Core along with…
-
Small storm in Big data world (CVE-2021-22135 & CVE-2021-22136) 13th May 2021
Preface: 3350 companies reportedly use Elasticsearch in their tech stacks, including Uber, Shopify, and Udemy. Background: Organizations can use big data analytics systems and software to make data-driven decisions that can improve business-related outcomes. Elasticsearch is a popular open-source searchand analytics engine for use cases such as log analytics, real-time application monitoring, and click stream…
-
CVE-2021-23134 : Linux – the implementation of nfc sockets contains flaw ! (12th May 2021)
Preface: Near field communication (NFC) technology lets smartphones and other enabled devices communicate with other devices containing a NFC tag. Vulnerability details: Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.2 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local…