Preface: CODESYS is the leading manufacturer-independent IEC 61131-3 automation software for engineering control systems.However the design weakness jeopardize the Industrial world. Highlights: According to the CVE announcement on 30th September 2020. A series of WAGO PLC-ETHERNET fieldbus controllers are vulnerable to cyber attack. Vulnerability details: The authentication can be disabled for the port 11740 when…

Preface: So far, it is difficult to detect the PendingIntent vulnerability from a tool. Background: “PendingIntends” insecure usage can lead to serverBY exploiting vulnerable but benign applications that are in securely using PendingIntents. A malicious application without any permissions can perform many critical operations, such as sending text messages (SMS) to a premium number. Known…

Preface: Cutting-edge technology companies like open source software. Big data analytics companies may need to pay attention. Observation: According to our observation for advanced technology development firm. No matter they are small size or it is a enterprise firm. They do not mind to use the opensource software application. From business point of view, since…

Preface: On a Linux system, chmod never changes the permissions of symbolic links; the chmod system call cannot change their permissions. This is not a problem since the permissions of symbolic links are never used. However, for each symbolic link listed on the command line, chmod changes the permissions of the pointed-to file. VULNERABILITY DETAILS:…

Preface: AVEVA has reached agreement to acquire OSIsoft, a pioneer and global leader in real-time industrial operational data software and services. Background: Under normal circumstance, authorized user can navigate to the ASMX file through your browser. So, you can fill in the form with the parameters and post to the DB. If attacker finds the…

Preface: JerryScript is the lightweight JavaScript engine intended to run on a very constrained devices such as microcontrollers. Background: In traditional programming environment.The source code is passed through a program called a compiler, which translates it into bytecode that the machine understands and can execute. Internet of Things devices have serious constraints on CPU performance…

Preface: It is common for application developers to use open source as a reference. Synopsis: If you are consider or has been used the free source code to develop the seat-reservation-system.You should stay alert for vulnerabilities in this software product. Vulnerability details: Seat Reservation System 1.0 Unauthenticated SQL Injection (CVE-2020-25762)Seat Reservation System version 1.0 suffers…

Preface: CFB8 was created to have good error propagation properties over a noisy channel. It is well known that it is not fast; it is actually 16 times as slow, as it requires a block encrypt for each byte. Details: CVE-2020-1472, also known as “Zerologon,” was given a “critical” security rating from Microsoft. It has…

Preface: Companies large and small are using Rust in production all over the world, including Mozilla, Dropbox, npm, Postmates, Braintree and others. Vulnerability details: An issue was discovered in the sized-chucks crate through 0.6.2 for Rust CVE-2020-25791…CVE-2020-25796.Chunk:– Array size is not checked when constructed with unit() and pair()– Array size is not checked when constructed…

Preface: The popularity of NFC mobile payments is owed to its ease of use and improved security options. Near-field communication (NFC) enables smartphones to exchange data and function as a payment device. It stores the customer’s credit card details and allows the user to pay at NFC POS terminals through smartphones. Vulnerability details: In NFC,…