Cyber security technical information

Category: Potential Risk of CVE

  • Security focus – Fileless malware execution with powershell (27-08-2020)

    Preface: Modern Cyber Defense solution without difficulties detect malicious activities. For instance, applications need approved permissions before installation; and security software can scan files to be written, read, and/or executed to check for known signatures. But we still heard data breach incident occurred. Why? Detail description: On 26th Aug, 2020, US Homeland security published articles…

  • Learn about ATM technology through NCR vulnerabilities (26th Aug 2020)

    Preface: A few years ago, ATM attackers might have the opportunity to compromise ATM machines through this method (Raspberry Pi + Python + Wifi). It looks that it is not possible right now. Study Road Map: From a security perspective, the design weaknesses disclosed by the vendor this time are divided by 3 types.– Insufficient…

  • CVE-2020-7711- Pure Go repositories (goxmidsig) vulnerability – 23-08-2020

    Preface: SAML 2.0 implementation for Service Providers based on etree and goxmldsig, a pure Go implementation of XML digital signatures. Background: “nil” in Go that represents zero values for pointers, interfaces, channels, maps, slices and function types. Vulnerability Details: A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be…

  • CVE-2020-8620 can be transformed as a tool to bother DNS sinkhole function – 23 Aug 2020

    Preface: BIND (Berkeley Internet Name Domain) is the most commonly used DNS software on the Internet today. DNS servers that use BIND as server software account for about 90% of all DNS servers. Technical background: The BIND nameserver is based on a custom event queueing system that wraps around the libuv library (http://libuv.org) for performing…

  • Do not use insecure deserializer BinaryFormatter – 19th Aug 2020

    Preface: SharePoint is a web-based collaborative platform that integrates with Microsoft Office.So called WebParts”gadgets” that provide new functionality when added to a page. Background: On July 14, 2020, Microsoft released a security update to fix the vulnerabilities found in the .NET Framework, Microsoft SharePoint and Visual Studio. A proof of concept shown that attacker can…

  • Apache release security advisory for struts 2 (aug 2020)

    Preface: Struts2 OGNL is the expression language. OGNL is tightly coupled in Struts2 and used to store form parameters as java bean variables in ValueStack and to retrieve the values from ValueStack in result pages. ActionForm has the following responsibilities:Perform data security verification to prevent malicious data from entering the application. Vulnerability details: However, it…

  • SAP completes the remediation – Let’s review the flaw – CVE-2020-6286

    Preface: Path traversal vulnerability perhaps will be ignore by some people. But this design weakness similar provide a channel to attacker conduct a search. The vulnerability described in SAP security notes 2934135 contains with two different vulnerabilities. Background: SAP NetWeaver is a software stack for many of SAP SE’s applications.It can be used for custom…

  • Cyber security Focus – IE Scripting Engine Memory Corruption Vulnerability (11th Aug 2020)

    Preface: In Windows 10, there are two ways to uninstall Internet Explorer. Option 1:Turn Windows features on or off optionOption 2: Disable IE11 using PowerShell commands Open PowerShell and Run as administrator. Execute the following command:Disable-WindowsOptionalFeature -FeatureName Internet-Explorer-Optional-amd64 –Online Security Focus: CVE-2020-1380 – Scripting Engine Memory Corruption Vulnerability Even you turn off the Internet Explorer,…

  • CVE-2020-5413: vmware (kryo_codec) – Deserialization of Untrusted Data (Aug 2020)

    Preface: Serialization in Java is a mechanism of writing the state of an object into a byte-stream. It is mainly used in Hibernate, RMI, JPA, EJB and JMS technologies. The reverse operation of serialization is called deserialization where byte-stream is converted into an object. Product background: Spring Integration framework provides Kryo Codec implementations as an…

  • Operation technology environment – Staying Alert! (CVE-2020-15492)

    Preface: Computer technology enlightens the automation industry. Due to modern CNC (Computer Numeric Control) technology, tiny parts are easy to produce. Who is the hero of this industry? I believe it is CAD technology. Background: CAD administrators use INNEO “Startup TOOLS” to manage working environments including licenses and standardized library elements and maintain their correct…