Preface: Dedicated to the specific industry, so called operation technology. Details: Schneider Electric announce to public that their Easergy T300 has design weakness. When you go through the document (see below url). It official inform that you have to trust your source and make use of your firewall or VPN enforcing the protection. Perhaps you…

Preface: As of June 2020, Apache is used by 37.7% of all the websites. Versions Affected:Apache Tomcat 10.0.0 – M1 to 10.0.0 – M5Apache Tomcat 9.0.0. M1 to 9.0.35Apache Tomcat 8.5.0 to 8.5.55 Impact: An attacker could exploit this vulnerability to cause a denial-of-service condition. Background: HTTP/2 uses header compression which requires a strict commitment…

Preface: If you don’t use the VMware 3D graphics feature. Perhaps the remedy solution this week by vendors in 3D features fixed will not your focus. But how about USB feature? Background: To enable PCI devices to interrupt the CPU, all PCI devices on the PCI bus are assigned an IRQ number. The VMkernel uses…

Background: Magento is an e-commerce platform written in PHP atop the zend-framework, available under both open-source and commercial licenses. It is written in an advanced object-oriented idiom that uses the MVC pattern and XML configuration files, aiming for flexibility and extensibility. Vulnerabilities announced this week – HintsVendor have the right to remain vulnerability details and…

Preface: On Jul 2019, found vulnerability in the Windows Spatial Data Service could allow file deletion in arbitrary locations on Windows system found The official announcement this week state that Windows Spatial Data Service improperly handles objects in memory causes elevation of Privilege Vulnerability. Background: The Spatial Data Service is running as NT AUTHORITY\LocalService in…

Preface: In order to avoid the impact of the vulnerability. VMware do not provide the details for CVE-2020-3961. Synopsis: This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system. Vulnerability details: VMware Horizon Client for Windows contains a privilege escalation vulnerability due to folder permission configuration and…

Preface: Microsoft has released a security advisory to address a remote code execution vulnerability (CVE-2020-0796) in Microsoft Server Message Block 3.1.1 (SMBv3) on 11th Mar 2020. Synopsis: The proof of concept code vulnerability has been made public. Attacker do the exploit is that send a specially crafted packet to a targeted SMBv3 server. (refer to…

Preface: Bluetooth enabled consumer electronics such as mobile phones, cameras simplify data sharing between devices. For instance, smartphone can wirelessly connect to a headset to make hands-free calling easier or can send pictures to another. Background: The Bluetooth market has changed dramatically in the past three to four years. Perhaps is the potential power of…