-
CVE-2019-0188 Apache Camel XML External Entity Injection Vulnerability – May 2019
Preface: The computing market trending on open source development and thus its growth rapidly. Believe it or not, see how many Apache server running now. Apache Camel background: You can use MQ (message queues) to enable applications to communicate at different times and in many diverse computing environments. This is the famous vendor proprietary toys…
-
Previous vulnerabilities, today’s emergency alert – 1st June 2019
Preface: If the victim of cybersecurity is a defensive device? What you can do? Background: Leading players in the Global It Asset Management (Itam) Software Market Research Report are: HP, Cherwell Software, Oracle & Dell KACE . Vulnerability details: The Dell Kace K1000 Appliance contains multiple vulnerabilities, including a blind SQL injection vulnerability and a…
-
CVE-2019-5018 Sqlite3 Window Function Functionality Use-After-Free Vulnerability
Preface: Use-After-Free vulnerability similar animal ruminating. Background: SQLite3 is a compact free database you can use easily create and use a database. It has become very popular with smart phone developers. SQLite runs many different computer systems such as Apple OS X, Linux, and Windows. Even though Airbus, they are the SQLite3 user. Vulnerability details:…
-
CVE-2019-10132 – libvirt virtlockd-admin.socket & virtlogd-admin.socket systemd Privilege Escalation Vulnerability (May 2019)
Preface: Business computing architecture now go to virtualization world, perhaps it is hard to imagine in five year ago! Technical background: The libvirt library is used to interface with different virtualization technologies. It is accessible from C, Python, Perl, Java and more. Meanwhilethe libvirt project supports KVM, QEMU, Xen, Virtuozzo, VMWare ESX, LXC & BHyve.…
-
CVE-2019-0911 Microsoft Edge and Internet Explorer Scripting Engine Memory Corruption Vulnerability – May 2019
Synopsis: As time goes by, cyber criminals formulated phishing scam through email and website visit. It seems to be a main trend. In order to avoid the attack occurs, home users installing antivirus program including malware detector, virus protection and predictive control. If web browser contains vulnerability? What we can do? Vulnerability details: A remote…
-
CVE 2019-11634 Citrix Workspace App before 1904 for windows has incorrect access control – 22nd May 2019
Preface: VDI (Virtual Desktop Infrastructure), one of the way make your IT operations secure. Product overview: Citrix Workspace Suite is a collection of Citrix products that deliver secure access to desktops, data, applications and services to subscribers on any device, and on any network. Vulnerability details: Citrix Workspace App before 1904 for Windows has Incorrect…
-
CVE-2019-11328 Singularity 3.1.0 to 3.2.0-rc2 defect causes privilege escalation on the host – May 2019
Preface: We might have had a debate about the definition of a powerful-enough computer to be called a supercomputer or HPC system. Technical background: When Docker creates a container, it creates a new instance of the above six namespaces, and then puts all the processes in the container into these namespaces, so that processes in…
-
Siemens security advisory – Multiple Vulnerabilities in SIMATIC WinCC, SIMATIC WinCC Runtime,SIMATIC PCS7,SIMATIC TIA Portal (May 2019)
Preface: DCOM is a proprietary Microsoft technology for communication between software components on networked computers. Technical background: High-Level applications use the DCOM client to obtain object references and make ORPC calls on the object. The DCOM client uses the RPC Protocol Extensions to communicate with the object server. Vulnerability details: An authenticated attacker with network…
-
RSA security advisory: CVE-2019-3724 & CVe-2019-3725 – 9th May 2019
Preface: Gartner Reports give people direction, but sometime as a customer, you can select your appropriate product on your decision. For instance cyber security product Technical background: SIEM software products provides real-time analysis of security alerts generated by applications and network hardware. Netwitness can investigate data capture and display the real scenario on screen.It is…
-
CVE-2019-12098 – Heimdal design limitation causes man-in-the-middle attack Vulnerability – 20th May 2019
Preface: Before Kerberos, Microsoft used an authentication technology called NTLM. Technical background: The biggest difference between the two systems is the third-party verification and stronger encryption capability in Kerberos. Kerberos version 4 was targeted at Project Athena in 80s. Neuman and Kohl published version 5 in 1993 to improve the limitations and enhance the security.…