Preface: Industrial Ethernet has been the network of choice in factory auto-mation for many years and offers a powerful communication basis with PROFINET-based solutions. Vulnerability details: A vulnerability has been identified in Scalance X-200 (All versions), Scalance X-300 (All versions), Scalance XP/XC/XF-200 (All versions <V4.1). The monitor barrier of the affected products insufficiently blocks data…

Preface: The vulnerability if not require attacker conduct scam to persuade a user. It is a extreme dangerous vulnerability. Technical background of Kubernetes: Kubernetes (often referred to as K8s) is an open source system for automatically deploying, extending, and managing containerized applications. The system was designed by Google and donated to the Cloud Native Computing…

Alert: The Apache Software Foundation has released Apache HTTP Server version 2.4.39 to address multiple vulnerabilities. mod_auth_digest access control bypass (CVE-2019-0217) mod_ssl access control bypass (CVE-2019-0215) mod_http2, possible crash on late upgrade (CVE-2019-0197) CVE-2019-0211 bring to my attention. For the synopsis of this matter, please refer to attached diagram. Remedy: The Apache Software Foundation has…

Preface: Today, the stored password is not encrypted like walking around without clothes! Technical background: Portainer is a lightweight management UI which allows you to easily manage your different Docker environments (Docker hosts or Swarm clusters). It allows you to manage your all your Docker resources (containers, images, volumes, networks and more) ! It is…

Preface: Splunk is powerful, it can extract cookie of web connections. If client connection still alive, hacker can hijack and get the connection. Vulnerability details: A vulnerability in Splunk Python SDK could allow an unauthenticated, remote attacker to bypass security restrictions on a targeted system. An attacker could exploit this vulnerability by executing a man-in-the-middle…

Preface: Linus Benedict Torvalds, he is the principal developer of the Linux kernel, which became the kernel for many Linux distributions and operating systems. Vulnerability details: An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g.,…

Preface: Coding is the process of translating and writing codes from one language to another support operating system platform. What is Flatpak? If Linux user found that the new application not available in the App Stores. He can do the installation via the DEB or RPM packages. Some of them are available via PPAs (for…

Synopsis: session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session(sometimes also called a session key) to gain unauthorized access to information or services in a computer system. In software development, time of check to time of use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused…

Preface: The libseccomp package provides an easy to use and platform independent interface to the Linux kernel’s syscall filtering mechanism. Technical background: Syscall filtering is a security mechanism that allows applications to define which syscalls they should be allowed to execute. Vulnerability detail: The design mistaken doing 64-bit comparisons using 32-bit operators.Whereby, leading to a…

Preface: Analyzing big data not so easy. Synopsis: Analyzing big data not so easy. It requires knowledge of enterprise search engines for making content from different sources like enterprise database, social media, sensor data etc. searchable to a defined audience. Elasticsearch is one of the free and open source enterprise search software. Vulnerability detail: The…