-
CVE-2019-9636 (Python) urlsplit does not handle NFKC normalization
Preface: Python is used quite a lot in robotics. Apply artificial intelligence to robots using Python . Why choose Python? Less Code: Python can implement the same logic with as much as 1/5th code as compared to other OOPs languages. Prebuilt Libraries: include Numpy for scientific computation, Scipy for advanced computing and Pybrain for machine…
-
Highly vulnerable – Moxa customer must be vigilant!
Preface: The MoxaEDS–405A/408A are entry-level 5 and 8-port managed Ethernet switches designed especially for industrial applications. Technical background: Turbo Ring is a self-healing technology that enables fast fault recovery under 20 ms. Moxa’s Turbo Ring and Turbo Chain Ethernet technologies maximize railway network availability with ideal redundancy technology. Security focus: CVE-2019-6563 (CVSS:10) – Moxa IKS…
-
CVE-2019-3778 Pivotal Spring Security OAuth Open Redirector Vulnerability (critical)
Preface: OAuth has become a standard for third-party applications to communicate with the APIs of popular web sites, such as Facebook, Twitter, and Foursquare, to name a few. Technical background: Currently, the two major versions of OAuth are 1.0(a) and 2.0. With Spring Security and its OAuth 2.0 support, the OAuth (Open Authorisation) is a…
-
Status update for the announcement on 6th Mar 2019 (Cisco NX-OS Software Unauthorized Filesystem Access Vulnerability) – 11th Mar 2019.
Preface: On 6th Mar, 2019, Cisco announcement that there are vulnerabilities found on Cisco FXOS and NX-OS Software. The total 26 of the vulnerabilities have a Security Impact Rating (SIR) of High. Successful exploitation of the vulnerabilities could allow an attacker to gain unauthorized access. Technical background: Cisco NX-OS based on Wind River Linux and…
-
CVE-2019-0187: Apache JMeter Missing client auth for RMI connection when distributed test is used! Mar 2019
Preface: If your company hasn’t been performing load testing, it is hard to know the web application actual performance. Deploying JMeter will display the test results in a graph updated in real time. Synopsis: Perhaps software developers did not imagine that JMeter design weakness will be hazardous of web server. And therefore we might found…
-
Cisco confirm OCI flaw only affecting small group of items in their product line – 8th Mar 2019
Preface: Container Privilege Escalation Vulnerability Affecting Cisco Products status update Description: IT world is safe again, Cisco you are super again! There is only 3 items of Cisco product involves into the Container Privilege Escalation Vulnerability found on last month (Feb 2019). Remedy has been proceed. Further details in below: Network Management and Provisioning: Cisco…
-
CVE-2018-11793: Apache Mesos JSON Payload Parsing DoS Vulnerability 5th Mar 2019
Preface: Apache Mesos is an open-source project to manage computer clusters. It was developed at the University of California, Berkeley. About Payload in Web services: Typically the term payload refers to JSON-formatted text that is either posted (via an http POST) to a web service when a user creates a resource or returned from a…
-
Cisco Event Response: March 2019 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. 6th Mar 2019
Preface: The urgent announcement by Cisco might scare the customer of Cisco. It is about the vulnerabilities found on Cisco FXOS and NX-OS Software. But no worries, Cisco managed it. Technical background: Cisco NX-OS based on Wind River Linux and is inter-operable with other Cisco operating systems. The command-line interface of NX-OS is similar to…
-
Unknown vulnerability Found Affecting Intel CPUs – 5th Mar 2019
Preface: So called Spoilter, a vulnerability given by Intel CPU design limitation. If hacker successful exploit such vulnerability. They can conduct “Rowhammer” attack for privileges escalation. Vulnerability detail: The speculative execution function of Intel’s processors aim to increase the performance of a CPU. Meanwhile it caused Intel CPU vulnerability issues in the past. A new…
-
Former vulnerability (CVE-2018-20033 (flexnet_publisher) ) – But enterprise firm must be vigilant! vigilant!
Preface: FlexNet Publisher (formerly known as FLEXlm) is a software license manager from Flexera Software which implements license management and is intended to be used in corporate environments to provide floating licenses to multiple end users of computer software. Vulnerability background: The design weakness found on 2018. But the official announcement was release on 2019-01-28.…