Preface: Node.js is popular in technology world. No matter crypto or distributed ledger platform, Docker development, REST API…etc can deploy by node.js. About node.js? Node.js is a JavaScript runtime environment that processes incoming requests in a loop, called the event loop (initialization and callbacks) and offers a Worker Pool to handle expensive tasks like file…

Preface: Python provides the essential programming language for smart devices and solutions for the Internet of Things and Industry 4.0. Technical background: When you use AES128 encrypt string, if the encrypted string is too long. It will contain \r\n in it. Actually, the encryption output is an array of 8-bit bytes, not characters. The code…

Preface: Medical software manufacturer uses Adobe ColdFusion to more securely collect electronic clinical outcome assessment (eCOA) data.Digital solutions company uses Adobe ColdFusion to help midmarket companies manage eCommerce more effectively. Some expert predicted that ColdFusion was losing the market but he is still alive. Critical statement of this vulnerability and remedy. This attack requires the…

Preface: xmlrpc_decode — Decodes XML into native PHP types Vulnerability detail: The vulnerability is due to improper input validation by the xmlrpc_decode() function of the affected software. Impact: A successful exploit could cause a heap out-of-bounds read or read-after-free condition, which could result in a complete system compromise. Remedy: PHP has released software updates at…

Preface: Huge rise in hack attacks as cyber-criminals target small businesses. For the Average Hacker, Your Small Business Is an Ideal Target . Vulnerability detail: Improper Restriction of Operations within the Bounds of a Memory Buffer. And therefore causes vulnerability encounter on Management Interface to trigger Remote Command Execution. Don’t become a botnet soldier! Cisco…

Preface: As of December 2017, PHP makes up over 83% of server side languages used on the internet. As of today, PHP looks running strong because a large amount of users, applications and also legacy applications. Vulnerability Details: CVE-2019-9025: PHP mb_split() Function Invalid Multibyte String Vulnerability Impact: A successful exploit could cause buffer over-read and…

CVE ID: CVE-2019-1559 Operation vector: Remote Impact: Security restrictions bypass Vulnerable versions: OpenSSL version 1.0.2q, 1.0.2p, 1.0.2o, 1.0.2n, 1.0.2m, 1.0.2l, 1.0.2k, 1.0.2j, 1.0.2i, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2, 1.0.2h Official announcement: https://www.openssl.org/news/secadv/20190226.txt

Preface: Linux-based airline seat-back entertainment system won the market since 2007. Background: Seat back entertainment system including Wi-Fi, movies and television shows, games and music. Some of it is built into an airline’s fleet, and some have options where you can bring your own devices and access in-flight entertainment options. Vulnerability details: A buffer overflow…

Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS Vulnerability – CVE-2019-5727 NVD Published Date: 02/20/2019 Preface: SIEM can enforce your cyber security protection meanwhile it is the potential target by hacker.…

Preface: The Domain Name System (DNS) was standardized 30 years ago by IETF (RFC1034 and RFC1035). An additional standard, EDNS (RFC2671) was published in 1999 and updated in 2013 (RFC6891). Synopsis: As time goes by, EDNS, gained importance with the wide deployment of DNSSEC, among others, which has become an essential part of the DNS…