-
CVE-2019-7164 SQLAlchemy order_by Parameter SQL Injection Vulnerability – Feb 2019
Preface: SQLAlchemy is an open-source SQL toolkit and object-relational mapper (ORM) for the Python programming language released under the MIT License. Who is their customer? SQLAlchemy is used by organizations such as: Yelp! reddit DropBox The OpenStack Project Survey Monkey Modern programming languages are almost all object-oriented. While most object-oriented languages offer developer benefits such…
-
Microsoft IIS web server design weakness – causes resources exhaustion (20th Feb 2019)
Preface: Many companies do not plan to use the Microsoft IIS web server until MS SharePoint is born. MS SharePoint baseline design: If you decide to use SharePoint, IIS web server will be work with you forever. Indeed that SharePoint products are popular. And such away let people forget about IIS web server weakness. Perhaps…
-
Cisco HyperFlex Software Unauthenticated Root Access Vulnerability (CVE-2019-1664) – 20th Feb 2019
Preface: HyperFlex is Cisco’s hyper-converged infrastructure (HCI) platform. It enable centralized management and enhanced operation efficiency. Vulnerability detail: The vulnerability resides in the hxterm service of the Cisco HyperFlex software package and it can “allow an unauthenticated, local attacker to gain root access to all nodes in the cluster, said Cisco. If the following occurs:…
-
Security Focus – CVE-2018-13888
Preface: This design flaw has attracted me. Perhaps the supplier has no formal remediation solution yet. But the impact of this vulnerability seems to be broad! Vulnerability detail: There is potential for memory corruption in the RIL daemon due to the following reason. The location of dereference of memory is outside the allocated array length…
-
CVE-2018-19018: Omron CX-Supervisor security alert! – Feb 2019
Preface: CX-Supervisor is dedicated to the design and operation of PC visualization and machine control in Omron controller applications. Technical background: Configuring CX supervisor in OPC and DDE is extremely simple if you have your DDE and OPC server with the SCADA package. CX supervisor contains a large number of predefined functions and libraries, and…
-
Linux Kernel before 4.20.8 kvm_ioctl_create_device Use-After-Free Vulnerability – Feb 2019
Preface: Linus Torvalds, he is the principal developer of the Linux kernel. Many Linux distributions and operating systems are based on Linus Torvalds design foundation. Synopsis: The module (virt/kvm/kvm_main.c) enables machines with Intel VT-x extensions to run virtual machines without emulation or binary translation. The module (virt/kvm/kvm_main.c) enables machines with Intel VT-x extensions to run…
-
About Linux kernel flaw (CVE-2018-5391) – Cisco information update
Preface: Cisco provide status update on CVE-2018-5391 on 18th Feb 2019 , it is the follow up action for Linux kernel flaw announced August last year. Synopsis: A decade ago, we said that the vulnerabilities of Microsoft windows will be jeopardize the IT world. Perhaps this statement not suitable today because Linux and open sources…
-
CVE-2019-7304 – Canonical snapd Local Privilege Escalation Vulnerability – 15th Feb 2019
Preface: Why REST so popular? REST can be used over nearly any protocol, when used for web APIs it typically takes advantage of HTTP. Canonical snapd technical features: Snap is a software deployment and package management system.It capable to deliver and update your app on any Linux distribution for desktop, cloud, and Internet of Things.…
-
VMware announcement – they resolve mishandled file descriptor vulnerability in runc container runtime (15th Feb 2019)
Preface: Docker containers can be created in VMware. Therefore, VMware and Docker can work together. Therefore, they are not just competitors. Vulnerability background: Docker announce on 12th Feb 2019 that they are vulnerable for malicious attack. The vulnerability allows a malicious container to overwrite the host runc binary and thus gain root-level code execution on…
-
Container Privilege Escalation Vulnerability (CVE-2019-5736) Affecting Cisco Products – Products under investigation – 15th Feb 2019
Preface: Cisco MSE is distributed as an Open Virtual Appliance (OVA) for installation on a virtual appliance and as an ISO image for installation on a physical appliance. Cisco MSE acts as a platform (physical or virtual Cisco Mobility Services Engine [MSE] appliance) to deploy and run the Cisco services. Open Container Initiative overview: OCI…