Preface: Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, … New vulnerabilities found in WebAccess/SCADA Version 8.3: CVE-2019-6519 – An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data. CVE-2019-6521 – Specially crafted requests could allow…

Preface: runc is a CLI tool for spawning and running containers according to the OCI specification. Vulnerability: Found vulnerability on runc affecting several open-source container management systems that leverage runc Impact: The vulnerability allows a malicious container to overwrite the host runc binary and thus gain root-level code execution on the host. But exploit this…

Preface: It was because of new version 4.0 introduced on Jan 2018. Cisco urge customers upgrade to 4.0 to do the remediation. The Elastic Services Controller Service Portal Authentication Bypass Vulnerability finally fixed on Feb 2019. Product background: Cisco ESC provides a single point of control to manage all aspects of VNF lifecycle for generic…

Preface: GD is extensively used with PHP. As of PHP 5.3, a system version of GD may be used as well, to get the additional features that were previously available only to the bundled version of GD. Technical background: The LibGD 2.2.5 allow to written C code to load an entire image file into a…

Preface: Apple found memory vulnerability, since no additional information will be provided by vendor. Does it relate to DUI (Dereference Under the Influence)? What is DUI?Attackers use the DUI vulnerability as a memory access service to mount attacks. Their aim to influence memory operations of isolated components through inputs to their public interface. Apple Releases…

Preface: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. Background: A WAF is deployed to protect a specific web application or set of web applications. Generally, the common attacks such as cross-site scripting (XSS)…

Preface: Avahi is a free zero-configuration networking (zeroconf) implementation, including a system for multicast DNS/DNS-SD service discovery. Technical background: Multicast DNS (mDNS) is a protocol that uses packets similar to unicast DNS except sent over a multicast link to resolve hostnames. Vulnerability found in Avahi: The vulnerability exists because the affected software misses link-local checks,…

Preface: Dynamic memory automatically reclaimed when the garbage collector no longer sees any live reference to it. Description: A vulnerability in the data acquisition (DAQ) component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access control policies or cause a denial of service (DoS) condition. Official announcement…