Category: Potential Risk of CVE

  • Release updates from the Chrome team – design weakness (Dec 2018)

    Preface: As of 2018, expert estimates that Google Chrome has a 68% worldwide usage share of web browsers as a desktop browser. It also has 61% market share across all platforms combined. Moreover it has over 50% share on smartphones. Technical features: Google chrome not only a web browser. It contained friendly capabilities. How to…

  • Security Bulletin: NVIDIA GeForce Experience – November 2018

    Preface: NVIDIA GeForce graphics cards are built for the ultimate PC gaming experience, delivering amazing performance, immersive VR gaming, and high-res graphics. Technical background: GeForce Experience is the companion application to your GeForce GTX graphics card. It keeps your drivers up to date and automatically optimizes your game settings. Vulnerability details announced on Nov 2018:…

  • Cyber Security focus: Node.js – Nov 2018

    Preface: Who use Node JS? Node.js build various applications such as social media apps, video and text chat engines, real-time tracking apps, online games and collaboration tools. CiscoDevNet has sample to guide the developer how to integrate integrate Webex with node.js. Technology background: Node.js is an open-source, cross-platform JavaScript run-time environment that executes JavaScript code…

  • Cisco Prime License Manager SQL Injection Vulnerability – 28th Nov 2018

      Preface: Cisco Prime License Manager provides simplified, enterprise-wide management of user-based licensing, including license fulfillment. Cisco Prime License Manager handles licensing fulfillment, supports allocation and reconciliation of licenses across supported products, and provides enterprise-level reporting of usage and entitlement. Vulnerability synopsis: A vulnerability in the web framework code of Cisco Prime License Manager (PLM)…

  • Samba release security update – 27th Nov 2018

    Preface: Samba is an implementation of the Server Message Block (SMB)/Common Internet File System (CIFS) protocol for Unix systems, providing support for cross-platform file and printer sharing with Microsoft Windows, OS X, and other Unix. Vulnerabilities highlights: Double free error is caused by freeing same memory location twice by calling free() on the same allocated…

  • CVE-2018-18955 kernel: Privilege escalation in map_write() in kernel/user_namespace.c

    Preface: Linux makes very efficient use of the system’s resources.You can give new life to your old and slow Windows system by installing a lightweight Linux system. Variants of Linux are most widely used in the Internet of things and smart devices. Vulnerability synopsis: Namespaced mapping – when the two sorted arrays are used, the…

  • CVE-2018-6983 VMware Workstation and Fusion updates address an integer overflow issue – 22nd Nov 2018

    Preface: VMware Workstation is a hosted hypervisor that runs on x64 versions of Windows and Linux operating systems[4] (an x86 version of earlier releases was available);[3] it enables users to set up virtual machines (VMs) on a single physical machine, and use them simultaneously along with the actual machine. Findings: VMware Workstation and Fusion contain…

  • The amazon PAYFORT payfort-php-SDK payment gateway SDK vulnerabilities – 14th Nov 2018

    Preface: PAYFORT Online Payment Gateway is the most Trusted in the Middle East. PAYFORT is here to help you accept online payments, reduce fraud & max your transaction amount. Remark: On Mar 2018, official announce that PayFort International Inc. and its subsidiaries will be acquired by Amazon. Vulnerabilities synopsis: The Amazon PAYFORT payfort-php-SDK payment gateway…

  • CVE-2018-0692 – The installer of Baidu Browser may insecurely load Dynamic Link Libraries

    Preface: Baidu Spark Browser is based on Chromium, the same engine which runs Google Chrome. Vulnerability findings: Baidu Browser provided by Baidu, Inc. is a Web browser. The installer of Baidu Browser contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Impact: Arbitrary code may be executed…

  • VMware Releases Security Updates – November 20, 2018

    Preface: vSphere Data Protection is a backup and recovery solution designed for vSphere environments.It provides agentless, image-level virtual-machine backups to disk. VMware vSphere 6.5 is the last release which includes the VDP product. All existing vSphere Data Protection installations with active Support and Subscription (SnS) will continue to be supported until their End of General…