-
Security Alert! Moxa ThingsPro IIoT Gateway and Device Management Software (Oct 2018)
Security Alert – Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. MQTT (formerly MQ Telemetry Transport) is an ISO standard (ISO/IEC PRF 20922) publish-subscribe-based “lightweight” messaging protocol for use on top of the TCP/IP protocol. Since the original design objective of this protocol not for handling confidential information and therefore cyber security…
-
What is a smart city from an security point of view?
Preface The objective of the smart city is design to incorporates information and communication technologies (ICT) to enhance the quality of life. The Smart City derivatives the cost effective solution. As a result, it benefits to urban services such as energy, transportation and utilities in order to reduce resource consumption, wastage and overall costs.…
-
Security Advisories and Alerts – LAquis SCADA Versions 4.1.0.3870 and prior
Since it build and run on top of Microsoft windows platform and speculated that vulnerabilities might given from Microsoft itself. For instance: LAquis SCADA Versions 4.1.0.3870 and prior Integer overflow to buffer overflow vulnerabilities, which may allow remote code execution. Hints: Microsoft GDI+ is prone to an integer-overflow vulnerability. An attacker can exploit this issue…
-
LIVE555 Streaming Library vulnerability – Oct 2018
The VLC is a packet-based media player it plays almost all video content. It can play some, even if they’re damaged, incomplete, or unfinished, such as files that are still downloading via a peer-to-peer (P2P) network. So it is very popular in the IoT Environments especially video streaming in vehicular IoT (VSV-IoT) environments. However…
-
Libssh Server-Side State Machine Unauthorized Access Vulnerability – 17thOct2018
Background: Libssh is a library written in C implementing the SSH protocol. It can be used to implement client and server applications. Vulnerability found on 17th Oct 2018: By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without…
-
Yammer Desktop Application Remote Code Execution Vulnerability – 19th Oct 2018
The Yammer desktop app is a native client for Mac and Windows with the full functionality of Yammer. Along with streamlined log in and SSO support, the app integrates with native operating system capabilities such as notifications, shortcuts, and launch on startup. Microsoft announce vulnerability occurs today. But it looks that it is a old…
-
Oracle Releases October 2018 Security Bulletin – Stay alert!
Oracle has released a gamut security update to address high amounts of vulnerabilities in its various enterprise products. The official vulnerability checklist includes some follow up actions given by 2016 and 2017. Perhaps we focus vulnerability in frequent and do the priority of analysis for the score. Even though the vulnerability score is important. But…
-
VMWARE ESXi,Workstation and Fusion out-of-bounds read vulnerability in SVGA device – 16thOct2018
Malware authors constantly seek new methods to obfuscate their code so as to evade detection by virus scanners. Have you heard shader code? In order to avoid the vulnerability occurs, VMware Releases Security Updates on October 16, 2018. ESXi has an out-of-bounds read vulnerability in the SVGA device that might allow a guest to execute…
-
TIBCO Spotfire Statistics Services remote execution vulnerabilities – Oct 2018
Theoretically, big data analytics is the often complex process of examining large and varied data sets to uncover information including hidden patterns and unknown correlation. Basically it can help organizations make informed business decisions. Since you can use the URL API to send administration, expression, or function requests to the TIBCO web server. Use the…
-
Advisory on PHP Vulnerabilities – 12th Oct 2018
The Multi-State Information Sharing & Analysis Center (MS-ISAC) has released an advisory on multiple Hypertext Preprocessor (PHP) vulnerabilities today (refer below url): https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-113/ Perhaps PHP program version will make you frustrated. Why? The vulnerabilities addressed by MS-ISAC only for Version 7.2.11 & Version 7.1.23. However there is another fix coming soon (see below): PHP 7.1.24…