-
4th June 2018 – SAML Authentication Bypass ((Symantec) CVE-2018-5241)
SAML for single sign-on (SSO) makes it possible for your users to authenticate through your company’s identity provider when they log in to Cloud computing platform. SSO allows a user to authenticate once and then access multiple products during their session, without needing to authenticate with each of those. Please be remind that SSO will…
-
Hyperledger Iroha v1.0 beta-2 version to remediate CVE-2018-3756 (May 2018)
The earlier generation of blockchain technology empower encryption power let the world know his capability. As times goes by people found the design weakness of blockchain technology is the performance of synchoization of the peer nodes. Such design weakness cause double spending vulnerability. The next generation of technology so called HYPERLEDGER. It enhance the design…
-
A vulnerability found in becton dickinson DB Manager (CVE-2018-10593 and CVE-2018-10595)
On May 2017, Ransomware attack suspended UK healthcare system services. It shown the security weakness in hospital and clinic IT system infrastructure. BD is a global medical technology company that is advancing the world of health by improving medical discovery, diagnostics and the delivery of care. A vulnerabilitiy found on Becton Dickinson causes a series…
-
22nd May 2018: Security Advisory – Privilege escalation vulnerability found in some Dahua IP products
Based in Hangzhou, China, Dahua Technology is one of the world’s leading manufacturers of security and video surveillance equipment. According to its unaudited results for 2017, it had a turnover of $2.89bn representing a year-on-year increase of 41%, and a gross profit of $404m, growing by 31%.Based on above details, you can imagine that how…
-
21st May 2018 – Citrix XenMobile 10.x Multiple Security Updates
Applicable Products (XenMobile 10.7 & XenMobile 10.8) Affecting XenMobile Server 10.7 and 10.8: CVE-2018-10653 (High): XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server CVE-2018-10650 (Medium): Insufficient Path Validation Vulnerability in Citrix XenMobile Server CVE-2018-10654 (Medium): Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server CVE-2018-10648 (Low): Unauthenticated File Upload Vulnerabilities in Citrix XenMobile…
-
Vulnerabilities – Waiting for vendor response – 23rd May 2018
The cyber attacks are wreak havoc today. In order to protect the power facility, water supply, Gas supply and petroleum industry daily operations. The SCADA control system vendor implemented security control in their system infrastructure. However when vulnerabilities encounter on their products. The remediation step of the vendor response sometimes not in effecient. For instance,…
-
21 May 2018 – CPU hardware utilizing speculative execution may be vulnerable to cache side-channel attacks
Regarding to the subject matter, please refer to below url for reference. Q2 2018 Speculative Execution Side Channel Update https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html Vulnerability of Speculative Processors to Cache Timing Side-Channel Mechanism https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
-
Quick look in virtual machine Zone (CVE-2018-8897) – 05/18/2018
Technology world is a challengeing zone. The key word “rest” looks do not apply to system developer, application programmer and IT expert! I re-call the vulnerability (CVE-2018-8897) to review. It ennounced by security experts for week ago. Perhaps you have full understanding. However no harm in my view point to do the review since it…
-
Software design limitation causes hardware Involved software Attacks – Shanghai 2345 Network
Shanghai 2345 Network major business focusing Mainland China. This companyprovides Internet access platforms. It provides 2345 Website navigation that facilitates users to find their own needs of the site entrance, as well as provides weather forecasts, practical inquiries, commonly used software download, e-mail login, search engine portal, online collection, and other Internet common service; 2345…
-
May 18, 2018 – ISC Releases Security Advisories for BIND
ISC Releases Security Advisories for BIND on May 18, 2018. This alert awaken my defense thinking. I was written few articles about the electronic war and the cyber arsenal. But forgot to contains a scenario which annoucned by ISC today (Security Advisories for BIND). Regarding to to the subject (ISC Releases Security Advisories for BIND) indeed…