-
Security Focus of CVE-2023-34039: About Aria Operations for Networks design weakness (Issue Date:2023-08-29)
Preface: VMware Aria Operations for Networks (Formerly vRealize Network Insight). Background: VMware Aria Operations for Networks (formerly vRealize Network Insight) delivers end-to-end network visibility converged across virtual and physical networks, planning and troubleshooting with assurance and verification that network and application connectivity performs towards business and security intents across Software Defined Data Center, VMware NSX,…
-
CVE-2023-41361: FRRouting 9.0 encountered buffer overflow (29th Aug 2023)
Preface: OSPF is used to determine the fastest route, while BGP focuses on determining the best path. Background: Network architects using FRR for ISPs, SaaS infrastructure, web 2.0 businesses, hyperscale services, and Fortune 500 private clouds. If you look around, the traditional networking equipment vendors also offer software appliances, because now it’s a tiny stackable…
-
CVE-2023-36481 – Buffer copy without checking input size during PPP communication in Shannon BaseBand (28th Aug 2023)
Preface: Samsung has also used a cheaper and less smart processor, Exynos 9610 with the unit cost of $14.90, for the affordable Galaxy A50 model. Background: Global edition devices instead use EXYNOS – Samsung LSI’s in-house SoC (System on a chip). Shannon co-exists in the SoC floorplan as an IP block. Every phone today that…
-
CVE-2023-40017 on GeoNodes (24th Aug 2023)
Preface: Server Side Request forgery (SSRF) in few years ago not bring IT admin attention. But when ransomware was born, SSRF vulnerability make worries because it can exploit by cyber criminals. So we should be careful when we know our web server apps contains SSRF vulnerability. Background: GeoNode is a geospatial content management system, a…
-
CVE-2023-40178: Node-SAML Improper Verification of Cryptographic Signature(23rd Aug 2023)
Preface: Now that said, SSO reduces the number of attack surfaces because users only log in once each day and only use one set of credentials. Reducing login to one set of credentials improves enterprise security. Or are there other concerns? Background: Node-SAML has built in support for SLO including. Signature validation. IdP initiated and…
-
CVE-2023-41105: Python 3.11 through 3.11.4.(os[.]path[.]normpath) truncates input on null bytes (23th Aug 2023)
Preface: It is popular like Java, Python applications can run on all operating systems (Windows, Unix, Linux, Mac). Background: What’s New in Python 3.11. One of the new module is tomllib – For parsing TOML.I. TOML makes writing configuration files simple, straightforward, and more human-readable than many other formats, including JSON.The TOML file used to…
-
CVE-2023-36787: What’s up? (2023-08-23)
Background: Edge was initially built with Microsoft’s own proprietary browser engine, EdgeHTML, and their Chakra JavaScript engine. In late 2018, it was announced that Edge would be completely rebuilt as a Chromium-based browser with Blink and V8 engines. Chrome used only WebCore, and included its own JavaScript engine named V8 and a multiprocess system. Chrome for…
-
CVE-2023-21273: When you run this design, you should be concerned about this vulnerability! (20th Aug 2023)
Preface: UUID is an simple 128 bit digit which uniquely distributed across the world. Bluetooth sends data over air and all nearby device can receive it. Background: Android “O” was officially released on August 21, 2017 under the name “Oreo”. The BluetoothHidDevice framework adds the SDP record during app registration, so that the Android device…
-
CVE-2023-40272: Apache Airflow Spark Provider design weakness (17th Aug 2023)
Background: What is Apache Airflow used for? Apache Airflow is an open-source tool to programmatically author, schedule, and monitor workflows. It is one of the most robust platforms used by Data Engineers for orchestrating workflows or pipelines. You can easily visualize your data pipelines’ dependencies, progress, logs, code, trigger tasks, and success status. What is the…
-
NVD-2023-4387: Linux correct VMware vmxnet3 Ethernet NIC driver under Linux design weakness (17th Aug 2023)
Background: VMware VMXNET3 is a para-virtual(Hypervisor aware) network driver. The goal to designed and developed to address the network complexities in a virtualized infrastructure. A para-virtual driver is a high-performance driver that significantly reduces the overhead caused by the emulation of the corresponding physical device. VMXNET3 is aware of the hypervisor and does not require…