Skip to content

Cyber security technical information

Illustration of a bird flying.
  • Abuse macOS features, installing undetectable malware – 2nd Nov, 2021

    Preface: Apple replaces bash with zsh as the default shell in macOS. Background: According to the ZSH documentation on Startup/Shutdown Files, there are a number of files (located in the home directory $HOME or ~/):[.]zprofile (login shell)[.]zshenv (environment variables)[.]zshrc (interactive shell)[.]zlogin (login shell)[.]zlogout (when the shell exits) When zsh start, it looks for environment variables…

    November 5, 2021
  • Officials stated that CVE-2021-1048 may be subject to limited and targeted use. But did not elaborate? Can we guess what happened? 3rd Nov 2021

    Preface: Android garbage collection is an automatic process which removes unused objects from memory. However, frequent garbage collection consumes a lot of CPU, and it will also pause the app. Background: The garbage collection of Unix sockets first selects a set of candidate sockets that are only referenced from the flight (total_refs == inflight_refs). This…

    November 4, 2021
  • CVE-2021-41036 old-wine-in-a-new-bottle, problem resolved. But you should stay alert! (2nd Nov, 2021)

    Preface: The open source Paho MQTT project for embedded C to connect and communicate with IoT Platform. Background: MQTT is based on the client-server communication mode. MQTT server is called as MQTT Broker. Currently, there are many MQTT Brokers in the IIoT world. MQTT client libraries under different programming languages and platforms (see below): Eclipse…

    November 3, 2021
  • Vulnerabilities review – Chrome CVE-2021-38000 & CVE-2021-38003 (31-10-2021)

    Preface: Mojo is a collection of runtime libraries providing a platform-agnostic abstraction of common IPC primitives, a message IDL format, and a bindings library with code generation for multiple target language to facilitate convenient message passing across arbitrary inter – and intra-process boundaries. Background:Chrome limits most of the attack surface of the web (e.g., DOM…

    November 1, 2021
  • CVE-2021-3903 vim is vulnerable to Heap-based Buffer Overflow, Apple may also have encountered this design weakness (27th Oct, 2021)

    Preface: Generally speaking, heap buffer overflow unlike stack overflow, there is no such thing as ret on the heap that can change the program flow, so at most, the data is overwritten. It seems that there is little risk, but in fact it is not the case. Background: Vim comes standard with most modern Linux…

    October 28, 2021
  • CVE-2021-41172 Maybe there was an impact, or nothing happened (26th Oct, 2021)

    Preface: We install and configure a caching plugin which will speed up the delivery of page assets to your visitors, since these content will have been generated beforehand. The result will be a faster loading page, and reduced wait times for all operations. Background: A caching plug-in will speed up the web application response. For…

    October 27, 2021
  • CVE-2021-41035 : Which products will be affected? (25th Oct, 2021)

    Preface: The Eclipse OpenJ9 virtual machine (VM) implements the Java Virtual Machine Specification. Most Java applications should run on an OpenJDK that contains the OpenJ9 VM without changing anything. However, because it is an independent implementation there are some differences compared to the HotSpot VM, which is the default OpenJDK VM and is also included…

    October 26, 2021
  • CISA urges developer to update to patched version 2.7.9 (Discourse package) or later (24th Oct, 2021)

    Preface: If you have already integrated the Discourse API with the AWS API, you should be vigilant about this. Background: Amazon Simple Notification Service (Amazon SNS) is a managed service that provides message delivery from publishers to subscribers (also known as producers and consumers). Publishers communicate asynchronously with subscribers by sending messages to a topic,…

    October 25, 2021
  • CISA urges to be vigilant! About GPS Daemon (GPSD) Rollover Bug (21st Oct, 2021)

    Preface: If you are using a security token (fobs or software), when there is a problem with the NTP time source. This is unforeseen. Maybe there is nothing wrong with it. Or, in the worst case, similar you mistaken reset the NTP server time setting. Therefore, all your tokens should be suspended. Background: Because in…

    October 22, 2021
  • CVE-2021-41135 Cosmos-SDK up to 0.44.1 xauthz Module ValidateBasic unusual condition (21st Oct, 2021)

    Preface:To date, more than 240 applications have been built on the Cosmos mainnet. The main categories of applications include finance, infrastructure, privacy, and social interactions. Background: The Cosmos SDK is a framework for building blockchain applications. Tendermint Core (BFT Consensus) and the Cosmos SDK are written in the Golang programming language. Cosmos SDK is used…

    October 21, 2021
←Previous Page
1 … 125 126 127 128 129 … 248
Next Page→

Cyber security technical information

Proudly powered by WordPress