-
CVE-2019-12643 Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability (Aug 2019)
Preface: Because a stateless API can increase request overhead by handling large loads of incoming and outbound calls, a REST API should be designed to encourage the storage of cacheable data. Vulnerability details: A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to…
-
PePe Talk – Linux Kernel driver qedi_dbg.c Out-of-Bounds Read Vulnerability CVE-2019-15090 (Aug 2019)
Preface: PePe the frog, he will never die. PePe could appear anywhere. May be you can see him in political world or your whatsapp communications. Even CVE vulnerability record details. QLogic offload iSCSI driver (qedi_dbg.c) technical background – For both Windows and Linux operating systems, iSCSI boot can be configured to boot with two distinctive…
-
webmin function critical vulnerability cve-2019-15107 (aug 2019)
Preface: The Amazon rainforest is the lungs of the earth. Even humans are stronger than ancient people. But we rely on oxygen to survive. Amazon rainforest fire, do you think we are heading to the edge? About webmin software: Webmin is a web-based interface for system administration for Unix. Using any modern web browser, you…
-
ABout MasterCard data breach – Aug 2019
Preface: Still remember that when I was work in bank environment. Visa and Master payment solutions looks indeed secure. Those facilities are running in standalone machine. The communication protocol is the IBM SDLC communication. In order to communication with S390 mainframe. We setup data link switch in network switch and define VTAM major nodes on…
-
Vulnerabilities in SIMATIC S7-1200 and SIMATIC S7-1500 CPU families (Aug 2019)
Preface: In 1885 Westinghouse imported a Siemens AC generator, to begin experimenting with AC networks in Pittsburgh. As of today, the business development of Siemens extend to all industry. Product background: The Siemens SIMATIC S7-1200 & S7-1500 is the controller for open-loop and closed-loop control tasks in mechanical equipment manufacture and plant construction. Its range…
-
CVE-2019-12256 The industrial, and medical devices has been affected by IPV 4 component design flaws in VxWorks 7 & VxWorks 6.9 (Aug 2019)
Background: Wind River’s VxWorks is widely used in communications, military, aerospace, industrial control and other fields for its high reliability and excellent real-time performance. For example, it is used in the US F-16, FA-18 fighters, B-2 stealth bombers and Patriot missiles. The most famous is the Mars probe that landed on the surface of Mars…
-
When CVE-2019-14809 was announced, do you think you need to adjust your e-commerce operations? Aug 2019
Background: Google Go Language is suitable for web development especially front-end development. Quite a lot of companies using GO. For instance Facebook, Twitter, YouTube, Apple, Dropbox, Docker, Soundcloud, Mozilla Firefox, The New York Times, Github, GOV.UK and UBER. Vulnerability details: A vulnerability in the net/url package in Golang Go could allow an unauthenticated, remote attacker…
-
Previous NFS 4.1 vulnerability (CVE-2018-16884) show linux kernel design weakness.
Preface: A vulnerability in the NFS41+ subsystem of the Linux Kernel could allow an authenticated, adjacent attacker execute arbitrary code on a targeted system. The vulnerability exists because the bc_svc_process() function of the affected software uses the wrong back-channel ID. use-after-free in svc_process_common The defect not only affected software uses the wrong back-channel ID. Furthermore…
-
Closer look: CVE-2019-1162 Windows ALPC Elevation of Privilege Vulnerability
Preface: ALPC (Advanced/Asynchronous Local Procedure Call) is a C/S model technology developed by Microsoft to replace LPC for native RPC. Vulnerability details: Tasks created by the Task Scheduler will create the folder and file in “c:\windows\system32\ tasks”. This function original to be designed to write the discretionary access control list of the task in this…
-
THE GREATER THE POWER OF THE COUNTRY, THE STRONGER THE SUPERCOMPUTER.
Summit, launched in 2018, delivers 8 times the computational performance of Titan’s 18,688 nodes, using only 4,608 nodes. Summit still carry the flags tell the world that he keep the fast run record. Over the past decade, Linux Clusters founded and starting the competition with mainframe computer. The most famous IBM crossbar switch encounter doubt…