-
Have you heard CVE-20170-5645? Oracle critical patch update advisory – July 2018.
Background Java programming language sometimes look like a accomplice. The Java Sandbox, which attempts to enforce a privilege model that permits safe execution of untrusted code, and is most famously used to permit the automatic execution of Java Applets in a browser. Vulnerability details Apache Log4j is a Java-based logging utility. Log4j is one of…
-
July 2018 – SAP Security Patch Day
According to Panorama Consulting, the average implementation costs for SAP and Oracle both increased while competitor implementation costs decreased. But regarding to cyber security, all the products do not have differences. Yes, it is do the patch management and update. SAP Security Patch Day – July 2018 SAP businessobjects business intelligence suite : CVE-2018-2432,CVE-2018-2427 and…
-
9th Jul 2018 – Total 329 ethereum tokens vulnerable for integer overflow
More ethereum tokens now involves into a bug and causes jeopardize the reputation. So called integer overflow, a design limitation allows the owner of the contract to set the balance of an arbitrary user to any value. Reference resource (Hyperlink) – see below: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md The status last week (9th July 2018) shown that there are…
-
Node.js hits arbitrary command injection (CVE-2018-13797)
Node.js framework become popular today. Node.js can build the application on ethereum (cryptocurrency). Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript engine. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js’ package ecosystem, npm, is the largest ecosystem of open source libraries in the world. Meanwhile, npm is…
-
Jul 2018 – Siemens Security Advisory by Siemens ProductCERT
Selective Availability (SA) was an intentional degradation of public GPS signals implemented for national security reasons. In May 2000, at the direction of President Bill Clinton, the U.S government discontinued its use of Selective Availability in order to make GPS more responsive to civil and commercial users worldwide. And therefore the GPS open to public…
-
Jul 2018 – The IoT P2P (Peer to Peer) design flaw let passwords of over 30,000 devices exposed in search engine
The P2P (Peer to Peer) function is common function for the operation support for Internet of things devices. It aim to simplify the operation and increasing flexibility. We now focusing on data personal privacy but the fundamental of user friendly functions looks contained contradiction with secure operation. The firm (NewSky security) found password for tens…
-
New version of black energy cyber attack target Microsoft OLE product design weakness
Ukrainian intel agency has claimed it stopped a cyber attack against a chlorine plant that was launched using the notorious VPNFilter malware. Perhaps the world focusing VPN filter malware spreading and infection. We known earlier last month that such attack targets are the low end wireless router and network access storage (NAS). However, from my…
-
12th Jul 2018 – ISC Kea 1.4.0 failure to release memory may exhaust system resources
CVE-2018-5739: ISC Kea 1.4.0 failure to release memory may exhaust system resources Hook/Hook Point – used interchageably, this is a point in the code at which a call to user functions is made. Each hook has a name and each hook can have any number (including 0) of user functions attached to it. Store leases…
-
Integer overflow weakness similar kill the Ethereum. But SafeMath to protect from overflows.
Integer overflow weakness similar kill the Ethereum – for more details, please see below (url): Jul 2018 – Integer overflow may killed Ethereum! But SafeMath to protect from overflows. c >= a causes integer overflow happen arithmetic: c=a+b-M (where M = 2**256 is the max unit256 plus one) If c >=a replace to get a…
-
Jul 10, 2018 MS Patch Tue – MS Office
MS Patch Tuesday sometimes really annoying. What’s the root causes we encountered vulnerability weekly? But we require to do the patch if you would like to using your computer with security protection instead of cyber security victim. One of the security update targeting to resolves vulnerabilities in Microsoft Office that could allow remote code execution…