-
Important: CVE-2023-24540 burdens the OpenShift API for Data Protection (OADP), resulting in a security vulnerability (31st Jul 2023)
Preface: Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set “\t\n\f\r\u0020\u2028\u2029” in JavaScript contexts that also contain actions may not be properly sanitized during execution (CVE-2023-24540) Background: OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume…
-
Drones are similar to radio-controlled aircraft, but GPS and (5G or 4G) empowerment are leading the way. (29th Jul 2023)
Preface: Do you think Chinese meaning of intelligence and clever have similar meanings? if you ask me. Perhaps I would say that clever refers to the sensitivity of the ears and eyes. Intelligence is about your brain. Maybe you have other explanations. When you watch a sci-fi movie, the AI core sends out drones to…
-
Time-honored brands face ordeal. Caused by CVE-2023-35078! (26th Jul 2023)
Preface: The company was founded in 2007. MobileIron, he is early pioneer in mobile security and management for smartphones and tablet computers, such as iPhone, iPad, Android…etc. Background: Core supports a number of application program interfaces (APIs): The MobileIron V2 API is a RESTful API you use to send HTTPS requests to get data from…
-
About Apple Neural Engine (CVE-2023-38136) 26th Jul 2023
Preface: We can only use the Neural Engine through Core ML. Core ML is the foundation for domain-specific frameworks and functionality. You can build and train a model with the Create ML app bundled with Xcode. Models trained using Create ML are in the Core ML model format and are ready to use in your…
-
CVE-2023-20593: AMD patched the Zenbleed vulnerability that could allow attackers to exploit several Ryzon and EPYC processors (25th Jul 2023)
Preface: The x86-64-AMD Ryzen Zen 2 CPU is a microprocessor architecture developed by AMD. It is based on the Zen microarchitecture, which was first introduced in 2017. The Zen 2 architecture features a number of improvements over the previous generation, including higher performance, lower power consumption, and support for new features such as PCIe 4.0…
-
About CVE-2023-2430: The io_uring is a completely new approach to I/O API. Linux Kernel is super again. (24th Jul 2023)
Preface: How does IO uring work? It works by creating two circular buffers, called “queue rings”, for storage of submission and completion of I/O requests, respectively. For storage devices, these are called the submission queue (SQ) and completion queue (CQ). Background: io_uring can handle various I/O related requests. for example: How io_uring is implemented in…
-
CVE-2023-22052 – Vulnerability in the Java VM component of Oracle Database Server (19th Jul 2023)
Preface: In Oracle Database, you can store and execute Java code directly in the database using Oracle Java Virtual Machine (OJVM). You can take your Java code, put it into the database and execute it. Background: You can extend a relational database’s storage, indexing, and searching capabilities to include semistructured and nonstructured data (including Web…
-
Regarding CVE-2023-3519: Design flaw under specified conditions, said Citrix (July 19, 2023)
Background: Use Citrix Gateway with StoreFront to provide secure remote access for users outside the corporate network and Citrix ADC to provide load balancing. *Citrix StoreFront is an enterprise application store that provides an interface for users to access XenDesktop and XenApp virtual desktops and applications remotely. How do I access Citrix StoreFront? On the…
-
The Base Score 3.7 (Integrity impacts). Why Oracle concerning about CVE-2023-21949? (18th Jul 2023)
Preface: What is Kerberos authentication in database? Kerberos is a protocol for authenticating service requests between trusted hosts across an untrusted network, such as the internet. Kerberos support is built in to all major computer operating systems, including Microsoft Windows, Apple macOS, FreeBSD and Linux. Background: The Oracle Advanced Networking Option is an optional product…
-
CVE-2023-34124, CVE-2023-34133, CVE-2023-34134, and CVE-2023-34137 – Perhaps multiple vulnerabilities on Tomcat/Apache burden Sonicwall GMS/Analyze! ( My point of view article published on 18th Jul 2023)
Preface: Since the software device will be customized by the manufacturer. So-called OS and even web server hardening will be done by the manufacturer. If the web server and SQL packages contain design flaws (so-called multiple vulnerabilities). Sometimes there is no workaround. Need to be patched. But manufacturers of cyber defense utilities were quick to…