Recently, the Apache Tomcat WebSocket DoS vulnerability (CVE-2020-13935) PoC has been made public. Apache officially disclosed the vulnerability on July 14, 2020. The vulnerability exploitation tool has been made public. To prevent your system...
On November 3, 2020, SaltStack has issued risk notices for multiple high-risk vulnerabilities. The vulnerabilities number are CVE-2020-16846, CVE-2020-17490, CVE-2020-25592. These vulnerabilities level is critical. Unauthorized remote attackers can cause arbitrary command execution by...
Recently, Google’s Project Zero only announced the Windows 10 zero-day security vulnerabilities. Although Microsoft has not repaired this security, the flaw relevant details have been disclosed. Once again, Google is now revealing new vulnerabilities....
On October 02, 2020, Apache Shiro had issued a risk notice about the Shiro authentication bypass vulnerability. The vulnerability number is CVE-2020-17510. The vulnerability level is high risk. Apache Shiro focuses on ease-of-use, so...
Microsoft announced information about the Windows Zerologon vulnerability in August. Of course, when the vulnerability was announced, security updates have also been released to block the vulnerability. This vulnerability received a CVSSv3 score of...
Under normal circumstances, Google’s Project Zero will reserve 90 days for developers to fix after the vulnerability is discovered. After 90 days, the details will be made public regardless of whether the vulnerability is...
Recently, we detected that the latest patch of CVE-2020-14882, Oracle Weblogic Console Remote Code Execution vulnerability can be bypassed. The vulnerability level is critical. The CVSS 3.1 Base Score is 9.8. Oracle fixed this...
Network-attached storage device (NAS) developer QNAP recently issued a reminder that two security vulnerabilities have been discovered in the QTS operating system and have been repaired. However, users must upgrade the QTS operating system...
On October 20, VMware issued a security notice to fix a VMware ESXi remote code execution vulnerability (CVE-2020-3992). The vulnerability comes from the “use-after-free” reuse problem of OpenSLP used in ESXi. The vulnerability comes...
On October 20, 2020, Oracle officially released the Oracle Critical Patch Update Advisory – October 2020. This security update released 421 vulnerability patches, of which Oracle Fusion Middleware has 46 vulnerability patch updates, mainly...
Magento is an open-source e-commerce platform written in PHP. It uses multiple other PHP frameworks such as Laminas and Symfony. Magento source code is distributed under Open Software License v3.0. Magento was acquired by...
Digital signatures are widely used in various places on the Internet. We use digital certificate encryption when browsing websites and digital signature verification when installing software. Software developers usually use digital certificates to sign...
According to a message released by the Microsoft Security Response Center, Windows Codecs and Visual Studio Code code editors have high-risk security vulnerabilities. Windows Codecs mainly refers to the various media codecs pre-installed in...
On October 16, 2020, SonicWALL officially released a risk notice for SonicOS. The vulnerability level is critical. The vulnerability score is 9.4. There is a buffer overflow vulnerability (CVE-2020-5135) in SonicOS. Remote attackers can...
Nexus is a repository manager, and acts as a staging repository which “intercepts” artifacts uploaded by mvn deploy. Thus artifacts can be safely deployed to Nexus as part of voting on a release. The...
On October 13, 2020, Google security researchers disclosed three vulnerabilities in the Bluetooth protocol stack of the Linux kernel. The vulnerability numbers are CVE-2020-12351, CVE-2020-12352, and CVE-2020-24490, including one high-risk vulnerability and two medium-risk...
