The Apache mailing list archives published two vulnerability (CVE-2020-17518 & CVE-2020-17519) reports. These vulnerabilities were submitted by the Ant Security FG Lab. Attackers can read and write remote files through the REST API and...
Zend Framework is an open-source object-oriented web application development framework. Currently, the framework has been downloaded and installed 570 million times on PHP. This week, security researchers discovered a deserialization security vulnerability (CVE-2021-3007) in...
Recently, Niels Teusink, a security researcher from EyeControl, a Dutch network security company, discovered that more than 100,000 Zyxel’s firewalls, access point controllers, and VPN gateway products have administrator-level backdoor accounts. These administrator-level accounts...
Airflow is a platform created by the community to programmatically author, schedule, and monitor workflows. Recently, an email notice issued by Apache disclosed the Apache Airflow Incorrect Session Validation in Airflow Webserver with default...
On December 27, 2020, SolarWinds issued a risk notice for SolarWinds code execution vulnerability, the vulnerability number is CVE-2020-10148. The vulnerability level is critical. SolarWinds disclosed a vulnerability outside the supply chain attack. This...
The US Cybersecurity Infrastructure and Security Agency (CISA) warned that a low-level TCP/IP software library developed by Treck has serious vulnerabilities, allowing remote attackers to run arbitrary commands and launch denial of service (DoS)...
As Microsoft exceeds 90 days, with an extension of 14 days, Google Project Zero will continue to publish details of the security vulnerabilities that have been exploited in Windows 10. According to Google’s regulations,...
On December 15, 2020, Nexus Repository Manager 3 issued a risk notice for the Nexus Repository Manager 3 XML External Entities Injection Vulnerability. The vulnerability number is CVE-2020-29436. The vulnerability level is high risk....
Google often announces certain unfixed security vulnerabilities, this situation seems to be very common to Google, even if the developers object. Previously, Google was complained by Microsoft for disclosing vulnerabilities that Microsoft has not...
On December 13, 2020, FireEye issued an analysis report on the SolarWinds Supply Chain Attack report. SolarWInds products have a one-year supply chain attack, and multiple backdoors have been implanted in their products. The...
On December 13, 2020, XStream issued a risk notice for Server-Side Forgery Requests and Arbitrary File Deletion vulnerabilities. The vulnerability numbers are CVE-2020-26259 and CVE-2020-26258. The vulnerability level is high risk. On the service...
Kubernetes, also known as K8s, is an open-source system for automating deployment, scaling, and management of containerized applications. Kubernetes accomplishes this by organizing application containers into Pods, nodes (physical or virtual machines), and clusters,...
In November 2020, VMware issued a security advisory, saying that the National Security Agency NSA reported a command injection vulnerability (CVE-2020-4006) in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector...
On December 8, Forescout Research Lab disclosed a total of 33 vulnerabilities in four open-source TCP/IP software libraries. This series of vulnerabilities are collectively referred to as AMNESIA:33, and the affected software libraries are...
In the latest security update released by Microsoft in December, a remote code execution vulnerability (CVE-2020-17144) in Microsoft Exchange Server 2010 was announced, which is officially rated High. The vulnerability is caused by the...
On December 8, 2020, Microsoft officially released a risk notice for the December security update. This security update patches for 58 vulnerabilities, mainly covering the following components as Windows operating system, IE/Edge browser, ChakraCore,...
