guest use of HLE constructs may lock up host

ISSUE DESCRIPTION Various Intel CPU models have an erratum listed under the title "Processor May Hang When Executing Code In an HLE Transaction". It describes a potential hang when using instructions with the XACQUIRE prefix on the host physical memory range covering the first 4 MiB starting at t...

F5 Networks BIG-IP : Lazy FP state restore vulnerability (K21344224)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.1.2 / 14.0.0.3 / 14.1.0. It is, therefore, affected by a vulnerability as referenced in the K21344224 advisory. System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocesso...

WordPress Arigato Autoresponder and Newsletter Plugin Has Unspecified Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Arigato Autoresponder and Newsletter plugin is an autoresponder plugin used in the ... A security vulnerability...

CVE-2018-18461

The Arigato Autoresponder and Newsletter aka bft-autoresponder v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments data to models/attachment.php...

PT-2018-14476

Name of the Vulnerable Software and Affected Versions Arigato Autoresponder and Newsletter plugin version 2.5.1.7 Description The issue allows remote attackers to execute arbitrary code by injecting PHP code into the attachments data sent to the models/attachment.php file. This enables attackers ...

CVE-2018-18461: Improper Control of Generation of Code

The Arigato Autoresponder and Newsletter aka bft-autoresponder v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments data to models/attachment.php...

Sony Smart TV Bug Allows Remote Access, Root Privileges

As the number of smart TVs grows, so does the number of vulnerabilities inside of them. On Thursday, security researchers revealed that eight Sony Bravia smart TV models are vulnerable to three separate bugs, one rated critical. The flaws – a stack buffer overflow, a directory traversal and a...

Pumping the Brakes on Artificial Intelligence

While the push-pull between defenders and attackers using artificial intelligence continues, there’s another security dimension to machine intelligence that should be of concern. Just as the rise of IoT devices has created an inadvertent new threat surface ripe for introducing vulnerabilities, so...

CVE-2018-9082

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their...

CVE-2018-11269

The CVE-2018-11269 entry concerns Qualcomm Snapdragon SoCs (listed in the initial description) where a potential buffer overflow may occur when parsing TFTP options. The affected product families include automotive, mobile, and wearables with processors such as MDM9206, MDM9607, MDM9635M, MDM9640...

Fixed in ClickHouse Release 18.12.13, 2018-09-10 

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...

CVE-2018-14672

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages. Andrey Krasichkov of Yandex Information Security Team...

CVE-2018-16410: Improper Neutralization of Special Elements used in an SQL Command

Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php...

ranker.com XSS vulnerability

Open Bug Bounty ID: OBB-668518 Description| Value ---|--- Affected Website:| ranker.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of Medtronic MiniMed medical equipment is caused by deficiencies in the authentication mechanism, allowing unauthorized users to replicate intercepted requests.

The vulnerability of Medtronic MiniMed 508, 522, 523, 523K, 551, 722, 723, 723K, and 751 insulin pumps is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows attackers to bypass the authentication process by executing a hijacked request...

The vulnerability of Medtronic MiniMed medical equipment, related to insufficient protection of transmitted information, allows a perpetrator to disclose protected information.

The vulnerability of Medtronic MiniMed 508, 522, 523, 523K, 551, 722, 723, 723K, and 751 medical devices lies in the transmission of protected information in an unencrypted form. Exploiting this vulnerability could allow an intruder to disclose protected information...

Protecting the protector: Hardening machine learning defenses against adversarial attacks

Harnessing the power of machine learning and artificial intelligence has enabled Windows Defender Advanced Threat Protection Windows Defender ATP next-generation protection to stop new malware attacks before they can get started often within milliseconds. These predictive technologies are central...

Medtronic MyCareLink 24950 Patient Monitor and 24952 Patient Monitor Information Disclosure Vulnerability

The Medtronic MyCareLink 24950 Patient Monitor and 24952 Patient Monitor are both monitor devices from Medtronic, Inc. that are used to monitor a patient's vital signs. An information disclosure vulnerability exists in the Medtronic MyCareLink 24950 Patient Monitor and 24952 Patient Monitor all...

SUSE-SU-2018:2076-1 Security update for microcode_ctl

This update for microcodectl fixes the following issues: The Intel CPU Microcode bundle was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 Spectre v3a and helps mitigating CVE-2018-3639 Spectre v4 bsc1100147 bsc1087082 bsc1087083 More details can be found on:...

Oracle Hyperion Information Disclosure Vulnerability

Oracle Hyperion is a set of Oracle's financial modeling applications, which provides financial closure, reporting and other functions.Hyperion Financial Reporting is one of the financial statement management component. A security vulnerability exists in the Security Models subcomponent of the...