CVE-2024-2193

A Speculative Race Condition SRC vulnerability that impacts modern CPU architectures supporting speculative execution related to Spectre V1 has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the...

CPU hardware utilizing speculative execution may be vulnerable to speculative race conditions

Overview A Speculative Race Condition SRC vulnerability that impacts modern CPU architectures supporting speculative execution has been discovered. CPU hardware utilizing speculative execution that are vulnerable to Spectre v1 are likely affected. An unauthenticated attacker can exploit this...

CVE-2024-2193

creationtimestamp| type| source ---|---|--- 2024-03-13 09:16:22+00:00| seen| https://t.me/ctinow/206483 2024-03-13 14:57:21+00:00| seen| https://t.me/itsecnews/4196 2024-03-14 11:19:45+00:00| published-proof-of-concept| https://t.me/truesecator/5520 2024-03-15 19:23:06+00:00| seen|...

CVE-2024-2193

A new cache speculation vulnerability, known as Spectre-SRC Speculative Race Conditions, was found in hw. Spectre-SRC is similar to the Spectre v1 and allows speculative use-after-free. The difference between this issue and Spectre V1 is that this issue is based on synchronization primitives with...

Speculative Race Conditions (SRCs)

Bulletin ID: AMD-SB-7016 Potential Impact: Speculative Race Condition Severity: Varies by CVE, see descriptions below Summary Researchers from IBM Research Europe and Vrije Universiteit Amsterdam have published a paper titled “GhostRace: Exploiting and Mitigating Speculative Race Conditions.” AMD...

CVE-2019-2193

creationtimestamp| type| source ---|---|--- 2024-02-13 16:36:39+00:00| seen| https://t.me/ctinow/183944...

Mattermost Server < 7.8.5 / 7.9.x < 7.9.4 Improper Authorization (MMSA-2023-00157)

The version of Mattermost Server running on the remote host is prior to 7.8.5 or 7.9.x prior to 7.9.4. It is, therefore, affected by an improper authorization vulnerability. Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessi...

Amazon Linux 2 : nerdctl (ALAS-2023-2193)

The version of nerdctl installed on the remote host is prior to 1.1.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2193 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the...

RHEL 9 : butane (RHSA-2023:2193)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2193 advisory. Butane translates human-readable Butane Configs into machine-readable Ignition configs for provisioning operating systems that use Ignition...

postgresql-server -- Row security policies disregard user ID changes after inlining

PostgreSQL Project reports While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving function inlining. This leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned...

CVE-2023-2193

creationtimestamp| type| source ---|---|--- 2023-04-20 12:35:33+00:00| seen| https://t.me/cibsecurity/62498...

CVE-2023-2193 Oauth authorization codes do not expire when deauthorizing an oauth2 app

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token...

CVE-2023-2193

Mattermost OAuth2: CVE-2023-2193 describes a flaw where deauthorizing an OAuth2 app fails to invalidate existing authorization codes. An attacker who possesses a valid authorization code can use it to obtain an access token, enabling unauthorized access. Affected product: Mattermost Server (vario...

SUSE CVE-2016-2193

PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions by leveraging a session that performs queries as more than one role...

CVE-2022-2193

creationtimestamp| type| source ---|---|--- 2022-07-19 18:40:56+00:00| seen| https://t.me/cibsecurity/46552...

CVE-2022-2193

Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page. This issue affects: HYPR Server versions prior to 6.14.1...

CVE-2022-2193

HYPR Server contains an Insecure Direct Object Reference (IDOR) in the Device Manager page. Remote authenticated attackers can tamper parameters to add a FIDO2 authenticator to arbitrary accounts. Affected: HYPR Server versions prior to 6.14.1. Remediation: upgrade to 6.14.1 or later.

mysql:8.0 security, bug fix, and enhancement update

An update is available for mecab-ipadic, mecab, mysql. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MySQL is a multi-user, multi-threaded SQL database server...

CVE-2021-2193 affecting package mysql 8.0.23-1

CVE-2021-2193 affecting package mysql 8.0.23-1. An upgraded version of the package is available that resolves this issue...

Ubuntu 18.04 LTS / 20.04 LTS : MySQL vulnerabilities (USN-4952-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4952-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been...