AMD Server Vulnerabilities – Nov 2023

Bulletin ID: AMD-SB-3002 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary Potential vulnerabilities in the AMD Secure Processor ASP, AMD System Management Unit SMU, AMD Secure Encrypted Virtualization SEV, AMD Secure Encrypted...

CVE-2021-46766: Incomplete Cleanup

Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality...

ASP.NET Model View Controller XSS

The vulnerability of the System.Web.Mvc.dll library, which is used by ASP.NET MVC for creating web applications, relates to the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows an attacker to bypass security restrictions and perform cross-sit...

CVE-2023-26578 Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application

Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server...

Zyxel PMG Security Breach

Zyxel PMG is a series of dual-band wireless ONT home gateway units from China's Hopkins Zyxel . A security vulnerability exists in Zyxel PMG version v.PMG2005-T20B, which originates from a vulnerability that could allow a remote attacker to cause a denial of service via a crafted script via the u...

CVE-2023-43198

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hiblock.asp function...

CVE-2023-43198

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hiblock.asp function...

CVE-2023-43197

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function...

PT-2023-4989 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in Microsoft SharePoint Server, which can be exploited by creating a specially crafted ASP.NET page. This...

Microsoft Visual Studio Information Disclosure

The vulnerability of Microsoft Visual Studio, a software development tool, and the Microsoft.NET platform is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-36899

ASP.NET Elevation of Privilege Vulnerability...

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability...

CVE-2023-20589

A flaw was found in hw. This flaw allows an attacker with specialized hardware and physical access to an impacted device to perform a voltage fault injection attack, compromising the ASP secure boot and potentially leading to arbitrary code execution. Mitigation Mitigation for this issue is eithe...

CVE-2023-20589

An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution...

Design/Logic Flaw

An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution...

Denial of Service (DoS)

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS in .NET Kestrel where a malicious...

Denial of Service (DoS)

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS in Kestrel where, on detecting a...

CVE-2023-20589

The CVE-2023-20589 entry corresponds to a voltage fault injection vulnerability affecting fTPM ASP secure boot on AMD Ryzen platforms (Zen 1/2/3). The AMD-SB-4005 bulletin provides concrete details: potential arbitrary code execution via physical access and specialized hardware, impacting a wide ...

CVE-2023-20589 fTPM Voltage Fault Injection

An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution...

Microsoft .NET and Visual Studio Security Vulnerabilities

Microsoft Visual Studio is a family of development tool suites and a fundamentally complete development toolset that includes most of the tools needed throughout the software lifecycle. Microsoft .NET is a software framework dedicated to agile software development, rapid application development,...