Security Bulletin: Due to the use of curl, IBM CICS TX Advanced is vulnerable to security restrictions potentially being bypassed (CVE-2023-38546).

Summary IBM CICS TX Advanced is vulnerable to CVE-2023-38546 if curl function, curleasyduphandle, has cookies enabled during the transfer when the handle is duplicated. Curl is used by IBM CICS TX Advancede to transfer data. An update to IBM CICS TX Advanced has been released to address this...

Security Bulletin: There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM CICS TX Advanced (CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049).

Summary There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM CICS TX Advanced CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049. An update to IBM CICS TX Advanced has been released to address these vulnerabilities...

AMD Processor Security Vulnerability

AMD Processors is a processor from Ultraviolet Semiconductor AMD. A security vulnerability exists in AMD Processor. An attacker exploiting this vulnerability could execute arbitrary code...

AMD SEV-SNP Security Vulnerability

AMD SEV-SNP is a secure encrypted virtualization firmware from UltraMicroelectronics AMD. A single key is used to encrypt system memory. A security vulnerability exists in AMD SEV-SNP that stems from a failure to initialize memory in the SEV firmware...

AMD SEV-SNP Security Vulnerability

AMD SEV-SNP is a secure encrypted virtualization firmware from UltraMicroelectronics AMD. A single key is used to encrypt system memory. AMD SEV-SNP has a security vulnerability that stems from a code error...

PT-2024-11956 · Amd · Amd Spi Protection Feature

Name of the Vulnerable Software and Affected Versions: AMD SPI protection feature affected versions not specified Description: The issue is related to improper access control in the AMD SPI protection feature, which may allow a user with Ring0 kernel mode privileged access to bypass protections...

AMD UltraScale Data Forgery Issue Vulnerability

AMD UltraScale is a family of chips from the American company UltraMicroelectronics AMD. AMD UltraScale suffers from a security vulnerability that stems from insufficient data authenticity validation...

AMD Processor Security Vulnerability

AMD Processors is a processor from Ultraviolet Semiconductor AMD. AMD Processor has a security vulnerability that stems from improper access control...

CVE-2022-34309

CVE-2022-34309 affects IBM CICS TX Standard and Advanced 11.1. The vulnerability arises from the use of weaker-than-expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. IBM’s advisories indicate that IBM CICS TX Standard and IBM CICS TX Advance...

CVE-2022-34311

CVE-2022-34311 affects IBM CICS TX Standard and IBM CICS TX Advanced 11.1. The issue allows a user with physical access to the web browser to gain access to the user’s session due to insufficiently protected credentials. CVSS v3 base score 4.3 (Attacker: Physical, Privileges Required: None, User ...

CVE-2022-34310

The CVE-2022-34310 issue affects IBM CICS TX Standard and Advanced 11.1, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Public documents confirm affected products and versions (IBM CICS TX Standard and IBM CICS TX Advanced, 11....

Priorities of the Joint Cyber Defense Collaborative for 2024

Today, CISA—on behalf of the collective group of industry and government partners that comprise the Joint Cyber Defense Collaborative JCDC—released JCDC’s 2024 Priorities. Similar to the 2023 JCDC Planning Agenda, JCDC’s 2024 Priorities will help focus the collective group on developing high-impa...

IBM CICS TX Standard 加密问题漏洞

IBM CICS TX Standard and Advanced is a comprehensive, single transaction runtime package from International Business Machines IBM, Inc. It can provide a cloud-native deployment model for standalone applications. IBM CICS TX Standard has a cryptographic issue vulnerability that stems from the use ...

Volt Typhoon: A Cyber Threat to U.S. Critical Infrastructure

Summary: State-sponsored cyber actors from the People’s Republic of China, known as Volt Typhoon, are actively targeting critical infrastructure in the United States, employing sophisticated tactics like pre-compromise reconnaissance and living off-the-land techniques. Threat Level - Red | Attack...

hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem

A flaw was found in some of AMD CPU's due to improper or unexpected behavior of the INVD. This issue may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU, potentially leading to a loss of guest virtual machine VM memory integrity...

Cross-site Scripting (XSS)

CKEditor4 is vulnerable to Cross-site Scripting. The vulnerability is due to editor instances that have enabled full-page editing mode or enabled CDATA elements in the Advanced Content Filtering configuration which defaults to script and style elements. This flaw allows an attacker to inject...

Critical: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.7.11 security and bug fix container update

Red Hat Advanced Cluster Management for Kubernetes 2.7.11 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a...

CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection

Affected packages The vulnerability has been discovered in the core HTML parsing module and may affect all editor instances that: Enabled full-page editing mode, or enabled CDATA elements in Advanced Content Filtering configuration defaults to script and style elements. Impact A potential...

amd: Return Address Predictor vulnerability leading to information disclosure

A side channel vulnerability was found in hw amd. Some AMD CPUs may allow an attacker to influence the return address prediction. This issue may result in speculative execution at an attacker-controlled instruction pointer register, potentially leading to information disclosure...

CVE-2024-24815 CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA...