CVE-2017-18347

Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug SWD commands because there is a race condition between full initialization of the SWD...

CVE-2017-18347

CVE-2017-18347 affects STMicroelectronics STM32F0 series devices; the root cause is a race condition between full SWD interface initialization and flash protection setup, enabling physically present attackers to extract protected firmware via a specific SWD command sequence on Level 1 RDP. The co...

Block Overflow

github.com/ethereum/go-ethereum is vulnerable to block overflow. The library does not ensure that the end chain comes after the start chain in debug mode, causing an overwrite when processing a malformed block that can overwrite the next block in the sequence...

Wind River VxWorks Vulnerabilities

Overview A security researcher has identified two vulnerabilities affecting the Wind River Systems’ VxWorks platform. The vulnerabilities are a debug service enabled by default VU362332 and a weak hashing algorithm used in authentication VU840249. ICS-CERT has been coordinating with CERT/CC in...

Red Hat glusterfs server remote code execution vulnerability

Red Hat glusterfs server is an open source distributed file system from Red Hat Red Hat. The system is mainly for media streaming , data analysis and other data and bandwidth intensive tasks to create large-scale distributed storage solutions. A security vulnerability exists in the Red Hat...

ASP.NET DEBUG Method Enabled

It is possible to send debug statements to the remote ASP scripts via the http DEBUG method. A remote, unauthenticated attacker may leverage this to alter the runtime of the remote scripts. No source data...

New Android Malware Framework Turns Apps Into Powerful Spyware

Security researchers have uncovered a new, powerful Android malware framework that is being used by cybercriminals to turn legitimate apps into spyware with extensive surveillance capabilities—as part of what seems to be a targeted espionage campaign. Legitimate Android applications when bundled...

UBUNTU-CVE-2018-15468

An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the...

ALPINE-CVE-2018-15468

An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the...

DEBIAN-CVE-2018-15468

An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the...

RHEL 7 : kernel (RHSA-2018:2389)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2389 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Modern operating systems implement...

@0ti.me/test-deps (>=0.1.1 <=0.1.22), @0ti.me/ts-test-deps (>=0.1.0 <=0.1.3) +2445 more potentially affected by CVE-2017-16137 via debug (>=3.2.0 <=3.2.6)

debug NPM version =3.2.0, =0.1.1, =0.1.0, =1.0.0, =0.2.39, =1.0.2, =2.0.3, =1.1.1, =0.0.34, =1.0.1, =1.0.2, =1.0.2, =0.0.2, =0.0.2, =0.1.0, =0.3.0 and more Source cves: CVE-2017-16137 Source advisory: OSV:GHSA-GXPJ-CX7G-858C...

@bahmutov/add-typescript-to-cypress (>=1.0.2 <=1.1.1), @betit/orion (>=1.0.0-beta.1 <=1.0.0-beta.6) +178 more potentially affected by CVE-2017-16137 via debug (>=3.0.0 <=3.0.1)

debug NPM version =3.0.0, =1.0.2, =1.0.0-beta.1, =1.0.0-beta.6, =2.0.1-SNAPSHOT.88, =0.0.4, =0.0.12, =1.0.1, =1.0.0, =1.0.0, =0.1.5, =2.8.0, =1.0.71, =1.0.10-14, =1.1.16 and more Source cves: CVE-2017-16137 Source advisory: OSV:GHSA-GXPJ-CX7G-858C...

0.8.18-p11 (=0.8.18-p12), 04_nodeblog (=1.0.0) +37638 more potentially affected by CVE-2017-16137 via debug (>=0.1.0 <=2.6.8)

debug NPM version =0.1.0, =1.0.0, =0.0.15, =1.0.4, =1.0.1, =0.0.1, =1.0.3, =0.0.1, =0.1.0, =0.1.2 - 200 =0.0.1 and more Source cves: CVE-2017-16137 Source advisory: OSV:GHSA-GXPJ-CX7G-858C...

Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue. This was later re-introduced in version v3.2.0, and...

GHSA-GXPJ-CX7G-858C Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue. This was later re-introduced in version v3.2.0, and...

Tamper proofing review: the iZettle card payment terminal

Tamper resistance is an increasingly important factor in smart devices. Together with secure hardware design and defensive coding, it can deliver a very secure device. One of the most common areas the average consumer will encounter tamper resistant devices is in payment terminals, or Pin Entry...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2018-4189)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-4189 advisory. - tcp: add tcpoootrycoalesce helper Eric Dumazet Orabug: 28453849 CVE-2018-5390 - tcp: call tcpdrop from tcpdataqueueofo Eric Dumazet Orabug: 28453849...

katello-debug Arbitrary File Overwrite Vulnerability

Katello is a system management engine that provides workflows for configuration management, subscription management and content management. katello-debug is one of the debuggers. An arbitrary file overwrite vulnerability exists in versions prior to katello-debug 3.4.0, which stems from the use of...

CVE-2018-7947

Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153C00 have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific...