PT-2023-8262 · Nvidia · Nvidia Dgx A100 Sbios

Name of the Vulnerable Software and Affected Versions: NVIDIA DGX A100 SBIOS affected versions not specified Description: The issue is related to incorrect dynamic variable analysis, which may allow a user to cause a dynamic variable evaluation by local access. A successful exploit of this issue...

CVE-2023-22354

Datakit CrossCadWarex64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information...

CVE-2023-21092

In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...

CVE-2023-21092

In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google Inc. in the United States. A security vulnerability exists in Google Android, which stems from incorrect input validation in the retrieveServiceLocked of the ActiveServices.java component, which could potentially dynamically...

Important: bind

Issue Overview: By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. CVE-2022-2795 A flaw was found in the Bind package, where the resolver ca...

CVE-2023-28140

An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a Dependency Link Library DLL via a local attack vector instead of the DLL that the application was expecting, when processes are running with...

Qualys Cloud Agent code-related vulnerabilities

Qualys Cloud Agent is a lightweight application from Qualys USA, Inc. A single agent for real-time, global visibility and response. A security vulnerability exists in Qualys Cloud Agent versions prior to 4.5.3.1, which stems from a malicious copy of the Dependency Link Library DLL that allows an...

ROS-20230418-03

A vulnerability in the attribute definition mechanism for the gitattributes paths of the Git distributed version control system is related to an integer overflow. Git version control system is related to integer overflow. Exploitation of the vulnerability could allow an attacker, acting remotely,...

Protect intellectual property with Govern 365 and Microsoft Purview

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Global supply chains face a broad range of risks, from physical threats to cybersecurity threats. Sharing information with suppliers is essential for the supply chain to function...

[SECURITY] Fedora 38 Update: dnsmasq-2.89-2.fc38

Dnsmasq is lightweight, easy to configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. It can serve the names of local machines which are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with...

CVE-2023-28968 Junos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail open

An Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder JDPI-Decoder Application Signature component of Junos OS's AppID service on SRX Series devices will stop the JDPI-Decoder from identifying dynamic application traffic, allowi...

Trend Micro Security may insecurely load Dynamic Link Libraries

Overview Trend Micro Security provided by Trend Micro Incorporated contains an insecure DLL loading issue CWE-427. While the affected version of Trend Micro Security is installed and a malicious DLL is placed in a directory where some application executable resides, invoking the application...

Trend Micro Security code-related vulnerabilities

Trend Micro Security is an antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Security that stems from the presence of a DLL hijacking vulnerability that could result in unsafe loading of dynamic link libraries. Affected products and versions: Trend Micro Security...

Substance 3D Stager Buffer Overflow

The vulnerability of the Substance 3D Stager software lies in the overflow of memory buffer in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

Substance 3D Stager Buffer Overflow

The vulnerability of the Substance 3D Stager software lies in the overflow of memory buffer in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

h5dump Heap Buffer Overflow DoS

The vulnerability of the h5toolsstrsprint function /hdf5/tools/lib/h5toolsstr.c in the hdf5 file viewer program h5dump from the HDF5 library is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE by allowing an attacker to load a runtime DLL from an unexpected location. Remediation Upgrade Microsoft.NETCore.App.Runtime.win-x64 to version 6.0.16, 7.0.5 or higher. References - Advisory - GitHub Commit -...

USN-6006-1 dotnet6, dotnet7 vulnerability

It was discovered that .NET did not properly manage dll files. An attacker could potentially use this issue to execute arbitrary code...

CVE-2023-29187

A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup Software Installation Program - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the...