3173 matches found
This Week in Security News: Ransomware Gang is Raking in Tens of Millions of Dollars and Microsoft Patch Tuesday Update Fixes 17 Critical Bugs
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about a ransomware group that walked away with 2,200 Bitcoin: More than $33 million based on the current Bitcoin exchange rate. Also, read...
Xen Platypus information leak via power sidechannel (XSA-351)
An information disclosure vulnerability exists in power/energy monitoring interfaces, which can be used to create covert channels and infer the operations and data used by other contexts within the system. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid142889;...
CVE-2020-28368
A flaw was found in Xen where access to power/energy monitoring interfaces was not properly restricted to privileged software. This flaw allows an unprivileged guest administrator to create covert channels and infer the operations or data used by other contexts within the system, such as AES keys...
Unbreakable Enterprise kernel-container security update
4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...
CVE-2020-28368
Xen through 4.14.x allows guest OS administrators to obtain sensitive information such as AES keys from outside the guest via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for...
CVE-2020-28368
Xen through 4.14.x allows guest OS administrators to obtain sensitive information such as AES keys from outside the guest via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for...
[ASA-202011-10] linux-hardened: multiple issues
Arch Linux Security Advisory ASA-202011-10 ========================================== Severity: Medium Date : 2020-11-10 CVE-ID : CVE-2020-8694 CVE-2020-25704 Package : linux-hardened Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1269 Summary ======= The package...
Unbreakable Enterprise kernel security update
5.4.17-2036.100.6.1.el8uek - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040802 CVE-2020-8694 CVE-2020-8695 - KVM: ioapic: break infinite recursion on lazy EOI Vitaly Kuznetsov Orabug: 32066585 CVE-2020-27152 CVE-2020-27152 - x86/mitigations: Restore paranoid checks fo...
AMD Energy Driver for Linux Vulnerability (RAPL) - Lenovo Support US
No description provided...
Hitachi ABB Power Grids XMC20 Multiservice-Multiplexer
1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Hitachi ABB Power Grids Equipment: XMC20 Multiservice-Multiplexer Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...
Akamai's Climate Leadership
Guest blogger Jim Boyle is CEO and Founder of Sustainability Roundtable, Inc. His views are his own and do not necessarily reflect those of Akamai. The business world has moved much further online in 2020 and showed up as never before at NYC's Climate Week September 21-27. HRH The Prince of Wales...
energy-speakers.com Cross Site Scripting vulnerability OBB-1406685
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
energy-save.gr Cross Site Scripting vulnerability OBB-1382324
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
This One Time on a Pen Test: Ain’t No Fence High Enough
Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part of an ongoing series featuring testimonials of what goes on beneath the hoodie. For more insights, check out our 2020 Under the Hoodie report. Read...
Advantech WebAccess Node
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Advantech Equipment: WebAccess Node Vulnerability: Incorrect Permission Assignment for Critical Resource 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate their...
Bluetooth Spoofing Bug Affects Billions of IoT Devices
A team of academic researchers have discovered a Bluetooth Low Energy BLE vulnerability that allows spoofing attacks that could affect the way humans and machines carry out tasks. It potentially impacts billions of Internet of Things IoT devices, researchers said, and remains unpatched in Android...
energy.mybusinesspagepro.com Cross Site Scripting vulnerability OBB-1320582
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
HMS Networks Ewon Flexy and Cosy
1. EXECUTIVE SUMMARY CVSS v3 2.3 ATTENTION: Low skill level to exploit Vendor: HMS Networks Equipment: Ewon Flexy and Cosy Vulnerability: Permissive Cross-domain Policy with Untrusted Domains 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to retrieve...
sunsure-energy.com Cross Site Scripting vulnerability OBB-1316921
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Siemens Spectrum Power
1. EXECUTIVE SUMMARY CVSS v3 3.7 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: Spectrum Power Vulnerabilities: Cleartext Storage of Sensitive Information, Exposure of Information Through Directory Listing 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow...