CVE-2017-12135: Incorrect Calculation

Xen allows local OS guest users to cause a denial of service crash or possibly obtain sensitive information or gain privileges via vectors involving transitive grants...

PT-2017-12357

Name of the Vulnerable Software and Affected Versions Xen affected versions not specified Description The issue allows local OS guest users to cause a denial of service, potentially obtain sensitive information, or gain privileges. This is achieved through vectors involving transitive grants...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

Double free

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

CVE-2017-12135

Xen allows local OS guest users to cause a denial of service crash or possibly obtain sensitive information or gain privileges via vectors involving transitive grants...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

multiple problems with transitive grants

ISSUE DESCRIPTION 1 Code to handle copy operations on transitive grants has built in retry logic, involving a function reinvoking itself with unchanged parameters. Such use assumes that the compiler would also translate this to a so called "tail call" when generating machine code. Empirically, th...

CVE-2017-2673

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles...

jsmf.org XSS vulnerability

Vulnerable URL: https://www.jsmf.org/grants/results.php?general2=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1179921 VIP website status:| No Check jsmf.org SSL connection:|...

grantsinternational.com XSS vulnerability

Vulnerable URL: http://www.grantsinternational.com/unsubscribe.cfm?email='" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2261543 VIP website status:| No Check grantsinternational.com SSL connection:| Grade: F...

National Science Foundation Internet of Things Security Grants

The National Science Foundation announced on Friday that it has awarded $6 million in grants to fund projects working toward securing networked things. The grants are part of a partnership with Intel Corp., and were awarded to separate projects at Stanford University and the University of...

Security, Tech Communities Rally to Support GnuPG

The last year has seen a big swing in the support from the technology community for open-source security tools, many of which are maintained by tiny staffs or volunteers. OpenSSL last year received a large chunk of funding from the Core Infrastructure Initiative, and now it’s GnuPG’s turn. After ...

Google Offers Bug Bounty Vulnerability Research Grants

Google last week announced that it has instituted a program for 2015 in which researchers can receive up to 3,133.70 in grant money for bug hunting. Researchers must apply for the grants, which will be an up-front award that will be paid out before a bug is submitted, Google said. “Researchers’...

OracleVM 3.2 : xen (OVMSA-2013-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: don't permit SVTNOVERIFY entries for known device types Only in cases where we don't know what to do we should leave the IRTE blank suppressing all validation, but we should always log a warning...

NSF Awards $15m for New Secure Internet Architecture

The National Science Foundation NSF is awarding $15 million in grants for the development, deployment and testing of future Internet architectures that are designed to enhance security, respond to emerging service challenges, and increase scalability. In 2010, the NSF Directorate for Computer and...

FreeBSD : FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys (eda151d8-4638-11e1-9f47-00e0815b8da8)

The OpenSSL library call used to decrypt private keys ignores the passphrase argument if the key is not encrypted. Because the pamssh module only checks whether the passphrase provided by the user is null, users with unencrypted SSH private keys may successfully authenticate themselves by providi...

House GOP Task Force Favors Private Incentives, Fewer Regulations for Cybersecurity

A House GOP task force called on Congress this week to adopt voluntary incentives – rather than federal requirements – to get private companies to further develop their cyber security. The GOP proposes a combination of tax credits, grants, insurance and rules set by non-regulatory agencies as a w...

Experts Discuss Stuxnet's Long-Term Impact on Cybersecurity

Stuxnet has both fascinated and horrified the cybersecurity community throughout 2010. Its multiple zero-day exploits, stealth capabilities, and precise control over industrial machinery mark it as a prime example of advanced cyber threats. Stuxnet represents both a nightmare and a dream for...