BIOS SMI Handler Input Validation Failures - US

Lenovo Security Advisory: LEN-14695 Potential Impact: Execution of code in System Management Mode by an attacker with local administrative access Severity: High Scope of Impact: Industry-Wide CVE Identifier: CVE-2017-3753 Summary Description: A vulnerability has been identified in some Lenovo...

BIOS SMI Handler Input Validation Failures - Lenovo Support US

No description provided...

Microsoft Windows Multiple Vulnerabilities (KB4093111)

This host is missing a critical security update according to Microsoft KB4093111 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4093107)

This host is missing a critical security update according to Microsoft KB4093107 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4093109)

This host is missing a critical security update according to Microsoft KB4093109 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Device Guard Security Feature Bypass Vulnerability

A security feature bypass exists when Device Guard incorrectly validates an untrusted file. An attacker who successfully exploited this vulnerability could make an unsigned file appear to be signed. Because Device Guard relies on the signature to determine the file is non-malicious, Device Guard...

KB4093111: Windows 10 April 2018 Security Update

The remote Windows host is missing security update 4093111. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass exists when Device Guard incorrectly validates an untrusted file. An attacker who successfully exploited this vulnerability could make an unsigned file...

KB4093119: Windows 10 Version 1607 and Windows Server 2016 April 2018 Security Update

The remote Windows host is missing security update 4093119. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when Windows improperly handles objects in memory and incorrectly maps kernel memory. CVE-2018-1009 - A security feature bypass...

Microsoft Windows Device Guard CVE-2018-0966 Remote Security Bypass Vulnerability

Description Microsoft Windows is prone to a remote security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit System...

PT-2018-9174

Name of the Vulnerable Software and Affected Versions: Windows Server 2016 Windows 10 Windows 10 Servers Description: A security feature bypass exists due to incorrect validation of an untrusted file by Device Guard, allowing attackers to affect the system. Recommendations: For Windows Server 201...

KB4093109: Windows 10 Version 1511 April 2018 Security Update

The remote Windows host is missing security update 4093109. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass exists when Device Guard incorrectly validates an untrusted file. An attacker who successfully exploited this vulnerability could make an unsigned file...

March 13, 2018—KB4088786 (OS Build 10240.17797)

None None...

Design/Logic Flaw

AESM daemon in Intel Software Guard Extensions Platform Software Component for Linux before 2.1.102 can effectively be disabled by a local attacker creating a denial of services like remote attestation provided by the AESM...

CVE-2018-3689

The CVE affects the AESM daemon in the Intel SGX Platform Software Component for Linux prior to version 2.1.102. A local attacker can disable AESM, causing a denial of service to remote attestation. The NVD CVSSv3.1 vector indicates LOCAL access, low attack complexity, privileges required: LOW, w...

UBUNTU-CVE-2018-9234

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey...

CVE-2018-3689: Undefined Security Weakness

AESM daemon in Intel Software Guard Extensions Platform Software Component for Linux before 2.1.102 can effectively be disabled by a local attacker creating a denial of services like remote attestation provided by the AESM...

PT-2018-16126

Name of the Vulnerable Software and Affected Versions Intel Software Guard Extensions Platform Software Component for Linux versions prior to 2.1.102 Description The issue allows a local attacker to disable the AESM daemon, resulting in a denial of service for features like remote attestation...

Roundcube Information Disclosure Vulnerability

roundCube is a browser-based IMAP client that supports address book management, message searching, spell checking, etc. The enigma plugin is one of the encryption components. A security vulnerability exists in the enigma plugin in roundcube 1.3.4 and earlier versions. An attacker can exploit this...

Intel Software Guard Extension Local Elevation of Privilege Vulnerability

Intel Software Guard Extensions Platform Software Component is a set of software components for the Software Guard Extensions Platform from Intel Corporation. A local elevation of privilege vulnerability exists in Intel Software Guard Extensions. A local attacker could exploit this vulnerability ...

Retrieving NTLM Hashes without Touching LSASS: Internal Monologue Attack

Mimikatz, developed by Benjamin Delpy @gentilkiwi, is a well-regarded post-exploitation tool, which allows adversaries to extract plain text passwords, NTLM hashes and Kerberos tickets from memory, as well as perform attacks such as pass-the-hash, pass-the-ticket or build a golden ticket. Arguabl...