13899 matches found
CVE-2023-32059: Function Call With Incorrect Order of Arguments
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the type...
Ubiquiti UniFi Cloud Key cross-site request forgeing vulnerability
Ubiquiti UniFi Cloud Key is a secret key device that supports management of UniFi networks from Ubiquiti, Inc. A security vulnerability exists in the Ubiquiti UniFi Cloud Key UniFi OS 2.5 and prior versions, which originated from a vulnerability that allows malicious actors to access certain...
Malicious code in the-universe-has-your-back-transform-fear-to-faith-by-gabrielle-bernstein-on-iphone-full-pages- (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd2dda2348af7d4384cb9a35d0387e5b87503b49779170d897bca656ab712b0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-23818
Insufficient input validation on the model specific register: VMHSAVEPA may potentially lead to loss of SEV-SNP guest memory integrity...
kernel: fscache: Fix invalidation/lookup race
In the Linux kernel, the following vulnerability has been resolved: fscache: Fix invalidation/lookup race If an NFS file is opened for writing and closed, fscacheinvalidate will be asked to invalidate the file - however, if the cookie is in the LOOKINGUP state or the CREATING state, then request ...
kernel: blk-mq: avoid double ->queue_rq() because of early timeout
In the Linux kernel, the following vulnerability has been resolved: blk-mq: avoid double -queuerq because of early timeout David Jeffery found one double -queuerq issue, so far it can be triggered in VM use case because of long vmexit latency or preempt latency of vCPU pthread or long page fault ...
kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva
A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause a kernel oops condition on the host, resulting in a denial of service...
kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning
A flaw was found in the x86 KVM subsystem in kvmstealtimesetpreempted in arch/x86/kvm/x86.c in the Linux kernel. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVMVCPUPREEMPTED situations...
kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks
A flaw was found in the KVM's Intel nested virtualization feature nVMX. Since L1 and L2 shared branch prediction modes guest-user and guest-kernel, KVM did not protect indirect branches in L1 from steering by a malicious agent in L2. This could allow a malicious nested guest to carry out Spectre ...
kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning
A flaw was found in the x86 KVM subsystem in kvmstealtimesetpreempted in arch/x86/kvm/x86.c in the Linux kernel. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVMVCPUPREEMPTED situations...
Malicious code in dojo-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58ff9bd8fdb50f834a7cc8a72c7d1a31edae453146ddf2e9358fbde9e4ce3c36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Moderate: libguestfs-winsupport security update
The libguestfs-winsupport package adds support for Windows guests to libguestfs, a set of tools and libraries allowing users to access and modify virtual machine VM disk images. Security Fixes: ntfs-3g: heap-based buffer overflow in ntfsck CVE-2021-46790 ntfs-3g: crafted NTFS image can cause heap...
PT-2023-12737 · Amd · Amd Sev-Snp
Name of the Vulnerable Software and Affected Versions: AMD SEV-SNP affected versions not specified Description: The issue is related to insufficient input validation on the model-specific register: VM HSAVE PA, which may potentially lead to loss of SEV-SNP guest memory integrity. Recommendations:...
ALSA-2023:2179 Moderate: libguestfs-winsupport security update
The libguestfs-winsupport package adds support for Windows guests to libguestfs, a set of tools and libraries allowing users to access and modify virtual machine VM disk images. Security Fixes: ntfs-3g: heap-based buffer overflow in ntfsck CVE-2021-46790 ntfs-3g: crafted NTFS image can cause heap...
PYSEC-2023-76
Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8...
PT-2023-20335 · Vm2 +1 · Vm2 +1
Name of the Vulnerable Software and Affected Versions: jsreport versions prior to 3.11.3 Description: The issue is related to code injection in the jsreport GitHub repository. An attacker can exploit this to obtain authority over the jsreport playground server or construct a malicious webpage/htm...
Oracle Database Server Java VM Data Access
The vulnerability of the Java VM component of the Oracle Database Server management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...
How to keep your ChatGPT conversations out of its training data
Last week, OpenAI announced it had given ChatGPT users the option to turn off their chat history. ChatGPT is a "generative AI", a machine learning algorithm that can understand language and generate written responses. Users can interact with it by asking questions, and the conversations users hav...
What does ChatGPT know about phishing?
Can ChatGPT detect phishing links? Hearing all the buzz about the amazing applications of ChatGPT and other language models, our team could not help but ask this question. We work on applying machine learning technologies to cybersecurity tasks, specifically models that analyze websites to detect...
