PT-2022-17907 · Microsoft +1 · System Center Virtual Machine Manager +1

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication versions 9.5U3 through 11.x Description: The issue is related to improper authentication in the component used for Microsoft System Center Virtual Machine Manager SCVMM, allowing attackers to execute arbitrary code...

CVAD Setup Wizard Fails To Complete When Using Citrix Cloud - Index Was Out Of Range

Running the Provisioning Services CVAD Setup Wizard to create or add new machines to a Citrix Cloud catalog fails to create the devices. Upon clicking finish, after specifying wizard parameters, the wizard closes and the following error appears: Error: Index was out of range. Must be non-negative...

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result the L2 guest would be allowed to read/write physical pages of the host resulting in a crash of the entire system leak of sensitive data or potential guest-to-host escape.

...

CVE-2022-25218

The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetdstartup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's...

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI has released an alert on Ragnarlocker campaign that has affected nearly 52 organizations encompassing 10 critical infrastructure sectors, including entities in significant manufacturing,...

VulnCheck KEV: CVE-2021-44207

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel...

CVE-2022-24738

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmo...

Out-of-bounds

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmo...

CVE-2022-24738 Account compromise in Evmos

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmo...

CVE-2022-24738

Evmos prior to v2.0.1 is vulnerable to draining unclaimed funds by an attacker who creates a malicious chain that does not enforce signature verification and connects it to a target Evmos instance via IBC, enabling migration of claim records and fund transfer. The issue stems from a vulnerability...

Adding Physical Devices to Citrix Cloud using the Provisioning Devices Export Wizard. "No Devices Found to Export"

When attempting to add Physical Devices to Citrix Cloud using the Citrix Provisioning Devices Export Wizard. Getting a message "No Devices Found to Export" after selected the Device Collection to export. Note:Physical Devices can also be a VM that will not be in a Power Managed Catalog...

CVE-2022-25089

Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEYLOCALMACHINE via UITasks.PersistentRegistryData...

Fortinet FortiPortal Security Feature Issue Vulnerability

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...

Alluxio has an unspecified vulnerability

Alluxio is Alluxio's to improve the speed of end-to-end distributed machine learning in the cloud. a security vulnerability exists in versions prior to Alluxio 2.7.3, which stems from the failure of the log server to validate input streams. No details of the vulnerability are currently available...

DEBIAN-CVE-2021-4093

A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State SEV-ES. A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction for example, outs or ins using the exit...

Google TensorFlow code issue vulnerability (CNVD-2022-14996)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. Google Tensorflow is vulnerable to a code issue that stems from an undefined behavior in the QuantizedMaxPool implementation, where user-controlled input can trigger a reference binding to a null...

Google TensorFlow numeric error vulnerability (CNVD-2022-14994)

TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow is vulnerable to a numerical error that could be exploited to crash the TensorFlow process by dividing it by zero...

Google TensorFlow numeric error vulnerability (CNVD-2022-14993)

TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow is vulnerable to a numerical error that results from the fact that the cost estimator of certain convolution operations can be used to perform an operation divided by zero, and the function fails ...

Algorithmia Msol 安全漏洞

Algorithmia Msol is a data machine artificial intelligence cloud platform from Algorithmia, USA. Algorithmia Msol suffers from a security vulnerability that can be exploited by an attacker to perform remote code execution...

Looking Over the Nation-State Actors’ Shoulders

Looking over the nation-state actors’ shoulders: Even they have a difficult day sometimes By Trellix and Marc Elias · Febraury 17, 2022 Have you ever been curious about how nation-state actors operate and what their day-to-day work looks like? This blog reveals some of these details observed base...