CVE-2019-14899

A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and...

Design/Logic Flaw

A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and...

CVE-2019-14899

A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and...

Talos Vulnerability Discovery Year in Review — 2019

By Martin Zeiser. Cisco Talos' Systems Security Research Team investigates software, operating system, IoT and ICS vulnerabilities to make sure we find vulnerabilities before the bad guys do. We provide this information to the affected vendors so that they can create patches and protect their...

The vulnerability of the Windows Installer component allows attackers to exploit their privileges.

The vulnerability of the Windows Installer component in operating systems is related to errors in the memory object handling mechanisms. Exploiting this vulnerability can allow an attacker to gain increased privileges...

New Linux Bug Lets Attackers Hijack Encrypted VPN Connections

A team of cybersecurity researchers has disclosed a new severe vulnerability affecting most Linux and Unix-like operating systems, including FreeBSD, OpenBSD, macOS, iOS, and Android, that could allow remote 'network adjacent attackers' to spy on and tamper with encrypted VPN connections. The...

Kernel: page cache side channel attacks

A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be us...

The vulnerability of the Win32k component in Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Win32k component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Win32k component in Windows operating systems, which allows attackers to escalate their privileges

The vulnerability of the Win32k component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

Kernel: page cache side channel attacks

A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be us...

Citrix Provisioning Service Target Device compatibility with Hyper V Generation 2 Virtual Machines.

The following table shows which 64-bit and 32-bit versions of Windows you can use as a guest operating system for generation 1 and generation 2 virtual machines. 64-bit versions of Windows| Generation 1| Generation 2 ---|---|--- Windows Server 2019| ✔| ✔ Windows Server 2016| ✔| ✔ Windows Server...

FreeBSD -- Machine Check Exception on Page Size Change

Intel discovered a previously published erratum on some Intel platforms can be exploited by malicious software to potentially cause a denial of service by triggering a machine check that will crash or hang the system. Malicious guest operating systems may be able to crash the host...

Persistence – Accessibility Features

The accessibility features provide additional options on screen keyboards, magnifier, screen reading etc. that could assist people with disabilities to use Windows operating systems easier. However, this functionality can be abused to achieve persistence on a host that RDP is enabled and...

Microsoft Guidance for Vulnerability in Trusted Platform Module (TPM)

Executive Summary This advisory addresses CVE-2019-16863. A security vulnerability exists in certain Trusted Platform Module TPM chipsets. The vulnerability weakens key confidentiality protection for a specific algorithm ECDSA. It is important to note that this is a TPM firmware vulnerability, an...

WebKit Component Memory Corruption Vulnerability in Multiple Apple Products (CNVD-2019-46969)

Apple iOS is an operating system developed for mobile devices.Apple tvOS is an operating system for smart TVs.Apple iPadOS is an operating system for iPad tablets.WebKit is one of the web browser engine components. A security vulnerability exists in the WebKit component of several Apple products...

Multiple Apple Products File System Events Component Memory Corruption Vulnerability

Apple iOS is an operating system developed for mobile devices. apple tvOS is a smart TV operating system. apple watchOS is a smart watch operating system. file System Events is a file system event reporting component. File System Events is a file system event reporting component. A security...

Facebook Sues Israeli NSO Spyware Firm For Hacking WhatsApp Users

Finally, for the very first time, an encrypted messaging service provider is taking legal action against a private entity that has carried out malicious attacks against its users. Facebook filed a lawsuit against Israeli mobile surveillance firm NSO Group on Tuesday, alleging that the company was...

Persistence – Port Monitors

The print spooler service is responsible for managing printing jobs in Windows operating systems. Interaction with the service is performed through the Print Spooler API which contains a function AddMonitor that can be used to install local port monitors and connects the configuration, data and...

The vulnerability of Windows operating systems, related to errors in memory object handling, allows a perpetrator to trigger a system failure.

The vulnerability of Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Xen Denial of Service Vulnerability (CNVD-2019-34764)

Xen is an open source virtual machine monitor product. Xen has a denial of service vulnerability that can be exploited by x86 client OS attackers to cause a denial of service or gain privileges...