SUSE CVE-2020-15852

An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tssinvalidateiobitmap mishandling causes a loss of synchronization between the I/O bitmaps ...

SUSE CVE-2020-29569

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring-xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the...

SUSE CVE-2021-26930

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later...

SUSE CVE-2021-26931

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests such as out of memory conditions, it isn'...

SUSE CVE-2022-23038

Linux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removing access rights of the...

SUSE CVE-2022-23041

Linux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removing access rights of the...

SUSE CVE-2022-33742

Linux disk/nic frontends data leaks This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend CVE-2022-26365,...

GSD-2023-1001896 acpi: Fix suspend with Xen PV

acpi: Fix suspend with Xen PV This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.9 by commit b96903b7fc8c82ddfd92df4cdd83db3e567da0a5, it was...

Guests can cause Xenstore crash via soft reset

ISSUE DESCRIPTION When a guest issues a "Soft Reset" e.g. for performing a kexec the libxl based Xen toolstack will normally perform a XSRELEASE Xenstore operation. Due to a bug in xenstored this can result in a crash of xenstored. Any other use of XSRELEASE will have the same impact. IMPACT A...

CVE-2023-23691

Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS...

CVE-2023-23691

Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS...

Design/Logic Flaw

Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS...

CVE-2023-23691

Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS...

CVE-2023-23691

Dell EMC PV ME5 (versions ME5.1.0.0.0 and ME5.1.0.1.0) contains a Client-side desync vulnerability. An unauthenticated attacker can force a victim’s browser to desynchronize from the website, typically enabling XSS and DoS. Connected sources indicate affected versions and impact; Nessus/DSA-2023-...

CVE-2023-23691: Inconsistent Interpretation of HTTP Requests

Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS...

Dell MEC PV ME5 环境问题漏洞

The Dell MEC PV ME5 is an entry-level block storage array built and optimized for price-sensitive SAN and DAS environments from Dell USA. A security vulnerability exists in Dell EMC PV ME5 version 5.1.0.0.0 and ME5.1.0.1.0. An attacker could exploit this vulnerability to force the victim's browse...

PT-2023-19135 · Dell Emc · Dell Emc Pv Me5

Name of the Vulnerable Software and Affected Versions: Dell EMC PV ME5 versions ME5.1.0.0.0 through ME5.1.0.1.0 Description: The issue is related to a Client-side desync vulnerability. An unauthenticated attacker could potentially exploit this to force a victim's browser to desynchronize its...

PT-2025-13340

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version containing commit f1e525009493 Description A vulnerability in the Linux kernel has been resolved, related to the Advanced Configuration and Power Interface ACPI handling when suspending the system und...

EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2022-2932)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - When sending malicous data to kernel by ioctl cmd FBIOPUTVSCREENINFO,kernel will write memory out of bounds. CVE-2021-33655 - In...

SUSE: Security Advisory (SUSE-SU-2022:3665-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...