850 matches found
SUSE CVE-2017-5753
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis...
SUSE CVE-2018-3693
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis...
SUSE CVE-2020-1773
An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...
SUSE CVE-2022-28693
Unprotected alternative channel of return branch target prediction in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
PT-2023-4440 · Libde265 +3 · Libde265 +3
Name of the Vulnerable Software and Affected Versions: Libde265 version 1.0.10 Description: The issue is related to a heap-buffer-overflow vulnerability in the derive spatial luma vector prediction function in motion.cc of the Libde265 video codec implementation. This vulnerability can be exploit...
PT-2023-1851 · Libde265 +4 · Libde265 +4
Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.10 Description: The issue is related to a NULL pointer dereference in the ff hevc put unweighted pred 8 sse function at sse-motion.cc. This allows attackers to cause a Denial of Service DoS via a crafted input file...
PT-2023-1848 · Libde265 +4 · Libde265 +4
Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.10 Description: The issue is related to a NULL pointer dereference in the ff hevc put weighted pred avg 8 sse function at sse-motion.cc. This allows attackers to cause a Denial of Service DoS via a crafted input file. The...
RHEL 8 : kpatch-patch (RHSA-2020:3297)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3297 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...
RHEL 8 : kpatch-patch (RHSA-2020:3073)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3073 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...
A week in security (January 9—15)
Last week on Malwarebytes Labs: Slack private code on GitHub stolen Crypto-inspired Magecart skimmer surfaces via digital crime haven Security vulnerabilities in major car brands revealed Microsoft ends extended support for Windows 7 and Windows Server 2008 today Pokemon NFT card game malware...
2023 prediction: Security workforce shortage will lead to nationally significant cyberattack
If 2022 was any indication, businesses are about to face an unprecedented volume, frequency, and sophistication of cyberthreats in 2023. Global cyberattacks have increased by 483 percent over the last two years, and at the current rate of growth, damage from such attacks will amount to $10.5...
enigmax 安全漏洞
enigmax is a cryptographic program in C by the individual developer Pierre-François Monville. A security vulnerability exists in enigmax version 2.2 and earlier. An attacker exploited the vulnerability to cause the pseudo-random number generator prng to predict seeds...
K64571774: BIG-IP virtual server TCP sequence numbers vulnerability CVE-2020-5947
Security Advisory Description On specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. CVE-2020-5947 Impact Attackers may be able to spoof TCP packet...
CVE-2016-15005 Cryptographically weak random number generation in github.com/dinever/golf
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...
hw: cpu: Intel: information disclosure via local access
A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some IntelR Processors may allow an authorized user to enable information disclosure via local access...
hw: cpu: Intel: information disclosure via local access
A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some IntelR Processors may allow an authorized user to enable information disclosure via local access...
Important: kernel
Issue Overview: In v4l2m2mquerybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Andro...
The vulnerability of the Indirect Branch Prediction Barrier (IBPB) implementation in AMD microprogramming software allows a hacker to gain unauthorized access to protected information.
The vulnerability of the Indirect Branch Prediction Barrier IBPB implementation in AMD microprocessors is related to improper cleaning of the RAS stack. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a secondary channel...
hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions
A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation eIBRS capabilities, soon after VM exit or IBPB command event, the linear address following the most recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer RSB...
hw: cpu: Intel: information disclosure via local access
A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some IntelR Processors may allow an authorized user to enable information disclosure via local access...