Intel® Processor Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow escalation of privilege. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2021-0146 Description: Hardware allows activation of test or debug logic at...

AMD Server Vulnerabilities – November 2021

Bulletin ID: AMD-SB-1021 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary During security reviews in collaboration with Google, Microsoft, and Oracle, potential vulnerabilities in the AMD Secure Processor ASP, AMD System Management Un...

多款Qualcomm产品缓冲区错误漏洞

Qualcomm QCA6574AU and others are products of Qualcomm Incorporated Qualcomm.QCA6574AU is a central processing unit CPU product.APQ8017 is a central processing unit CPU product.SDX55 is a modem.Qualcomm QCA6574AU is a central processing unit CPU product.APQ8017 is a central processing unit CPU...

The vulnerability of the incoming email processor in Redmine’s project and task management web application, related to improper authorization, allows a hacker to compromise data integrity.

The vulnerability of the incoming email processor in Redmine’s project and task management web application relates to the bypassing of the addissuenotes permission restrictions. Exploiting this vulnerability could allow a malicious actor to influence the integrity of data...

GitLab 输入验证错误漏洞

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. GitLab CE/EE is vulnerable to input validation errors, which can be exploited to cause high CPU usage...

CVE-2021-22097

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100%...

F5 Networks BIG-IP : Intel processor vulnerabilities (K41043270)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K41043270 advisory. CVE-2021-0086Observable response discrepancy in floating-point operations for some IntelR Processors may allow...

NewStart CGSL CORE 5.05 / MAIN 5.05 : microcode_ctl Multiple Vulnerabilities (NS-SA-2021-0139)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has microcodectl packages installed that are affected by multiple vulnerabilities: - Insufficient access control in protected memory subsystem for IntelR SGX for 6th, 7th, 8th, 9th Generation IntelR CoreTM Processor Families;...

SysFlow - Cloud-native System Telemetry Pipeline

This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of this description : repo's readme history Docker...

Researchers Break Intel SGX With New 'SmashEx' CPU Attack Technique

A newly disclosed vulnerability affecting Intel processors could be abused by an adversary to gain access to sensitive information stored within enclaves and even run arbitrary code on vulnerable systems. The vulnerability CVE-2021-0186, CVSS score: 8.2 was discovered by a group of academics from...

CVE-2021-30257

Possible out of bound read or write in VR service due to lack of validation of DSP selection values in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT...

The vulnerability of AMD’s microprogrammed software for processors lies in the speculative execution of read and write operations that access memory using invalid non- canonical addresses. This allows a hacker to exploit the vulnerability to gain access to information about the CPU’s address space.

The vulnerability of AMD’s microprogramming software is related to speculative operations for reading and writing data to memory, involving the use of non- canonical addresses. Exploiting this vulnerability can allow an attacker to gain access to information about the CPU’s address space, by usin...

kernel: SVM nested virtualization issue in KVM (AVIC support)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "intctl" field, this issue could allow a malicious ...

kernel: SVM nested virtualization issue in KVM (AVIC support)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "intctl" field, this issue could allow a malicious ...

Juniper Networks Junos OS 代码问题漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. Juniper Networks Junos OS is vulnerable to a code issue that could allow an unauthenticated attacker to cause a denial of...

Unbreakable Enterprise kernel-container security update

5.4.17-2102.206.1 - Revert 'scsi: core: Cap scsihost cmdperlun at canqueue' Jack Vogel Orabug: 33403144 5.4.17-2102.206.0 - Revert 'uek-rpm: Don't recompute build-ids for kernel-uek-debuginfo' Jack Vogel Orabug: 33245043 - integrity: Load mokx variables into the blacklist keyring Eric Snowberg...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

Usage Make sure Python and ncat are installed...

Windows 11 offers chip to cloud protection to meet the new security challenges of hybrid work

As the world has changed over the past 18-months, companies have been wrestling with ways to keep employees and data protected as they support new ways of hybrid working. We built Windows 11 to be the most secure Windows yet with built-in chip to cloud protection that ensures company assets stay...

多款Qualcomm产品安全漏洞

Qualcomm MSM8996AU and others are products of Qualcomm Incorporated Qualcomm, U.S.A. The MSM8996AU is a central processing unit CPU product.The QCA6574AU is a central processing unit CPU product.The SD 636 is a central processing unit CPU product. A security vulnerability exists in Qualcomm that...

多款Qualcomm产品缓冲区错误漏洞

Qualcomm QCA6574AU and others are products of Qualcomm Incorporated Qualcomm.QCA6574AU is a central processing unit CPU product.APQ8053 is a central processing unit CPU product.SDX55 is a modem. Multiple Qualcomm Products A buffer error vulnerability exists in the DSP service that stems from an...