CVE-2023-42727

In gpu driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed...

PT-2023-24172 · Qualcomm · Snapdragon +125

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption in the Audio component when running an invalid audio recording from ADSP. No information is provided about the...

UNISOC Chipsets Security Vulnerability

UNISOC Chipsets is a chipset from China's Unisplendour UNISOC. A security vulnerability exists in UNISOC Chipsets, which stems from an incorrect boundary check in the gpu driver module, which may result in out-of-bounds writes...

CLSA-2023-1701444720 microcode_ctl: Fix of 4 CVEs

Update Intel CPU microcode to microcode-20231114 release, addresses CVE-2022-40982 INTEL-SA-00828, CVE-2022-41804 INTEL-SA-00837, CVE-2023-23908 INTEL-SA-00836, CVE-2023-23583 INTEL-SA-00950: - Addition of 06-9a-04/0x40 microcode in 06-9a-04 at revision 0x5; - Addition of 06-ba-02/0xe0 microcode...

AMD Secure Processor DoS

The vulnerability of AMD Secure Processor ASP microprogramming software relates to the ability to write beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Graphic Drivers Buffer Overflow DoS

The vulnerability of graphics drivers in microprogramming software for Intel processors is related to reading data beyond the memory boundary. Exploiting this vulnerability can allow an attacker to disclose protected information...

hw: amd: Cross-Process Information Leak

A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances...

hw: Intel: Gather Data Sampling (GDS) side channel vulnerability

A Gather Data Sampling GDS transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local attacker using gather instruction load from memory to infer stale data from previously used vector registers on the same physical core...

Privilege Escalation

intel-microcode is vulnerable to Privilege Escalation. The vulnerability exists due to a sequence of processor instructions that results in unexpected behavior for certain IntelR Processors. An authenticated user may exploit this issue to potentially enable escalation of privilege, information...

org.apache.nifi:nifi-kafka-connector-tests (>=1.14.0, <=1.23.2), org.apache.nifi:nifi-standard-nar (>=1.14.0, <=1.15.3) +4 more potentially affected by CVE-2023-49145 via org.apache.nifi:nifi-jolt-transform-json-ui (>=1.14.0, <=1.23.2)

org.apache.nifi:nifi-jolt-transform-json-ui MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.15.0, =1.14.0, =1.23.2 - org.apache.plc4x:plc4j-nifi-plc4x-nar 0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors 0.10.0 Source cves: CVE-2023-49145 Source advisory: OSV:GHSA-68PR-6FJC-WMGM...

org.apache.nifi:nifi-kafka-connector-tests (>=1.14.0, <=1.23.2), org.apache.nifi:nifi-standard-nar (>=1.14.0, <=1.15.3) +4 more potentially affected by CVE-2023-49145 via org.apache.nifi:nifi-jolt-transform-json-ui (>=1.14.0, <=1.23.2)

org.apache.nifi:nifi-jolt-transform-json-ui MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.15.0, =1.14.0, =1.23.2 - org.apache.plc4x:plc4j-nifi-plc4x-nar 0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors 0.10.0 Source cves: CVE-2023-49145 Source advisory: GHSA-68PR-6FJC-WMGM...

Cross site scripting

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

CVE-2023-49145

Apache NiFi

CVE-2023-49145

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

CVE-2023-49145: Improper Neutralization of Input During Web Page Generation

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

OESA-2023-1855 microcode_ctl security update

This is a tool to transform and deploy microcode update for x86 CPUs. Security Fixes: Sequence of processor instructions leads to unexpected behavior for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denia...

Denial Of Service (DoS)

elasticsearch is vulnerable to Denial Of Service DoS. The vulnerability is caused due to a lack of exception handling while calling the simulate pipeline API. The script processor of an ingest pipeline fails to handle malformed scripts. This can lead to an elastic node crash and ultimately deny...

CVE-2023-46673

A flaw was found in Elasticsearch. A malicious script used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API. Mitigation No mitigation is yet available for this flaw...

Debian DSA-5563-1 : intel-microcode - security update

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5563 advisory. - Sequence of processor instructions leads to unexpected behavior for some IntelR Processors may allow an authenticated user to potentially enable escalation of...

Elasticsearch Improper Handling of Exceptional Conditions

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API...