CVE-2018-9065

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and...

Code injection

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and...

CVE-2018-9065

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and...

CVE-2018-9065

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and...

Samsung SmartThings Hub video-core Camera Creation Code Execution Vulnerability(CVE-2018-3905)

Summary An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub. The video-core process incorrectly extracts the "state" field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An...

Spectre attack variant can be remotely mounted to extract sensitive data

By ghostadmin What we know so far about Spectre attacks is that it relies upon execution of malicious code. The code is executed on computers having speculative-execution design flaws in processor chip; once a device is compromised, it becomes possible to obtain sensitive data such as passwords,...

SUSE-SU-2018:2102-1 Security update for the Linux Kernel (Live Patch 26 for SLE 12)

This update for the Linux Kernel 3.12.61-5289 fixes several issues. The following security issue was fixed: - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from...

NetSpectre — New Remote Spectre Attack Steals Data Over the Network

A team of security researchers has discovered a new Spectre attack that can be launched over the network, unlike all other Spectre variants that require some form of local code execution on the target system. Dubbed "NetSpectre," the new remote side-channel attack, which is related to Spectre...

Intel Processor Diagnostic Tool elevation of privilege vulnerability (CNVD-2018-15597)

Intel Processor Diagnostic Tool IPDT is a processor function diagnostic tool from Intel USA. An elevation of privilege vulnerability exists in Intel IPDT versions prior to 4.1.0.27. A local attacker can exploit this vulnerability to execute arbitrary code...

Intel Processor Diagnostic Tool Elevation of Privilege Vulnerability

Intel Processor Diagnostic Tool IPDT is a processor function diagnostic tool from Intel USA. A security vulnerability exists in Intel IPDT version 4.1.0.24, which is caused by the installation tool failing to properly set permissions on installed files. The vulnerability can be exploited to execu...

Intel Smart Sound Tech Vulnerable to Three High-Severity Bugs

Intel issued three fixes for bugs that could allow a local attacker to execute code on Intel Core and Atom processor-based PCs. The vulnerabilities are tied to versions of its own Intel Smart Sound Technology, used to boost audio processing for tasks such as voice commands and interactions with...

Intel ME 6.x/7.x/8.x/9.x/10.x./11.x, SPS 4.0, and TXE 3.0 Cumulative Security Update - US

Lenovo Security Advisory: LEN-17297 Potential Impact: An attacker could load and execute arbitrary code outside the visibility of the user, operating system, and hypervisor/virtualization platform; resulting in exfiltration of secrets, subtle manipulation of system operation, or denial of service...

Updated microcode packages fix security vulnerability

This microcode update provides the first set of fixes for Speculative Store Bypass SSBD, Spectre v4, CVE-2018-3639 and Rogue System Register Read RSRE, Spectre v3a, CVE-2018-3640 for Intel Sandybridge server, Ivy Bridge server, Haswell server, Skylake server, Broadwell server, a few HEDT Core i7/...

CVE-2018-14590

An issue has been discovered in Bento4 1.5.1-624. A SEGV can occur in AP4Processor::ProcessFragments in Core/Ap4Processor.cpp...

Wireshark DICOM Parser Infinite Loop Vulnerability

Wireshark formerly known as Ethereal is a set of network packet analysis software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis.DICOM dissector is one of the DICOM communication protocol parser. An infinite loo...

CVE-2018-2904

Vulnerability in the Oracle Communications EAGLE LNP Application Processor component of Oracle Communications Applications subcomponent: GUI. The supported version that is affected is 10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

Design/Logic Flaw

Vulnerability in the Oracle Communications EAGLE LNP Application Processor component of Oracle Communications Applications subcomponent: GUI. The supported version that is affected is 10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2018-2904

CVE-2018-2904 affects Oracle Communications EAGLE LNP Application Processor GUI in Oracle Communications Applications (10.x). The vulnerability allows an unauthenticated attacker with network access over HTTP to read and modify data, with a CVSS v3.0 base score of 6.5 (Impact: Confidentiality and...

CVE-2018-2904

Vulnerability in the Oracle Communications EAGLE LNP Application Processor component of Oracle Communications Applications subcomponent: GUI. The supported version that is affected is 10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

ClamAV Integer Overflow Vulnerability

ClamAV Clam AntiVirus is a free and open source antivirus program developed by the ClamAV team. The software is used to detect Trojans, viruses, malware and other malicious threats. An integer overflow vulnerability exists in the 'parsehwp3paragraph' function in the libclamav/hwp.c file in versio...