The vulnerability of the microprogramming software of AMI MegaRAC SP-X controllers allows a perpetrator to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the microprogramming software of AMI MegaRAC SP-X remote control servers is related to the use of a non-trusted pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of data...

CVE-2023-6935 Marvin Attack vulnerability in SP Math All RSA

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to configure: --enable-all CFLAGS="-DWOLFSSLSTATICRSA" The define “WOLFSSLSTATICRSA” enables static RSA cipher suites, which is n...

CVE-2023-6935 Marvin Attack vulnerability in SP Math All RSA

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to configure: --enable-all CFLAGS="-DWOLFSSLSTATICRSA" The define “WOLFSSLSTATICRSA” enables static RSA cipher suites, which is n...

CVE-2023-6935

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to configure: --enable-all CFLAGS="-DWOLFSSLSTATICRSA" The define “WOLFSSLSTATICRSA” enables static RSA cipher suites, which is n...

CVE-2023-6935: Observable Discrepancy

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to configure: --enable-all CFLAGS="-DWOLFSSLSTATICRSA" The define “WOLFSSLSTATICRSA” enables static RSA cipher suites, which is n...

sp-arte.com Cross Site Scripting vulnerability OBB-3847798

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.69 Fixed in 4.70 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-24868 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 55e058d86d8c Credits Yudistira Arya Required privilege...

GO-2024-2451 IV collision in github.com/bincyber/go-sqlcrypter

There is a risk of an IV collision using the awskms or aesgcm provider. NIST SP 800-38D section 8.3 states that it is unsafe to encrypt more than 2^32 plaintexts under the same key when using a random IV. The limit could easily be reached given the use case of database column encryption...

Moderate: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Oracle Linux 9 : openssl (ELSA-2024-0310)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0310 advisory. - AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries CVE-2023-2975 Resolves: RHEL-5302 - Excessive time spent...

RHEL 9 : openssl (RHSA-2024:0310)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0310 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

PT-2024-1992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a stack corruption vulnerability in the Linux kernel, specifically in the mlxsw sp acl tcam module. This vulnerability can occur when more than 16 ACLs are requir...

PT-2024-1583 · Ami · Ami Megarac Sp-X

Name of the Vulnerable Software and Affected Versions: AMI MegaRAC SP-X affected versions not specified Description: The issue is related to a buffer overflow in the dynamic memory of the AMI MegaRAC SP-X firmware, which can be exploited by an attacker over the network. This may lead to a loss of...

PT-2024-1584 · Ami · Ami Megarac Sp-X

Name of the Vulnerable Software and Affected Versions: AMI MegaRAC SP-X affected versions not specified Description: The issue is related to a heap memory corruption vulnerability in the BMC of AMI MegaRAC SP-X. This vulnerability can be exploited by an attacker via an adjacent network, potential...

PT-2024-1588 · Ami · Ami Megarac Sp-X

Name of the Vulnerable Software and Affected Versions: AMI MegaRAC SP-X affected versions not specified Description: The issue is related to a vulnerability in the BMC of AMI's SPx, where an attacker may cause an untrusted pointer to dereference via a local network. This could lead to a loss of...

PT-2024-1585 · Ami · Ami Megarac Sp-X

Name of the Vulnerable Software and Affected Versions: AMI MegaRAC SP-X affected versions not specified Description: The issue is related to a heap memory corruption vulnerability in the BMC of AMI MegaRAC SP-X. This vulnerability can be exploited by an attacker via an adjacent network, potential...

WordPress Plugin SIGMA Lite & Lite+ Buffer Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

NIST SP 800-53 Rev. 5 Updates: What You Need to Know About The Most Recent Patch Release (5.1.1)

On November 7th, the National Institute of Standards and Technology NIST issued an update to SP 800-53, a NIST-curated catalog of controls that organizations can implement to effectively manage security and privacy risk. In this blog we’ll cover the new and updated controls within patch release...

CLSA-2023-1702420529 microcode_ctl: Fix of CVE-2023-23583

Update Intel CPU microcode to microcode-20231114 release, addresses CVE-2023-23583 INTEL-SA-00950: - Update of 06-6a-06/0x87 ICX-SP D0 microcode in 06-6a-06 from revision 0xd0003a5 up to 0xd0003b9; - Update of 06-6c-01/0x10 ICL-D B0 microcode in 06-6c-01 from revision 0x1000230 up to 0x1000268; -...

sp-arte.com Cross Site Scripting vulnerability OBB-3792256

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...