CVE-2023-52434 smb: client: fix potential OOBs in smb2_parse_contexts()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2parsecontexts Validate offsets and lengths before dereferencing create contexts in smb2parsecontexts. This fixes following oops when accessing invalid create contexts from server: BUG: unabl...

PT-2024-26756

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.7.0-rc7-custom+ Description The vulnerability is related to the bcachefs filesystem in the Linux kernel. The issue arises from the incorrect freeing of memory allocated for bch fs::snapshots using kfree instead of kvfree...

AMD SMM Supervisor November 2023 Security Update

AMD has informed HP of a potential security vulnerability identified in some AMD processors which might allow arbitrary code execution. AMD is releasing firmware updates to mitigate these vulnerabilities. AMD has released updates to mitigate the potential vulnerability. HP has identified affected...

VulnCheck KEV: CVE-2023-27482

homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older...

VulnCheck KEV: CVE-2023-28770

The sensitive information exposure vulnerability in the CGI “ExportLog” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17ABYO.1C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file...

CVE-2023-20596

Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary code execution...

CVE-2023-20596

Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary code execution...

Input validation

Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary code execution...

CVE-2023-20596

CVE-2023-20596 involves improper input validation in the AMD SMM Supervisor. A compromised SMI handler could gain Ring0 and potentially execute arbitrary code. Documents show affected AMD platforms across Desktop, Mobile, and Embedded lines, with mitigations delivered via OEM firmware updates (e....

AMD SMM Supervisor Vulnerability Security Notice

Bulletin ID: AMD-SB-7011 Potential Impact: Loss of confidentiality, integrity, and availability Severity: High Summary External researchers reported a potential vulnerability during SMM Supervisor initialization which may impact some AMD processors. On systems that do not have Supervisor Mode...

Server Side Request Forgery

Home assistant is vulnerable to Server Side Request Forgery. The vulnerability is due to the service's susceptibility to a partial Server Side Request Forgery which allows an attacker to call the service and potentially invoke any Supervisor REST API endpoints through a POST request...

CVE-2023-41899

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...

Server side request forgery (ssrf)

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...

CVE-2023-41899

Home Assistant Core vulnerability CVE-2023-41899: a partial SSRF in the hassio.addon_stdin service allows an attacker who can call that service (e.g., via GHSA-h2jp-7grc-9xpp) to invoke any Supervisor REST API endpoints through a POST request. An exploited attacker can control the data dictionary...

CVE-2023-41899 Partial Server-Side Request Forgery in Home Assistant Core

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...

CVE-2023-41899 Partial Server-Side Request Forgery in Home Assistant Core

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...

CVE-2023-41899 Partial Server-Side Request Forgery in Home Assistant Core

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...

CVE-2022-26942

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment TEE modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure superviso...

Design/Logic Flaw

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

Design/Logic Flaw

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment TEE modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure superviso...