5050 matches found
Cisco Enterprise NFV Infrastructure Software Arbitrary Command Execution
The vulnerability of the Cisco Enterprise NFV Infrastructure Software NFVIS software registration process is related to lack of access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by installing a virtual machine with created metadata...
Ransom.Conti MVID-2022-0602 Code Execution
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/7ba20fce7ac259f6062f73290c2e28cf.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Ransom.Conti Vulnerability: Code Execution Description: Conti looks for and executes DLLs ...
Ransom.Conti MVID-2022-0603 Code Execution
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/6748dfe8e64dea2fc4c14691f7e766c6.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Ransom.Conti Vulnerability: Code Execution Description: Conti looks for and executes DLLs ...
Xtend Cross-Site Scripting Vulnerability
Xtend is a general-purpose high-level programming language for the Eclipse Foundation's Java Virtual Machine. Xtend Voice Logger version 1.0 has a security vulnerability that stems from a cross-site scripting vulnerability in the error page. An attacker can use the vulnerability to execute...
GHSA-784J-H234-M56X Protection Mechanism Failure in Jenkins Script Security Plugin
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM...
USN-5416-1 linux-oem-5.14 vulnerabilities
Qiuhao Li, Gaoning Pan and Yongkang Jia discovered that the KVM implementation in the Linux kernel did not properly perform guest page table updates in some situations. An attacker in a guest vm could possibly use this to crash the host OS. CVE-2022-1158 It was discovered that the implementation ...
CVE-2021-26339
A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers...
AMD CPUs security vulnerabilities
AMD CPUs are a family of CPUs from AMD in the United States. A security vulnerability exists in AMD CPUs. An attacker exploits this vulnerability to trigger a CPU core hang using specific code from an unprivileged VM, leading to a potential denial of service...
Oracle Database Server Java VM Data Modification
The vulnerability of the Java VM component of the Oracle Database Server management system is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to remotely gain access to modify, add, or delete data through various network protocols...
PT-2022-9727 · Amd +1 · Amd Cpus +1
Name of the Vulnerable Software and Affected Versions: AMD CPU affected versions not specified Description: A bug in AMD CPU's core logic may allow an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang, resulting in a potential denial of service. The specific code...
CVE-2021-26342
In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer TLB following a particular sequence of operations that includes creation of a new virtual machine control block VMCB. The failure to flush the TLB may cause the microcode to use stale TLB translations which may allow for...
CVE-2021-26339
A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers...
kernel: KVM: SVM: out-of-bounds read/write in sev_es_string_io
A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State SEV-ES. A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction for example, outs or ins using the exit...
kernel: iommu/amd: Fix I/O page table memory leak
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix I/O page table memory leak The current logic updates the I/O page table mode for the domain before calling the logic to free memory used for the page table. This results in IOMMU page table memory leak, and can be...
kernel: ppc: kvm: allows a malicious KVM guest to crash the host
A denial of service problem was found in the Linux kernel's Kernel-based Virtual Machine KVM specific to PowerPC. In this flaw, a user with local access can confuse the host offline code, causing the guest to crash...
kernel: KVM: SVM: out-of-bounds read/write in sev_es_string_io
A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State SEV-ES. A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction for example, outs or ins using the exit...
hw: cpu: intel: Branch History Injection (BHI)
A flaw was found in hw. The Branch History Injection BHI describes a specific form of intra-mode BTI. This flaw allows an unprivileged attacker to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to...
“Chemical attack” email warnings deliver Jester Stealer malware
Jester Stealer, a malicious file capable of large amounts of data theft, is on the prowl again. The Ukrainian Computer Emergency Response Team CERT-UA has warned of a large distribution campaign abusing a "chemical attack" theme. Receiving an email like this in the invasion-affected regions of...
Ransom.Cryakl Code Execution
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/2aea3b217e6a3d08ef684594192cafc8.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Ransom.Cryakl Vulnerability: Code Execution Description: Cryakl looks for and loads a DLL...
CVE-2022-20780
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an attacker to escape from the guest virtual machine VM to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these...