kernel: AMD: Cross-Thread Return Address Predictions

A flaw was found in HW. When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch, potentially resulting in information disclosure...

Mustang Panda Hackers Targets Philippines Government Amid South China Sea Tensions

The China-linked Mustang Panda actor has been linked to a cyber attack targeting a Philippines government entity amid rising tensions between the two countries over the disputed South China Sea. Palo Alto Networks Unit 42 attributed the adversarial collective to three campaigns in August 2023,...

AMD CPU Instruction Malpractice Vulnerability

AMD CPUs are a family of CPUs from AMD. The AMD CPUs suffer from an improper instruction vulnerability that stems from the fact that incorrect or unexpected behavior of the INVD instruction would allow an attacker with a malicious hypervisor to affect the cache line write-back behavior of the CPU...

CVE-2023-38361

IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770...

CVE-2023-38361 IBM CICS TX Advanced information disclosure

IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770...

CVE-2023-38361

CVE-2023-38361 affects IBM CICS TX Advanced 10.1, where weaker cryptographic algorithms could let an attacker decrypt highly sensitive data. The issue is documented across multiple sources (IBM bulletin A557C..., X-Force 260770). Remediation is available: upgrade to the fixed IBM CICS TX Advanced...

Bread - BIOS Reverse Engineering And Advanced Debugging

BREAD BIOS Reverse Engineering & Advanced Debugging is an 'injectable' real-mode x86 debugger that can debug arbitrary real-mode code on real HW from another PC via serial cable. Introduction BREAD emerged from many failed attempts to reverse engineer legacy BIOS. Given that the vast majority -- ...

IBM CICS TX Advanced 安全漏洞

IBM CICS TX is a comprehensive, single transaction runtime package from International Business Machines IBM. A weak algorithmic vulnerability exists in IBM CICS TX Advanced version 10.1, which stems from the use of a weak encryption algorithm that can be exploited by an attacker to decrypt highly...

LTESniffer - An Open-source LTE Downlink/Uplink Eavesdropper

LTESniffer is An Open-source LTE Downlink/Uplink Eavesdropper It first decodes the Physical Downlink Control Channel PDCCH to obtain the Downlink Control Informations DCIs and Radio Network Temporary Identifiers RNTIs of all active users. Using decoded DCIs and RNTIs, LTESniffer further decodes t...

GHSA-FXFF-WXXV-C2JC PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining CBC mode in AES encryption. This vulnerability can lead to the disclosure of information and communications...

CVE-2023-48056

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining CBC mode in AES encryption. This vulnerability can lead to the disclosure of information and communications...

CVE-2023-48053

Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining CBC mode in AES encryption. This vulnerability can lead to the disclosure of information and communications...

PYSEC-2023-245

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining CBC mode in AES encryption. This vulnerability can lead to the disclosure of information and communications...

Archery Security Vulnerabilities

Archery is an open source set of vulnerability assessment and management tools. A security vulnerability exists in Archery version v1.10.0 that stems from the use of non-random or static IVs for Cipher Block Linking CBC mode in AES encryption, which could lead to information and communication...

hw: amd: Cross-Process Information Leak

A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances...

Important: Red Hat Enhancement Advisory: ACS 4.3 enhancement update

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes new features and bug fixes. Release of ACS 4.3 provides these changes: New features: Increased support for hardware and software Vulnerability reporting 2.0 is generally available Watch and scan...

The vulnerability of the software for creating control panels for energy management systems, namely EcoStruxure PowerSCADA Operation (PSO) – Advanced Reporting and Dashboards Module, EcoStruxure PowerOperation (EPO) – Advanced Reporting and Dashboards Module, and the energy monitoring software EcoStruxure Power Monitoring Expert, arises due to insufficient protection measures for the website structure. This allows attackers to execute arbitrary JavaScript code.

The vulnerability of the software used for creating control panels for energy management systems, such as EcoStruxure PowerSCADA Operation PSO – Advanced Reporting and Dashboards Module, EcoStruxure PowerOperation EPO – Advanced Reporting and Dashboards Module, and the energy monitoring software...

DEBIAN-CVE-2023-20592

Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine VM memory integrity...

CVE-2022-23820

Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution...

UBUNTU-CVE-2023-20592

Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine VM memory integrity...