Intel® GPA Software Advisory

Summary: Potential security vulnerabilities in some Intel® Graphics Performance Analyzers GPA and Intel® GPA Framework software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-24460...

CentOS 9 : opensc-0.23.0-3.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the opensc-0.23.0-3.el9 build changelog. - Potential PIN bypass CVE-2023-40660 - Dynamic analyzers reports in pkcs15init CVE-2023-40661 - Out-of-bounds read in MyEID driver handlin...

Advisory ROSA-SA-2024-2388

Software: wireshark 4.0.10 OS: ROSA-CHROME packageevrstring: wireshark-4.0.10-1.src.rpm CVE-ID: CVE-2023-0666 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Due to a failure in length validation provided by an attacker-created RTPS packet, Wireshark is vulnerable by default to a heap buffer overflow an...

The vulnerability of microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA flow gas analyzers is related to deficiencies in authentication procedures. This allows attackers to compromise data integrity and cause service failures.

The vulnerability of the microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA gas analyzers is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to compromise data integrity and cause service failures...

The vulnerability of the microprogrammed software of Emerson Rosemount X-STREAM flow analyzers allows a intruder to disclose protected information.

The vulnerability of Microprogrammed Software in Emerson Rosemount X-STREAM flow analyzers is related to insufficient encryption reliability. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

opensc security update

0.20.0-7 - Fix file caching with different offsets RHEL-4077 - Fix CVE-2023-40660: Potential PIN bypass - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init - Fix CVE-2023-5992: Marvin: Side-channel leaks while stripping encryption PKCS1.5 padding...

Information disclosure

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a...

CVE-2022-41917

OpenSearch CVE-2022-41917 is an information-disclosure flaw in OpenSearch where an incorrect error-handling path allows certain crafted REST queries to read the first line from arbitrary text files, limited to files readable under the Java Security Manager policy. Affected versions are OpenSearch...

Intel Graphics Performance Analyzers 代码问题漏洞

Intel Graphics Performance Analyzers Intel Gpa is a graphics performance analyzer from Intel Corporation USA. A code issue vulnerability exists in Intel Graphics Performance Analyzers version 21.2 that could allow an authenticated user to potentially enable escalation to gain privileges via local...

Vulnerability Research Highlights 2021

At SonarSource we are constantly improving our code analyzers to help developers write Clean Code. The detection of severe code vulnerabilities plays an important role in this process so that applications are protected from attacks and security breaches. For this same reason, our research team...

Emerson Rosemount X-STREAM Gas Analyzer 安全漏洞

The Emerson Rosemount X-STREAM Gas Analyzer is an Emerson gas analyzer for industrial environments. The device supports up to five component gas analyzers and features NDIR/UV/VIS photometry, paramagnetic and electrochemical O2, thermal conductivity and humidity sensors. A security vulnerability...

Intel Owl - Analyze Files, Domains, IPs In Multiple Ways From A Single API At Scale

Do you want to get threatintelligence data about a file, an IP or a domain? Do you want to get this kind of data from multiple sources at the same time using a single API request? You are in the right place! This application is built to scale out and to speed up the retrieval of threat info. It c...

Grapl - Graph Platform For Detection And Response

Grapl is a Graph Platform for Detection and Response. For a more in depth overview of Grapl, read this. In short, Grapl will take raw logs, convert them into graphs, and merge those graphs into a Master Graph. It will then orchestrate the execution of your attack signatures and provide tools for...

FreeBSD : bro -- NULL pointer dereference and Signed integer overflow (f56669f5-d799-4ff5-9174-64a6d571c451)

Jon Siwek of Corelight reports : This is a security patch release to address potential Denial of Service vulnerabilities : - NULL pointer dereference in the RPC analysis code. RPC analyzers e.g. MOUNT or NFS are not enabled in the default configuration. - Signed integer overflow in BinPAC-generat...

Cortex Unshortenlink Analyzer 1.1 - Server-Side Request Forgery

Cortex Unshortenlink Analyzer 1.1 - Server-Side Request Forgery Exploit Title: Cortex Unshortenlink Analyzer 1.1 - Server-Side Request Forgery Date: 2/26/2019 Exploit Author: Alexandre Basquin Vendor Homepage: https://blog.thehive-project.org Software Link: https://github.com/TheHive-Project/Cort...

Cortex Unshortenlink Analyzer < 1.1 - Server-Side Request Forgery

Exploit Title: Cortex Unshortenlink Analyzer 1.1 - Server-Side Request Forgery Date: 2/26/2019 Exploit Author: Alexandre Basquin Vendor Homepage: https://blog.thehive-project.org Software Link: https://github.com/TheHive-Project/Cortex Version: Cortex = 2.1.3 Tested on: 2.1.3 CVE : CVE-2019-7652...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

Server side request forgery (ssrf)

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

The CVE-2019-7652 affects TheHive Project’s UnshortenLink analyzer (pre-1.1) included in Cortex analyzers (pre-1.15.2). It enables SSRF via the Data parameter when selecting URL, allowing an attacker to supply an SSRF payload (for example, http://127.0.0.1:22) and observe results on the dashboard...