600 matches found
Intel CPUs Vulnerable to New 'SGAxe' and 'CrossTalk' Side-Channel Attacks
Cybersecurity researchers have discovered two distinct attacks that could be exploited against modern Intel processors to leak sensitive information from the CPU's trusted execution environments TEE. Called SGAxe, the first of the flaws is an evolution of the previously uncovered CacheOut attack...
go-attestation:parse_ek_certificate_fuzzer: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6279937533411328 Project: go-attestation Fuzzing Engine: libFuzzer Fuzz Target: parseekcertificatefuzzer Job Type: libfuzzerasango-attestation Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000995166a Crash State: NULL Sanitizer:...
Tips to Accelerating PCI Data Security Standard Projects with Deep Security as a Service
Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...
The Shared Responsibility Model
I’m often asked what the biggest cyberthreats are in the cloud. When people pose that question, they seem to be expecting an answer on par with a Hollywood movie plot. The truth is far simpler. The number one threat in the cloud today is service misconfigurations. Despite the cloud’s clear...
CVE-2019-16992
The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation that an address at keybase.io can be used for Stellar payments to the user, which might be incompatible with a user's personal position on...
Design/Logic Flaw
The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation that an address at keybase.io can be used for Stellar payments to the user, which might be incompatible with a user's personal position on...
CVE-2019-16992
CVE-2019-16992 affects the Keybase iOS app (v2.13.2), where the implementation could sign a cryptocurrency attestation (that an address at keybase.io can be used for Stellar payments) using the user’s private key without clear user notice. The issue is described as a misuse/insufficient notice ab...
CVE-2019-16992
The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation that an address at keybase.io can be used for Stellar payments to the user, which might be incompatible with a user's personal position on...
How Windows Defender Antivirus integrates hardware-based system integrity for informed, extensive endpoint protection
Detecting and stopping attacks that tamper with kernel-mode agents at the hypervisor level is a critical component of the unified endpoint protection platform in Microsoft Defender Advanced Threat Protection Microsoft Defender ATP. It’s not without challenges, but the deep integration of Windows...
AMD Secure Encrypted Virtualization (SEV) Key Recovery Vulnerability
AMD Secure Encrypted Virtualization SEV is a hardware memory encryption feature. SEV protects guest virtual machines from the hypervisor, provides confidentiality guarantees at runtime and remote attestation at launch time. The SEV elliptic-curve ECC implementation was found to be vulnerable to a...
The vulnerabilities of the Intel SGX driver for Linux and the Intel SGX DCAP Linux driver are related to insufficient validation of input data, allowing attackers to trigger service failures.
The vulnerability of the Intel SGX driver for Linux and the Intel SGX DCAP Linux driver is related to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to cause service failures...
The vulnerability of the OpenAttestation agent, related to errors in the implementation of the host attestation process, allows a violator to disclose the protected information.
The vulnerability of the OpenAttestation technology is related to errors in the process of hosting attestation. Exploiting this vulnerability can allow attackers to disclose the protected information...
The vulnerability of the Open Cloud Integrity Technology, which is used to create cloud services, and the OpenAttestation agent, arises from errors in checking input data. This allows attackers to exploit these vulnerabilities to increase their privileges.
The vulnerability of the Open Cloud Integrity Technology, which is used to create cloud services, and the OpenAttestation agent are related to errors during the validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges by using specially crafted...
CVE-2019-0182
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2019-11092
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2019-0181
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2019-0183
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2019-0178
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access...