CVE-2023-31356

CVE-2023-31356: Incomplete memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially harming data integrity. Connected advisories (MiracleLinux AXSA:2024-8883/8884) reference this CVE among affected kernel/firmware components (linux-firmware pac...

CVE-2023-31356

Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity...

CVE-2023-31356

Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity...

CVE-2023-20591

Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to read or modify hypervisor memory, potentially resulting in loss of confidentiality, integrity, and availability...

CVE-2023-20509

An insufficient DRAM address validation in PMFW may allow a privileged attacker to perform a DMA read from an invalid DRAM address to SRAM, potentially resulting in loss of data integrity...

CVE-2023-20509

An insufficient DRAM address validation in PMFW may allow a privileged attacker to perform a DMA read from an invalid DRAM address to SRAM, potentially resulting in loss of data integrity...

CVE-2023-20509

CVE-2023-20509 describes an insufficient DRAM address validation in PMFW that could allow a local privileged attacker to perform a DMA read from an invalid DRAM address to SRAM, potentially leading to data integrity loss. Affected component is PMFW (PM firmware); root cause is address validation ...

PT-2024-12280 · Amd +8 · Sev Firmware +8

Name of the Vulnerable Software and Affected Versions: SEV firmware affected versions not specified Description: The issue is related to incomplete system memory cleanup in SEV firmware, which could allow a privileged attacker to corrupt guest private memory. This potentially results in a loss of...

PT-2024-6173 · Sap · Sap Commerce Cloud

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud affected versions not specified Description: The issue is related to errors in processing information in the OCC API Endpoint component of SAP Commerce Cloud. This could allow a remote attacker to gain unauthorized access t...

AMD Graphics Driver 安全漏洞

AMD Graphics Driver is an integrated graphics driver from UltraMicroelectronics AMD. A security vulnerability exists in AMD Graphics Driver that stems from insufficient address validation and could allow a privileged attacker to perform a DMA read to SRAM from an invalid DRAM address, resulting i...

PT-2024-11947 · Pmfw · Pmfw

Name of the Vulnerable Software and Affected Versions: PMFW affected versions not specified Description: The issue is related to an insufficient DRAM address validation in PMFW, which may allow a privileged attacker to perform a DMA read from an invalid DRAM address to SRAM. This could potentiall...

rsyslog: Heap Buffer Overflow

Background rsyslog is an enhanced multi-threaded syslogd with database support and more. Description Multiple vulnerabilities have been discovered in rsyslog. Please review the CVE identifiers referenced below for details. Impact Modules for TCP syslog reception have a heap buffer overflow when...

The vulnerability of the loginauth (/cgi-bin/cstecgi.cgi) function in the TOTOLINK EX200 router software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the loginauth /cgi-bin/cstecgi.cgi function in the TOTOLINK EX200 router software arises due to buffer overflows in the stack during the processing of the httphost parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, related to incorrect session expiration times, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of TeamCity in JetBrains is related to incorrect session duration settings. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

The vulnerability of the Fake Authentication Result Handler component in the DKIM-filtering software OpenDKIM allows a perpetrator to influence the integrity of the protected information.

The vulnerability of the Fake Authentication Result Handler component in the DKIM-filtering software OpenDKIM is related to the lack of checks for sequence numbers during the deletion of fake fields. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protecte...

The vulnerability of the ocelot_vlan_del() function in the network adapter driver of Microsemi’s operating system Linux allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ocelotvlandel function in the drivers/net/ethernet/mscc/ocelot.c file of the Microsemi network adapter driver for the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the btrfs_load_zone_info() function in the Btrfs file system of Linux kernels allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the btrfsloadzoneinfo function in the fs/btrfs/zoned.c file of the Btrfs file system in Linux kernel is related to the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the setWizardCfg function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK N350RT router’s software, which allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setWizardCfg function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK N350RT router microprogramming system is related to the issue of data being written outside of the buffer in memory when processing the ssid parameter. Exploiting this vulnerability allows an attacker ...

The vulnerability of the stm_register_device() function in the System Trace Module (STM) driver of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the stmregisterdevice function in the drivers/hwtracing/stm/core.c file of the System Trace Module driver for the Linux operating system is related to the repeated release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the...