Intel CPUs -- multiple vulnerabilities

Intel reports: 2024.1 IPU - Intel Processor Bus Lock Advisory A potential security vulnerability in the bus lock regulator mechanism for some Intel Processors may allow denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability. 2024.1 IPU - Intel Processor...

Malware targeting SonicWall devices could survive firmware updates

Researchers at Mandiant have identified a malware campaign targeting SonicWall SMA 100 Series appliances, thought to be of Chinese origin. The malware was likely deployed in 2021, and was able to persist on the appliances tenaciously, even surviving firmware upgrades. The malware was able to stea...

China-linked Hackers Targeting Unpatched SonicWall SMA Devices with Malware

A suspecting China-linked hacking campaign has been observed targeting unpatched SonicWall Secure Mobile Access SMA 100 appliances to drop malware and establish long-term persistence. "The malware has functionality to steal user credentials, provide shell access, and persist through firmware...

Another Malware with Persistence

Heres a piece of Chinese malware that infects SonicWall security appliances and survives firmware updates. On Thursday, security firm Mandiant published a report that said threat actors with a suspected nexus to China were engaged in a campaign to maintain long-term persistence by running malware...

Intel® NUC Firmware Advisory

Summary: Potential security vulnerabilities in system firmware and software for some Intel® NUCs may allow escalation of privilege. Intel is releasing firmware and software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2020-12336 Description: Insecure...

Intel® NUC Firmware Advisory

Summary: Potential security vulnerabilities in some Intel® NUC BIOS firmware may allow escalation of privilege or denial of service. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2021-33164 Description: Improper access control i...

2023.1 IPU - Intel® Xeon® Processor Advisory

Summary: A potential security vulnerability in some Intel® Xeon® Processors with Intel® Software Guard Extensions SGX may allow escalation of privilege. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-33196 Description: Incorrec...

Intel® Integrated Sensor Solution Advisory

Summary: A potential security vulnerability in the Intel® Integrated Sensor Solution may allow denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-30339 Description: Out-of-bounds read in firmware for the IntelR...

3rd Generation Intel® Xeon® Scalable Processors Advisory

Summary: A potential security vulnerability in some 3rd Generation Intel® Xeon® Scalable Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-33972 Description: Incorrect calculation in...

Intel® Ethernet Controllers and Adapters Advisory

Summary: A potential security vulnerability in some Intel® Ethernet Controllers and Adapters may allow denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-36382 Description: Out-of-bounds write in firmware for som...

2023.1 IPU - Intel® Processor Advisory

Summary: A potential security vulnerability in some Intel® Processors with Intel® Software Guard Extensions SGX may allow information disclosure. Intel is releasing firmware updates to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-38090 Description: Improper isolati...

2023.1 IPU - Intel® Atom® and Intel® Xeon® Scalable Processors Advisory

Summary: A potential security vulnerability in some Intel® Atom® and Intel® Xeon® Scalable Processors may allow escalation of privilege. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-21216 Description: Insufficient granularity...

HPESBHF04440 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00717, 2023.1 IPU - BIOS Advisory, Local Escalation of Privilege Vulnerabilities

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant XL450 Gen10 Server - Prior to 2.7602-09-2023 HPE Apollo 2000 Gen10 Plus System - Prior to 1.7202-02-2023 HPE Apollo 4200 Gen10 Plus System - Prior to 1.7202-02-20...

PT-2023-2627

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Admin versions prior to 10.4 Description The issue concerns a Remote Code Execution vulnerability in Ruckus Wireless Admin, allowing an unauthenticated attacker to execute arbitrary code via an HTTP GET request. This can be...

CVE-2022-43779

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...

Security Bulletin: IBM MQ Appliance is vulnerable to improper session invalidation (CVE-2022-40230)

Summary IBM MQ Appliance has resolved an improper session validation vulnerability. Vulnerability Details CVEID:CVE-2022-40230 DESCRIPTION: IBM MQ Appliance does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. CVSS Base score:...

CVE-2021-37377

Cross Site Scripting XSS vulnerability in Teradek Brik firmware version 7.2.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates...

CVE-2021-37377

Cross Site Scripting XSS vulnerability in Teradek Brik firmware version 7.2.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates...

CVE-2021-37378

Cross Site Scripting XSS vulnerability in Teradek Cube and Cube Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any...

CVE-2021-37373

Cross Site Scripting XSS vulnerability in Teradek Slice 1st generation firmware 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware...