8374 matches found
SUSE-SU-2024:0269-1 Security update for xen
This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851...
SUSE-SU-2024:0265-1 Security update for xen
This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851...
SUSE-SU-2024:0264-1 Security update for xen
This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851...
pci: phantom functions assigned to incorrect contexts
ISSUE DESCRIPTION PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions nee...
Microsoft Executives Hacked
Microsoft is reporting that a Russian intelligence agency--the same one responsible for SolarWinds--accessed the email system of the companys executives. Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and ga...
Moderate: Red Hat Security Advisory: sqlite security update
An update for sqlite is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
Prototype Pollution
hoolock is vulnerable to Prototype Pollution. The vulnerability is due to utility functions failing to block attempts to access or alter object prototypes. An attacker can modify application data or perform a Denial of Service by exploiting this vulnerability...
Prototype pollution not blocked by object-path related utilities in hoolock
Impact Utility functions related to object paths get, set and update did not block attempts to access or alter object prototypes. Patches The get, set and update functions will throw a TypeError when a user attempts to access or alter inherited properties in versions =2.2.1...
GHSA-4C2G-HX49-7H25 Prototype pollution not blocked by object-path related utilities in hoolock
Impact Utility functions related to object paths get, set and update did not block attempts to access or alter object prototypes. Patches The get, set and update functions will throw a TypeError when a user attempts to access or alter inherited properties in versions =2.2.1...
CVE-2024-23218
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...
Code injection
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An attacker may be able to decrypt legacy RSA PKCS1 v1.5 ciphertexts without having the...
CVE-2024-23218
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...
CVE-2024-23218
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...
PT-2024-1476 · Redis · Redis
Name of the Vulnerable Software and Affected Versions: Redis versions master-1b8bd86 through master-7b46079 Description: The issue is related to an ODR violation via the component hiredisAllocFns at /opt/fs/redisraft/deps/hiredis/alloc.c. This is associated with a buffer overflow in memory, which...
Uncaught Exception in surrealdb
Although custom parameters and functions are only supported at the database level, it was allowed to invoke those entities at the root or namespace level. This would cause a panic which would crash the SurrealDB server, leading to denial of service. Impact A client that is authorized to run queri...
PT-2024-40347 · Surrealdb · Surrealdb
Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 1.1.1 Description: The issue allows authorized clients to invoke custom parameters and functions at the root or namespace level, causing a panic that crashes the SurrealDB server, leading to denial of service. This...
PT-2026-60949
Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.1.1 Description Authorized clients can cause a server panic leading to a denial of service by invoking custom parameters and functions at root or namespace levels. This occurs because the server fails to properly...
NVIDIA DGX A100 BMC Privilege Escalation
The vulnerability of the BMC Baseboard Management Controller in NVIDIA’s DGX A100 server lies in the absence of authentication procedures for critical functions. Exploiting this vulnerability allows an attacker to enhance their privileges, gain read, write, or delete access to data, execute...
