ETHCrowdfundBase.sol: totalVotingPower is increased too much in the _finalize function

Lines of code Vulnerability details Impact This issue is about how the ETHCrowdfundBase.finalize functions calls PartyGovernanceNFT.increaseTotalVotingPower with an amount that does not reflect the sum of the individual users' voting power. Thereby it will become impossible to reach unanimous...

PT-2023-2444 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: InsydeH2O versions 5.0 through 5.5 Description: The issue is related to insufficient input validation in BIOS Guard updates, which can lead to memory corruption in SMM. An attacker can exploit this by supplying malformed inputs to the BIOS...

Amazon Linux AMI : microcode_ctl (ALAS-2023-1715)

The version of microcodectl installed on the remote host is prior to 2.1-47.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1715 advisory. 2024-02-14: CVE-2022-38090 was added to this advisory. 2024-02-01: CVE-2022-21216 was added to this advisory...

PT-2023-21163 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 Description: The issue concerns escalation of privileges when failure mode allow: true is configured for the ext authz filter in Envoy, an open source edge and service proxy...

Debian dla-3379 : intel-microcode - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3379 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3379-1 [email protected]...

The vulnerability of GnuPG’s information encryption and digital signatures software lies in its weak encryption methods, allowing attackers to gain access to confidential data.

The vulnerability of GnuPG’s information encryption and digital signatures lies in the use of weak encryption algorithms. Exploiting this vulnerability could allow a remote attacker to gain access to confidential data...

CVE-2023-28610

The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a remote attacker to gain root access to the system...

OMICRON StationGuard 安全漏洞

OMICRON StationGuard is an application from OMICRON Austria. It is used for network monitoring. A security vulnerability exists in OMICRON StationGuard versions 1.10 through 2.20 and OMICRON StationScout versions 1.30 through 2.20, which stems from the presence of a misauthorization, and can be...

CVE-2022-34148 WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin = 1.6.9.0 versions...

CVE-2022-34148 WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin = 1.6.9.0 versions...

Updated microcode packages fix security vulnerabilities

Updated microcode packages fix security vulnerabilities: Insufficient granularity of access control in out-of-band management in some IntelR Atom and Intel Xeon Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent network access CVE-2022-21216...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ucode-intel (SUSE-SU-2023:0568-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0568-1 advisory. Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Securi...

USN-5886-1 intel-microcode vulnerabilities

Erik C. Bjorge discovered that some IntelR Atom and Intel Xeon Scalable Processors did not properly implement access controls for out-of-band management. This may allow a privileged network-adjacent user to potentially escalate privileges. CVE-2022-21216 Cfir Cohen, Erdem Aktas, Felix Wilhelm,...

DEBIAN-CVE-2022-3219

GnuPG can be made to spin on a relatively small input by for example crafting a public key with thousands of signatures attached, compressed down to just a few KB...

Samsung adds Message Guard protection against zero-click exploits

Samsung has announced the introduction of Message Guard for the Samsung Galaxy S23 series. It will be gradually rolled out to other Galaxy smartphones and tablets later this year. Message Guard works on images received in messages by the apps "Samsung Messages" and "Messages by Google" and...

K23435400: Intel CPU vulnerability CVE-2022-0004

Security Advisory Description Hardware debug modes and processor INIT setting that allow override of locks for some IntelR Processors in IntelR Boot Guard and IntelR TXT may allow an unauthenticated user to potentially enable escalation of privilege via physical access. CVE-2022-0004 Impact There...

K40452417: BIG-IP ASM memory exhaustion vulnerability CVE-2019-6682

Security Advisory Description The BIG-IP ASM system may consume excessive resources when processing certain types of HTTP responses from the origin web server. This vulnerability is only known to affect resource-constrained systems in which the security policy is configured with response-side...

K51931024: Linux kernel vulnerability CVE-2017-1000364

Security Advisory Description An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over the stack guard page is bypassed, this affects Linux Kernel versions 4.11.5 and earlier the stackguard page was...

SUSE SLES15 Security Update : ucode-intel (SUSE-SU-2023:0454-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0454-1 advisory. Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for INTEL-SA-00767...

SUSE SLES12 Security Update : ucode-intel (SUSE-SU-2023:0456-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0456-1 advisory. Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for INTEL-SA-00767...