Don’t panic! “Unpatchable” Mac vulnerability discovered

Researchers at MITs Computer Science & Artificial Intelligence Lab CSAIL found an attack surface in a hardware-level security mechanism utilized in Apple M1 chips. The flaw is unpatchable, but attackers would need to chain it with other vulnerabilities to make use of the attack method. The hardwa...

Microsoft Guidance on Intel Processor MMIO Stale Data Vulnerabilities

Executive Summary On June 14, 2022, Intel published information about a class of memory-mapped I/O vulnerabilities known as Processor MMIO Stale Data Vulnerabilities. An attacker who successfully exploited these vulnerabilities might be able to read privileged data across trust boundaries. In...

Nokia G-2425G-A 跨站脚本漏洞

Nokia G-2425G-A is a home router from Nokia, Finland. A security vulnerability exists in Nokia G-2425G-A, which can be exploited by attackers to redirect users to malicious or phishing web pages based on a crafted payload, and the following products and versions are affected: Nokia "G-2425G-A"...

Bluetooth Signals Can Be Used to Track Smartphones, Say Researchers

Researchers warn Bluetooth signals can be used to track device owners via a unique fingerprinting of the radio signal. The technique was presented via a paper presented at IEEE Security and Privacy conference last month by researchers at the University of California San Diego. The paper suggests...

MIT Researchers Discover New Flaw in Apple M1 CPUs That Can't Be Patched

A novel hardware attack dubbed PACMAN has been demonstrated against Apple's M1 processor chipsets, potentially arming a malicious actor with the capability to gain arbitrary code execution on macOS systems. It leverages "speculative execution attacks to bypass an important memory protection...

Update now! Patch against vulnerabilities in Meeting Owl Pro and Whiteboard Owl devices

After a decent amount of pressure, Owl Labs has finally released updates for vulnerabilities in Meeting Owl, and Whiteboard Owl cameras. The vulnerabilities were reported to Owl Labs in January, One of the vulnerabilities, CVE-2022-31460 has been added to the Known exploited vulnerabilities catal...

Trellix Threat Labs Uncovers Critical Flaws in Widely Used Building Access Control System

Trellix Threat Labs Uncovers Critical Flaws in Widely Used Building Access Control System By Trellix · June 9, 2022 This story was also written by Steve Povolny and Sam Quinn. Today at the Hardwear.io Security Trainings and Conference, Trellix Threat Labs is sharing new research into...

Trellix Threat Labs Uncovers Critical Flaws in Widely Used Building Access Control System

Trellix Threat Labs Uncovers Critical Flaws in Widely Used Building Access Control System By Trellix · June 9, 2022 This story was also written by Steve Povolny and Sam Quinn. Today at the Hardwear.io Security Trainings and Conference, Trellix Threat Labs is sharing new research into...

Remote Desktop License Issue with RDS Per Device CALs

Users might see the following error message. Remote Desktop License IssueThere is a problem with your Remote Desktop License, and your session will be disconnected in 60 minutes. Contact your system administrator to fix this problem Screenshot: It occurs when VDA uses RDS Per Device CALs, User...

Remotely Controlling Touchscreens

Researchers have demonstrated controlling touchscreens at a distance, at least in a laboratory setting: The core idea is to take advantage of the electromagnetic signals to execute basic touch events such as taps and swipes into targeted locations of the touchscreen with the goal of taking over...

GSD-2022-1002523 data processing in LG F4DV910H2 version possibly all washers in the F4DV series

In the LG F4DV910H2 washing machine, possibly all washers in the F4DV series, a data processing vulnerability exists in the WiFi card and/or software that can be attacked via simply sending a large amount of WiFi network traffic on the WiFi network the washer is attached to, resulting in the wash...

The vulnerability of Windows Hyper-V’s hardware virtualization technology allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Windows Hyper-V hardware virtualization system in Windows operating systems is related to errors in information processing. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information remotely...

The vulnerability of Windows Hyper-V’s hardware virtualization technology allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Windows Hyper-V hardware virtualization system in Windows operating systems is related to errors in information processing. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information remotely...

ALBA-2022:4744 sos bug fix and enhancement update

The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging. Bug Fixes and Enhancements: sos collect fails to get node list from a pacemaker cluster BZ2071695 Tracke...

Security Bulletin: DS8000 Hardware Management Console is vulnerable to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary DS8000 Hardware Management Console which consumes Log4j, is subject to CVE-2021-45105 which could cause a denial of service and CVE-2021-45046 which could cause the leak of sensitive information and remote code execution in some environments and local code execution in all environments. I...

Security Bulletin: DS8000 Hardware Management Console uses Apache Log4j which is subject to a vulnerability alert CVE-2021-44228.

Summary The DS8000 Hardware Managment Console leverages Apache Log4j CVE-2021-44228, which is subject to a vulnerability and may allow remote attackers to execute local code on the system. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execu...

Fedora: Security Advisory for plib (FEDORA-2022-08022e9452)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenStack Neutron vulnerable to hardware address impersonation

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch c...

GHSA-HVM4-MC7M-22W4 OpenStack Neutron vulnerable to hardware address impersonation

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch c...

Security Bulletin: Security vulnerabilities have been identified in OpenSSL, IBM Java Runtime and the microcode shipped with the DS8000 Hardware Management Console (HMC)

Summary The updates indicated below have been released to address the following vulnerabilities: CVE-2016-2107 MITM attack in OpenSSL, CVE-2016-5547 Denial of service in IBM Runtime Environment Java™ CVE-2017-1123 Escalation of privilege in the DS8000 HMC Vulnerability Details CVEID: CVE-2016-210...