You Can’t Eliminate Cyberattacks, So Focus on Reducing the Blast Radius

Lately, I’ve started wondering if the biggest risk concerning cyberattacks is that we’re becoming desensitized to them. After all, businesses experience a ransomware attack every 11 seconds—the majority of which the public never hears about. Faced with this reality, it may seem like your efforts ...

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.

...

D-LINK DIR850 - Open Redirect Vulnerability

Exploit Title: DLINK DIR850 - Open Redirect Product: Dlink Model: DIR850 CVE: CVE-2021-46379 Exploit Author: AhmedAlroky Hardware version: b1 Firmware version: ET850-1.08TRb03 Vendor home page: https://www.dlink.com/ Exploit : Visit...

The vulnerability of the Windows Hyper-V hardware virtualization system allows a attacker to trigger a service failure.

The vulnerability of the Windows Hyper-V hardware virtualization system is related to resource release errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2022-24584

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the Yubico...

Design/Logic Flaw

DISPUTED Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the...

CVE-2022-24584

CVE-2022-24584 concerns incorrect access control in Yubico OTP on YubiKey hardware tokens and the Yubico OTP validation server. The issue is that a user can reprogram the OTP functionality via the Yubico Personalization Tool and then upload the new configuration to Yubico’s OTP validation servers...

CVE-2021-33317

The TRENDnet TI-PG1284i switch (Hardware v2.0R) is affected by a null pointer dereference in the LLDP-related component prior to firmware version 2.0.2.S0. The vulnerability arises from failing to verify the presence of the ChassisID TLV in received LLDP packets, allowing a crafted packet to cras...

CVE-2021-33316

The CVE-2021-33316 issue affects TRENDnet TI-PG1284i switches (hardware v2.0R) prior to version 2.0.2.S0. The vulnerability is in the LLDP-related component where a crafted ChassisID TLV length field can trigger an integer underflow, causing a negative length to be passed to memcpy() and potentia...

CVE-2021-33315

CVE-2021-33315 affects TRENDnet TI-PG1284i switches (hw v2.0R) prior to version 2.0.2.S0. The root cause is a lack of validation on the length field of the PortID TLV in the LLDP component, which can trigger an integer underflow and cause a negative value to be passed to memcpy(), potentially lea...

CVE-2022-0024

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...

Code injection

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...

PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...

CVE-2022-0024

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...

Security Bulletin: Crypto Hardware Initialization and Maintenance is vulnerable to arbitrary code execution due to Apache Log4j (CVE 2021-4104, CVE 2022-23302, CVE 2022-23305, CVE 2022-23307)

Summary Crypto Hardware Initialization and Maintenance CHIM as shipped with IBM Common Cryptographic Architecture CCA for MTM 4767 is affected by several vulnerabilities in Apache Log4j CVE-2021-4104, CVE-2022-23303, CVE 2022-23305 and CVE 2022-23307. CHIM is using Apache Log4j for internal loggi...

PT-2022-16736 · Yubico · Yubikey

Name of the Vulnerable Software and Affected Versions: YubiKey affected versions not specified Description: The issue concerns incorrect access control in the Yubico OTP functionality of the YubiKey hardware tokens and the Yubico OTP validation server. The Yubico OTP is supposed to create...

DLINK DIR850 - Insecure Access Control

Exploit Title: DLINK DIR850 - Insecure Access Control Product: Dlink Model: DIR850 Date: 14/1/2022 CVE : CVE-2021-46378 Exploit Author: Ahmed Alroky Hardware version: b1 Firmware version: ET850-1.08TRb03 Vendor home page: https://www.dlink.com/ Exploit : Visit http:///config.dat...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks. A security vulnerability exists in Palo Alto Networks PAN-OS. An attacker could use this vulnerability to upload a specially created configuration that interrupts system processes and executes arbitrary code...

DLINK DIR850 Insecure Direct Object Reference

Exploit Title: DLINK DIR850 - Insecure Access Control Product: Dlink Model: DIR850 Date: 14/1/2022 CVE : CVE-2021-46378 Exploit Author: Ahmed Alroky Hardware version: b1 Firmware version: ET850-1.08TRb03 Vendor home page: https://www.dlink.com/ Exploit : Visit http:///config.dat...

hw: cpu: intel: Branch History Injection (BHI)

A flaw was found in hw. The Branch History Injection BHI describes a specific form of intra-mode BTI. This flaw allows an unprivileged attacker to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to...