8123 matches found
Design/Logic Flaw
The fpufxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits...
CVE-2016-3158
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOT...
WebUSB API — Connect Your USB Devices Securely to the Internet
Two Google engineers have developed a draft version of an API called WebUSB that would allow you to connect your USB devices to the Web safely and securely, bypassing the need for native drivers. WebUSB – developed by Reilly Grant and Ken Rockot – has been introduced to the World Wide Web...
Juniper Updates ScreenOS: Hopes RNG/NSA Controversy Over
Juniper Networks hopes to remove any clouds of uncertainty that its networking gear might still have a backdoor that could allow the NSA or hackers to snoop on traffic running through its hardware. On Thursday, Juniper completed an update to the way its ScreenOS software handles encryption. Junip...
Black-Box CAN Network Analysis Framework: CANToolz
CANToolz is a framework forCANbus network and device analysis. This tool consist of various different modules which can be piped together and used by security researchers and automotive/OEM security testers for black-box analysis of any CANbus system. You can use this software for ECU discovery,...
RS - Hardware Keyboard Layouts - Suspicious files vulnerabilities
HackApp vulnerability scanner discovered that application RS - Hardware Keyboard Layouts published at the 'play' market has multiple vulnerabilities...
Shopify: XSS on hardware.shopify.com
This is stored vulnerability for all your users, not only registered or signed in. Vulnerable parameter: propertiesbuilderid at .shopify.com/cart/add The vulnerability is in array levels. When you try something like propertiesbuilderidsecondparameter=value, you will see many corrupted tags in HTM...
Delicate Hardware Hacks Could Unlock Shooter's iPhone
A researcher at IOActive believes the U.S. intelligence community has the capability to carry out a delicate hardware hack that could unlock the iPhone 5c at the center of the current FBiOS debate. The attack requires considerable financial resources and acumen with an intrusive attack against th...
hardware.redhat.com XSS vulnerability
Vulnerable URL: https://hardware.redhat.com/list.cgi?product=Red+Hat+Hardware+Certificationtype==Red+Hat+Enterprise+Linuxinternalwhiteboard=Server=%22%3E%3Csvg%2Fonload%3Dprompt%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at 29.03.2016 Latest check for patch:|...
Mageia: Security Advisory (MGASA-2016-0072)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Updated libgcrypt packages fix security vulnerabilities
Updated libgcrypt packages fix security vulnerability: Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack CVE-2015-7511. The libgcrypt package was also...
Critical glibc Flaw Puts Linux Machines and Apps at Risk (Patch Immediately)
A highly critical vulnerability has been uncovered in the GNU C Library glibc, a key component of most Linux distributions, that leaves nearly all Linux machines, thousands of apps and electronic devices vulnerable to hackers that can take full control over them. Just clicking on a link or...
Wanna Mine Bitcoins Faster? Researchers Find New Way to Do it
A new machine for Bitcoin Mining called "Approximate Hardware" would make Bitcoin mining easier. Bitcoin had gained tremendous popularity over a few couple of years among the virtual currencies due to its decentralized principle. Mining a single Bitcoin is not an ice cake walk, as it requires an...
Shopify: XSS on hardware.shopify.com
Hello @Shopify. I found CSRF and XSS, that very good combine with each other. CSRF This CSRF is not dangerous, but is serves me in order to perform other bugs. For example, here CSRF for adding product: http://hardware.shopify.com/cart/add?&id=1106494145&iPad Stand=1120276481&Cash...
Debian DSA-3471-1 : qemu - security update
Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. - CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets. - CVE-2015-7504 Qinghao...
Debian DSA-3470-1 : qemu-kvm - security update
Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. - CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service via resource exhaustion, that could occur when receiving large...
Debian DSA-3469-1 : qemu - security update
Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. - CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service via resource exhaustion, that could occur when receiving large packets....
Debian Security Advisory DSA 3470-1 (qemu-kvm - security update)
Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service via resource exhaustion, that could occur when receiving large packet...
The vulnerability of the QEMU hardware emulation software allows a hacker to trigger a service failure or cause some other unknown effect.
The vulnerability of the QEMU hardware emulation software is related to incorrect restrictions on commands received from ATAPI devices. Exploiting this vulnerability can allow a malicious actor to cause service failures or potentially have other unspecified effects by using certain IDE commands...
