Vulnerability Spotlight: Remote code execution bugs in NVIDIA D3D10 driver

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered multiple remote code execution vulnerabilities in the NVIDIA D3D10 driver. This driver supports multiple GPUs that NVIDIA produces. An adversary could exploit these vulnerabilities by...

NVIDIA D3D10 driver nvwgf2umx_cfg.dll nvwg MUL code execution vulnerability

Summary An exploitable code execution vulnerability exists in the nvwg MUL functionality of NVIDIA D3D10 Driver Version 442.50 - 26.21.14.4250. A specially crafted shader can cause remote code execution. An attacker can use this vulnerability to guest-to-host escape through Hyper-V RemoteFX. Test...

NVIDIA D3D10 driver nvwgf2umx_cfg.dll nvwg MOV_SAT code execution vulnerability

Summary An exploitable code execution vulnerability exists in the nvwg MOVSAT functionality of the NVIDIA D3D10 driver, version 442.50 - 26.21.14.4250. A specially crafted shader can cause remote code execution. An attacker can use this vulnerability to guest-to-host escape through Hyper-V...

NVIDIA D3D10 driver nvwgf2umx_cfg.dll nvwg MOV code execution vulnerability

Summary An exploitable code execution vulnerability exists in the nvwg MOV functionality of the NVIDIA D3D10 driver, version 442.50 - 26.21.14.4250. A specially crafted shader can cause remote code execution. An attacker can use this vulnerability to guest-to-host escape through Hyper-V RemoteFX...

NVIDIA D3D10 Driver nvwgf2umx_cfg.dll nvwg DCL_CONSTANT_BUFFER code execution vulnerability

Summary An exploitable code execution vulnerability exists in the nvwg DCLCONSTANTBUFFER functionality of NVIDIA D3D10 Driver Version 442.50 - 26.21.14.4250. A specially crafted shader can cause remote code execution. An attacker can use this vulnerability to guest-to-host escape through Hyper-V...

The vulnerability of the Hyper-V hardware virtualization system for Windows operating systems allows a perpetrator to trigger a service failure.

The hardware virtualization system Hyper-V for Windows operating systems has vulnerabilities due to insufficient validation of input data. Exploiting these vulnerabilities can allow attackers to cause service failures...

The vulnerability of the Hyper-V hardware virtualization system for Windows operating systems allows a perpetrator to trigger a service failure.

The hardware virtualization system Hyper-V for Windows operating systems has vulnerabilities due to insufficient validation of input data. Exploiting these vulnerabilities can allow attackers to cause service failures...

The vulnerability of the storvsp.sys component of the Hyper-V hardware virtualization system in the Windows operating system allows a perpetrator to increase their privileges.

The vulnerability of the storvsp.sys component of the Hyper-V hardware virtualization technology in the Windows operating system is related to privilege management errors. Exploiting this vulnerability can allow an attacker to increase their privileges...

openSUSE Security Update : virtualbox (openSUSE-2020-1486)

This update for virtualbox fixes the following issues : Update to Oracle version 6.1.14a. This minor update enables the building of libvirt again. Version update to 6.1.14 released September 04 2020 by Oracle File 'fixvirtiobuild.patch' is added to fix a build problem. This is a maintenance...

Metasploit Wrap-Up

Refreshingly configurable F5, on top of being a handy shortcut you can press over and over again until 3am just to watch the RTX 3080 preorders sell out instantly, is also a company that specializes in the delivery, security, performance, and availability of web applications, computing, storage,...

CVE-2020-24623

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...

CVE-2020-24623

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...

CVE-2020-24623

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...

Sql injection

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...

CVE-2020-24623

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...

CVE-2020-24623

CVE-2020-24623 affects Hewlett Packard Enterprise Universal API Framework (UAF) components for VMware ESXi v2.5.2 and HPE UAF for Microsoft Hyper-V (VHD). The reported issue is a SQL injection in the uaf_token header within the connections resource, exploitable by network-adjacent attackers. ZDI ...

PT-2020-15774

Name of the Vulnerable Software and Affected Versions Hewlett Packard Enterprise Universal API Framework versions prior to the fixed version Description A potential security issue has been identified that could allow SQL injection, potentially leading to information disclosure. This issue affects...

CVE-2020-24623: Improper Neutralization of Special Elements used in an SQL Command

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...

Windows Hyper-V VM Enumeration

This module will check if the target machine is a Hyper-V host and, if it is, will return a list of all of the VMs running on the host, as well as stats such as their state, version, CPU Usage, uptime, and status. Module Options msf use post/windows/gather/enumhypervvms msf postenumhypervvms show...

HPESBGN04024 rev.2 - Hewlett Packard Enterprise Universal API Framework for VMware ESXi (OVA) and Microsoft Hyper-V (VHD), Remote SQL Injection Information Disclosure Vulnerability

Potential Security Impact: Remote: SQL Injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Universal API Framework for VMware ESXi OVA - Prior to v2.5.2 HPE Universal API Framework for Microsoft Hyper-V VHD - Prior to v2.5.2 CVSS Scores: | CVE | CVSS Vector | Base Score ...