New Report on IoT Security

The Atlantic Council has published a report on securing the Internet of Things: "Security in the Billions: Toward a Multinational Strategy to Better Secure the IoT Ecosystem." The report examines the regulatory approaches taken by four countries--the US, the UK, Australia, and Singapore--to secur...

CVE-2022-3044

Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page...

CVE-2022-3053

Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigation via a crafted HTML page...

USN-5639-1: Linux kernel (Azure CVM) vulnerabilities

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-33655 Moshe Ko...

CVE-2022-3053

CVE-2022-3053 corresponds to an “Inappropriate implementation in Pointer Lock” in Google Chrome on macOS prior to 105.0.5195.52, enabling a remote attacker to restrict user navigation via a crafted HTML page. The connected documents confirm this vulnerability in Chromium/Chrome with affected vers...

CVE-2022-39243

NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's JavajavalangUNIXProcessforkAndExec method 1.2.0+, attackers can use NUL characters in their strings to perform command line injection. Java's...

Security Bulletin: Multiple JRE vulnerabilities addressed in IBM Sterling External Authentication Server (CVE-2013-1571, CVE-2013-1500, CVE-2013-0443, CVE-2013-0440, CVE-2013-0169)

Abstract The IBM JRE embedded in the IBM Sterling External Authentication Server has security vulnerabilities in its Javadoc, and in SSL connections to the configuration GUI. Content VULNERABILITY DETAILS CVE ID: CVE-2013-1571 DESCRIPTION: The Javadoc documentation generated for the Sterling...

Security Bulletin: The embedded help system in IBM InfoSphere Streams contains a potential vulnerability (CVE-2013-0599)

Abstract The embedded help system in IBM InfoSphere Streams has a potential vulnerability where sensitive information about the help system’s implementation is disclosed. Content VULNERABILITY DETAILS: CVE ID:CVE-2013-059 9 CVSS: CVSS Base Score: 5.0 CVSS Temporal Score: See...

Exploit for Out-of-bounds Write in Openssl

CVE-2022-2274 A POC OF CVE-2022-2274 openssl The OpenSSL 3...

Ubuntu: Security Advisory (USN-5630-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

fhir-works-on-aws-authz-smart information leakage vulnerability

fhir-works-on-aws-authz-smart is a SMART implementation on FHIR v1.0.0 of the FHIR Works on AWS framework open-sourced by Amazon Web Services Labs. Designed to leverage the OAuth2/OIDC authorization server to authorize requests. An information disclosure vulnerability exists in...

PT-2022-16011 · U-Boot +4 · U-Boot +4

Name of the Vulnerable Software and Affected Versions: UBoot affected versions not specified Description: The issue is related to an unchecked length field in UBoot's DFU implementation. Specifically, the U-Boot DFU implementation does not bound the length field in USB DFU download setup packets,...

USN-5630-1: Linux kernel (Raspberry Pi) vulnerabilities

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-33655 Moshe Ko...

Why Zero Trust Should be the Foundation of Your Cybersecurity Ecosystem

For cybersecurity professionals, it is a huge challenge to separate the "good guys" from the "villains". In the past, most cyberattacks could simply be traced to external cybercriminals, cyberterrorists, or rogue nation-states. But not anymore. Threats from within organizations – also known as...

Azure Identity SDK と Azure Key Vault SDKに関する多層防御のためのアップデートとベストプラクティスの実装ガイダンス

本ブログは、Defense-in-Depth Updates for Azure Identity SDK and Azure Key Vault SDK plus Best Practice Implementation Guidance の抄訳版です。最新の情報は...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-10603)

Google TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow has an input validation error vulnerability that stems from the fact that the BlockLSTMGradV2 implementation does not fully validate its input, which could be exploited by an attacker to...

SUSE-SU-2022:3294-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP2 kernel was updated receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries bnc1203107. -...

USN-5616-1: Linux kernel (Intel IoTG) vulnerabilities

Asaf Modelevsky discovered that the IntelR 10GbE PCI Express ixgbe Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. CVE-2021-33061 Moshe Kol, Amit Klein and Yossi Gilad discovered that the I...

Windows TCP/IP Code Execution

The vulnerability of the TCP/IP protocol implementation in Windows operating systems is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EulerOS 2.0 SP9 : openssl (EulerOS-SA-2022-2300)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properl...