CVE-2019-8667

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6. The encryption status of a Time Machine backup may be incorrect...

Design/Logic Flaw

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6. The encryption status of a Time Machine backup may be incorrect...

Design/Logic Flaw

This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may authenticate via Face ID...

CVE-2019-8760

This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may authenticate via Face ID...

CVE-2019-8760

CVE-2019-8760 concerns Face ID authentication on Apple iOS. Description and multiple sources confirm that a 3D model constructed to resemble the enrolled user could bypass Face ID. The issue is addressed by improving Face ID machine learning models and was fixed in iOS 13. Related entries in Red ...

CVE-2019-8667

CVE-2019-8667 affects macOS Mojave components where Time Machine backup encryption status could be presented incorrectly due to an inconsistent user interface resolved by improved state management. The issue is documented as fixed in macOS Mojave 10.14.6. Public notes link the vulnerability to a ...

CVE-2019-8667

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6. The encryption status of a Time Machine backup may be incorrect...

Data governance and retention in your Microsoft 365 tenant—a secure and highly capable solution

Data governance has relied on transferring data to a third-party for hosting an archive service. Emails, documents, chat logs, and third-party data Bloomberg, Facebook, LinkedIn, etc. must be saved in a way that it can’t be changed and won’t be lost. Data governance is part of IT at the enterpris...

Kernel: KVM: OOB memory access via mmio ring buffer

An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvmcoalescedmmio' object, wherein write indices 'ring-first' and 'ring-last' value could be supplied by a host user-space...

kpatch: hw: incomplete fix for CVE-2018-12207

It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure...

DB Ticket Vending Machine WinXP - Privilege Escalation

Document Title: =============== DB Ticket Vending Machine WinXP - Privilege Escalation References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2191 Vulnerability Magazine:...

DB Ticket Vending Machine WinXP - Privilege Escalation

Document Title: =============== DB Ticket Vending Machine WinXP - Privilege Escalation References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2191 Vulnerability Magazine:...

Finding a common language to describe AI security threats

As artificial intelligence AI and machine learning systems become increasingly important to our lives, it’s critical that when they fail we understand how and why. Many research papers have been dedicated to this topic, but inconsistent vocabulary has limited their usefulness. In collaboration wi...

ALPINE-CVE-2019-19583

An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service guest OS crash because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for DB...

CVE-2019-19339

It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure...

The vulnerability of VMnetDHCP hypervisors in VMware Workstation and VMware Fusion allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of VMnetDHCP hypervisors in VMware Workstation and VMware Fusion lies in the lack of protection for service-related data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Microsoft Windows Uninitialized Variable Local Privilege Elevation

This module exploits CVE-2019-1458, an arbitrary pointer dereference vulnerability within win32k which occurs due to an uninitalized variable, which allows user mode attackers to write a limited amount of controlled data to an attacker controlled address in kernel memory. By utilizing this...

Failure Modes in Machine Learning

Interesting taxonomy of machine-learning failures pdf that encompasses both mistakes and attacks, or -- in their words -- intentional and unintentional failure modes. It's a good basis for threat modeling...

Unspecified vulnerability in ShapeShift KeepKey finite state machine

ShapeShift KeepKey is an e-wallet device for cryptocurrency storage. An unspecified vulnerability exists in the ShapeShift KeepKey finite state machine, which stems from the program not being sufficiently authenticated. The vulnerability can be exploited to reset a portion of the encryption key t...

Compositing Engine machine stuck with error "Lifetime validation failed. The token is expired"

Offload compositing getting stuck with error "Lifetime validation failed. The token is expired" and the compositing engine machine gets deleted after 20 mins. ELM fails with error: The compositing engine failed to initialize after "00:20:00". Screenshot:...