CVE-2023-4570

CVE-2023-4570 describes an improper access restriction in NI MeasurementLink Python services that permits an attacker on an adjacent network to reach services exposed on localhost, previously believed to be unreachable externally. Affected component: ni-measurementlink-service Python package (ver...

PT-2023-29652

Name of the Vulnerable Software and Affected Versions ni-measurementlink-service versions 1.1.0 and earlier Description An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were...

x86/Intel: Gather Data Sampling

ISSUE DESCRIPTION A researcher has discovered Gather Data Sampling, a transient execution side-channel whereby the AVX GATHER instructions can forward the content of stale vector registers to dependent instructions. The physical register file is a structure competitively shared between sibling...

Apache NiFi 代码注入漏洞

Apache NiFi is an open source tool for building reliable and secure data pipelines. It supports collecting, aggregating and transferring data from a variety of sources and provides powerful data processing and transformation capabilities. A remote code execution vulnerability exists in Apache NiF...

Medium: openssl11

Issue Overview: AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in...

K14236: OpenSSL vulnerability CVE-2012-2686

Security Advisory Description A flaw in the OpenSSL handling of CBC ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI supporting platforms can be exploited in a denial-of-service DoS attack. Anyone using an AES-NI platform for TLS 1.2 or TLS 1.1 on OpenSSL 1.0.1 before 1.0.1d is affected. Platforms...

K93600123: OpenSSL vulnerability CVE-2016-2107

Security Advisory Description The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC...

SUSE CVE-2022-2097

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption...

PT-2023-33948 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.87 Description: A potential issue exists where the ni lock is held when calling truncate setsize. The actual impact and attack plausibility have not yet been proven. Recommendations: For versions prior to...

EulerOS 2.0 SP10 : linux-sgx (EulerOS-SA-2022-2852)

According to the versions of the linux-sgx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internal...

Design/Logic Flaw

Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface CLI may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-42718

The CVE-2022-42718 entry concerns NI LabVIEW Command Line Interface (CLI). The root issue is incorrect default permissions in the installation folder, which may allow an authenticated local user to escalate privileges. Impact is a local privilege-escalation risk with high severity (CVE reported w...

CVE-2022-42718

Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface CLI may allow an authenticated user to potentially enable escalation of privilege via local access...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2022-2432)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properl...

Input validation

An improper input validation in NI System Configuration Manager before 22.5 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2022-35415

The CVE-2022-35415 entry concerns NI System Configuration Manager prior to version 22.5, with an improper input validation issue that may allow a privileged user to escalate privileges via local access. Affected component: NI System Configuration Manager (pre-22.5). Root cause: input validation w...

CVE-2022-35415

An improper input validation in NI System Configuration Manager before 22.5 may allow a privileged user to potentially enable escalation of privilege via local access...

PT-2022-22815 · National Instruments · Ni System Configuration Manager

Name of the Vulnerable Software and Affected Versions: NI System Configuration Manager versions prior to 22.5 Description: The issue is related to improper input validation, which may allow a privileged user to potentially enable escalation of privilege via local access. Recommendations: For...

CLSA-2022-1660238832 Fixed CVE-2022-2097 in openssl

CVE-2022-2097: Fix AES OCB encrypt/decrypt for x86 AES-NI...

USN-5502-1 openssl vulnerability

Alex Chernyakhovsky discovered that OpenSSL incorrectly handled AES OCB mode when using the AES-NI assembly optimized implementation on 32-bit x86 platforms. A remote attacker could possibly use this issue to obtain sensitive information...