237 matches found
多款 ARM 产品安全漏洞
ARM Cortex-M55 and others are products of ARM UK.ARM Cortex-M55 is ARM Holdings' ultra-low power ARM microarchitecture for microcontrollers and embedded subsystems.ARM Cortex-M35P is a tamper-resistant Cortex -M processor.ARM Cortex-M33 is a feature-rich implementation of the Armv8-M architecture...
OESA-2021-1276 maven security update
Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: Apache Maven will follow repositories that are defined in a...
CVE-2020-11298
CVE-2020-11298 affects Qualcomm Snapdragon platforms where non-secure clients can change permissions on shared memory buffers used by the HLOS Invoke Call to the secure kernel. The issue is described as local in scope with potential for elevation of privileges, based on the affected Snapdragon Au...
CVE-2020-11298
While waiting for a response to a callback or listener request, non-secure clients can change permissions to shared memory buffers used by HLOS Invoke Call to secure kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,...
CVE-2021-27562
In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode...
UBUNTU-CVE-2020-24588
The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames which is mandatory as part of 802.11...
多款Qualcomm产品缓冲区错误漏洞
The Qualcomm Snapdragon SOC Snapdragon Processor is a chip from Qualcomm Incorporated that is used in mobile devices to process information. A buffer error vulnerability exists in various Qualcomm products. The vulnerability stems from the fact that a non-secure bootloader can unlock and modify...
DEBIAN-CVE-2021-26291
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...
CVE-2021-26291
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...
UBUNTU-CVE-2021-26291
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...
PT-2021-7897
Name of the Vulnerable Software and Affected Versions Apache Maven versions prior to 3.8.1 Description The issue is related to shortcomings in the mechanism of confirming the source of data in the Apache Maven framework. Exploitation of this issue may allow a remote attacker to gain unauthorized...
CVE-2021-28117
libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs that are neither https:// nor http:// based on the content of the store.kde.org web site. 5.18.7 is also a fixed version...
Information disclosure
Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due to insufficient checks in the syscall handler and leads to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,...
How to configure Citrix Receiver for Windows to manually add HTTP stores
This article describes how to enable users to add non-secure HTTP instead of HTTPS stores using Receiver...
PT-2021-4942
Name of the Vulnerable Software and Affected Versions Arm Trusted Firmware-M versions M through 1.2 Description The issue is related to an out-of-bounds write in the implementation of the NSPE Non-secure Processing Environment mode in Arm Trusted Firmware-M. This can cause a system halt, overwrit...
PT-2020-16399 · Mysql Server · Dbdeployer
Name of the Vulnerable Software and Affected Versions: DBdeployer versions prior to 1.58.2 Description: DBdeployer is a tool that deploys MySQL database servers easily. Users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such...
CVE-2020-28209
A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agen...
CVE-2020-28209
A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agen...
Stack overflow
In Arm software implementing the Armv8-M processors all versions, the stack selection mechanism could be influenced by a stack-underflow attack in v8-M TrustZone based processors. An attacker can cause a change to the stack pointer used by the Secure World from a non-secure application if the sta...
PT-2020-14256 · Helm +2 · Helm +2
Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: A Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attack...