CVE-2019-12904

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. The C implementation is used on platforms where an assembly-language implementation is unavailable. NOTE: the vendor's position is...

CVE-2019-12904

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. The C implementation is used on platforms where an assembly-language implementation is unavailable. NOTE: the vendor's position is...

Feds: Cyberattack on NASA's JPL Threatened Mission-Control Data

NASA’s Jet Propulsion Laboratory JPL may know how to send delicate equipment to Mars, but basic cybersecurity best practices appear to pose an issue for it. A comprehensive federal review has detailed an April 2018 security incident that compromised mission systems – stemming from multiple IT...

PT-2019-13013 · Gnu +2 · Libgcrypt +2

Name of the Vulnerable Software and Affected Versions: Libgcrypt version 1.8.4 Description: The C implementation of AES in Libgcrypt is susceptible to a flush-and-reload side-channel attack. This occurs because physical addresses are accessible to other processes, and the C implementation is used...

CVE-2019-10998

An issue was discovered on Phoenix Contact AXC F 2152 No.2404267 before 2019.0 LTS and AXC F 2152 STARTERKIT No.1046568 before 2019.0 LTS devices. Unlimited physical access to the PLC may lead to a manipulation of SD cards data. SD card manipulation may lead to an authentication bypass opportunit...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

CVE-2019-0174

Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access...

CVE-2019-0174

Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access...

CVE-2019-0174

CVE-2019-0174 is a RAMBleed-style information-disclosure vulnerability in certain Intel microprocessors where a local attacker could potentially disclose partial physical addresses. Intel’s advisory (Intel SA-00247) lists affected families (e.g., Core X-series, 4th Gen Core i5/i3, Pentium, Xeon E...

RAMBleed attack steals sensitive data from computer memory

By Waqas "RAMBleed Reading Bits in Memory Without Accessing Them." A team of security researchers has published a report on a relatively advanced and previously undetected variant of the Rowhammer attack called RAMBleed. Researchers claim that the new variant can be used for reading the contents ...

CVE-2019-0174

Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access...

Information Disclosure Vulnerability in Multiple Intel Products (CNVD-2019-25499)

Intel Core X-series Processors are products of Intel Corporation.Intel Core X-series Processors are X-series central processing units CPUs.4th Generation Intel Core i5 Processors are 4th generation Core i5-series central processing units CPUs.4th Generation Intel Core i3 Processors are 4th...

Partial Physical Address Leakage Vulnerability - Lenovo Support US

No description provided...

Russia and Iran Plan to Fundamentally Isolate the Internet

Opinion: Russia and Iran’s decisions to build isolated, domestic internets represent a new form of internet fragmentation—one that is far more physical than what we’ve seen before...

CVE-2019-4048

IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311...

CVE-2019-4048

CVE-2019-4048 affects IBM Maximo Asset Management 7.6. The vulnerability allows a physical user to obtain sensitive information from a previous user on the same machine (a back-and-refresh-type information disclosure). Affected core product: Maximo Asset Management 7.6 (and related Industry Solut...

Intel® CSME Assets Advisory

Summary: A potential security vulnerability in Intel® CSME, Intel® Server Platform Services and Intel® Trusted Execution Engine Firmware may allow information disclosure. Intel is releasing Intel® CSME, Intel® Server Platform Services and Intel® Trusted Execution Engine updates to mitigate this...

PT-2022-9181 · Gnome +1 · Gnome Shell +1

Name of the Vulnerable Software and Affected Versions: gnome-shell versions affected versions not specified Description: A locking protection bypass flaw was found in gnome-shell, allowing a physical attacker with access to a locked system to kill existing applications and start new ones as the...

Privilege escalation

A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller SHC before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the adversary needs physical access to the...