AMD Downplays CPU Threat Opening Chips to Data Leak Attacks

AMD is seeking to downplay side-channel attacks that can leak potentially sensitive data from its processors released between 2011 and 2019. The “Take A Way” attack, so-called by researchers with the Graz University of Technology in a new analysis this weekend, is a side-channel attack...

9 Years of AMD Processors Vulnerable to 2 New Side-Channel Attacks

AMD processors from as early as 2011 to 2019 carry previously undisclosed vulnerabilities that open them to two new different side-channel attacks, according to a freshly published research. Known as "Take A Way," the new potential attack vectors leverage the L1 data L1D cache way predictor in...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2020-5560)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5560 advisory. 2.6.39-400.320.1 - rds: Avoid flushing MRs in rdsrdmadropkeys aru kolappan Orabug: 30650888 - media: b2c2-flexcop-usb: add sanity checking Oliver Neukum...

CVE-2019-10546

Buffer overflow can occur in WLAN firmware while parsing beacon/proberesponse frames during roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wire...

CVE-2019-10546

CVE-2019-10546 describes a buffer overflow in WLAN firmware when parsing beacon/probe_response frames during roaming on Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, and others including APQ8096/.. SXR2130). Affected hardware spans numerous Snapdragon SoCs, including IPQ/MDM/SDM fam...

PT-2020-9066

Name of the Vulnerable Software and Affected Versions Snapdragon Auto versions APQ8096 through SM8250 Snapdragon Compute versions APQ8096 through SM8250 Snapdragon Connectivity versions APQ8096 through SM8250 Snapdragon Consumer Electronics Connectivity versions APQ8096 through SM8250 Snapdragon...

Promise-probe Command Injection Vulnerability

Promise-probe is a probe module. A command injection vulnerability exists in promise-probe versions prior to 0.10.0. The vulnerability stems from a network system or product not properly filtering specific elements of externally entered data during the construction of executable commands. An...

CVE-2019-10791

promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization...

CVE-2019-10791

promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization...

CVE-2019-10791

The CVE-2019-10791 issue affects the Node.js module promise-probe. The root cause is lack of sanitization in the file, outputFile and options functions, enabling remote command injection when untrusted input is used. Public references from Red Hat, GHSA, OSV, and Snyk corroborate a severe impact ...

CVE-2019-10791: Improper Neutralization of Special Elements used in an OS Command

promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization...

PT-2020-9142

Name of the Vulnerable Software and Affected Versions promise-probe versions prior to 0.10.0 Description The issue allows remote attackers to perform a command injection attack. The file, outputFile, and options functions can be controlled by users without any sanitization. Recommendations For...

Buffer overflow

Buffer overflow in the auerswaldprobe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service via a crafted USB device, or take full control of the system...

A week in security (February 3 – 9)

Last week on Malwarebytes Labs, we looked at Washington state’s latest efforts in providing better data privacy rights for their residents, and we dove into some of the many questions regarding fintech: What is it? How secure is it? And what are some of the problems in the space? We also detailed...

CA Unified Infrastructure Management Nimsoft 7.80 - Remote Buffer Overflow

This module exploits a buffer overflow within the CA Unified Infrastructure Management nimcontroller. The vulnerability occurs in the robot controller component when sending a specially crafted directorylist probe. Technically speaking the target host must also be vulnerable to CVE-2020-8010 in...

Command Injection

Overview promise-probe is a FFprobe wrapper. Affected versions of this package are vulnerable to Command Injection via the ffprobefile and createMuteOggoutputFile, options functions. file,outputFile,options can be controlled by users without any sanitization PoC by JHU System Security Lab js var...

ffmpeg-promise-peaks (>=0.6.0, <=0.7.6) potentially affected by CVE-2019-10791 via promise-probe (0.1.12)

promise-probe NPM version 0.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on promise-probe and may be impacted: - ffmpeg-promise-peaks =0.6.0, =0.7.6 Source cves: CVE-2019-10791 Source advisory: SNYK:JS-PROMISEPROBE-546816...

PT-2020-6487 · FFmpeg +4 · Ffmpeg +4

Name of the Vulnerable Software and Affected Versions: ffmpeg versions prior to 4.3 Description: The issue is related to the tty demuxer in the FFmpeg library, which did not have a read probe function assigned to it. This can be exploited by crafting a legitimate "ffconcat" file that references a...

CVE-2020-7984: Cleartext Transmission of Sensitive Information

SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the...

PT-2020-19899

Name of the Vulnerable Software and Affected Versions SolarWinds N-central versions 12.1 before SP1 HF5 SolarWinds N-central versions 12.2 before SP1 HF2 Description The issue allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings and obtain other...