CVE-2021-33767

Open Enclave SDK Elevation of Privilege Vulnerability...

Privilege escalation

Open Enclave SDK Elevation of Privilege Vulnerability...

CVE-2021-33767 Open Enclave SDK Elevation of Privilege Vulnerability

...

CVE-2021-33767

The CVE concerns Open Enclave SDK with an Elevation of Privilege vulnerability. Connected sources describe an issue of insecure privilege management in the Open Enclave SDK, enabling privilege escalation. Details about affected versions or a fix are not specified in the provided documents; one PT...

CVE-2021-24117

In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single...

CVE-2021-24117

In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single...

Code injection

In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single...

CVE-2021-24117

In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single...

CVE-2021-24117

CVE-2021-24117 affects Apache Teaclave Rust SGX SDK 1.1.3 and is caused by a side-channel vulnerability in base64 PEM file decoding that can be exploited in isolated environments running on Intel SGX. This allows system-level attackers to glean information about secret RSA keys via a controlled-c...

Microsoft OpenEnclave 权限许可和访问控制问题漏洞

Microsoft OpenEnclave is a software development kit from Microsoft Corporation USA. A vulnerability exists in microsoft OpenEnclave with privilege license and access control issues. The following products and versions are affected: Open Enclave SDK...

KLA12245 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Visual Studio Code can be...

Security Update for Microsoft Visual Studio Code .NET Education Bundle SDK Install Tool Extension (July 2021)

The Microsoft Visual Studio Code .NET Education Bundle SDK Install Tool Extension is prior to version 0.7.0. It is, therefore, affected by an elevation of privilege vulnerability due to inaccurately scoped permissions being set on downloaded .NET install scripts. Note that Nessus has not tested f...

Updated libupnp packages fix a security vulnerability

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp libupnp appears to be vulnerable to DNS rebinding attacks because it does not check the value of the 'Host' header. This can be mitigated by using DNS revolvers whic...

Security Bulletin: A security vulnerability has been identified in IBM Java SDK shipped with IBM InfoSphere Optim Performance Manager (CVE-2015-4872)

Summary IBM Java SKD is shipped as a component of IBM InfoSphere Optim Performance Manager. Information about a security vulnerability affecting IBM Java SDK has been published in a security bulletin. Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An unspecified vulnerability in Oracle...

Security Bulletin: Eclipse OpenJ9 jio_snprintf() and jio_vsnprintf() buffer overflow and

Summary In Eclipse OpenJ9, prior to the 0.12.0 release, the jiosnprintf and jiovsnprintf native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. These functions were not directly callable by non-native user code. And This...

Security Bulletin: IBM SDK, Java Technology Edition Version could allow a local authenticated attacker to execute arbitrary code on the system

Summary IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By...

Security Bulletin: Security vulnerabilities affecting IBM InfoSphere Optim Performance Manager (CVE-2015-1916, CVE-2015-0488)

Summary This advisory covers all the issues disclosed by Oracle in their April 2015 Critical Patch Update CPU, plus additional CVEs which are specific to the IBM JRE/SDK. Vulnerability Details CVE-2015-1916 Description: Server applications which use the IBM Java Secure Socket Extension provider t...

Security Bulletin: Eclipse OpenJ9 could allow a local attacker to gain elevated privileges on the system and Multiple binaries in IBM SDK, Java Technology Edition on the AIX platform use insecure absolute RPATHs CVE-2019-4473 and CVE-2019-11771

Summary Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984. Eclipse OpenJ9 could allow a local attacker to gain elevated privileges ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect InfoSphere Optim Performance Manager (CVE-2015-7575, CVE-2016-0475)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by InfoSphere Optim Performance Manager. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”. Vulnerability Detai...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect InfoSphere Optim Performance Manager (CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2016-5547, CVE-2016-2183)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by InfoSphere Optim Performance Manager. These issues were disclosed as part of the IBM Java SDK updates in January 2017. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An unspecified vulnerabili...