278 matches found
Design/Logic Flaw
Uncontrolled resource consumption for some IntelR SPS firmware before version SPSE506.01.04.002.0 may allow a privileged user to potentially enable denial of service via network access...
CVE-2023-29153
Intel SPS firmware CVE-2023-29153 affects Intel Server Platform Services prior to SPS_E5_06.01.04.002.0. The issue is uncontrolled resource consumption that may allow a privileged user to cause a denial of service over the network. CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/I:N/A:H (base score 4.9,...
CVE-2023-29153
Uncontrolled resource consumption for some IntelR SPS firmware before version SPSE506.01.04.002.0 may allow a privileged user to potentially enable denial of service via network access...
CVE-2023-29153
Uncontrolled resource consumption for some IntelR SPS firmware before version SPSE506.01.04.002.0 may allow a privileged user to potentially enable denial of service via network access...
Intel® SPS Firmware Advisory
Summary: A potential security vulnerability in some Intel® Server Platform Services SPS firmware may allow denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-29153 Description: Uncontrolled resource consumption f...
Cross-Site Scripting (XSS)
SPS Commerce is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to improper serialization of user inputs which allows an attacker to inject and execute malicious scripts...
Cross-site Scripting in @spscommerce/ds-react
Impact XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS. Patches The code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher Workarounds This is not...
GHSA-CFXH-FRX4-9GJG Cross-site Scripting in @spscommerce/ds-react
Impact XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS. Patches The code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher Workarounds This is not...
CVE-2023-28546
Memory Corruption in SPS Application while exporting public key in sorter TA...
Memory corruption
Memory Corruption in SPS Application while exporting public key in sorter TA...
CVE-2023-28546
CVE-2023-28546 corresponds to memory corruption in the SPS Application when exporting a public key in the sorter TA. The connected PT-2023-21794 entry confirms the issue is memory-corruption related with potential code execution, but it does not specify affected versions and provides no informati...
CVE-2023-28546 Buffer Copy Without Checking Size of Input in SPS Applications
Memory Corruption in SPS Application while exporting public key in sorter TA...
Qualcomm Chipsets Security Vulnerability
Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from a buffer copy in SPS Applications that does not check the input size...
@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError
Summary The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. Details It was noticed that in the validatePostRequestAsync flow in saml.js, the current timestamp is never checked. This could present a...
GHSA-VX8M-6FHW-PCCW @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError
Summary The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. Details It was noticed that in the validatePostRequestAsync flow in saml.js, the current timestamp is never checked. This could present a...
SUSE CVE-2022-48434
libavcodec/pthreadframe.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances e.g., hardware re-initialization upon a mid-video SPS change when...
The vulnerability of the sps.cc component in the h.265 Libde265 video codec implementation allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the sps.cc component in the h.265 video codec implementation by Libde265 is related to the insufficient use of the assert function. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and even cause service failures...
K59145983: Intel CSME and SPS vulnerability CVE-2019-0090
Security Advisory Description Insufficient access control vulnerability in subsystem for IntelR CSME before version 12.0.35, IntelR SPS before version SPSE305.00.04.027.0 may allow unauthenticated user to potentially enable escalation of privilege via physical access. CVE-2019-0090 Impact Traffix...
K30105730: Intel SPS vulnerability CVE-2019-0099
Security Advisory Description Insufficient access control vulnerability in subsystem in IntelR SPS before version SPSE305.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access. CVE-2019-0099 Impact Traffix SDC An attacker with physical...
K32412503: Trusted Platform Module vulnerabilities CVE-2019-11090 and CVE-2019-16863
Security Advisory Description CVE-2019-11090 Cryptographic timing conditions in the subsystem for IntelR PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; IntelR TXE 3.1.70 and 4.0.20; IntelR SPS before versions SPSE504.01.04.305.0, SPSSoC-X04.00.04.108.0,...