kernel: perf/x86/intel/lbr: Fix unchecked MSR access error on HSW

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/lbr: Fix unchecked MSR access error on HSW The fuzzer triggers the below trace. 7763.384369 unchecked MSR access error: WRMSR to 0x689 tried to write 0x1fffffff8101349e at rIP: 0xffffffff810704a4...

PT-2023-7394 · Intel · Intel Trace Analyzer/Collector

Name of the Vulnerable Software and Affected Versions: Intel Trace Analyzer and Collector versions prior to 2021.8.0 Description: The issue is related to an out-of-bounds write in the Intel Trace Analyzer and Collector software. This could potentially allow an authenticated user to escalate their...

PT-2023-7395 · Intel · Intel Trace Analyzer/Collector

Name of the Vulnerable Software and Affected Versions: IntelR Trace Analyzer and Collector versions prior to 2021.8.0 Description: The issue is related to a buffer overflow in memory, which may allow an attacker to escalate their privileges. This can be achieved through local access by an...

Intel® Trace Analyzer and Collector Software Advisory

Summary: Potential security vulnerabilities in some Intel® Trace Analyzer and Collector software may allow escalation of privilege or information disclosure. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-23569 Description:...

Vulnerabilities fixed in IBM MQ

IBM has fixed vulnerabilities in MQ. A malicious party could exploit the exploit the vulnerabilities to cause a Denial-of-Service, or to gain access to sensitive data. To access sensitive data, the malicious party must have access to a client where the Trace feature is enabled. IBM has released...

GHSA-MJV9-VP6W-3RC9 AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to...

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to...

CVE-2023-30610 AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

CVE-2023-30610

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The "awssigv4::SigningParams" struct had a derived "Debug" implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging...

RUSTSEC-2023-0125 Logs AWS credentials when TRACE-level logging is enabled

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

Logs AWS credentials when TRACE-level logging is enabled

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

CVE-2023-30610: Insertion of Sensitive Information into Log File

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

WildFly: possible information disclosure

A flaw was found in WildFly. This flaw allows an attacker to see deployment names, endpoints, and any other data the trace payload may contain...

PT-2023-3900 · Amazon · Aws-Sigv4

Name of the Vulnerable Software and Affected Versions: aws-sigv4 versions prior to 0.55.1 aws-sigv4 version 0.54.2 aws-sigv4 version 0.53.2 aws-sigv4 version 0.52.1 aws-sigv4 version 0.51.1 aws-sigv4 version 0.50.1 aws-sigv4 version 0.49.1 aws-sigv4 version 0.48.1 aws-sigv4 version 0.47.1 aws-sig...

Mozilla: Potential Memory Corruption following Garbage Collector compaction

The Mozilla Foundation Security Advisory describes this flaw as: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash...

Prototype Pollution

safe-eval is vulnerable to Prototype Pollution. The vulnerability exists in safeEval in index.js due to sandbox escaping which allows an attacker to access the host error objects during the generation of a stack trace...

CVE-2023-24402

creationtimestamp| type| source ---|---|--- 2023-04-07 12:27:47+00:00| seen| https://t.me/cibsecurity/61645...

WildFly: possible information disclosure

A flaw was found in WildFly. This flaw allows an attacker to see deployment names, endpoints, and any other data the trace payload may contain...

PT-2023-36677

Уязвимость функции remove instance модуля kernel/trace/trace.c поддержки трассировки ядра операционной системы Linux связана с повторным использованием ранее освобожденной памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

CVE-2023-27487

A flaw was found in envoy. The header x-envoy-original-path should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header could then be used for trace logs and grpc logs, used ...