PT-2022-9757 · Amd · Amd Secure Processor

Name of the Vulnerable Software and Affected Versions: AMD Secure Processor ASP affected versions not specified Description: The issue is related to insufficient memory cleanup in the AMD Secure Processor ASP Trusted Execution Environment TEE. This may allow an authenticated attacker with...

AMD Secure Processor 安全漏洞

AMD Secure Processor ASP is a standalone ARM Coretex-A5 chip from UltraMicroelectronics AMD. A security vulnerability exists in AMD Secure Processor ASP that stems from inadequate memory cleanup in the Trusted Execution Environment TEE, which could allow an authenticated attacker to have the...

AMD Radeon 安全漏洞

AMD Radeon is a device driver and utility software package for Advanced Micro Devices graphics cards and GPUs from UltraMicro Semiconductor AMD. A security vulnerability exists in AMD Radeon that stems from insufficient validation of multiple header signatures when loading a trusted application T...

PT-2022-9755 · Amd · Amd Radeon Rx 5000 Series & Pro W5000 Series +15

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to insufficient verification of multiple header signatures while loading a Trusted Application TA, which may allow an attacker with...

PT-2022-9756 · Amd · Amd Radeon Rx 5000 Series & Pro W5000 Series +66

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to insufficient verification of a missing size check in the 'LoadModule' function, which may lead to an out-of-bounds write. This...

CVE-2021-26393

Insufficient memory cleanup in the AMD Secure Processor ASP Trusted Execution Environment TEE may allow an authenticated attacker with privileges to generate a valid signed TA and potentially poison the contents of the process memory with attacker controlled data resulting in a loss of...

nodejs: Improper handling of URI Subject Alternative Names

A flaw was found in node.js where it accepted a certificate's Subject Alternative Names SAN entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host...

IBM InfoSphere Information Server Cross-Site Request Forgery Vulnerability

IBM InfoSphere Information Server is a data integration platform from International Business Machines Corporation IBM. IBM InfoSphere Information Server version 11.7 contains a cross-site request forgery CSRF vulnerability that could be exploited by an attacker to perform malicious and unauthoriz...

kernel security, bug fix, and enhancement update

5.14.0-70.30.1.0.10.OL9 - lockdown: also lock down previous kgdb use Daniel Thompson Orabug: 34290418 CVE-2022-21499 5.14.0-70.30.10.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted...

Cross site scripting

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."...

CVE-2022-30615

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592...

CVE-2022-35642

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."...

Cannot complete your request on Gateway URL after adding new domain to trusted domains

After adding a trusted domain to Storefront. when you go to "Manage Authentication Methods", click on the settings, click on "Configure trusted Domains" and add new domains, when users try to go to the gateway URL, you may get either "Login Expired" or "Cannot Complete your Request|" error messag...

CVE-2022-3786

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate...

CISA Upgrades to TLP 2.0

Today, CISA officially upgraded to Traffic Light Protocol TLP 2.0, which facilitates greater information sharing and collaboration. CISA made this upgrade in accordance with the recommendation from the Forum of Incident Response and Security Teams to upgrade to TLP 2.0 by January 2023. Key TLP 2....

CVE-2022-3512

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

CVE-2022-3512

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

CVE-2022-3512

CVE-2022-3512 affects Cloudflare WARP by allowing a user to disconnect the WARP client and bypass the Lock WARP switch using the warp-cli add-trusted-ssid command, enabling Zero Trust policies not to be enforced on the endpoint. The available sources consistently describe the bypass vector and it...

CVE-2022-3512 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

CVE-2022-3512

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...