31 matches found
Silhouette
Silhouette By Gabriel Landau and Mark Mager at Elastic Security. From Hide Your Valuables — Mitigating Physical Credential Dumping Attacks presented at Shmoocon 2023. Slides here. Keeping LSA secrets out of physical memory Silhouette is a POC that mitigates the use of physical memory to dump...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: Fixed the issue where enabling Bluetooth fails again for QCA6390 after a warm reboot. The commit 272970be3dab “Bluetooth: hciqca: Fixed the driver shutdown issue when the serdev is closed” causes the following...
Malicious Package
Overview vsc-accountpage-clients is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
commandfrog (>=0.2.1, <=0.3.1), elasticlogger (2.4.0) +4 more potentially affected by CVE-2026-59890 via setuptools (53.1.0)
setuptools PYPI version 53.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - commandfrog =0.2.1, =0.8.0, =0.1.30, =0.20.1, =0.24.2 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...
MAL-2026-4530 Malicious code in cloudsmith-vsc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b49ad4432747f754181e7a8428aff5fd2613f9d86283f05a04c2dd1f9ac2f2f package.json declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js reads installer-side system...
Linux driver misc mei vsc-tp Heap Buffer Overflow DoS
The vulnerability in the drivers/misc/mei/vsc-tp.c component of the Linux operating system is related to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...
DEBIAN-CVE-2025-39711
In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing meicldevdisable calls Both the ACE and CSI driver are missing a meicldevdisable call in their remove function. This causes the meicl client to stay part of the meidevice-filelist...
UBUNTU-CVE-2025-39711
In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing meicldevdisable calls Both the ACE and CSI driver are missing a meicldevdisable call in their remove function. This causes the meicl client to stay part of the meidevice-filelist...
Linux Distros Unpatched Vulnerability : CVE-2025-37816
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fix fortify-panic caused by invalid countedby use gcc 15 honors the countedbylen...
CVE-2025-34123
A stack-based buffer overflow affecting VideoCharge Studio 2.12.3.685 is triggered while parsing a specially crafted .VSC configuration file. The root cause is improper handling of user-supplied data in the XML Name attribute, causing an SEH overwrite. This can allow arbitrary code execution unde...
CVE-2025-34123 VideoCharge Studio 2.12.3.685 SEH Buffer Overflow via .VSC File
A stack-based buffer overflow vulnerability exists in VideoCharge Studio 2.12.3.685 when processing a specially crafted .VSC configuration file. The issue occurs due to improper handling of user-supplied data in the XML 'Name' attribute, leading to an SEH overwrite condition. An attacker can...
CVE-2025-34123: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in VideoCharge Studio 2.12.3.685 when processing a specially crafted .VSC configuration file. The issue occurs due to improper handling of user-supplied data in the XML 'Name' attribute, leading to an SEH overwrite condition. An attacker can...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fixed the issue caused by invalid use of countedby GCC 15 recognizes the countedbylen attribute in vsctppacket.buf, and the vsc-tp.c code uses this attribute incorrectly. len does not contain the available size in the...
DEBIAN-CVE-2025-37816
In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fix fortify-panic caused by invalid countedby use gcc 15 honors the countedbylen attribute on vsctppacket.buf and the vsc-tp.c code is using this in a wrong way. len does not contain the available size in the buffer, it...
UBUNTU-CVE-2025-37816
In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fix fortify-panic caused by invalid countedby use gcc 15 honors the countedbylen attribute on vsctppacket.buf and the vsc-tp.c code is using this in a wrong way. len does not contain the available size in the buffer, it...
CVE-2025-37816: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fix fortify-panic caused by invalid countedby use gcc 15 honors the countedbylen attribute on vsctppacket.buf and the vsc-tp.c code is using this in a wrong way. len does not contain the available size in the buffer, it...
PT-2025-20345
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel. The issue is related to the use of the counted by function in the vsc-tp.c code, which is using the counted bylen attribute on vsc ...
SUSE CVE-2024-42137
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot Commit 272970be3dab "Bluetooth: hciqca: Fix driver shutdown on closed serdev" will cause below regression issue: BT can't be enabled after below steps: col...
Malicious code in vsc-config (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 c2ec1c70e372eda0ea5a9836df505e286be87f7259eb91e6b3d2fb81928dbcba Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2024-11747 Malicious code in vsc-accountpage-clients (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4a944a63a10d8227a08f1e886092063f618336d89a3dfe4600908830fa199b77 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...