‼ CVE-2023-27482 ‼
📖 Read
via "National Vulnerability Database".
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.📖 Read
via "National Vulnerability Database".
🕴 40% of Global ICS Systems Attacked With Malware in 2022 🕴
📖 Read
via "Dark Reading".
Led by growth in Russia, more than 40% of global ICS systems faced malicious activity in the second half of 2022.📖 Read
via "Dark Reading".
Dark Reading
40% of Global ICS Systems Attacked With Malware in 2022
Led by growth in Russia, more than 40% of global ICS systems faced malicious activity in the second half of 2022.
‼ CVE-2023-26489 ‼
📖 Read
via "National Vulnerability Database".
wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined 33-bit effective address. This bug means that, with default codegen settings, a wasm-controlled load/store operation could read/write addresses up to 35 bits away from the base of linear memory. Due to this bug, however, addresses up to `0xffffffff * 8 + 0x7ffffffc = 36507222004 = ~34G` bytes away from the base of linear memory are possible from guest code. This means that the virtual memory 6G away from the base of linear memory up to ~34G away can be read/written by a malicious module. A guest module can, without the knowledge of the embedder, read/write memory in this region. The memory may belong to other WebAssembly instances when using the pooling allocator, for example. Affected embedders are recommended to analyze preexisting wasm modules to see if they're affected by the incorrect codegen rules and possibly correlate that with an anomalous number of traps during historical execution to locate possibly suspicious modules. The specific bug in Cranelift's x86_64 backend is that a WebAssembly address which is left-shifted by a constant amount from 1 to 3 will get folded into x86_64's addressing modes which perform shifts. For example `(i32.load (i32.shl (local.get 0) (i32.const 3)))` loads from the WebAssembly address `$local0 << 3`. When translated to Cranelift the `$local0 << 3` computation, a 32-bit value, is zero-extended to a 64-bit value and then added to the base address of linear memory. Cranelift would generate an instruction of the form `movl (%base, %local0, 8), %dst` which calculates `%base + %local0 << 3`. The bug here, however, is that the address computation happens with 64-bit values, where the `$local0 << 3` computation was supposed to be truncated to a a 32-bit value. This means that `%local0`, which can use up to 32-bits for an address, gets 3 extra bits of address space to be accessible via this `movl` instruction. The fix in Cranelift is to remove the erroneous lowering rules in the backend which handle these zero-extended expression. The above example is then translated to `movl %local0, %temp; shl $3, %temp; movl (%base, %temp), %dst` which correctly truncates the intermediate computation of `%local0 << 3` to 32-bits inside the `%temp` register which is then added to the `%base` value. Wasmtime version 4.0.1, 5.0.1, and 6.0.1 have been released and have all been patched to no longer contain the erroneous lowering rules. While updating Wasmtime is recommended, there are a number of possible workarounds that embedders can employ to mitigate this issue if updating is not possible. Note that none of these workarounds are on-by-default and require explicit configuration: 1. The `Config::static_memory_maximum_size(0)` option can be used to force all accesses to linear memory to be explicitly bounds-checked. This will perform a bounds check separately from the address-mode computation which correctly calculates the effective address of a load/store. Note that this can have a large impact on the execution performance of WebAssembly modules. 2. The `Config::static_memory_guard_size(1 << 36)` option can be used to greatly increase the guard pages placed after linear memory. This will guarantee that memory accesses up-to-34G away are guaranteed to be semantically correct by reserving unmapped memory for the instance. Note that this reserves a very large amount of virtual memory per-instances and can greatly reduce the maximum number of concurrent instances being run. 3. If using a non-x86_64 host is possible, then that will also work around this bug. This bug does not affect Wasmtime's or Cranelift's AArch64 backend, for example.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-24532 ‼
📖 Read
via "National Vulnerability Database".
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1278 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5. Affected by this issue is some unknown functionality of the file mobil/index.php. The manipulation of the argument accesstoken leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-222608.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1276 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222599.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1277 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222600.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46394 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r39p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23760 ‼
📖 Read
via "National Vulnerability Database".
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to versions 3.8 and was fixed in versions 3.7.7, 3.6.10, 3.5.14, and 3.4.17. This vulnerability was reported via the GitHub Bug Bounty program.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26956 ‼
📖 Read
via "National Vulnerability Database".
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27486 ‼
📖 Read
via "National Vulnerability Database".
xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanism to secure clusters in XCAT, it is possible for a local root user from one node to obtain credentials to SSH to any node in any zone, except the management node of the default zone. XCAT zones are not enabled by default. Only users that use the optional zone feature are impacted. All versions of xCAT prior to xCAT 2.16.5 are vulnerable. This problem has been fixed in xCAT 2.16.5. Users making use of zones should upgrade to 2.16.5. Users unable to upgrade may mitigate the issue by disabling zones or patching the management node with the fix contained in commit `85149c37f49`.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-24533 ‼
📖 Read
via "National Vulnerability Database".
Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this.📖 Read
via "National Vulnerability Database".
🕴 TSA Issues Urgent Directive to Make Aviation More Cyber Resilient 🕴
📖 Read
via "Dark Reading".
Will stricter cybersecurity requirements make flying safer? The TSA says yes, and sees it as a time-sensitive imperative.📖 Read
via "Dark Reading".
Dark Reading
TSA Issues Urgent Directive to Make Aviation More Cyber Resilient
Will stricter cybersecurity requirements make flying safer? The TSA says yes, and sees it as a time-sensitive imperative.
🕴 Edgeless Systems Raises $5M to Advance Confidential Computing 🕴
📖 Read
via "Dark Reading".
Confidential computing will revolutionize cloud security in the decade to come and has become a top C-level priority for industry leaders such as Google, Intel and Microsoft. Edgeless Systems is leading these advancements to ensure all data is always encrypted.📖 Read
via "Dark Reading".
Dark Reading
Edgeless Systems Raises $5M to Advance Confidential Computing
Confidential computing will revolutionize cloud security in the decade to come and has become a top C-level priority for industry leaders such as Google, Intel and Microsoft. Edgeless Systems is leading these advancements to ensure all data is always encrypted.
🕴 Emotet Resurfaces Yet Again After 3-Month Hiatus 🕴
📖 Read
via "Dark Reading".
More than two years after a major takedown by law enforcement, the threat group is once again proving just how impervious it is against disruption attempts.📖 Read
via "Dark Reading".
Dark Reading
Emotet Resurfaces Yet Again After 3-Month Hiatus
More than two years after a major takedown by law enforcement, the threat group is once again proving just how impervious it is against disruption attempts.
🕴 'Skinny' Cyber Insurance Policies Create Compliance Path 🕴
📖 Read
via "Dark Reading".
It's getting hard to buy cyber insurance, but not having it is not always an option. Low-coverage plans could bridge the gap.📖 Read
via "Dark Reading".
Dark Reading
'Skinny' Cyber-Insurance Policies Create Compliance Path
It's getting hard to buy cyber insurance, but not having it is not always an option. Low-coverage plans could bridge the gap.
‼ CVE-2023-24782 ‼
📖 Read
via "National Vulnerability Database".
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.📖 Read
via "National Vulnerability Database".
🤔1
‼ CVE-2023-1283 ‼
📖 Read
via "National Vulnerability Database".
Code Injection in GitHub repository builderio/qwik prior to 0.21.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22891 ‼
📖 Read
via "National Vulnerability Database".
There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords for other accounts.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22889 ‼
📖 Read
via "National Vulnerability Database".
SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to remote code execution by unauthenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27477 ‼
📖 Read
via "National Vulnerability Database".
wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.📖 Read
via "National Vulnerability Database".