-
Why CVE-2025-53770 and CVE-2025-53771 do not affect SharePoint Online, even though they exploit how SharePoint processes serialized input in on-prem environments. (22-07-2025)
Preface: About a decade ago, a technical white paper evaluated how many cybersecurity experts a bank should hire to manage cybersecurity. Although Tier 1 financial institutions have information security controls in-house, their effectiveness cannot be compared to managed security services. The examples at the time were AWS cloud and cybersecurity controls. Now, the details of…
-
CVE-2023-4969 – Researchers from Trail of Bits reported a potential vulnerability, titled “LeftoverLocals.”, actually this GPU design weakness are fickle! (21-07-2025)
Preface: “LeftoverLocals” allows recovery of data from GPU local memory created by other processes on Apple, Qualcomm, AMD, and Imagination GPUs. LeftoverLocals affects the security posture of the entire GPU application, especially LLM and machine learning models running on affected GPU platforms. NVD published on January 16, 2024. So far, AMD appears to be the…
-
CVE-2025-23270: NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode (20th July 2025)
Preface: To enter UEFI Management mode on a Jetson device, you’ll typically need to access it during the boot process by pressing a specific key (like F2, F10, or Del) before the OS starts loading. Once in UEFI, you can configure settings related to booting, such as boot order and device selection. Background: CUDA is…
-
CVE-2025-23263: About NVIDIA DOCA-Host and Mellanox OFED (17th July 2025)
Preface: Mellanox OpenFabrics Enterprise Distribution for Linux (MLNX_OFED) is a software stack developed by NVIDIA (formerly Mellanox) that provides a tested and packaged version of the OpenFabrics Enterprise Distribution (OFED) for Mellanox network adapters. It enables high-performance networking capabilities, including RDMA and kernel bypass, for InfiniBand and Ethernet (RoCE) technologies. Background: NVIDIA introduced DOCA-OFED in…
-
CVE-2025-23266 and CVE-2025-23266: NVIDIA Container Toolkit design weakness (16-07-2025)
Preface: Docker Compose is a tool that makes it easier to define and manage multi-container Docker applications. It simplifies running interconnected services, such as a frontend, backend API, and database, by allowing them to be launched and controlled together. Docker Compose is a utility for defining and running multi-container Docker applications. Furthermore, Docker Compose responsible…
-
CVE-2025-53818: Command Injection in MCP Server github-kanban-mcp-server (15th July 2025)
Preface: Does it good when artificial Intelligence use Open Source software? Yes, using open-source software is generally considered a positive aspect for artificial intelligence development. It fosters collaboration, transparency, and faster innovation, while also potentially reducing costs and biases. However, it’s crucial to acknowledge potential risks like misuse and the need for responsible development practices.…
-
AMD-based AI systems combining AMD rocBLAS and Intel MKL can become fast supercomputer in the world (14-07-2025)
Preface: Supercomputers rely on math libraries to efficiently handle the complex numerical computations required for scientific simulations and modeling. These libraries provide optimized routines for linear algebra, numerical analysis, and other mathematical operations, enabling supercomputers to perform these calculations much faster than with general-purpose code. While math libraries are a crucial component, they are not…
-
CVE-2025-30403: A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. (13th Jul 2025)
Preface: mvfst (Pronounced move fast) is a client and server implementation of IETF QUIC protocol in C++ by Facebook. QUIC is a UDP based reliable, multiplexed transport protocol that will become an internet standard. Background: QUIC (Quick UDP Internet Connections), was designed with the primary goal of enhancing the speed and reliability of internet connections,…
-
Nvidia security focus – Rowhammer attack potential risk – July 2025 (11th July 2025)
Preface: The Rowhammer effect, a hardware vulnerability in DRAM chips, was first publicly presented and analyzed in June 2014 at the International Symposium on Computer Architecture (ISCA). This research, conducted by Yoongu Kim et al., demonstrated that repeatedly accessing a specific row in a DRAM chip can cause bit flips in nearby rows, potentially leading…
-
CVE-2025-32462 – Local Privilege Escalation via chroot option (10th July 2025)
Preface: Using LDAP to manage sudoers rules is becoming a more common practice, particularly in larger organizations. It offers several advantages over traditional methods of storing sudoers in a local file, including simplified management, improved scalability, and enhanced security. Background: Best Practices for Using sudo. This helps to minimize security risks associated with elevated privileges.…