-
CVE-2023-6200: A race condition was found in the Linux Kernel.(29th Jan 2024)
Preface:An essential race condition occurs when an input has two transitions in less than the total feedback propagation time. Background: ICMPv6 over the Internet is important for Path MTU Discovery (which uses the ICMPv6 Packet Too Big message) since ipv6 routers don’t fragment packets. ICMPv6 is an integral part of IPv6 and performs error reporting…
-
CVE-2023-33036: NULL Pointer Dereference in Hypervisor (26th Jan 2024)
This Qualcomm security bulletin was originally published on 1st January 2024. Preface: One method of conducting these PDoS attacks is commonly referred to as phlashing. During such an attack, an attacker bricks a device or destroys firmware, rendering the device or an entire system useless. This is one method to exploit vulnerabilities and replace a…
-
CVE-2024-23212: Apple Neural Engine design has weakness in memory handling. (25th January 2024)
This announcement was originally published on January 22nd 2024 Preface: Neural networks, also known as artificial neural networks (ANNs) or simulated neural networks (SNNs), are a subset of machine learning and are at the heart of deep learning algorithms. Recent advances in artificial intelligence systems, such as voice or facial recognition programs, have benefited from neural networks, densely interconnected…
-
CVE‑2023‑31037: Design weakness on NVIDIA Bluefield 2 and Bluefield 3 DPU BMC (Updated 01/22/2024)
Preface: Virtio-net device emulation enables users to create VirtIO-net emulated PCIe devices in the system where the NVIDIA® BlueField® DPU is connected. Background: The Intelligent Platform Management Interface (IPMI) is a standard interface for hardware management used by system administrators to control the devices and monitor the sensors. For these, it is necessary the IPMI…
-
CVE-2023-34063: A vulnerability was discovered in VMware Aria Automation and Cloud Foundation that affects unknown components. (23rd Jan 2024)
Preface: The missing function-level access control vulnerability refers to the flaws in the authorization logic. By exploiting it, an attacker, who could be an existing user of the application, is able to escalate privileges and access restricted functionalities. Background: VMware Aria Automation Orchestrator. (formerly vRealize Orchestrator). VMware Aria is an intelligent multi-cloud management solution that…
-
CVE-2023-6531: A use-after-free flaw was found in the Linux Kernel , fixed design weakness, attacker cannot relies on io_uring_get_socket() anymore (21st Jan 2024)
Preface: In my opinion, this design flaw is dangerous. But no worries, about a month ago. Vendors have issued remediations based on their priorities. CVE technical details were released today (21st Jan 2024). Background: io_uring is applicable to most businesses and applications with a demand for asynchronous I/O. As of now, io_uring has been integrated…
-
CVE-2024-21735: SAP LT Replication Server design weakness (included – version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108) 18th Jan 2024
Preface: The latest version of SAP Landscape Transformation Replication Server. It combines the latest SAP Landscape Transformation Replication Server functionality with the latest SAP Basis version for the best support of all uses cases involving SAP systems and databases. There are two options for using this version of SAP Landscape Transformation Replication Server (see also…
-
Oracle’s January 2024 Critical Patch Update Bulletin to remediate the related CVE-2023-44487 vulnerability in its product family (17th Jan 2024)
Preface: HTTP/2 Rapid Reset, based on stream multiplexing. HTTP/2 Rapid Reset attacks mostly affect the large infrastructure providers. Software smaller providers use, such as NGINX, Apache Server, ….etc Background: Oracle GraalVM is a high-performance JDK that can speed up the performance of Java and JVM-based applications using an alternative just-in-time (JIT) compiler. Vulnerability details: The…
-
Netscaler zero-days – CVE-2023-6548 and CVE-2023-6549 (16th Jan 2024)
Preface: NetScaler was initially developed in 1997 by Michel K Susai and acquired by Citrix Systems in 2005. What is the difference between NetScaler ADC and NetScaler gateway? NetScaler ADC is an application delivery controller. NetScaler Gateway (formerly Citrix Gateway) is an access gateway with SSL VPN solution, providing single sign-on (SSO) and authentication for…
-
LiDAR assists archaeologist discovered ruins found in upper Amazon rainforest (15th Jan 2024)
Preface: In ancient time of South America Tribal leaders would cover their bodies with gold powder and wash themselves in a holy lake in the mountains. For example, the famous place for ancient civilization execute this ceremony is Lake Titicaca. Priests and nobles would throw precious gold and emeralds into the lake dedicated to God.…