-
AMD Fixed CVE-2024-21969 (23rd June 2025)
CVE-2024-21969: Whispering Pixels: Exploiting Uninitialized Register Accesses in Modern GPUs. Preface: How to Enable Secure GPU Mode (Register Clearing) Background: The proliferation of graphics processing units (GPUs) has brought unprecedented computing power. Multiple register-based vulnerabilities found across different GPU implementations. So-called whisper pixels. The vulnerability poses unique challenges to an adversary due to opaque scheduling…
-
About Veeam Backup (CVE-2025-23120 and CVE-2025-23121) – 23-06-2025
CVE-2025-23121 NVD Published Date: 06/18/2025 NVD Last Modified: 06/18/2025 Preface: Veeam introduced a custom serialization formatter to protect against unsafe deserialization vulnerabilities (see below): -They override the default .NET deserialization behavior. -They validate or restrict which types can be deserialized. -This is a security hardening measure to prevent attackers from exploiting deserialization to execute arbitrary…
-
CVE-2025-52556: Insufficient verification of timestamp response signatures. Users should immediately upgrade to rfc3161-client 1.0.3 or later. (23-06-2025)
Preface: rfc3161-client version 1.0.3 is not designed to be installed on the server side. It’s a Python library, specifically a client-side tool, for interacting with RFC 3161 Time-Stamp Protocol (TSP) servers. It’s used to create timestamp requests and process timestamp responses, which is a client-side function of interacting with a time-stamping authority. Background: The primary…
-
CVE-2025-44952: About Open5GS (19-6-2025)
Preface: Open5GS is a popular open-source 5G core network (5GC) implementation, particularly among researchers and those building private 5G networks. It’s recognized as one of the leading open-source 5GC projects. Open5GS is known for its adherence to 3GPP standards and its mature development, making it suitable for various applications like testbeds, research, and even some…
-
CVE-2025-23252 – NVIDIA has released a software update for NVIDIA® NVDebug tool to address the security issue.(18-06-2025)
Preface: The NVdebug tool, used for NVIDIA GPU debugging, relies on the NVIDIA Data Center GPU Manager (DCGM) library. Specifically, it utilizes DCGM version 2.2.x or later. DCGM is a suite of tools for managing and monitoring NVIDIA GPUs in data center and cluster environments. Background: The NV Debug Tool is part of the NVIDIA…
-
CVE-2025-6087: About @opennextjs/cloudflare package (16-6-2025)
Preface: Next.js is a powerful React framework that simplifies web development by providing features like server-side rendering (SSR), static site generation (SSG), and API routes, all while offering built-in optimizations and a great developer experience. It’s essentially a framework built on top of React, adding extra functionality to create high-performance, SEO-friendly web applications. Background: The…
-
CVE-2024-55567: A vulnerability in the UsbCoreDxe driver of the InsydeH2O UEFI firmware, specifically due to improper input validation. (16-6-2025)
NVD Published Date: 06/12/2025 NVD Last Modified: 06/12/2025 Preface: InsydeH2O is a UEFI firmware developed by Insyde Software, used in a wide range of devices from servers to AI PCs. It’s known for its modular architecture, which allows for flexibility and faster development cycles. The kernel likely refers to the core components of this firmware,…
-
CVE-2025-41234: In specifics condition, Spring Framework vulnerable to reflected file download (RFD) attack. (16-06-2025)
Preface: The Spring Framework is a popular, open-source, Java-based framework that simplifies enterprise application development by providing a comprehensive set of tools and libraries for building robust, scalable, and maintainable applications. It’s known for its core features like dependency injection (DI) and aspect-oriented programming (AOP), and it offers support for various technologies like JDBC, Hibernate,…
-
CVE-2025-36852: “first-to-cache wins” jeopardizes Bucket-based object storage! (12th June 2025)
Preface: Cloud service providers use “first-to-cache wins” (also known as “cache hit”) for improved performance and efficiency. By caching frequently accessed data, they can quickly retrieve it without needing to access the slower underlying storage layer. This reduces latency, enhances user experience, and can also lower costs associated with accessing and processing data. Background: In…
-
CVE-2025-2884 – Design weakness in the Trusted Platform Module (TPM) 2.0 reference implementation code. (11th June 2025)
Preface: The main difference between AMD’s Trusted Platform Module (TPM) and those from other manufacturers , how it’s implemented: AMD offers a firmware TPM (fTPM), while many other manufacturers, including Intel, also offer a dedicated hardware TPM (dTPM). Background: TPM refers to a Trusted Platform Module, which is a specialized chip that securely stores cryptographic…