-
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in web support (07 Aug 2024)
Preface: CGI is a standard protocol that allows web servers to execute external programs or scripts, typically written in languages like Perl or Python, in response to client requests. Path Traversal: Exploiting lax file path validation, attackers navigate outside the intended directory, accessing restricted files or directories. Background: MLNX-OSis a next-generation switch operating system for…
-
About CVE-2024-7553: Improper Access Control in MongoDB (8th Aug 2024)
Preface: What Is a Document Database? A document-oriented database is a special type of key-value store where keys can only be strings. Moreover, the document is encoded using standards like JSON or related languages like XML. You can also store PDFs, image files, or text documents directly as values. Background: As a document database, MongoDB…
-
CVE-2024-1067 was released in May 2024. Are CVE-2024-2937 and CVE-2024-4607, released in August 2024, caused by similar design flaws? (7 Aug 2024)
Preface: May 2021 to May 2023 (ARM GPU evolution) Valhall 3rd Gen – On May 25, 2021, Arm announced their Valhall 3rd Gen GPU Architecture (as part of TCS21), including the Mali-G710, Mali-G510, and Mali-G310 GPUs. Valhall 4th Gen – On June 28, 2022, Arm announced their Valhall 4th Gen GPU Architecture (as part of…
-
About CVE-2024-21980, SNP firmware design weakness! (5th Aug 2024)
Preface: Confidential node pools use VMs with hardware-based Trusted Execution Environments (TEEs). AMD SEV-SNP Confidential VM denies hypervisor and other host management code access to VM memory and state, and adds defense-in-depth against operator access. Background: The SNP firmware may exist in two states: UNINIT and INIT. UNINIT – The platform is uninitialized. This is…
-
CVE-2024-3056 – About Podman (5th-Aug-2024)
-
RHSA-2024-4982 -Security Advisory- OpenShift API for Data Protection (OADP) – Security Fix – golang: net/netip – CVE-2024-24790 (2nd Aug 2024)
Preface: The IPv4-mapped IPv6 address format allows the IPv4 address of an IPv4 node to be represented as an IPv6 address. The IPv4 address is encoded into the low-order 32 bits of the IPv6 address, and the high-order 96 bits hold the fixed prefix 0:0:0:0:0:FFFF. Background: OpenShift API for Data Protection (OADP) enables you to…
-
CVE-2024-40782 – Nullptr crash due to `display:ruby block` and continuations. (1st Aug 2024)
Preface: Apple doesn’t allow third party developers to use any other browser engine other than the WebKit which is the engine developed by Apple. Background: The browser parses HTML into DOM and css into CSSOM and combines them to create a render tree. Once each node from the DOM has its style assigned, the rendering…
-
CVE-2024-33976: Check for correct values rank in UpperBound and LowerBound. (30th Jul 2024)
Preface: Segmentation faults (segfaults) are a common error that occurs when a program tries to access a restricted area of memory. Segfaults can occur for a wide variety of reasons: usage of uninitialized pointers, out-of-bounds memory accesses, memory leaks, buffer overflows, etc. Background: TensorFlow can be used to develop models for various tasks, including natural…
-
CVE-2024-40836: iOS allows running scripts from shortcuts but making protecting your data difficult! (July 29, 2024)
CVE-2024-40836: iOS allows running scripts from shortcuts but making protecting your data difficult! (July 29, 2024) Preface: A shortcut is usually implemented as a small file that contains the target URI or GUID of the object, or the name of the target program file that the shortcut represents. Shortcuts can also specify parameters to be…
-
Regarding CVE-2024-0108: The manufacturer did not describe much. Is the situation below exactly what CVE mentioned? (25/07/2024)
Preface: What is an example of autonomous AI? Autonomous intelligence is artificial intelligence (AI) that can act without human intervention, input, or direct supervision. It’s considered the most advanced type of artificial intelligence. Examples may include smart manufacturing robots, self-driving cars, or care robots for the elderly. Background: What is Jetson AGX Xavier used for? As…