Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Nov 14, 2023Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavCVE-2023-20592 · Other software · AMD · reported by psirt@amd.comMedium 6.5
Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023 A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a pCVE-2023-20575 · Other software · AMD · reported by psirt@amd.comMedium 6.5
A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially leading CVE-2023-20520 · Other software · AMD · reported by psirt@amd.comCritical 9.8
Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially leading to arbitrary code execution.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially rCVE-2022-27672 · Other software · AMD · reported by psirt@amd.comMedium 4.7
When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgamd.com
May 10, 2022Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integCVE-2021-26408 · Other software · AMD · reported by psirt@amd.comHigh 7.1
Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integrity or confidentiality.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code executionCVE-2021-26331 · Other software · AMD · reported by psirt@amd.comHigh 7.8
AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code execution.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.CVE-2021-26330 · Other software · AMD · reported by psirt@amd.comMedium 5.5
AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.CVE-2021-26321 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a denCVE-2021-26320 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification.CVE-2020-12954 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources.CVE-2021-26329 · Other software · AMD · reported by psirt@amd.comMedium 5.5
AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.CVE-2021-26322 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.