Stan

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the KVM SEV subsystem where the `setup vmgexit scratch()` function allocates a buffer using `kvzalloc()` based on a guest-controlled variable `exit info 2`. The `snp begin psc()` function fails to validate the `end entry` variable against the actual buffer size, checking it only against a maximum constant. This allows a malicious SEV-SNP guest to trigger out-of-bounds (OOB) reads and writes in the host kernel heap memory (specifically `kmalloc-cg-32` slab objects). By manipulating `exit info 2` and the entry range (`cur entry`/`end entry`), an attacker can leak host heap layout information, corrupt host kernel heap memory, or trigger use-after-free conditions. This can be achieved by sending unlimited VMGEXIT requests to target different slab positions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Carinal Tien Hospital Health Report System (affected versions not specified) Description: The system's login page has improper authentication, allowing a remote attacker to acquire another user's privilege by modifying the `cookie` parameter without authentication. This enables the attacker to perform limited operations on the system, modify data, and make the service partially unavailable to the user. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.