CVE-2021-20389

CVE-2021-20389 affects IBM Security Guardium 11.2, where user credentials are stored in plaintext on disk and readable by a local user. Root cause: credentials are stored in clear text, enabling local access to sensitive data. Impact: potential disclosure of credentials to anyone with local acces...

CVE-2021-20419

CVE-2021-20419 affects IBM Security Guardium 11.2. The described issue is weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information (CVE-2021-20419; IBM X-Force ID 196280). Affected products/versions include Guardium 11.2; IBM lists multipl...

CVE-2021-20386

CVE-2021-20386 affects IBM Security Guardium 11.2 Web UI and is described as a cross-site scripting vulnerability that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The provided documents substantiate the issue and i...

CVE-2021-20385

CVE-2021-20385 affects IBM Security Guardium 11.2, where a remote authenticated attacker could execute arbitrary commands via a specially crafted request. The primary sources confirm the vulnerability in Guardium and assign an IBM X-Force ID 195766, with a high impact indication in the CVSS metri...

CVE-2020-4990

CVE-2020-4990 affects IBM Security Guardium 11.2 (and 11.3). The vulnerability is an SQL injection in Guardium, allowing a remote attacker to view, add, modify, or delete data in the back-end database. The IBM bulletin states that Guardium has fixed this vulnerability, listing affected versions (...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2021-37192)

IBM Security Guardium is a comprehensive data protection solution that offers a full range of data security features from compliance support to dynamic data shielding. An information disclosure vulnerability exists in IBM Security Guardium version 11.2. An attacker could exploit this vulnerabilit...

Fuzzing iOS code on macOS at native speed

Or how iOS apps on macOS work under the hood Posted by Samuel Groß, Project Zero This short post explains how code compiled for iOS can be run natively on Apple Silicon Macs. With the introduction of Apple Silicon Macs, Apple also made it possible to run iOS apps natively on these Macs. This is...

Apple macOS 缓冲区错误漏洞

Apple macOS is a suite of specialized operating systems developed by Apple Inc. for Mac computers. A buffer error vulnerability exists in macOS due to a boundary condition within the CoreAudio component. The following products and versions are affected: macOS: 11.0 20A2411, 11.0.1 20B29, 11.0.1...

Apple Safari 资源管理错误漏洞

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. Safari suffers from a resource management error vulnerability that stems from improper resource management within Safari on macOS. The following products and versions a...

Apple macOS 缓冲区错误漏洞

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A buffer error vulnerability exists in macOS that originates from a boundary condition within the ImageIO component. The following products and versions are affected: macOS: 11.0 20A2411, 11.0.1 20B29, 11.0.1...

Security Bulletin: Db2 Query Management Facility is vulnerable to an unspecified vulnerability in Java SE - CVE-2020-2773

Summary An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecifie...

CVE-2021-1782

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a...

CVE-2021-1781

A privacy issue existed in the handling of Contact cards. This was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A malicious application may be able to leak sensiti...

CVE-2021-1737

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Processing a maliciously crafted image may lead to arbitrary code execution...

Cross site scripting

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution...

Input validation

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing maliciously crafted web content may lead to code executi...

Design/Logic Flaw

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause a denial of service...

Cross site scripting

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code...

Code injection

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to create or modify system files...

CVE-2021-1871

CVE-2021-1871 is a WebKit/WebKitGTK logic issue that could allow remote code execution. Public sources confirm the flaw affects multiple WebKit components and was fixed in macOS Big Sur 11.2, macOS Security Update 2021-001 for Catalina and Mojave, and iOS/iPadOS 14.4. Debian’s security advisory (...