Vulnerabilities fixed in IBM i2 Analyst's Notebook

Vulnerabilities have been fixed in the IBM i2 Analyst's Notebook. A malicious party could exploit the vulnerabilities to obtain system data and sensitive information. IBM has released updates to fix the vulnerabilities. For more information, see: https://www.ibm.com/support/pages/node/6474861...

Security Bulletin: IBM i2 Analyst's Notebook Premium has an information disclosure vulnerability (CVE-2021-29767)

Summary Excess information was disclosed in http requests from i2 Analist's Notebook Premium to the i2 Analyze server. Vulnerability Details CVEID: CVE-2021-29767 DESCRIPTION: IBM i2 Analyst's Notebook Premium could allow a remote attacker to obtain sensitive information when a detailed technical...

Security Bulletin: i2 Analyse and Analyst's Notebook Premium have hyperlink clicking vulnerability (CVE-2021-29770)

Summary IBM i2 Analyse and Analyst's Notebook Premium are vulnerable to malicious hyperlinks in certain data fields Vulnerability Details CVEID: CVE-2021-29770 DESCRIPTION: IBM i2 Analyst's Notebook Premium could allow an authenticated user to perform unauthorized actions due to hazardous input...

Security Bulletin: IBM Analyst's Notebook Premium uses a component with known vulnerabilities (CVE-2020-16013, CVE-2020-16009, CVE-2020-15999)

Summary IBM i2 Analyst's Notebook Premium uses a browser component version with known vulnerabilities. Vulnerability Details CVEID: CVE-2020-16013 DESCRIPTION: Google Chrome could allow a remote attacker to bypass security restrictions, caused by inappropriate implementation in V8. By persuading ...

Security Bulletin: IBM i2 Analyze and i2 Analyst's Notebook Premium has session handling vulnerability (CVE-2021-20431)

Summary i2 Analyze is subject to an auth token expiration vulnerability. Vulnerability Details CVEID: CVE-2021-20431 DESCRIPTION: IBM i2 Analyst's Notebook Premium does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. CVSS Base...

CVE-2021-29766

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202680...

IBM i2 Analysts Notebook Premium 安全漏洞

IBM i2 Analyst's Notebook Premium is a premium version of IBM i2 Analyst's Notebook from IBM USA. IBM i2 Analyst's Notebook Premium has an information disclosure vulnerability that could be exploited by an attacker to obtain sensitive information...

CVE-2021-20431

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342...

CVE-2021-29767

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202681...

IBM i2 Analysts Notebook Premium 安全漏洞

IBM i2 Analyst's Notebook Premium is a premium version of IBM i2 Analyst's Notebook from IBM of America. IBM i2 Analyst's Notebook Premium is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to obtain cookie values by listening to traffic...

CVE-2021-20430

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341...

IBM i2 Analysts Notebook Premium 代码问题漏洞

IBM i2 Analyst's Notebook Premium is a premium version of IBM i2 Analyst's Notebook from IBM USA. IBM i2 Analyst's Notebook Premium has an information disclosure vulnerability that could be exploited by an attacker to obtain sensitive information from the system...

CVE-2021-3614

A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage...

Design/Logic Flaw

A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage...

CVE-2021-3614

CVE-2021-3614 concerns Lenovo notebook BIOS: Condition: attacker with physical access can elevate privileges during a BIOS update performed via Lenovo Vantage on some Lenovo notebooks. Root cause hint in connected CNNVD entry suggests lack of authentication measures in the BIOS update process. Im...

CVE-2021-3614

A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage...

CVE-2021-32698

eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0...

CVE-2021-32698

eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0...

Cross site request forgery (csrf)

eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0...

CVE-2021-32698

CVE-2021-32698 affects the eLabFTW open source electronic lab notebook. The issue is a blind server-side request forgery (SSRF) that lets an attacker cause the server to issue GET requests on behalf of the server, without the attacker seeing the response. The vulnerability is mitigated by a patch...