9713 matches found
OESA-2022-1799 shim security update
Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments. Security Fixes: No description is available for this CVE.CVE-2022-28737...
SAMSUNG mTower 安全漏洞
SAMSUNG mTower is a new Trusted Execution Environment TEE from Samsung South Korea. A security vulnerability exists in SAMSUNG mTower version 0.3.0, which stems from the TEEPopulateTransientObject and uteefromattr functions that allow a trusted application to call the function...
The vulnerability of the LibreOffice office software package arises from improper verification of the certificate authenticity, allowing a perpetrator to execute arbitrary code.
The vulnerability of the LibreOffice office software package is related to incorrect verification of the certificate’s authenticity. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code by creating a certificate with a random serial number and an issuer...
Design/Logic Flaw
Rust-WebSocket is a WebSocket RFC6455 library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based...
CVE-2022-34161
IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 229331...
CVE-2022-32750
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...
Cross site scripting
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...
IBM DataPower Gateway 跨站脚本漏洞
IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and optimizes access across...
CVE-2022-31774
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...
[SECURITY] Fedora 36 Update: golang-github-theupdateframework-notary-0.7.0-7.fc36
The Notary project comprises a server and a client for running and interacting with trusted collections. See the service architecture documentation for more information. Notary aims to make the internet more secure by making it easy for people to publish and verify content. We often rely on TLS t...
CVE-2021-3601
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. OpenSSL does not class this issue as a security vulnerability. The trusted CA store should not contain anything that the user does not trust to issue other certificates. Notes:...
UBUNTU-CVE-2021-3601
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. OpenSSL does not class this issue as a security vulnerability. The trusted CA store should not contain anything that the user does not trust to issue other certificates. Notes:...
CVE-2021-3601
CVE-2021-3601 is rejected/not used; this CVE entry is not a security vulnerability per the description.
CVE-2021-3601
Removed by vendor...
IBM Security Verify Information Queue Cross-Site Request Forgery Vulnerability (CNVD-2022-54907)
IBM Security Verify Information Queue is an integration product from IBM USA. It utilizes Kafka technology and a publish/subscribe model to integrate data between IBM Security products. A cross-site request forgery vulnerability exists in IBM Security Verify Information Queue version 10.0.2, whic...
Synology Calendar Cross-Site Request Forgery Vulnerability
Synology Calendar, a file protection application running on Synology NAS devices from Synology, Taiwan, China, is vulnerable to cross-site request spoofing in versions prior to Synology Calendar 2.3.4-0631, which stems from a webapi component that does not adequately validate that the request is...
Vulnerabilities fixed in LibreOffice
The Document Foundation has fixed three vulnerabilities in LibreOffice. An unauthenticated remote malicious person could potentially exploit the vulnerabilities potentially exploit them to execute arbitrary macro code in the user's context, or to gain access to user passwords in the local passwor...
CVE-2022-1494
Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page...