CVE-2021-20580

IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery CSRF which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 198241...

IBM Business Process Manager and IBM Cloud Pak for Automation Cross-Site Scripting Vulnerability

IBM Business Process Manager BPM is a comprehensive business process management platform from IBM, U.S.A. IBM Cloud Pak for Automation is an intelligent software platform for building automation applications in cloud environments from IBM, U.S.A. IBM Cloud Pak for Automation is an intelligent...

CVE-2021-29775

IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-29775

IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

IBM Planning Analytics 跨站请求伪造漏洞

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. IBM Planning Analytics suffers from a cross-site request forgery vulnerability that stems from...

Basecamp: Error Page Content Spoofing or Text Injection

Target: https://gopher.hey.com/ Description: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle...

CVE-2021-29677

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Cross site scripting

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2021-29677

CVE-2021-29677 is an XSS vulnerability in IBM Security Verify Privilege Vault (10.9.66) where attackers can embed arbitrary JavaScript in the Web UI, potentially altering functionality and disclosing credentials within a trusted session. The root cause is a cross-site scripting flaw in the Privil...

CVE-2021-34394

Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an attacker to use the malicious CA that is run by the user to cause the buffer overflow, which may lead to information disclosure and data modification...

Integer overflow

Trusty the trusted OS produced by NVIDIA for Jetson devices driver contains a vulnerability in the NVIDIA OTE protocol message parsing code where an integer overflow in a malloc size calculation leads to a buffer overflow on the heap, which might result in information disclosure, escalation of...

NVIDIA OTE 代码问题漏洞

Nvidia NVIDIA OTE is a standalone, software-partitioned environment from Nvidia Corporation in the United States that provides Trusted Operations. The NVIDIA OTE suffers from a code issue vulnerability that stems from the fact that Trusty includes a vulnerability in all TAs where its deserializer...

Nvidia NVIDIA TLK 缓冲区错误漏洞

Nvidia NVIDIA TLK is a scheduler from Nvidia Corporation, USA, for use with Trusted Firmware-A TF-A. A security vulnerability exists in NVIDIA TLK, which stems from Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function, where a missing check allows exploitation of an integer...

Nvidia NVIDIA TLK 输入验证错误漏洞

Nvidia NVIDIA TLK is a scheduler from Nvidia Corporation of America that is used in conjunction with Trusted Firmware-A TF-A. NVIDIA TLK suffers from an Input Validation Error vulnerability that stems from Trusty TLK containing a vulnerability in the NVIDIA TLK kernel function, where a missing...

NVIDIA Jetson 缓冲区错误漏洞

Nvidia NVIDIA Jetson is an embedded system development module from Nvidia Corporation. NVIDIA Jetson has a security vulnerability that stems from Trusty includes a vulnerability in all Trusted Applications TAs where a stack cookie is not randomized, which could result in a stack-based buffer...

NVIDIA TLK 访问控制错误漏洞

Nvidia NVIDIA TLK is a scheduler from Nvidia Corporation of America for use with Trusted Firmware-A TF-A. The NVIDIA TLK suffers from an Access Control Error vulnerability that stems from the fact that the ARM® TrustZone technology, on which Trusty is based, contains a vulnerability in the access...

NVIDIA TLK 访问控制错误漏洞

Nvidia NVIDIA TLK is a scheduler from Nvidia Corporation of America that works with Trusted Firmware-A TF-A. NVIDIA TLK suffers from an Access Control Error vulnerability that stems from Trusty TLK including a vulnerability in its access rights settings that does not properly restrict access to...

Nvidia NVIDIA TLK 输入验证错误漏洞

Nvidia NVIDIA TLK is a scheduler from Nvidia Corporation of America for use with Trusted Firmware-A TF-A. NVIDIA TLK suffers from an Input Validation Error vulnerability that stems from Trusty TLK containing a vulnerability in the NVIDIA TLK kernel function, where a missing check allows...

PT-2021-3477 · Libtpms +1 · Libtpms +1

Name of the Vulnerable Software and Affected Versions: libtpms affected versions not specified Description: The issue is caused by an out-of-bounds access in memory due to a flaw in the libtpms library. This can be triggered by specially-crafted TPM 2 command packets containing illegal values. Th...

NVIDIA TLK 输入验证错误漏洞

Nvidia NVIDIA TLK is a scheduler from Nvidia Corporation of America that is used in conjunction with Trusted Firmware-A TF-A. NVIDIA TLK suffers from an input validation error vulnerability that stems from the fact that Trusty TLK contains a vulnerability in the NVIDIA TLK kernel, where an intege...