The vulnerability of the IWA (Integrated Windows Authentication) mechanism in software for managing virtual infrastructure such as VMware vCenter Server and VMware Cloud Foundation allows a perpetrator to escalate their privileges.

The vulnerability of the IWA Integrated Windows Authentication implementation in VMware vCenter Server and VMware Cloud Foundation software relates to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

USN-5165-1 linux-oem-5.14 vulnerabilities

It was discovered that the NFC subsystem in the Linux kernel contained a use-after-free vulnerability in its NFC Controller Interface NCI implementation. A local attacker could possibly use this to cause a denial of service system crash or execute arbitrary code. CVE-2021-3760 It was discovered...

[SECURITY] Fedora 34 Update: remmina-1.4.21-1.fc34

Remmina is a remote desktop client written in GTK+, aiming to be useful for system administrators and travelers, who need to work with lots of remote computers in front of either large monitors or tiny net-books. Remmina supports multiple network protocols in an integrated and consistent user...

[SECURITY] Fedora 35 Update: freeipa-4.9.7-4.fc35

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

Microsoft unpacks comprehensive security at Gartner and Forrester virtual events

Every day, Microsoft is committed to maintaining comprehensive security for all across our interconnected global community. With that purpose in mind, we recently sponsored the 2021 Gartner Security and Risk Summit and 2021 Forester Security and Risk Forum, where we discussed ongoing changes in t...

PT-2021-20040

Name of the Vulnerable Software and Affected Versions IntelR NUC M15 Laptop Kit Integrated Sensor Hub driver pack versions prior to 5.4.1.4449 Description The issue is related to incorrect default permissions in the installer for the IntelR NUC M15 Laptop Kit Integrated Sensor Hub driver pack. Th...

CVE-2021-33088: Incorrect Default Permissions

Incorrect default permissions in the installer for the IntelR NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-12954

A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification...

CVE-2020-12954

A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification...

CVE-2020-12954

CVE-2020-12954 relates to an AMD Platform Security Processor (ASP) boot loader header where improper input and range validation can allow attacker-controlled values before signature verification, potentially enabling arbitrary code execution and bypassing SPI ROM protections to modify SPI ROM. Th...

IBM System x servers operating system command injection vulnerability

IBM System x servers are a server from International Business Machines Corporation IBM, and an operating system command injection vulnerability exists in the Integrated Management Module IMM of IBM System x 3550 M3 and IBM System x 3650 M3 servers, which could be exploited by an attacker to execu...

CVE-2021-3723

A command injection vulnerability was reported in the Integrated Management Module IMM of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet session...

OESA-2021-1429 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: An improper validation of an array index and out of bounds memory read in the Linux kernel s Integrated Services Digital Network ISDN functionality was found in the way users call ioctl CMTPCONNADD. A local user could use this fl...

IBM System x servers 操作系统命令注入漏洞

IBM System x servers are a server from International Business Machines Corporation IBM, and an operating system command injection vulnerability exists in the Integrated Management Module IMM of IBM System x 3550 M3 and IBM System x 3650 M3 servers, which could be exploited by an attacker to execu...

CVE-2021-3723: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability was reported in the Integrated Management Module IMM of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet session...

Vulnerability fixed in VMware vCenter and Cloud Foundation

VMware has fixed a vulnerability in vCenter Server and Cloud Foundation. An authenticated malicious party could, by exploiting this vulnerability obtain elevated privileges on the vulnerable system. The vulnerability is located in the Integrated Windows Authentication IWA authentication mechanism...

CVE-2021-22048

The vCenter Server contains a privilege escalation vulnerability in the IWA Integrated Windows Authentication authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group...

VMware vCenter Server updates address a privilege escalation vulnerability (CVE-2021-22048)

3. VMware vCenter Server IWA privilege escalation vulnerability CVE-2021-22048 The vCenter Server contains a privilege escalation vulnerability in the IWA Integrated Windows Authentication authentication mechanism. VMware has evaluated the severity of this issue to be in the Important severity...

PT-2021-4966

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions affected versions not specified VMware Cloud Foundation versions affected versions not specified Description The issue is related to a privilege escalation vulnerability in the IWA Integrated Windows Authenticati...

Microsoft Visual Studio Elevation of Privilege Vulnerability (CNVD-2021-94901)

Microsoft Visual Studio is an integrated development environment for developing computer programs, websites, web applications, web services, and mobile applications. an elevation of privilege vulnerability exists in Microsoft Visual Studio. An attacker could exploit this vulnerability to elevate...