CVE-2021-33088

Incorrect default permissions in the installer for the IntelR NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an authenticated user to potentially enable escalation of privilege via local access...

rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack

A flaw was found in rubygem-actionpack. Information disclosure or unintended method execution is possible when using the redirectto or polymorphicurl helper with untrusted user input. The highest threat from this vulnerability is to data confidentiality...

rails: Possible Denial of Service vulnerability in Action Dispatch

A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible Denial of Service vulnerability was found in the Mime type parser of Action Dispatch...

Security Bulletin: Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38984)

Summary Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager CVE-2021-38984. Vulnerability Details CVEID: CVE-2021-38984 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti...

Security Bulletin: Use of a one way hash without a salt in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38979)

Summary Use of a one way hash without a salt in IBM Security Guardium Key Lifecycle Manager CVE-2021-38979. Vulnerability Details CVEID: CVE-2021-38979 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a passwor...

Security Bulletin: Password stored in cleartext in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38976)

Summary Password stored in cleartext in IBM Security Guardium Key Lifecycle Manager CVE-2021-38976. Vulnerability Details CVEID: CVE-2021-38976 DESCRIPTION: IBM Tivoli Key Lifecycle Manager stores user credentials in plain clear text which can be read by a local user. CVSS Base score: 6.2 CVSS...

Security Bulletin: Missing cookie secure attribute in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38977)

Summary Missing cookie secure attribute in IBM Security Guardium Key Lifecycle Manager CVE-2021-38977. Vulnerability Details CVEID: CVE-2021-38977 DESCRIPTION: IBM Tivoli Key Lifecycle Manager does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to g...

Security Bulletin: Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38978)

Summary Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager CVE-2021-38978. Vulnerability Details CVEID: CVE-2021-38978 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow a remote attacker to obtain sensitive information, caused by the failure to...

Security Bulletin: Application error in IBM Security Guardium Key Lifecycle Manager 4.1.1 (CVE-2021-38981)

Summary Application error in IBM Security Guardium Key Lifecycle Manager 4.1.1 CVE-2021-38981. Vulnerability Details CVEID: CVE-2021-38981 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow a remote attacker to obtain sensitive information when a detailed technical error message is returne...

Security Bulletin: Cross-Site scripting in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38982)

Summary Cross-Site scripting in IBM Security Guardium Key Lifecycle Manager CVE-2021-38982. Vulnerability Details CVEID: CVE-2021-38982 DESCRIPTION: IBM Tivoli Key Lifecycle Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2021-34798 DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service, caused by a NULL pointer dereference in httpd core. By...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Strategic Supply Management Platform (CVE-2021-2438)

Summary An Oracle Database Server security vulnerability has been addressed in IBM Emptoris Strategic Supply Management Platform. Vulnerability Details CVEID: CVE-2021-2438 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Java VM component could allow an...

Intel NUC 授权问题漏洞

The Intel NUC is a small mini computer from Intel USA. An authorization issue vulnerability exists in the Intel NUC M15 Laptop Kit Management Engine driver pack, which stems from a default privilege management error in the product's installer. An attacker could use this vulnerability to cause a...

Microsoft Office 2013 Service Pack 1 RCE Vulnerability (KB5002038)

This host is missing an important security update according to Microsoft KB5002038 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Office 2013 Service Pack 1 Security Feature Bypass Vulnerability (KB5002035)

This host is missing an important security update according to Microsoft KB5002035 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Excel 2013 Service Pack 1 Multiple Vulnerabilities (KB5002072)

This host is missing an important security update according to Microsoft KB5002072 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Intel NUC 访问控制错误漏洞

The Intel NUC is a small mini computer from Intel USA. An Access Control Error vulnerability exists in the Intel NUC M15 Laptop Kit Keyboard LED Service driver pack, which stems from a default privilege management error in the product's installer. An attacker could use this vulnerability to cause...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to Information disclosure (CVE-2021-38887)

Summary An Information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2021-38887 DESCRIPTION: IBM InfoSphere Information Server could allow an authenticated user to obtain sensitive information from application response requests that...

Security Bulletin: A security vulnerability in PostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management.

Summary A security vulnerability in PostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management. Vulnerability Details CVEID: CVE-2021-32027 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an integer...

Security Bulletin: A security vulnerability in PostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management.

Summary A security vulnerability in PostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management. Vulnerability Details CVEID: CVE-2021-32028 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to obtain sensitive information, caused by a memory disclosure...