CVE-2021-33092: Incorrect Default Permissions

Incorrect default permissions in the installer for the IntelR NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33094: Incorrect Permission Assignment for Critical Resource

Insecure inherited permissions in the installer for the IntelR NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33093: Incorrect Permission Assignment for Critical Resource

Insecure inherited permissions in the installer for the IntelR NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33087: Improper Authentication

Improper authentication in the installer for the IntelR NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticated user to potentially enable denial of service via local access...

rails: Possible Denial of Service vulnerability in Action Dispatch

A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible Denial of Service vulnerability was found in the Mime type parser of Action Dispatch...

rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack

A flaw was found in rubygem-actionpack. Information disclosure or unintended method execution is possible when using the redirectto or polymorphicurl helper with untrusted user input. The highest threat from this vulnerability is to data confidentiality...

Security Bulletin: Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38984)

Summary Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager CVE-2021-38984. Vulnerability Details CVEID: CVE-2021-38984 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti...

Security Bulletin: Use of a one way hash without a salt in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38979)

Summary Use of a one way hash without a salt in IBM Security Guardium Key Lifecycle Manager CVE-2021-38979. Vulnerability Details CVEID: CVE-2021-38979 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a passwor...

Security Bulletin: Password stored in cleartext in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38976)

Summary Password stored in cleartext in IBM Security Guardium Key Lifecycle Manager CVE-2021-38976. Vulnerability Details CVEID: CVE-2021-38976 DESCRIPTION: IBM Tivoli Key Lifecycle Manager stores user credentials in plain clear text which can be read by a local user. CVSS Base score: 6.2 CVSS...

Security Bulletin: Missing cookie secure attribute in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38977)

Summary Missing cookie secure attribute in IBM Security Guardium Key Lifecycle Manager CVE-2021-38977. Vulnerability Details CVEID: CVE-2021-38977 DESCRIPTION: IBM Tivoli Key Lifecycle Manager does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to g...

Security Bulletin: Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38978)

Summary Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager CVE-2021-38978. Vulnerability Details CVEID: CVE-2021-38978 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow a remote attacker to obtain sensitive information, caused by the failure to...

Security Bulletin: Application error in IBM Security Guardium Key Lifecycle Manager 4.1.1 (CVE-2021-38981)

Summary Application error in IBM Security Guardium Key Lifecycle Manager 4.1.1 CVE-2021-38981. Vulnerability Details CVEID: CVE-2021-38981 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow a remote attacker to obtain sensitive information when a detailed technical error message is returne...

Security Bulletin: Cross-Site scripting in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38982)

Summary Cross-Site scripting in IBM Security Guardium Key Lifecycle Manager CVE-2021-38982. Vulnerability Details CVEID: CVE-2021-38982 DESCRIPTION: IBM Tivoli Key Lifecycle Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2021-34798 DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service, caused by a NULL pointer dereference in httpd core. By...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Strategic Supply Management Platform (CVE-2021-2438)

Summary An Oracle Database Server security vulnerability has been addressed in IBM Emptoris Strategic Supply Management Platform. Vulnerability Details CVEID: CVE-2021-2438 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Java VM component could allow an...

Microsoft Excel 2013 Service Pack 1 Multiple Vulnerabilities (KB5002072)

This host is missing an important security update according to Microsoft KB5002072 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Office 2013 Service Pack 1 Security Feature Bypass Vulnerability (KB5002035)

This host is missing an important security update according to Microsoft KB5002035 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Intel NUC licensing issue vulnerabilities

The Intel NUC is a small mini computer from Intel USA. An authorization issue vulnerability exists in the Intel NUC M15 Laptop Kit Management Engine driver pack, which stems from a default privilege management error in the product's installer. An attacker could use this vulnerability to cause a...

Intel NUC Access Control Vulnerability

The Intel NUC is a small mini computer from Intel USA. An Access Control Error vulnerability exists in the Intel NUC M15 Laptop Kit Keyboard LED Service driver pack, which stems from a default privilege management error in the product's installer. An attacker could use this vulnerability to cause...

Microsoft Office 2013 Service Pack 1 RCE Vulnerability (KB5002038)

This host is missing an important security update according to Microsoft KB5002038 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...