Information disclosure

A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user with root or CAPNETADMIN when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected...

CVE-2021-20177

A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user with root or CAPNETADMIN when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected...

CVE-2021-20177

CVE-2021-20177: Linux kernel flaw in string matching for packets; a privileged user (root or CAP_NET_ADMIN) inserting iptables rules can trigger a kernel panic. Affected kernels before 5.5-rc1. Mitigation is to apply a patch/upstream fix (5.5-rc1 or newer).

CVE-2021-20487

IBM Power9 Self Boot EngineSBE could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process...

Acronis True Image Denial of Service Vulnerability

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. Acronis True Image 2020 version 24.5.22510 contains a denial of service vulnerability that stems from the program's logs being generated in a predictable pattern, allowing a non-privileged user to...

kernel: Integer overflow in Intel(R) Graphics Drivers

A flaw was found in the Linux kernel. An integer overflow in the firmware for some IntelR Graphics Drivers may allow a privileged user to potentially enable an escalation of privilege via local access. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

IBM Power9 Self Boot Engine(SBE) 数据伪造问题漏洞

The IBM Power9 Self Boot Engine is a chip from the American company IBM. A security vulnerability exists in the IBM Power9 Self Boot Engine SBE that could allow a user with appropriate privileges to inject malicious code and compromise the integrity of the host firmware through the host firmware...

Acronis True Image 安全漏洞

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. Acronis True Image 2020 version 24.5.22510 contains a denial of service vulnerability that stems from the program's logs being generated in a predictable pattern, allowing a non-privileged user to...

Dell EMC XtremIO Cross-Site Request Forgery Vulnerability

DELL Dell EMC XtremIO XMS is a suite of XtremIO Enterprise Storage Platform management software from Dell DELL in the United States. A cross-site request forgery vulnerability exists in Dell EMC XtremIO versions 6.3.3 through 6.3.8, which can be exploited by an unprivileged attacker who may be ab...

Security Bulletin: A vulnerability in IBM Spectrum Scale that could allow a local attacker which has access to the GUI pod can ssh to the core pods as a privileged user (CVE-2021-29708)

Summary A security vulnerability has been identified in IBM Spectrum Scale CNSA that could allow a local attacker which has access to the GUI pod can ssh to the core pods as a privileged user . A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2021-29708 DESCRIPTION: IBM...

CVE-2021-21549

Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this vulnerability, leading to a privileged victim application user being tricked into sending state-changing requests to the vulnerable...

Authorization

Dell Wyse Windows Embedded System versions WIE10 LTSC 2019 and earlier contain an improper authorization vulnerability. A local authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass the restricted environment and perform unauthorized actions on the...

CVE-2021-21549

Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this vulnerability, leading to a privileged victim application user being tricked into sending state-changing requests to the vulnerable...

Dell EMC XtremIO 跨站请求伪造漏洞

DELL Dell EMC XtremIO XMS is a suite of XtremIO Enterprise Storage Platform management software from Dell DELL in the United States. A cross-site request forgery vulnerability exists in Dell EMC XtremIO versions 6.3.3 through 6.3.8, which can be exploited by an unprivileged attacker who may be ab...

WordPress plugin authorization issue vulnerability (CNVD-2021-36535)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . WordPress plugin 2.9 prior to the version Login Protectio...

WordPress plugin authorization issue vulnerability (CNVD-2021-36536)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A vulnerability exists in the WordPress plugin before...

CVE-2021-31930

Persistent cross-site scripting XSS in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the...

Cross site scripting

Persistent cross-site scripting XSS in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the...

CVE-2021-31930

Persistent cross-site scripting XSS in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the...

An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.

...