9753 matches found
CVE-2021-40327
Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...
CVE-2021-40327
Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...
UBUNTU-CVE-2021-40327
Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...
CVE-2021-40327
Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...
CVE-2021-40327
Affected software: Trusted Firmware-M (TF-M) 1.4.0, specifically when using Profile Small. Vulnerability: Incorrect access control allows NSPE to access a secure key held by the Crypto service based solely on knowledge of the key ID; there is no authorization check governing the relationship betw...
Qnap QcalAgent 输入验证错误漏洞
Qnap QcalAgent is a time management center from China Weilian Technology Qnap. It is used to manage personal schedules, share calendars with others, and share each other's schedules. An input validation error vulnerability exists in QNAP QcalAgent that stems from not properly handling user input...
Jenkins 跨站请求伪造漏洞
Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . Jenkins has a cross-site request forgery vulnerability that stems from the WEB application not adequately verifying tha...
[WP-H9] Centralization Risk: Funds can be frozen when critical key holders lose access to their keys
Handle WatchPug Vulnerability details The current implementation requires trusted key holders isTrustedmsg.sender to send transactions initRedeemStable to initialize withdrawals from EthAnchor before the users can withdraw funds from the contract. This introduces a high centralization risk, which...
Parse CAs from UI Input
This plugin checks for data in from the Trusted CAs UI input, and stores the info if any in the KB TRUSTED...
CVE-2022-21672 /etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-ca
make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make-ca misinterprets Mozilla certdata.txt and treats explicitly untrusted certificates like trusted ones, causing those explicitly untrusted...
CVE-2021-40014
The bone voice ID trusted application TA has a heap overflow vulnerability. Successful exploitation of this vulnerability may affect data confidentiality...
CVE-2021-40014
The bone voice ID trusted application TA has a heap overflow vulnerability. Successful exploitation of this vulnerability may affect data confidentiality...
CVE-2021-38895
IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...
Cross site scripting
IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...
MediaWiki 跨站请求伪造漏洞
MediaWiki is a free, free-to-use web-based wiki engine from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems.A cross-site request forgery vulnerability exists in MediaWiki, which stems from a failure of the product's...
Krisp: Error Page Content Spoofing or Text Injection
Summary: Error Page Content Spoofing or Text Injection in two urls Target: https://download.prelive.krisp.ai/ Target:https://upld.prelive.krisp.ai/ Description: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user...
CVE-2021-38895
IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...
PT-2022-11136 · Unknown · Bone Voice Id Trusted Application
Name of the Vulnerable Software and Affected Versions: bone voice ID trusted application TA affected versions not specified Description: The bone voice ID trusted application TA has a heap overflow issue. Successful exploitation of this issue may affect data confidentiality. Recommendations: At t...
IBM Business Automation Workflow Cross-Site Scripting Vulnerability (CNVD-2022-14710)
IBM Business Automation Workflow is a suite of workflow automation solutions from IBM USA. The product is mainly used for workflow management, compliance management, and features workflow visibility and scalability. A cross-site scripting vulnerability exists in IBM Business Automation Workflow,...
UBUNTU-CVE-2021-38576
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system...