CVE-2021-32740

A resource-consumption vulnerability was found in rubygem addressable, where its URI template implementation could allow an attacker's crafted template to consume resources, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Mitigation Create...

CVE-2021-32740

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted templat...

The vulnerability of the libtpms library arises from a transaction that occurs outside of the buffer in memory, allowing an attacker to trigger an emergency system shutdown or cause a service failure.

The vulnerability of the libtpms library arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a perpetrator to cause the system to terminate abnormally or trigger a service failure using a specially crafted TPM 2 package...

CVE-2020-4935

IBM Datacap Fastdoc Capture IBM Datacap Navigator 9.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2020-4935

IBM Datacap Fastdoc Capture IBM Datacap Navigator 9.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Cross site scripting

IBM Datacap Fastdoc Capture IBM Datacap Navigator 9.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Archlinux libtpms 缓冲区错误漏洞

Archlinux libtpms is an Archlinux open source application. A library that provides software emulation of Trusted Platform Modules TPM 1.2 and TPM 2.0. A buffer error vulnerability exists in Archlinux libtpms that stems from a boundary condition. A local user can trigger an out-of-range read error...

CVE-2021-34373

Trusty trusted Linux kernel TLK contains a vulnerability in the NVIDIA TLK kernel where a lack of heap hardening could cause heap overflows, which might lead to information disclosure and denial of service...

CVE-2021-34375

Trusty contains a vulnerability in all trusted applications TAs where the stack cookie was not randomized, which might result in stack-based buffer overflow, leading to denial of service, escalation of privileges, and information disclosure...

CVE-2021-34373

Trusty trusted Linux kernel TLK contains a vulnerability in the NVIDIA TLK kernel where a lack of heap hardening could cause heap overflows, which might lead to information disclosure and denial of service...

CVE-2021-34373

CVE-2021-34373 affects NVIDIA’s Trusty TLK (Jetson TLK kernel) used in Jetson TX1/TX2/Xavier series; root cause is lack of heap hardening leading to heap overflows in the TLK kernel, enabling information disclosure and denial of service. NVIDIA’s security bulletin notes the vulnerability in the T...

CVE-2021-20477

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949...

CVE-2021-20477

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949...

CVE-2021-20580

IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery CSRF which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 198241...

IBM Business Process Manager and IBM Cloud Pak for Automation Cross-Site Scripting Vulnerability

IBM Business Process Manager BPM is a comprehensive business process management platform from IBM, U.S.A. IBM Cloud Pak for Automation is an intelligent software platform for building automation applications in cloud environments from IBM, U.S.A. IBM Cloud Pak for Automation is an intelligent...

CVE-2021-29775

IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-29775

IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

IBM Planning Analytics 跨站请求伪造漏洞

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. IBM Planning Analytics suffers from a cross-site request forgery vulnerability that stems from...

Basecamp: Error Page Content Spoofing or Text Injection

Target: https://gopher.hey.com/ Description: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle...

CVE-2021-29677

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...