The vulnerability of Microprogramming Software: Intel Converged Security and Manageability Engine (CSME), Intel Trusted Execution Engine (TXE), and Intel Dynamic Application Loader (DAL) arises from insufficient session verification, allowing attackers to exploit their privileges.

The vulnerability of the Intel Active Management Technology AMT implementation of the Intel Converged Security and Manageability Engine CSME software is related to insufficient session verification. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of Microprogramming Software: Intel Converged Security and Manageability Engine (CSME) and Intel Trusted Execution Engine (TXE) arises from insufficient validation of input data. This allows attackers to disclose sensitive information, escalate their privileges, or cause service interruptions.

The vulnerability of Microprogrammed Software-Based Intel Converged Security and Manageability Engine CSME and Intel Trusted Execution Engine TXE is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to disclose sensitive information, enhance their...

Cross site scripting

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.16 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

CVE-2019-4569

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.16 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

CVE-2019-4569

IBM Tivoli Netcool Impact 7.1.0.0–7.1.0.16 is affected by a stored cross-site scripting vulnerability in the operator view/web UI. The issue enables an attacker to embed arbitrary JavaScript, potentially altering functionality and exposing credentials within a trusted session. IBM’s advisory list...

kernel security update

4.18.0-147.0.31.OL8 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 4.18.0-147.0.31 - drm drm/i915/cmdparser: Fix jump whitelist clearing Dave...

Design/Logic Flaw

Use after free issue in cleanup routine due to missing pointer sanitization for a failed start of a trusted application. in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845,...

CVE-2019-2329

CVE-2019-2329 is a use-after-free issue in the cleanup routine caused by missing pointer sanitization after a failed start of a trusted application. Affected are Qualcomm Snapdragon platforms: Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, and Snapdrago...

Cobbler Cross-Site Request Forgery Vulnerability (CNVD-2019-42585)

Cobbler is a network installation server suite for quickly setting up a Linux network installation environment. A cross-site request forgery vulnerability exists in Cobbler that stems from a WEB application that does not adequately validate that a request is coming from a trusted user, which can ...

XML External Entities (XXE)

nifi-lookup-services is vulnerable to XML external entities XXE. The vulnerability exists as the XMLFileLookupService allowed trusted users to use a malicious XML file to cause information such as the versions of Java, Jersey, and Apache to be revealed...

Information disclosure

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE and reveal information such as the versions of Java, Jersey, and Apache that the NiFI...

CVE-2019-10080

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE and reveal information such as the versions of Java, Jersey, and Apache that the NiFI...

Lenovo LenovoPaper CVE-2019-6191 Unspecified Local Privilege Escalation Vulnerability

Description Lenovo LenovoPaper software is prone to an unspecified local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges. Technologies Affected Lenovo LenovoPaper Recommendations Permit local access for trusted individuals only. Where possibl...

Multiple Qualcomm Products Resource Management Error Vulnerability (CNVD-2020-16066)

Qualcomm MDM9205 and others are products of Qualcomm Incorporated USA.MDM9205 is a central processing unit CPU product. The QCS404 is a central processing unit CPU product.The SDX55 is a modem. A resource management error vulnerability exists in QTEE in multiple Qualcomm products. The vulnerabili...

CVE-2014-5118

Trusted Boot tboot before 1.8.2 has a 'loader.c' Security Bypass Vulnerability...

Security feature bypass

Trusted Boot tboot before 1.8.2 has a 'loader.c' Security Bypass Vulnerability...

CVE-2014-5118

Trusted Boot tboot before 1.8.2 has a 'loader.c' Security Bypass Vulnerability...

CVE-2014-5118

Trusted Boot tboot before 1.8.2 has a 'loader.c' Security Bypass Vulnerability...

CVE-2014-5118

CVE-2014-5118 concerns a security bypass in Trusted Boot (tboot) prior to version 1.8.2, specifically a bypass in the loader.c component that undermines the measured boot mechanism. Multiple connected documents confirm the issue and document remediation efforts; SUSE advisories (SUSE-SU-2017:3114...

CVE-2019-18651

A cross-site request forgery CSRF vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions e.g., delete application users by sending a crafted HTML document or encoded URL to a user that the website trusts. The user...