ALPINE-CVE-2021-28701

Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2...

Security Bulletin: IBM Security Identity Manager deprecated Self Service UI contains Struts V1 (CVE-2016-1182)

Summary IBM Security Identity Manager made code changes to remove the deprecated function and its related Struts V1 code library. Vulnerability Details CVEID: CVE-2016-1182 DESCRIPTION: Apache Struts could allow a remote attacker to bypass security restrictions, caused by the failure to properly...

CVE-2021-38617: Undefined Security Weakness

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation...

PT-2021-22249

Name of the Vulnerable Software and Affected Versions Eigen NLP version 3.10.1 Description The issue is related to a lack of access control on the "/auth/v1/user/" endpoint, which allows a standard user to create a super user account with a defined password. This leads to privilege escalation...

PT-2021-22248

Name of the Vulnerable Software and Affected Versions Eigen NLP version 3.10.1 Description A lack of access control on the "/auth/v1/user/user-guid/" user edition endpoint could permit any logged-in user to increase their own permissions via a user permissions array in a PATCH request. A guest us...

CVE-2021-38615: Undefined Security Weakness

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user guest, standard, or admin to view and modify information...

CVE-2021-38312: Incorrect Authorization

The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The permissionscallback used in this file only checked f...

CVE-2021-36032: Improper Input Validation

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privile...

Security Bulletin: IBM Security Identity Manager Virtual Appliance deprecated Self Service UI contains Struts V1 (CVE-2016-1182)

Summary IBM Security Identity Manager Virtual Appliance made code changes to remove the deprecated function and its associated Struts V1 code library. Vulnerability Details CVEID: CVE-2016-1182 DESCRIPTION: Apache Struts could allow a remote attacker to bypass security restrictions, caused by the...

PT-2021-22252

Name of the Vulnerable Software and Affected Versions netless Agora Flat Server versions prior to 2021-07-30 Description The issue concerns the remove API in the netless Agora Flat Server, specifically in the file v1/controller/cloudStorage/alibabaCloud/remove/index.ts, which mishandles file...

CVE-2021-38621: Undefined Security Weakness

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership...

CVE-2021-36032

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privile...

PT-2021-21949

Name of the Vulnerable Software and Affected Versions: Planview Spigit version 4.5.3 Description: The issue allows remote unauthenticated attackers to query sensitive user accounts data. This is demonstrated by a request to the "api/v1/users/1" endpoint. Recommendations: For Planview Spigit versi...

CVE-2021-38095: Undefined Security Weakness

The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request...

Security Bulletin: CVE-2021-27568 An issue was discovered in netplex json-smart-v1, an exception is thrown from a function

Summary CVE-2021-27568 An issue was discovered in netplex json-smart-v1, an exception is thrown from a function, may cause programs to crash or expose sensitive info Vulnerability Details CVEID: CVE-2021-27568 DESCRIPTION: Netplex json-smart-v1 and json-smart-v2 are vulnerable to a denial of...

PT-2021-1524

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free flaw was found in the cgroup v1 parser, specifically in the cgroup1 parse param function in kernel/cgroup/cgroup-v1.c. This issue can be exploited by a local attacker wi...

Security Bulletin: Vulnerability found in Apache Log4j V1.x may affect IBM Enterprise Records

Summary IBM Enterprise Records may be affected by vulnerability found in Apache Log4j V1.x Vulnerability Details CVEID: CVE-2019-17571 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization of untrusted data in...

SUSE: Security Advisory (SUSE-SU-2019:14157-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2018:1368-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2018:1376-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...