CVSS: 9.1EPSS: 0%CPEs: 17EXPL: 0CVE-2021-4048 – lapack: Out-of-bounds read in *larrv
https://notcve.org/view.php?id=CVE-2021-4048
08 Dec 2021 — An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory. Se ha encontrado un fallo de lectura fuera de límites en las funciones CLARRV, DLARRV, SLARRV y ZLARRV de lapack versiones hasta 3.10.0, usadas también en OpenBLAS versiones anteriores a 0.3.18. L... • https://github.com/JuliaLang/julia/issues/42415 • CWE-125: Out-of-bounds Read •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2021-38911
https://notcve.org/view.php?id=CVE-2021-38911
19 Oct 2021 — IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940. IBM Security Risk Manager on CP4S versión 1.7.0.0, almacena las credenciales de usuarios en texto sin cifrar que puede ser leído por un usuario privilegiado autenticado. IBM X-Force ID: 209940 • https://exchange.xforce.ibmcloud.com/vulnerabilities/209940 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29912
https://notcve.org/view.php?id=CVE-2021-29912
19 Oct 2021 — IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828. IBM Security Risk Manager on CP4S versión 1.7.0.0, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web... • https://exchange.xforce.ibmcloud.com/vulnerabilities/207828 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3442 – RHOAM: XSS in 3scale at various places
https://notcve.org/view.php?id=CVE-2021-3442
14 Oct 2021 — A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text boxes leading to a XSS attack. The highest threat from this vulnerability is to data confidentiality. Se ha encontrado un fallo en el producto Red Hat OpenShift API Management. Las entradas del usuario no son comprobadas, lo que permite a un usuario autenticado inyectar scripts en algunos cuadros de texto, conllevando a un ataque de tipo XSS. • https://access.redhat.com/security/cve/CVE-2021-3442 • CWE-20: Improper Input Validation CWE-134: Use of Externally-Controlled Format String •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-29906
https://notcve.org/view.php?id=CVE-2021-29906
08 Oct 2021 — IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a local user when it is configured to use an IBM Cloud API key to connect to cloud-based connectors. IBM X-Force ID: 207630. IBM App Connect Enterprise Certified Container versiones 1.0, 1.1, 1.2, 1.3, 1.4 y 1.5, podría divulgar información confidencial a un usuario local cuando es configurado para usar una clave API de IBM Cloud para conectarse a conectores basados en la nube. IBM X-Force ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/207630 •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 1CVE-2021-3631 – libvirt: Insecure sVirt label generation
https://notcve.org/view.php?id=CVE-2021-3631
01 Oct 2021 — A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity. Se ha encontrado un fallo en libvirt mientras genera pares de categorías MCS de SELinux para las etiquetas dinámicas de las máquinas virtuales. Este defecto permite que un huésped explotado acceda a ar... • https://access.redhat.com/errata/RHSA-2021:3631 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29894
https://notcve.org/view.php?id=CVE-2021-29894
30 Sep 2021 — IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207320. IBM Cloud Pak for Security (CP4S) versiones 1.7.0.0, 1.7.1.0, 1.7.2.0 y 1.8.0.0, usa algoritmos criptográficos más débiles de lo esperado que podrían permitir a un atacante descifrar información altamente confidencial. IBM X-Force ID: 207320 • https://exchange.xforce.ibmcloud.com/vulnerabilities/207320 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-20578
https://notcve.org/view.php?id=CVE-2021-20578
30 Sep 2021 — IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282. IBM Cloud Pak for Security (CP4S) versiones 1.7.0.0, 1.7.1.0, 1.7.2.0 y 1.8.0.0, podría permitir a un atacante llevar a cabo acciones no autorizadas debido a controles de autenticación inapropiados o ausentes. IBM X-Force ID: 199282 • https://exchange.xforce.ibmcloud.com/vulnerabilities/199282 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3703 – serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196
https://notcve.org/view.php?id=CVE-2021-3703
16 Sep 2021 — It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16.0 and Serverless client kn 1.16.0. These have been fixed with Serverless 1.17.0. Se ha detectado que las vulnerabilidades CVE-2021-27918, CVE-2021-31525 y CVE-2021-33196 se han mencionado incorrectamente como corregidas en RHSA para Serverless versión 1.16.0 y Serverless client kn versión 1.16.0. Estos han sido corregidos con Serverless versión 1.17.0. CVE-2021-27918, ... • https://access.redhat.com/security/cve/CVE-2021-3703 •
CVSS: 5.9EPSS: 0%CPEs: 22EXPL: 0CVE-2021-3597 – undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS
https://notcve.org/view.php?id=CVE-2021-3597
08 Sep 2021 — A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final. Se ha encontrado un fallo en Undertow. • https://bugzilla.redhat.com/show_bug.cgi?id=1970930 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •