CVE-2021-21688

An incorrect access restriction vulnerability was found in Jenkins. The FilePathreadingFileVisitor does not reject any operations giving users unrestricted read access with certain operations creating archives, copyRecursiveTo. This may allow an attacker to get access to restricted data. Mitigati...

PT-2021-23752 · Unknown · Sourcecodester Simple Subscription Website

Name of the Vulnerable Software and Affected Versions: Sourcecodester Simple Subscription Website version 1.0 Description: A Cross Site Scripting XSS issue exists due to the id parameter in plan application. This allows for potential malicious script execution. Recommendations: For version 1.0,...

Access Restriction Bypass

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Access Restriction Bypass due to front-end restrictions. Random users can self-register even when the admin does not allow it. Remediation Upgrade...

PT-2021-23138 · Unknown +1 · Freeswitch +1

Name of the Vulnerable Software and Affected Versions: FreeSWITCH versions prior to 1.10.7 Description: The issue allows an attacker to perform a SIP digest leak attack against FreeSWITCH, potentially recovering gateway passwords by exploiting the challenge response of a gateway configured on the...

About the security content of macOS Monterey 12.0.1

About the security content of macOS Monterey 12.0.1 This document describes the security content of macOS Monterey 12.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

Authentication flaw

An access issue was addressed with improved access restrictions. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6, tvOS 15. A user may gain access to protected parts of the file system...

PT-2021-20985 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.26 and prior Description: A vulnerability in the MySQL Server product allows a high privileged attacker with network access via multiple protocols to compromise the server. Successful attacks can result in the...

PT-2021-4711 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.26 and prior Description: The issue is related to insufficient input validation in the MySQL Server component, specifically the Data Dictionary. This can be exploited by a high-privileged attacker with logon to the...

PT-2021-20061 · Nagvis +1 · Nagvis +1

Name of the Vulnerable Software and Affected Versions: NagVis versions prior to 1.9.29 Description: The Manage Backgrounds functionality within NagVis is vulnerable to an authenticated path traversal vulnerability. This vulnerability allows a malicious actor to arbitrarily delete files on the loc...

PT-2021-21265 · Yellowfin · Yellowfin

Name of the Vulnerable Software and Affected Versions: Yellowfin versions prior to 9.6.1 Description: The issue is related to a Stored Cross-Site Scripting vulnerability in the video embed functionality. It can be exploited through a specially crafted HTTP POST request to the page...

Atlassian JIRA < 8.5.15 / 8.6.x < 8.13.7 / 8.14.x < 8.17.0 Unauth User Enum (JRASERVER-71559)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is affected by an information disclosure vulnerability in the QueryComponentRendererValue!Default.jspa due to an improper access restriction. An unauthenticated, remote attacker can explo...

PT-2021-22902 · Sap · Sap Internet Communication Framework

Name of the Vulnerable Software and Affected Versions: SAP Internet Communication framework ICM versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785 Description: The issue allows an attacker with logon functionality to exploit the authentication function. This can be done...

PT-2021-23030 · Mkdocs +1 · Mkdocs +1

Name of the Vulnerable Software and Affected Versions: mkdocs version 1.2.2 Description: The mkdocs built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Recommendations: For mkdocs version 1.2.2, as a temporary workaroun...

PT-2021-22730 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 8.13 and later Description: The issue concerns an endpoint that discloses names of private groups with access to a project to low-privileged users who are part of that project. Recommendations: For GitLab EE versions 8.13 a...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from not properly...

PT-2021-21211 · Dell · Dell Enterprise Sonic Os

Name of the Vulnerable Software and Affected Versions: Dell Enterprise SONiC OS versions 3.3.0 and earlier Description: The issue allows an authenticated malicious user with access to the system to read sensitive information using the TACACSRadius credentials stored, potentially using it in furth...

PT-2021-10541 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version V15.03.06.60 EN Description: A stack-based buffer overflow in the httpd server allows remote attackers to execute arbitrary code or cause a denial of service DoS via a crafted POST request to "/goform/SetStaticRouteCfg"...

PT-2021-10433 · Wuzhicms · Wuzhi Cms

Name of the Vulnerable Software and Affected Versions: Wuzhi CMS version 4.1.0 Description: The issue is a remote code execution RCE vulnerability located in the attachmentadminindex.php file. Recommendations: For Wuzhi CMS version 4.1.0, consider restricting access to the index.php file in the...

PT-2021-21388 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: WordPress uListing plugin versions = 2.0.5 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. Vulnerable parameters include filterid, filteruser, filterexpired date, filtercreated date, and...

PT-2021-16156 · Oracle · Linux-Oracle

Name of the Vulnerable Software and Affected Versions: Oracle Linux versions 7 through 8 Description: A vulnerability in the OSwatcher component of Oracle Linux allows a low-privileged attacker with logon to the infrastructure to compromise Oracle Linux. Successful attacks can result in the...