PT-2021-23119 · Minio · Minio

Name of the Vulnerable Software and Affected Versions: Minio versions RELEASE.2021-10-10T16-53-30Z through RELEASE.2021-10-12T23-59-59Z Description: The issue involves bypassing policy restrictions on regular users in Minio, a Kubernetes native application for cloud storage. Normally, the...

PT-2021-4374 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an information disclosure vulnerability. It allows attackers to obtain sensitive information and potentially affect the system. There is no information provided abou...

PT-2021-4371 · Microsoft · Windows Dns Server +1

Name of the Vulnerable Software and Affected Versions: Windows DNS Server affected versions not specified Description: The issue is related to incorrect code generation management in the Windows DNS Server component. It allows remote attackers to execute arbitrary code, affecting the system...

PT-2021-4379 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in privilege management within the Windows operating system. It allows an attacker to potentially elevate their privileges. Recommendations: At the moment,...

PT-2021-4394 · Microsoft · Windows Ad Fs +1

Name of the Vulnerable Software and Affected Versions: Windows AD FS affected versions not specified Description: The issue is related to errors in security settings, allowing a remote attacker to bypass the security mechanism. This can affect the system. Recommendations: At the moment, there is ...

PT-2021-22718 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 and later Description: The issue allows an attacker to bypass the setting to disable Bitbucket Server import by making a crafted API call. This affects instances of GitLab CE/EE where this setting is enabled...

CVE-2021-22869

An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with access to one enterprise runner group...

PT-2021-21941 · Npm +2 · Object-Path +2

Name of the Vulnerable Software and Affected Versions: object-path affected versions not specified Description: The issue is related to Improperly Controlled Modification of Object Prototype Attributes, also known as 'Prototype Pollution'. This occurs because the del function does not properly...

GHSA-5VP3-V4HC-GX76 UUPSUpgradeable vulnerability in @openzeppelin/contracts

Impact Upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon. Patches A fix is included in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeabl...

PT-2021-6318 · Microsoft · Windows Subsystem For Linux +1

Name of the Vulnerable Software and Affected Versions: Windows Subsystem for Linux affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Subsystem for Linux, which can be exploited to elevate privileges. This could allow an attacker t...

PT-2021-6962 · Microsoft · Visual Studio Code

Name of the Vulnerable Software and Affected Versions: Visual Studio Code affected versions not specified Description: The issue is related to errors in the representation of information by the user interface, which can allow an attacker to conduct spoofing attacks. There is also a mention of a...

PT-2021-22458 · Pomerium +1 · Pomerium +1

Name of the Vulnerable Software and Affected Versions: envoyproxy envoy, pomerium affected versions not specified Description: The issue concerns a problem in envoyproxy envoy and pomerium. No specific details about the nature of the issue or its potential impact are provided. Recommendations: At...

PT-2021-7631 · Microsoft · Edge For Android

Name of the Vulnerable Software and Affected Versions: Microsoft Edge for Android affected versions not specified Description: The issue is related to insecure privilege management in Microsoft Edge for Android. Exploitation of this issue may allow a remote attacker to elevate their privileges...

Denial Of Service (DoS)

Exiv2 is vulnerable to denial of service. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a deni...

PYSEC-2021-589

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.SparseFillEmptyRows. The shape inference implementation does not validate that the input arguments are not empt...

CVE-2021-37640

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of tf.rawops.SparseReshape can be made to trigger an integral division by 0 exception. The implementation calls the reshaping functor whenever there is at least an index in the input but...

PT-2021-7891 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue is related to insufficient protection of service data in Microsoft SharePoint Server, which can be exploited by a remote attacker to gain unauthorized access t...

PT-2021-7926 · Exiv2 +9 · Exiv2 +9

Name of the Vulnerable Software and Affected Versions: Exiv2 versions v0.27.4 and earlier Description: An out-of-bounds read was found in Exiv2, a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered wh...

CVE-2021-37843

The CVE-2021-37843 issue affects Atlassian SAML SSO apps and allows a remote attacker to login to a user account knowing only the username (no additional authentication). Fixed versions include Jira: 3.6.6.1, 4.0.12, 5.0.5; Confluence: 3.6.6, 4.0.12, 5.0.5; Bitbucket: 2.5.9, 3.6.6, 4.0.12, 5.0.5;...

PT-2021-9468 · Unknown · Magicmotion Flamingo 2

Name of the Vulnerable Software and Affected Versions: MagicMotion Flamingo 2 affected versions not specified Description: The issue concerns a lack of BLE encryption, which enables data sniffing and packet forgery. Recommendations: At the moment, there is no information about a newer version tha...