Intel IPP Cryptography Advisory (Used in Intel SGX) - Lenovo Support US

No description provided...

CVE-2022-21658 Race condition in std::fs::remove_dir_all in rustlang

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

PT-2022-15849 · Jenkins · Jenkins Warnings Next Generation Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Next Generation Plugin versions 9.10.2 and earlier Description: The issue allows attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system due to...

CVE-2022-21649 Stored XSS via attribute in convos

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

PT-2021-8042 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17-rc1 Description: The issue is related to an information leak flaw in the Linux kernel's TIPC protocol subsystem. This flaw occurs due to uninitialized memory when a user sends a TIPC datagram to one or more...

PT-2021-23975 · Pjsip +3 · Pjsip +3

Name of the Vulnerable Software and Affected Versions: PJSIP versions 2.11.1 and prior Description: The issue affects PJSIP, a free and open source multimedia communication library. In the affected versions, if an incoming RTCP XR message contains a block, the data field is not checked against th...

PT-2021-5651 · Apache +1 · Apache Http Server +6

Name of the Vulnerable Software and Affected Versions: SonicWall SMA 100 Appliances version 10.2.0.8-37sv SonicWall SMA 100 Appliances version 10.2.1.1-19sv SonicWall SMA 100 Appliances version 10.2.1.2-24sv SonicWall SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19s...

PT-2021-22088 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.5 and earlier Description: The issue allows for cross-site scripting XSS attacks via a crafted snippet that contains an app loader reference within an app loader URL. This enables potential attackers to execute...

PT-2021-20564 · 3S Smart Software Solutions · Codesys V2

Name of the Vulnerable Software and Affected Versions: CODESYS V2 versions prior to 1.1.9.22 Description: The issue is caused by crafted web server requests that may lead to a heap-based buffer overflow, potentially triggering a denial-of-service condition due to a crash in the web server...

CVE-2021-41159

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections /gt:rpc fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue h...

PT-2021-7914 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.28 Description: The issue is related to a buffer overflow in the Core component of Oracle VM VirtualBox, which can be exploited to cause a denial of service. A high-privileged attacker with logon to...

PT-2021-5992

Name of the Vulnerable Software and Affected Versions TP-Link AX10v1 versions prior to v1 211117 Description The issue is related to a deficiency in handling HTTP requests, which can be exploited by a remote unauthenticated attacker to conduct an HTTP request smuggling attack. This can lead to a...

CVE-2021-39215

Jitsi Meet prior to version 2.0.5963 is vulnerable: a Prosody module permits using symmetric algorithms to validate JSON Web Tokens, allowing tokens created by any source to authorize access to protected rooms. The issue is fixed in Jitsi Meet 2.0.5963. There are no publicly documented workaround...

PT-2021-6797 · Adobe +4 · Xmp Toolkit Sdk +4

Name of the Vulnerable Software and Affected Versions: XMP Toolkit SDK versions 2021.07 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such ...

PT-2021-16102 · WordPress · Per Page Add To Head

Name of the Vulnerable Software and Affected Versions: Per page add to head WordPress plugin versions prior to 1.4.4 Description: The issue is related to the lack of CSRF checks when saving settings, which could allow attackers to make changes to the settings of a logged-in admin. Additionally, t...

PT-2021-5804 · Ntfs-3G +7 · Ntfs-3G +7

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs get attribute value. This issue may allow an attacker to access confidential data,...

PT-2022-4773 · Mariadb +9 · Mariadb +10

Name of the Vulnerable Software and Affected Versions: MariaDB versions 10.5.13 and earlier Description: The issue is related to errors in resource release in the ha maria::extra component of MariaDB, which can cause an application crash via certain SELECT statements. This can lead to a denial of...

Intel Ethernet Linux Driver Advisory - Lenovo Support US

No description provided...

PT-2021-20596 · Sendgrid · Wordpress Sender Plugin

Name of the Vulnerable Software and Affected Versions: SendGrid WordPress plugin versions up to and including 1.11.8 Description: The issue allows authenticated users to bypass authorization and export statistics for a WordPress multi-site main site. This is possible due to a vulnerability in the...

PT-2021-21584 · Mupdf +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: MuPDF versions prior to 1.18.2 Description: The issue arises from an out-of-bounds write in the cached color converter, which fails to properly consider the maximum key size of a hash table. This can be observed with crafted "mutool draw"...