PT-2022-1637 · Cisco · Cisco Email Security Appliance +1

Name of the Vulnerable Software and Affected Versions: Cisco Email Security Appliance ESA versions prior to Cisco AsyncOS Software Release 13.5.4.102 Description: A vulnerability in the DNS-based Authentication of Named Entities DANE email verification component could allow an unauthenticated,...

PT-2022-7482 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc3+ Description: The vulnerability is related to a double free race condition in the cifs component of the Linux kernel. When cifs get root fails during cifs smb3 do mount, the kernel calls deactivate...

PT-2022-9521 · WordPress · Wordpress Rsvp Plugin

Name of the Vulnerable Software and Affected Versions: RVM WordPress plugin versions prior to 6.4.2 Description: The issue concerns a lack of proper authorization, CSRF checks, and validation of the rvm upload regions file path parameter in the rvm import regions AJAX action. This allows any...

PT-2022-7731 · Starwind · Starwind Iscsi Target

Name of the Vulnerable Software and Affected Versions: StarWind iSCSI target versions prior to 6.0 build 2013-03-20 Description: A flaw was found in the StarWind iSCSI target, where the StarWind service does not limit client connections and allocates memory on each connection attempt. This could...

PT-2022-11876 · Codex · Codex

Name of the Vulnerable Software and Affected Versions: Codex versions prior to 1.4.0 Description: A Cross Site Scripting XSS issue exists via the Notebook/Page name field, allowing malicious users to execute arbitrary code through a crafted http code in a .json file. Recommendations: For versions...

EPA fails after Chrome/Edge version 98 update

NOTE: It’s recommended to have latest version of EPA and Gateway Plugins to get optimum User experience as several items have been addressed in recent versions such as disconnection on reboot and standalone setup for plugin. Few of the issues in feedback , “disconnection on reboot”, and “standalo...

PT-2022-1411

Name of the Vulnerable Software and Affected Versions polkit affected versions not specified policykit-1 versions prior to 0.105-25+deb10u1 policykit-1 versions prior to 0.105-31+deb11u1 policykit-1 versions prior to 0.105-4ubuntu3.14.04.6+esm1 Description A local privilege escalation issue exist...

PT-2022-9605 · WordPress · Mobile Events Manager

Name of the Vulnerable Software and Affected Versions: Mobile Events Manager WordPress plugin versions prior to 1.4.4 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of various settings, even when the unfilter...

PT-2022-4183 · Hewlett Packard · Hpe Oneview

Name of the Vulnerable Software and Affected Versions: HPE OneView versions prior to 6.6 Description: The issue is related to authentication errors in the HPE OneView IT infrastructure management system. Exploitation of this issue may allow an attacker to gain unauthorized access to protected...

PT-2022-12158 · Owncloud · Owncloud

Name of the Vulnerable Software and Affected Versions: ownCloud versions prior to 2.9.2 Description: The issue allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution. Recommendations: For versions prior to 2.9.2, update to version 2.9.2 or later ...

CVE-2022-21664 SQL injection in WordPress

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected...

PT-2021-23432 · Wireshark +4 · Wireshark +4

Name of the Vulnerable Software and Affected Versions: Wireshark versions 3.4.0 through 3.4.10 Description: The issue is related to a crash in the Gryphon dissector, allowing denial of service via packet injection or crafted capture file. Recommendations: For Wireshark versions 3.4.0 through...

PT-2021-21064 · Foreman +2 · Foreman +2

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 2.4.1 Foreman versions prior to 2.5.1 Foreman versions prior to 3.0.0 Description: A server-side remote code execution issue was found in the Foreman project. An authenticated attacker could use Sendmail configuratio...

CVE-2021-43807

Opencast is vulnerable to HTTP method spoofing in versions prior to 9.10. An attacker can override the intended HTTP method via a URL parameter, turning GET into PUT or form submissions into DELETE, enabling state-changing actions and CSRF bypasses. The issue is fixed in Opencast 9.10 and 10.0. M...

PT-2021-23960 · Patrowl · Patrowl

Name of the Vulnerable Software and Affected Versions: PatrOwl versions prior to 1.77 Description: The issue is related to improper privilege management in PatrowlManager, allowing unlogged-in users to download all finding import files. The files are stored under /media/imports//, where owner id ...

PT-2021-8087 · Heimdal +7 · Heimdal +7

Name of the Vulnerable Software and Affected Versions: Heimdal versions prior to 7.7.1 Description: The issue is related to an invalid free in the ASN.1 codec used by the Key Distribution Center KDC, which can be exploited by remote attackers to execute arbitrary code. This can also lead to...

PT-2021-24155 · Knime · Knime Server

Name of the Vulnerable Software and Affected Versions: KNIME Server versions prior to 4.13.4 Description: The issue allows directory traversal in a request for a client profile. This means an attacker could potentially access files or directories outside the intended directory structure by...

PT-2021-16708 · Bl31 +1 · Bl31 +1

Name of the Vulnerable Software and Affected Versions: LDFW and BL31 versions prior to SMR Dec-2021 Release 1 Description: The issue is related to an improper boundary check in the secure log of LDFW and BL31, which allows for arbitrary memory write and code execution. Recommendations: For versio...

PT-2021-16356 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.4.8 Description: The issue arises from the plugin's failure to sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting...

PT-2021-16207 · WordPress · Download Plugin

Name of the Vulnerable Software and Affected Versions: Download Plugin WordPress plugin versions prior to 1.6.1 Description: The issue concerns a lack of capability and CSRF checks in the dpwap plugin activate AJAX action. This allows any authenticated users to activate plugins that are already...