PT-2021-3188

Name of the Vulnerable Software and Affected Versions Lodash versions prior to 4.17.21 Description The issue is related to Command Injection via the template function, which can be exploited by a remote attacker to execute arbitrary commands. This is due to the lack of neutralization of special...

PT-2021-3189

Name of the Vulnerable Software and Affected Versions lodash versions prior to 4.17.21 Description The issue is related to the toNumber, trim, and trimEnd functions in the lodash library, which can lead to an uncontrolled consumption of resources, potentially causing a denial of service. This can...

PT-2021-2308 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier Description: The issue is related to the inadequate invalidation of user sessions, which could lead to unauthorized access to restrict...

PT-2021-13848 · Privoxy +4 · Privoxy +4

Name of the Vulnerable Software and Affected Versions: Privoxy versions prior to 3.0.31 Description: A flaw was found in Privoxy that may lead to denial of service due to an assertion failure triggered by a crafted CGI request. The highest threat from this issue is to system availability...

PT-2021-19235 · 1с · 1С:Предприятие +1

Name of the Vulnerable Software and Affected Versions: 1C:Enterprise 8 versions prior to 8.3.17.1851 Description: The issue concerns the Web server in 1C:Enterprise 8, which sends base64 encoded credentials in the creds URL parameter. Recommendations: For versions prior to 8.3.17.1851, update to...

PT-2021-11820

Name of the Vulnerable Software and Affected Versions: Pillow versions prior to 8.1.0 Description: The issue arises from a 4-byte buffer over-read in the SGIRleDecode function when decoding crafted SGI RLE image files. This occurs due to the mishandling of offsets and length tables...

PT-2021-11714 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: Cockpit versions prior to 0.6.1 Description: The issue allows an attacker to inject custom PHP code and achieve Remote Command Execution via the registerCriteriaFunction in lib/MongoLite/Database.php. This can be demonstrated by sending value...

PT-2020-17390 · Openbsd · Opensmtpd

Name of the Vulnerable Software and Affected Versions: OpenSMTPD versions prior to 6.8.0p1 Description: The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, via a crafted pattern of client activity. This occurs because the filter state machine does not...

PT-2020-15032

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 10.0.0-M1 through 10.0.0-M9 Apache Tomcat versions 9.0.0-M1 through 9.0.39 Apache Tomcat versions 8.5.0 through 8.5.59 Description The issue allows Apache Tomcat to re-use an HTTP request header value from the previous...

PT-2020-16234 · Micro Focus · Micro Focus Arcsight Logger

Name of the Vulnerable Software and Affected Versions: Micro Focus ArcSight Logger version 7.1 Description: The issue is a Cross-Site Scripting vulnerability that could be remotely exploited, resulting in Cross-Site Scripting XSS. Recommendations: For Micro Focus ArcSight Logger version 7.1, upda...

PT-2020-17024 · Ipswitch · Moveit Transfer

Name of the Vulnerable Software and Affected Versions: MOVEit Transfer versions prior to 2020.1 Description: A malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute...

PT-2020-11856 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.0.1 Description: An access issue was addressed with improved access restrictions. Processing a maliciously crafted document may lead to a cross site scripting attack. Recommendations: For versions prior to 11.0.1,...

PT-2020-11851 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.0.1 Description: A logic issue was addressed with improved state management, allowing a malicious application to potentially determine kernel memory layout. Recommendations: For versions prior to 11.0.1, update to...

PT-2020-16847 · Apple · Ios +4

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.2 iPadOS versions prior to 14.2 tvOS versions prior to 14.2 watchOS versions prior to 7.1 Description: An out-of-bounds read issue was addressed with improved input validation. Processing a maliciously crafted audio...

PT-2021-7499 · Mariadb +10 · Mariadb Server +10

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.6.5 and below Description: The issue is related to an use-after-free in the component Item args::walk arg, which can be exploited via specially crafted SQL statements, potentially allowing a remote attacker to cause...

PT-2020-4535 · Oracle +10 · Mysql Server +9

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.7.31 and prior MySQL Server versions 8.0.21 and prior Description: The issue is related to insufficient input validation in the InnoDB component of the MySQL Server product. It allows a high-privileged attacker with...

PT-2020-15519 · Jenkins · Jenkins Active Choices Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Choices Plugin versions 2.4 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability because the name and description of build parameters are not properly escaped. This vulnerability can be...

PT-2020-19758 · Hello.Js · Hellojs

Name of the Vulnerable Software and Affected Versions: hellojs versions prior to 1.18.6 hello.js versions prior to 1.18.6 Description: The issue arises from the package getting the oauth redirect parameter from the URL and passing it to location.assign without proper checks and sanitization. This...

PT-2022-8871 · Upx +2 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX version 4.0.0 Description: An invalid memory address reference was discovered in the elf lookup function in p lx elf.cpp via a crafted Mach-O file. Recommendations: For UPX version 4.0.0, consider updating to a newer version that contains...

PT-2020-14049 · Philips · Philips Clinical Collaboration Platform

Name of the Vulnerable Software and Affected Versions: Philips Clinical Collaboration Platform versions 12.2.1 and prior Description: The issue arises because the product does not properly validate input or data it receives, which can lead to incorrect processing. Recommendations: For versions...