CVE-2021-32729

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script right...

PT-2021-3455 · Symfony · Symfony

Name of the Vulnerable Software and Affected Versions: Symfony versions 5.3.0 through 5.3.1 Description: A vulnerability in Symfony is related to firewall authentication. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other...

Elastic APM .NET Agent 1.10.0 Security Update

Elastic APM .NET Agent information disclosure ESA-2021-14 The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM serve...

PT-2021-3345 · 3S Smart Software Solutions · Codesys V2 Runtime System

Name of the Vulnerable Software and Affected Versions: CODESYS V2 runtime system SP versions prior to 2.4.7.55 Description: The issue is a Heap-based Buffer Overflow in the CODESYS V2 runtime system SP. This can be exploited by a remote attacker to cause a denial of service. Recommendations: For...

PT-2021-20870 · Unknown · Noobaa-Operator

Name of the Vulnerable Software and Affected Versions: noobaa-operator versions prior to 5.7.0 Description: A flaw was found in noobaa-operator where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could u...

CVE-2021-29486

cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values. In versions prior to 2.0.0 apps using this library on improper data may crash or go into an infinite-loop. In the case of a nodejs...

CVE-2021-21388

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version = 5.6.4. If you cannot...

HPESBNW04126 rev.2 - Aruba AirWave Management Platform, Multiple Vulnerabilities

Potential Security Impact: Remote: Escalation of Privilege, SQL Injection, URL Redirection, Unauthorized Access, Authentication Restriction Bypass, XML External Entity XXE, Insecure Deserialization SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba AirWave Management Platform -...

PT-2021-13765 · Unknown · Jquery-Deparam

Name of the Vulnerable Software and Affected Versions: jquery-deparam version 0.5.1 Description: The issue allows a malicious user to inject properties into Object.prototype through 'Prototype Pollution'. This occurs due to improperly controlled modification of object prototype attributes in...

PT-2021-19419 · Mediawiki +1 · Abusefilter Extension +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.2 AbuseFilter extension for MediaWiki through 1.35.2 Description: An issue in the AbuseFilter extension for MediaWiki allows the disclosure of suppressed MediaWiki usernames to unprivileged users through the...

GHSA-58F5-HFQC-JGCH Padding Oracle Attack due to Observable Timing Discrepancy in jose

jose is an npm library providing a number of cryptographic operations. Impact AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown. But a possibly...

PT-2022-2220

Name of the Vulnerable Software and Affected Versions Python versions prior to 3.10.0b1 Python versions prior to 3.9.5 Python versions prior to 3.8.11 Python versions prior to 3.7.11 Python versions prior to 3.6.14 Description The issue involves the urllib.parse module in Python, which does not...

GHSA-JFF2-QJW8-5476 Command Injection Vulnerability in systeminformation

Impact command injection vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version = 5.6.4 Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite, si.services, si.processLoad ... do onl...

PT-2021-14677 · Jenkins · Jenkins Jabber (Xmpp) Notifier/Control Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Jabber XMPP notifier and control Plugin versions 1.41 and earlier Description: The issue concerns the storage of passwords in the global configuration file on the Jenkins controller. Specifically, passwords are stored unencrypted in t...

PT-2021-15157 · Rockwell Automation · Micrologix 1400

Name of the Vulnerable Software and Affected Versions: Rockwell Automation MicroLogix 1400 versions 21.6 and below Description: The issue allows a remote unauthenticated attacker to send a specially crafted Modbus packet, enabling the retrieval or modification of random values in the register...

PT-2021-4609 · Leptonica +1 · Leptonica +1

Name of the Vulnerable Software and Affected Versions: Leptonica versions prior to 1.80.0 Description: The issue is related to a heap-based buffer over-read in the pixFewColorsOctcubeQuantMixed function in the colorquant1.c file. This can potentially allow a remote attacker to cause a denial of...

Arbitrary Code Execution

Overview yolov5 is a Packaged version of the Yolov5 object detector Affected versions of this package are vulnerable to Arbitrary Code Execution. The package was vulnerable to insecure deserialization attack due to the usage of unsafe yaml load function in the package. Remediation Upgrade yolov5 ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user. Remediation Upgrade github.com/argoproj/argo-cd/cmd to version 1.7.13, 1.8.6 or higher...

Web Cache Poisoning

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Web Cache Poisoning. Django contains a copy of urllib.parse.parseqsl which was added to backport some security fixes. A further...

PT-2021-7858 · Google +11 · Protocol Buffers +10

Name of the Vulnerable Software and Affected Versions: Protocol Buffers versions prior to 3.15.0 MySQL Server versions 8.0.28 and earlier Description: A nullptr dereference occurs when a null char is present in a proto symbol, leading to an unchecked call into the proto file's name during...