CVE-2021-27579

Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an IT environment. A privilege-escalation vulnerability exists if CPUID is enabled, and thus it should be disabled via configuration settings...

PT-2021-17068 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: An attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by viewing the result of the "api-aa" endpoint,...

PT-2021-17066 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: The issue allows an attacker to see all users in the CMS using the API endpoint "/users/id". For each call, they get in response a lot of information about the user, such as email address, firs...

PT-2021-3581 · Selinux +6 · Selinux +6

Name of the Vulnerable Software and Affected Versions: SELinux version 3.2 Description: The issue is related to a use-after-free in the cil verify classperms function of the SELinux access control system. This can potentially allow an attacker to cause a denial of service. The cil verify classper...

Security Bulletin: IBM QRadar Wincollect is vulnerable to improper access control (CVE-2020-4485, CVE-2020-4486)

Summary IBM QRadar Wincollect agents could allow authenticated users to bypass restrictions to delete arbitrary files or disable the Wincollect service. Vulnerability Details CVEID: CVE-2020-4485 DESCRIPTION: IBM QRadar could allow an authenticated user to disable the Wincollect service which cou...

PT-2021-2011

Name of the Vulnerable Software and Affected Versions: Kaspersky Endpoint Security affected versions not specified Kaspersky Rescue Disk affected versions not specified Description: A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of...

nss security and bug fix update

3.53.1-17 - Fix various corner cases with ike v1 app b support. 3.53.1-16 - Fix the following CVE - CVE-2020-12403 chacha-poly issues - CVE-2020-12400 constant time ECC. - CVE-2020-6829 constant time ECC. 3.53.1-15 - Revert some policy changes the generate ABI runtime issues. 3.53.1-14 - Add...

PT-2021-5544 · Openldap +6 · Openldap +6

Name of the Vulnerable Software and Affected Versions: OpenLDAP versions 2.4.57 and 2.5.x through 2.5.1alpha Description: The issue is related to an assertion failure in the issuerAndThisUpdateCheck function, which can occur via a crafted packet with a short timestamp, resulting in a denial of...

PT-2021-3193

Name of the Vulnerable Software and Affected Versions Apache Thrift versions 0.9.3 through 0.13.0 Description The issue is related to an uncontrolled resource consumption in the Apache Thrift library of the Avrora Center application. It can be exploited by a remote attacker to cause a denial of...

CVE-2021-25251

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit...

CVE-2021-25251

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit...

Code injection

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit...

Elastic Stack 7.11.0 and 6.8.14 Security Update

Elasticsearch information disclosure ESA-2021-03 Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or...

PT-2021-17177 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 1.8.4 Description: The issue arises from the fact that tokens remain active even after the associated user account has been disabled. This is due to a problem in the util/session/sessionmanager.go file...

PT-2021-2328 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier Description: The issue is related to a stored cross-site scripting XSS in the customer address upload feature. Successful exploitation...

PT-2021-17175 · Discord · Probot

Name of the Vulnerable Software and Affected Versions: ProBot bot through 2021-02-08 for Discord Description: The issue allows attackers to interfere with the intended purpose of the "Send an image when a user joins the server" feature, or possibly have unspecified other impact, because the...

PT-2021-11931 · Libmysofa +1 · Libmysofa +1

Name of the Vulnerable Software and Affected Versions: libmysofa versions 0.5 through 1.1 Description: The issue arises from incorrect handling of input data in the changeAttribute function, which can lead to a NULL pointer dereference and result in a segmentation fault error when restrictive...

PT-2021-11932 · Libmysofa +1 · Libmysofa +1

Name of the Vulnerable Software and Affected Versions: libmysofa library versions 0.5 through 1.1 Description: The issue arises from incorrect handling of input data in the loudness function within the libmysofa library, leading to a heap buffer overflow and access to an unallocated memory block...

PT-2021-16810 · Cosmos Network · Ethermint

Name of the Vulnerable Software and Affected Versions: Cosmos Network Ethermint versions = v0.4.0 Description: The issue is related to a cross-chain transaction replay vulnerability in the EVM module. This vulnerability is caused by the use of the same chainID and signature schemes with Ethereum...

Adobe Flash Player End of Life (EOL) Detection

The Adobe Flash Player on the remote host has reached the end of life EOL / is discontinued and should not be used anymore. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...