CVE-2021-1231

A vulnerability in the Link Layer Discovery Protocol LLDP for Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an unauthenticated, adjacent attacker to disable switching on a small form-factor pluggable SFP interface. This vulnerability is due to...

Cisco Nexus 9000 Series Fabric 访问控制错误漏洞

Cisco Nexus 9000 Series Fabric Switches is a 9000 series fiber optic switch from Cisco USA. A security vulnerability exists in the Nexus 9000 Series Fabri that can be exploited by an attacker to disable switching on SFP interfaces, which could disrupt the network...

PT-2021-14664 · Jenkins · Jenkins Support Core Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Support Core Plugin versions 2.72 and earlier Description: The issue concerns the provision of serialized user authentication as part of the "About user basic authentication details only" information, which can include the session ID ...

CVE-2021-27579

Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an IT environment. A privilege-escalation vulnerability exists if CPUID is enabled, and thus it should be disabled via configuration settings...

PT-2021-17068 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: An attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by viewing the result of the "api-aa" endpoint,...

PT-2021-17066 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: The issue allows an attacker to see all users in the CMS using the API endpoint "/users/id". For each call, they get in response a lot of information about the user, such as email address, firs...

PT-2021-3581 · Selinux +6 · Selinux +6

Name of the Vulnerable Software and Affected Versions: SELinux version 3.2 Description: The issue is related to a use-after-free in the cil verify classperms function of the SELinux access control system. This can potentially allow an attacker to cause a denial of service. The cil verify classper...

Security Bulletin: IBM QRadar Wincollect is vulnerable to improper access control (CVE-2020-4485, CVE-2020-4486)

Summary IBM QRadar Wincollect agents could allow authenticated users to bypass restrictions to delete arbitrary files or disable the Wincollect service. Vulnerability Details CVEID: CVE-2020-4485 DESCRIPTION: IBM QRadar could allow an authenticated user to disable the Wincollect service which cou...

PT-2021-2011

Name of the Vulnerable Software and Affected Versions: Kaspersky Endpoint Security affected versions not specified Kaspersky Rescue Disk affected versions not specified Description: A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of...

nss security and bug fix update

3.53.1-17 - Fix various corner cases with ike v1 app b support. 3.53.1-16 - Fix the following CVE - CVE-2020-12403 chacha-poly issues - CVE-2020-12400 constant time ECC. - CVE-2020-6829 constant time ECC. 3.53.1-15 - Revert some policy changes the generate ABI runtime issues. 3.53.1-14 - Add...

PT-2021-5544 · Openldap +6 · Openldap +6

Name of the Vulnerable Software and Affected Versions: OpenLDAP versions 2.4.57 and 2.5.x through 2.5.1alpha Description: The issue is related to an assertion failure in the issuerAndThisUpdateCheck function, which can occur via a crafted packet with a short timestamp, resulting in a denial of...

PT-2021-3193

Name of the Vulnerable Software and Affected Versions Apache Thrift versions 0.9.3 through 0.13.0 Description The issue is related to an uncontrolled resource consumption in the Apache Thrift library of the Avrora Center application. It can be exploited by a remote attacker to cause a denial of...

CVE-2021-25251

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit...

CVE-2021-25251

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit...

Code injection

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit...

Elastic Stack 7.11.0 and 6.8.14 Security Update

Elasticsearch information disclosure ESA-2021-03 Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or...

PT-2021-17177 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 1.8.4 Description: The issue arises from the fact that tokens remain active even after the associated user account has been disabled. This is due to a problem in the util/session/sessionmanager.go file...

PT-2021-2328 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier Description: The issue is related to a stored cross-site scripting XSS in the customer address upload feature. Successful exploitation...

PT-2021-17175 · Discord · Probot

Name of the Vulnerable Software and Affected Versions: ProBot bot through 2021-02-08 for Discord Description: The issue allows attackers to interfere with the intended purpose of the "Send an image when a user joins the server" feature, or possibly have unspecified other impact, because the...

PT-2021-16810 · Cosmos Network · Ethermint

Name of the Vulnerable Software and Affected Versions: Cosmos Network Ethermint versions = v0.4.0 Description: The issue is related to a cross-chain transaction replay vulnerability in the EVM module. This vulnerability is caused by the use of the same chainID and signature schemes with Ethereum...