PT-2021-19212 · Cncf · Cncf Cortex

Name of the Vulnerable Software and Affected Versions: CNCF Cortex versions prior to 1.8.1 Description: The issue concerns a local file disclosure problem in the Alertmanager component when the -experimental.alertmanager.enable-api option is enabled. This allows an attacker to potentially send an...

PT-2021-17582 · Pegasystems · Pega Infinity

Name of the Vulnerable Software and Affected Versions: Pega Infinity versions 8.2.1 through 8.5.2 Description: The issue concerns the password reset functionality for local accounts, which can be exploited to bypass local authentication checks. Recommendations: For Pega Infinity versions 8.2.1...

PT-2021-3132

Name of the Vulnerable Software and Affected Versions BIND versions 9.5.0 through 9.11.29 BIND versions 9.12.0 through 9.16.13 BIND Supported Preview Edition versions 9.11.3-S1 through 9.11.29-S1 BIND Supported Preview Edition versions 9.16.8-S1 through 9.16.13-S1 BIND 9.17 development branch...

PT-2021-18239 · Hedgedoc · Hedgedoc

Name of the Vulnerable Software and Affected Versions: HedgeDoc versions prior to 1.5.0 Description: The issue affects HedgeDoc, an open-source collaborative markdown editor, where an attacker can receive arbitrary files from the file system when exporting a note to PDF. This exploit requires the...

CVE-2020-28973

The ABUS Secvest wireless alarm system FUAA50000 v3.01.17 fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. This information can then be used to...

CVE-2020-28973

The ABUS Secvest wireless alarm system FUAA50000 v3.01.17 fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. This information can then be used to...

Design/Logic Flaw

The ABUS Secvest wireless alarm system FUAA50000 v3.01.17 fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. This information can then be used to...

PT-2023-4471 · Sqlite3 +1 · Sqlite3 +1

Name of the Vulnerable Software and Affected Versions: SQLite3 version 3.35.4 Description: The issue in the appendvfs.c component of the SQLite database management system is related to reading beyond the valid boundaries of a data buffer. This can be exploited by a remote attacker to cause a deni...

VulnCheck KEV: CVE-2020-24557

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain...

PT-2021-11749 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.1.3 Description: A server-side request forgery SSRF vulnerability in the addCustomThemePluginRepository function in index.php allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installe...

CVE-2020-36322

A denial of service flaw was found in fusedogetattr in fs/fuse/dir.c in the kernel side of the FUSE filesystem in the Linux kernel. A local user could use this flaw to crash the system. Mitigation As the FUSE module will be auto-loaded when required, its use can be disabled by preventing the modu...

PT-2021-18556 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 8.8.2 Description: The issue arises when using ConfigurableInternodeAuthHadoopPlugin for authentication. In this scenario, distributed requests are forwarded or proxied using server credentials instead of the...

OPENSUSE-SU-2021:0544-1 Security update for ceph

This update for ceph fixes the following issues: - ceph was updated to to 15.2.9 - cephadm: fix 'inspect' and 'pull' bsc1182766 - CVE-2020-27839: mgr/dashboard: Use secure cookies to store JWT Token bsc1179997 - CVE-2020-25678: Do not add sensitive information in Ceph log files bsc1178905 -...

PT-2021-7867 · Libraw +8 · Libraw +8

Name of the Vulnerable Software and Affected Versions: LibRaw version 0.20.0 Description: The issue is related to a buffer overflow in the LibRaw buffer datastream::gets function, located in the libraw datastream.cpp component of the LibRaw image processing library. This allows an attacker to...

OPENSUSE-SU-2021:0542-1 Security update for tpm2-tss-engine

This update for tpm2-tss-engine fixes the following issues: - Added support to disable fixed compilation flags - Added --disable-defaultflags during compilation to avoid breakage of our gcc-PIE profile resulted in non-position-independent executable tpm2-tss-genkey, bsc1183895 This update was...

PT-2021-8023 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.12.0-rc4-syzkaller Description: The vulnerability is related to a divide error in the nft limit init function, which is caused by the div u64 function dividing a 64-bit unsigned integer by a 32-bit unsigned...

SUSE-SU-2021:1113-1 Security update for tpm2-tss-engine

This update for tpm2-tss-engine fixes the following issues: - Added support to disable fixed compilation flags - Added --disable-defaultflags during compilation to avoid breakage of our gcc-PIE profile resulted in non-position-independent executable tpm2-tss-genkey, bsc1183895...

The vulnerability of the XPC service in Kaspersky Internet Security’s antivirus protection software for MacOS systems allows a hacker to disable the antivirus protection.

The vulnerability of Kaspersky Internet Security’s XPC service for the MacOS operating system is related to errors in the authentication process. Exploiting this vulnerability could allow a hacker to disable the antivirus protection...

CVE-2013-1055

The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was...

PT-2021-14481 · Syncthing +2 · Syncthing +2

Name of the Vulnerable Software and Affected Versions: Syncthing versions prior to 1.15.0 Description: The issue allows a malicious relay server to cause Syncthing to crash by sending a malformed relay protocol message with a negative length field. Similarly, the relay server strelaysrv can be...