PT-2021-22770 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.11 through 14.3.5 GitLab CE/EE versions 14.4 through 14.4.3 GitLab CE/EE versions 14.5 through 14.5.1 Description: An issue has been discovered in GitLab CE/EE due to a business logic error, allowing an unauthorized...

PT-2021-5169

Name of the Vulnerable Software and Affected Versions Apache Log4j2 versions 2.0-beta9 through 2.15.0 Apache Log4j2 version 2.16.0 and later are not affected, as the vulnerable functionality has been completely removed. Description The vulnerability in Apache Log4j2 is related to the JNDI feature...

A closer look at Qakbot’s latest building blocks (and how to knock them down)

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan,...

A closer look at Qakbot’s latest building blocks (and how to knock them down)

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan,...

Hillrom Welch Allyn Cardio Products

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely Vendor: Hillrom Equipment: Welch Allyn Cardio Products Vulnerability: Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access...

PT-2021-14839 · Unknown · Dream Report Ods Remote Connector

Name of the Vulnerable Software and Affected Versions: Dream Report ODS Remote Connector version 20.2.16900.0 Description: A privilege escalation issue exists in the Remote Server functionality due to a specially-crafted command injection, which can lead to elevated capabilities. An attacker can...

PT-2021-23949 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel versions prior to 8.75.0, 7.30.6, and 6.20.42 Description: The issue is related to a possible cross-site scripting XSS vulnerability in the Blade templating engine. This vulnerability can be exposed if the parent template contains an...

Johnson Controls CEM Systems AC2000

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Controlled Electronic Management Systems, Ltd., a subsidiary of Johnson Controls, Inc. Equipment: CEM Systems AC2000 Vulnerability: Off-by-one Error 2. RISK EVALUATION Successful exploitation of this vulnerability could...

PT-2021-23930 · Unknown · @Backstage/Plugin-Scaffolder-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-scaffolder-backend versions prior to 0.15.14 Description: A malicious actor with write access to a registered scaffolder template can manipulate the template to write files to arbitrary paths on the scaffolder-backend host...

DEBIAN-CVE-2021-41270

Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula...

The End of the Cybersecurity Skills Crisis (Maybe?)

In just 4 years, you can learn to be fluent in Mandarin. In 2 years, NASA can get you through astronaut training. But the cybersecurity skills gap? It's dire and dead-stuck in its fifth straight year of zero progress. Globally, 3.5 million cybersecurity jobs remain unfilled, and of those candidat...

PT-2021-15392 · Gallagher · Gallagher Command Centre

Name of the Vulnerable Software and Affected Versions: Gallagher Command Centre versions prior to 8.40.1888 MR3 Gallagher Command Centre versions prior to 8.30.1454 MR3 Gallagher Command Centre versions prior to 8.20.1291 MR5 Gallagher Command Centre versions prior to 8.10.1284 MR7 Gallagher...

PT-2021-10962 · Xnview Mp · Xnview Mp

Name of the Vulnerable Software and Affected Versions: XnView MP version 0.96.4 Description: A heap overflow issue allows attackers to cause a denial of service DoS via a crafted pict file, related to a User Mode Write AV starting at ntdll!RtlpLowFragHeapFree. Recommendations: For XnView MP versi...

NetApp Clustered Data ONTAP Vulnerabilities - Lenovo Support US

No description provided...

Intel® EMA Advisory

Summary: A potential security vulnerability in the Intel® Endpoint Management Assistant EMA may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2021-0013 Description: Improper input validation for IntelR EMA...

PT-2021-4805

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server versions prior to the fixed version Microsoft Active Directory Domain Services affected versions not specified Description The issue is related to insecure privilege management in Active Directory Domain Services,...

PT-2024-4434

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.59 and earlier Description The vulnerability is caused by improper escaping of output in the mod rewrite module of Apache HTTP Server. This allows an attacker to map URLs to filesystem locations that are permitt...

Intel® SSD DC Firmware Advisory

Summary: A potential security vulnerability in some Intel® Solid State Drive SSD Data Center DC products may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2021-0148 Description: Insertion of informatio...

PT-2021-6913 · Mariadb +5 · Mariadb Server +5

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.7 and below Description: An issue in the component Used tables and const cache::used tables and const cache join of MariaDB Server was discovered to allow attackers to cause a Denial of Service DoS via specially...

PT-2021-7248 · Npm · Json-Pointer

Name of the Vulnerable Software and Affected Versions: json-pointer versions up to and including 0.6.1 Description: A type confusion issue in the json-pointer package can lead to a bypass when the pointer components are arrays. This can potentially allow a remote attacker to execute arbitrary cod...