PT-2021-7248 · Npm · Json-Pointer

Name of the Vulnerable Software and Affected Versions: json-pointer versions up to and including 0.6.1 Description: A type confusion issue in the json-pointer package can lead to a bypass when the pointer components are arrays. This can potentially allow a remote attacker to execute arbitrary cod...

GitLab CE/EE 访问控制错误漏洞

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. The application can be used to access a project's file content, commit history, bug list, etc. An access control error vulnerability exists in GitLab CE/EE, which could be...

CLSA-2021-1635459358 Fix CVE(s): CVE-2021-23017

SECURITY UPDATE: Update fix for CVE-2021-23017 accoding nginx.org recomendations - debian/patches/cve-2021-23017.patch - CVE-2021-23017...

NSA-CISA Series on Securing 5G Cloud Infrastructures

The National Security Agency NSA and CISA have published the first of a four-part series, Security Guidance for 5G Cloud Infrastructures. Security Guidance for 5G Cloud Infrastructures – Part I: Prevent and Detect Lateral Movement provides recommendations for mitigating lateral movement attempts ...

PT-2021-20858 · Unknown · Kiwi Syslog Server

Name of the Vulnerable Software and Affected Versions: Kiwi Syslog Server versions 9.7.2 and earlier Description: The Secure flag is not set in the SSL Cookie, which means the cookie can be sent over unencrypted requests if the application is accessible over both HTTP and HTTPS. This poses a risk...

PT-2021-4922 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense FTD with Snort3 configured and either a rule with Block with Reset or Interactive Block with Reset actions configured Description: The issue is due to improper handling of the Block with Reset or Interactive Blo...

PT-2021-23262 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.6.0 Atlassian Jira Server and Data Center versions 8.7.0 through 8.13.12 Atlassian Jira Server and Data Center versions 8.14.0 through 8.20.1 Description: The issue allows authenticate...

CLSA-2021-1634922818 Fixed CVE-2021-23017 in nginx

Update fix for CVE-2021-23017 accoding nginx.org recomendations...

RUSTSEC-2021-0137 sodiumoxide is deprecated

Alternatives may be found - not in any specific order: - libsodium-sys-stable - dryoc - RustCrypto/nacl-compat cryptobox, cryptokx, cryptosecretstream - RustCrypto/xsalsa20poly1305 cryptosecretbox - Signatory - ed25519-compact - ed25519-dalek - ring Recommendations can be also found from: - Aweso...

PT-2021-22160 · Inhand Networks · Inhand Networks Ir615 Router

Name of the Vulnerable Software and Affected Versions: InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description: The issue allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control...

PT-2021-19259 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 15.1R7-S10 Juniper Networks Junos OS versions prior to 17.4R3-S5 Juniper Networks Junos OS versions prior to 18.3R3-S5 Juniper Networks Junos OS versions prior to 18.4R3-S9 Juniper Networks Junos OS...

PT-2021-10783 · Mercury · Mercury Router Mer1200

Name of the Vulnerable Software and Affected Versions: Mercury Router MER1200 version 1.0.1 Mercury Router MER1200G version 1.0.1 Description: A remote command execution issue exists in the add server service of PPTP SERVER in the affected routers. Recommendations: For Mercury Router MER1200...

PT-2021-4481 · Apache +3 · Apache +3

Name of the Vulnerable Software and Affected Versions: LedgerSMB version 1.8 Description: The issue is related to the absence of the 'Secure' attribute in session authorization cookies when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. This allows an attacker to obtain...

CVE-2021-42009

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address...

Siemens SIMATIC Process Historian

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC Process Historian Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could enable the execution of...

PT-2021-4295

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.4.49 Apache HTTP Server version 2.4.50 Description An insufficient fix for a previous path traversal issue allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If the...

Apache Releases Security Update for Apache HTTP Server

Updated October 7, 2021 Apache has released additional fixes for CVE-2021-41773, which is tracked as CVE-2021-42013. For more information see the Apache vulnerabilities page. Originally published October 6, 2021 The Apache Software Foundation has released Apache HTTP Server version 2.4.50 to...

PT-2021-23108 · Scrapy +2 · Scrapy +2

Name of the Vulnerable Software and Affected Versions: Scrapy versions prior to 2.5.1 Scrapy versions 1.8 and earlier Description: The issue affects Scrapy when using HttpAuthMiddleware for HTTP authentication, causing all requests to expose credentials to the request target. This includes reques...

PT-2021-15571 · Rexroth +1 · Indramotion Mlc L20 +13

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue involves information disclosure where the main configuration, including users and their hashed passwords, is exposed through an unprotected web server resource. This...

PT-2021-21211 · Dell · Dell Enterprise Sonic Os

Name of the Vulnerable Software and Affected Versions: Dell Enterprise SONiC OS versions 3.3.0 and earlier Description: The issue allows an authenticated malicious user with access to the system to read sensitive information using the TACACSRadius credentials stored, potentially using it in furth...