PT-2021-21267 · Yellowfin · Yellowfin

Name of the Vulnerable Software and Affected Versions: Yellowfin versions prior to 9.6.1 Description: The issue allows enumeration and download of uploaded images through an Insecure Direct Object Reference vulnerability. This can be exploited by sending a specially crafted HTTP GET request to th...

PT-2021-22065 · Brizy +1 · Brizy +1

Name of the Vulnerable Software and Affected Versions: Brizy Page Builder plugin versions 2.3.11 and earlier Brizy versions 1.0.127 and earlier, excluding version 1.0.126 Description: The Brizy Page Builder plugin for WordPress used an incorrect authorization check, allowing any logged-in user...

PT-2021-8121 · Draytek · Draytek Vigorconnect

Name of the Vulnerable Software and Affected Versions: Draytek VigorConnect version 1.6.0-B3 Description: A local file inclusion vulnerability exists in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary...

PT-2021-16165 · WordPress · Poll Maker

Name of the Vulnerable Software and Affected Versions: The Poll Maker WordPress plugin versions prior to 3.4.2 Description: The issue allows unauthenticated users to perform SQL injection via the ays finish poll AJAX action. Although the result is not disclosed in the response, it is possible to...

PT-2021-22557 · WordPress · Wp Bannerize

Name of the Vulnerable Software and Affected Versions: WP Bannerize WordPress plugin versions 2.0.0 through 4.0.2 Description: The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the /Classes/wpBannerizeAdmin.php file, which allows attacker...

PT-2021-7272 · Siemens · Simatic Step 7

Name of the Vulnerable Software and Affected Versions: SIMATIC STEP 7 TIA Portal V15 All versions SIMATIC STEP 7 TIA Portal V16 All versions V16 Update 5 SIMATIC STEP 7 TIA Portal V17 All versions V17 Update 2 Description: A vulnerability has been identified due to improper access control in the...

PT-2021-10651 · Muyucms · Muyucms

Name of the Vulnerable Software and Affected Versions: Myucms version 2.2.1 Description: The issue is related to a remote code execution RCE vulnerability in the controllerpoint.php component. This vulnerability can be exploited via the add method. Recommendations: For Myucms version 2.2.1,...

PT-2021-23485 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.36.3 Description: An issue was discovered in the GlobalWatchlist extension where the rev-deleted-user and ntimes messages were not properly escaped, allowing users to inject HTML and JavaScript. Recommendations:...

PT-2021-22716 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.9 and later Description: The issue concerns project exports in GitLab CE/EE, where trigger tokens configured on a project may be exposed. This affects all versions since 8.9. Recommendations: For GitLab CE/EE versions...

PT-2021-23357 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.10.33 SuiteCRM versions prior to 7.11.22 Description: The issue allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file name parameter of the Step3...

PT-2021-23413

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.36.2 Description The issue allows for a denial of service due to resource consumption caused by lengthy query processing time. Visiting Special:Contributions can sometimes result in a long running SQL query becaus...

PT-2021-21204 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 Description: The issue concerns an arbitrary file deletion vulnerability that can be exploited using the Windows feature of NTFS called Symbolic links...

PT-2021-23316 · D Link · D-Link Dcs-932L +1

Name of the Vulnerable Software and Affected Versions: D-Link DCS-5000L version 1.05 and older D-Link DCS-932L version 2.17 and older Description: An Elevated Privileges issue exists due to the use of digest-authentication for the devices command interface, potentially allowing malicious users on...

PT-2021-5424 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.3.3 Description: The issue is related to an exposed dangerous function in the Enterprise Server Service of Ivanti Avalanche, which can be exploited for privilege escalation. This vulnerability is associate...

IBM Security Secret Server Information Disclosure Vulnerability (CNVD-2022-05090)

IBM Security Secret Server is a privileged access management solution from IBM Corporation. The product supports password management, privileged account identification, and privileged session access monitoring logs.IBM Security Secret Server 11.0 previously had a security vulnerability that stemm...

PT-2021-4505 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.8.1 Description: The issue is related to the wp die function in WordPress, which can leak output data under certain conditions, including sensitive information like nonces. This leaked data can be used to perform...

PT-2021-22197 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.0.0 through 2.1.2 Description: The issue concerns the variable import endpoint not being protected by authentication. This allows unauthenticated users to access the endpoint, potentially leading to denial of service...

PT-2021-22260 · Hashicorp +3 · Hashicorp Consul +4

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise version 1.10.1 Description: The Txn.Apply endpoint in HashiCorp Consul and Consul Enterprise allowed services to register proxies for other services, enabling access to service traffic. Recommendations:...

PT-2021-8864 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.9.0 and prior versions Description: A bash command injection issue in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. Recommendations: For Apache Zeppelin versions 0.9.0...

PT-2021-9680 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.9.0 and prior versions Description: The issue is an authentication bypass vulnerability that allows an attacker to bypass the Zeppelin authentication mechanism and act as another user. Recommendations: For Apache...