PT-2022-1636 · Zabbix +1 · Zabbix +1

Name of the Vulnerable Software and Affected Versions: Zabbix versions 4.0 LTS through 5.0 LTS Description: The issue allows for Remote Code Execution RCE due to authorization errors. Any user with the Zabbix Admin role can run custom shell scripts on the application server in the context of the...

PT-2021-10269 · Simiki · Simiki

Name of the Vulnerable Software and Affected Versions: Simiki versions 1.6.2.1 and prior Description: The issue allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'. This enables attackers to potentially gain unauthorized...

PT-2021-4939 · Advantech +1 · Advantech R-Seenet +1

Name of the Vulnerable Software and Affected Versions: Advantech R-SeeNet version 2.4.15 Description: A privilege escalation issue exists in the Windows version of Advantech R-SeeNet, related to insufficient access control to the directory C:R-SeeNet. This can allow an attacker to elevate their...

PT-2021-3887 · Blackberry · Blackberry Qnx Os For Medical +2

Name of the Vulnerable Software and Affected Versions: BlackBerry QNX Software Development Platform SDP versions 6.5.0SP1 and earlier BlackBerry QNX OS for Medical versions 1.1 and earlier BlackBerry QNX OS for Safety versions 1.0.1 and earlier Description: The issue is related to an integer...

PT-2021-5777 · Ntfs-3G +7 · Ntfs-3G +7

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: The issue is related to a heap-based buffer overflow in the ntfs inode lookup by name function of the NTFS-3G driver. This can be triggered by a crafted NTFS image, potentially allowing an...

PT-2021-21805 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow version 2.6.0 Description: The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition. An attacker c...

PT-2021-6290 · Adobe · Magento Commerce

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 2.4.2 and earlier Magento Commerce versions 2.4.2-p1 and earlier Magento Commerce versions 2.3.7 and earlier Description: The issue exists due to insufficient input validation in the Magento Commerce platform, allowi...

PT-2021-4174 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 7.6.53 ELTS TYPO3 versions prior to 8.7.42 ELTS TYPO3 versions prior to 9.5.29 TYPO3 versions prior to 10.4.19 TYPO3 versions prior to 11.3.2 Description: The content rendering process in the website frontend is...

PT-2021-3812 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Windows Recovery Environment Agent affected versions not specified Microsoft Windows affected versions not specified Description: The vulnerability is related to insufficient access control in the Windows Recovery Environment Agent component ...

PT-2021-14788 · Advantech · Advantech R-Seenet

Name of the Vulnerable Software and Affected Versions: Advantech R-SeeNet version 2.4.12 Description: An OS Command Injection issue exists in the ping.php script functionality. A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request...

PT-2021-14869 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.13.3 Elasticsearch versions prior to 6.8.17 Description: An uncontrolled recursion issue in the Elasticsearch Grok parser could lead to a denial of service attack. A user who can submit arbitrary queries to...

PT-2021-6956 · Microsoft · 365 +3

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Microsoft 365 affected versions not specified Microsoft Office affected versions not specified Microsoft Office Online Server affected versions not specified Description: The issue is related to...

Shopify: Create free Shopify application credits.

Details According to docs available at https://shopify.dev/api/admin/rest/reference/billing/applicationcredit, appCreditCreate is used to issue credits to merchants that can be used towards future app purchases in Shopify. I believe appCreditCreate mutation shouldn't be accessible to store owners...

PT-2021-10441 · Mikrotik · Mikrotik Routeros

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOs version 6.44.5 Description: The issue is related to a stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cause a Denial of Service due to overloading the system's CPU...

PT-2021-20591

Name of the Vulnerable Software and Affected Versions: ProfilePress WordPress plugin versions 3.0.0 through 3.1.3 Description: A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file made it possible for users to upload arbitrary files during user registrati...

PT-2021-20812 · Fidelis · Fidelis Network/Deception

Name of the Vulnerable Software and Affected Versions: Fidelis Network and Deception versions prior to 9.3.7 Fidelis Network and Deception version 9.4 Description: The issue allows authenticated command injection through the web interface, enabling a specially crafted HTTP request to execute syst...

PT-2021-10201 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 versions prior to 5.3.2.8 Description: The issue is related to a SQL Injection vulnerability. It can be exploited via the table prefix parameter in the install db.php file. Recommendations: For versions prior to 5.3.2.8, update to a...

PT-2021-10740 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System in PHP version 4.0 Description: The issue concerns a SQL injection vulnerability located in the hmsadminbetweendates-detailsreports.php file. This vulnerability can be exploited by remote unauthenticated...

PT-2021-19398 · Opentext · Opentext Brava! Desktop

Name of the Vulnerable Software and Affected Versions: OpenText Brava! Desktop version 16.6.4.55 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file...

PT-2021-15206 · Schneider Electric · Powerlogic Egx100 +1

Name of the Vulnerable Software and Affected Versions: PowerLogic EGX100 versions 3.0.0 and newer PowerLogic EGX300 all versions Description: A vulnerability exists due to improper input validation, potentially causing denial of service or remote code execution via a specially crafted HTTP packet...